| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/21 03:21 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": [
"BT_HCIUART",
"BT_HCIUART_3WIRE",
"SERIAL_DEV_BUS"
],
"FocusSymbols": [
"device_schedule_reprobe",
"device_reprobe_work_fn"
],
"KMSANReasoning": "The patch introduces a new function `device_schedule_reprobe` to standardise deferred device reprobing across drivers, replacing custom work items in `btintel_pcie`, `hci_h5`, and `iwlwifi`. It also adds a `shutdown_done` flag to prevent reprobing devices during system shutdown. All memory allocations (e.g., `struct device_reprobe` via `kzalloc_obj`) are fully zero-initialized. The changes are strictly confined to internal kernel device lifecycle management, driver binding/unbinding, and workqueue scheduling. There are no modifications to structures copied to user space, no new network packet parsing, and no complex data structures where uninitialized fields could be read or leaked. Any potential bugs introduced by these changes would be related to object lifetimes (use-after-free), locking (deadlocks), or null pointer dereferences, all of which are effectively caught by KASAN, LOCKDEP, and standard kernel debugging tools. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
"NeedsKMSAN": false,
"Reasoning": "The patch introduces a new function `device_schedule_reprobe` to the driver core, which allows scheduling a deferred detach and re-probe of a device. This is a functional change in the core driver model that can be reached and fuzzed. The function is used by several drivers, including the `hci_h5` serial driver, which can be reached in virtualized environments.",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/21 03:21 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 7f673fef7486a698b94cf291d658beda0ea5574a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Aug 21 03:21:25 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/base/base.h b/drivers/base/base.h\nindex a5b7abc10ff02..6234e37de7e99 100644\n--- a/drivers/base/base.h\n+++ b/drivers/base/base.h\n@@ -106,6 +106,10 @@ struct driver_private {\n * @dead: This device is currently either in the process of or has been\n *\t removed from the system. Any asynchronous events scheduled for this\n *\t device should exit without taking any action.\n+ * @shutdown_done: Set once device_shutdown() has reached this device, under\n+ *\t the device lock, before any shutdown callback runs. Read under the\n+ *\t device lock. A deferred re-probe scheduled with\n+ *\t device_schedule_reprobe() must not detach the device anymore.\n *\n * Nothing outside of the driver core should ever touch these fields.\n */\n@@ -120,6 +124,7 @@ struct device_private {\n \tchar *deferred_probe_reason;\n \tstruct device *device;\n \tu8 dead:1;\n+\tu8 shutdown_done:1;\n };\n #define to_device_private_parent(obj)\t\\\n \tcontainer_of(obj, struct device_private, knode_parent)\ndiff --git a/drivers/base/core.c b/drivers/base/core.c\nindex 4d026682944f2..8a7dbe4e8362b 100644\n--- a/drivers/base/core.c\n+++ b/drivers/base/core.c\n@@ -4906,6 +4906,9 @@ void device_shutdown(void)\n \t\t\tdevice_lock(parent);\n \t\tdevice_lock(dev);\n \n+\t\tif (dev-\u003ep)\n+\t\t\tdev-\u003ep-\u003eshutdown_done = true;\n+\n \t\t/* Don't allow any more runtime suspends */\n \t\tpm_runtime_get_noresume(dev);\n \t\tpm_runtime_barrier(dev);\ndiff --git a/drivers/base/dd.c b/drivers/base/dd.c\nindex 60c005223844d..d765e1ae5614a 100644\n--- a/drivers/base/dd.c\n+++ b/drivers/base/dd.c\n@@ -1436,3 +1436,105 @@ void driver_detach(const struct device_driver *drv)\n \t\tput_device(dev);\n \t}\n }\n+\n+struct device_reprobe {\n+\tstruct delayed_work work;\n+\tstruct device *dev;\n+\tstruct device *parent;\n+\tconst struct device_driver *drv;\n+};\n+\n+static void device_reprobe_work_fn(struct work_struct *work)\n+{\n+\tstruct device_reprobe *rp = container_of(work, struct device_reprobe,\n+\t\t\t\t\t\t work.work);\n+\tstruct device *dev = rp-\u003edev;\n+\tstruct device *parent = rp-\u003eparent;\n+\tbool detached = false;\n+\tint ret;\n+\n+\t__device_driver_lock(dev, parent);\n+\t/*\n+\t * rp-\u003edrv is only ever compared, never dereferenced: the driver it\n+\t * points to may have been unregistered and freed by now.\n+\t */\n+\tif (!dev-\u003ep-\u003edead \u0026\u0026 !dev-\u003ep-\u003eshutdown_done \u0026\u0026\n+\t dev-\u003edriver \u0026\u0026 dev-\u003edriver == rp-\u003edrv) {\n+\t\t__device_release_driver(dev, parent);\n+\t\tdetached = true;\n+\t}\n+\t__device_driver_unlock(dev, parent);\n+\n+\tif (detached) {\n+\t\t/*\n+\t\t * device_attach() must run with the parent locked on buses\n+\t\t * that require it, mirroring bus_rescan_devices_helper().\n+\t\t */\n+\t\tif (parent \u0026\u0026 dev-\u003ebus-\u003eneed_parent_lock)\n+\t\t\tdevice_lock(parent);\n+\t\tret = device_attach(dev);\n+\t\tif (ret \u003c 0)\n+\t\t\tdev_err_probe(dev, ret,\n+\t\t\t\t \"re-probe failed, device left unbound\\n\");\n+\t\tif (parent \u0026\u0026 dev-\u003ebus-\u003eneed_parent_lock)\n+\t\t\tdevice_unlock(parent);\n+\t}\n+\n+\tput_device(dev);\n+\tput_device(parent);\n+\tkfree(rp);\n+}\n+\n+/**\n+ * device_schedule_reprobe - schedule a deferred detach and re-probe\n+ * @dev: device to detach and re-probe\n+ * @delay_ms: delay in milliseconds before the re-probe runs\n+ *\n+ * Schedule a detach and re-probe of @dev after @delay_ms milliseconds.\n+ * The re-probe is skipped if, by the time the scheduled work runs, the\n+ * device has been removed, the system shutdown sequence has reached the\n+ * device, or @dev is no longer bound to the driver that was bound at\n+ * scheduling time. In particular an administrative unbind is never\n+ * undone by a stale re-probe.\n+ *\n+ * The work function is built-in text, so the bound driver may call this\n+ * from its own code without holding a module reference. If the driver\n+ * module is unloaded before the work runs, driver unregistration unbinds\n+ * @dev first and the scheduled work does nothing.\n+ *\n+ * Multiple pending re-probes for the same device are individually safe;\n+ * a caller that wants at most one pending re-probe must gate scheduling\n+ * itself.\n+ *\n+ * May only be called from process context.\n+ *\n+ * Returns: 0 on success, -EINVAL if @dev is not a registered device\n+ * bound to a driver, -ENOMEM on allocation failure.\n+ */\n+int device_schedule_reprobe(struct device *dev, unsigned int delay_ms)\n+{\n+\tstruct device_reprobe *rp;\n+\n+\tif (!dev-\u003ebus || !dev-\u003ep || !device_is_registered(dev))\n+\t\treturn -EINVAL;\n+\tif (!dev-\u003edriver)\n+\t\treturn -EINVAL;\n+\n+\trp = kzalloc_obj(*rp);\n+\tif (!rp)\n+\t\treturn -ENOMEM;\n+\n+\trp-\u003edev = get_device(dev);\n+\t/*\n+\t * Pin the parent too: the work locks it, and an unregister of @dev\n+\t * would otherwise drop the last reference before the work runs.\n+\t */\n+\trp-\u003eparent = get_device(dev-\u003eparent);\n+\trp-\u003edrv = READ_ONCE(dev-\u003edriver);\n+\tINIT_DELAYED_WORK(\u0026rp-\u003ework, device_reprobe_work_fn);\n+\tqueue_delayed_work(system_dfl_wq, \u0026rp-\u003ework,\n+\t\t\t msecs_to_jiffies(delay_ms));\n+\n+\treturn 0;\n+}\n+EXPORT_SYMBOL_GPL(device_schedule_reprobe);\ndiff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c\nindex baa621b3fef93..29be05d414298 100644\n--- a/drivers/bluetooth/btintel_pcie.c\n+++ b/drivers/bluetooth/btintel_pcie.c\n@@ -3012,7 +3012,7 @@ static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data)\n \t * BT needs pci_save_state()/pci_restore_state() because the BT driver\n \t * is still partially attached when the _PRR runs (it hasn't been unbound yet).\n \t * The PCI device needs to remain minimally functional so that\n-\t * device_reprobe(\u0026pdev-\u003edev) can work afterward\n+\t * the deferred re-probe of the BT device can work afterward\n \t */\n \tret = btintel_pcie_acpi_reset_method(data);\n \n@@ -3023,14 +3023,16 @@ static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data)\n \t}\n \n \tif (!ret) {\n-\t\tif (device_reprobe(\u0026pdev-\u003edev))\n-\t\t\tBT_ERR(\"BT reprobe failed for BDF:%s\", pci_name(pdev));\n+\t\tif (device_schedule_reprobe(\u0026pdev-\u003edev, 0))\n+\t\t\tBT_ERR(\"BT reprobe scheduling failed for BDF:%s\",\n+\t\t\t pci_name(pdev));\n \t}\n }\n \n /*\n- * Issue a Function Level Reset and hand teardown/re-init off to the PCI\n- * core via device_reprobe(), mirroring the PLDR path's contract.\n+ * Issue a Function Level Reset and hand teardown/re-init off to the\n+ * driver core via device_schedule_reprobe(), mirroring the PLDR path's\n+ * contract.\n *\n * Caller must hold pci_lock_rescan_remove() and must have already\n * disabled interrupts and drained both rx_work and coredump_work.\n@@ -3052,14 +3054,12 @@ static int btintel_pcie_perform_flr(struct btintel_pcie_data *data)\n \t\treturn err;\n \t}\n \n-\t/* device_reprobe() always detaches the driver first (running\n-\t * .remove(), which frees 'data'); any re-probe failure leaves the\n-\t * device unbound but 'data' is already gone, so just log it.\n-\t */\n-\tif (device_reprobe(\u0026pdev-\u003edev))\n-\t\tBT_ERR(\"BT reprobe failed for BDF:%s\", pci_name(pdev));\n+\terr = device_schedule_reprobe(\u0026pdev-\u003edev, 0);\n+\tif (err)\n+\t\tBT_ERR(\"BT reprobe scheduling failed for BDF:%s\",\n+\t\t pci_name(pdev));\n \n-\treturn 0;\n+\treturn err;\n }\n \n static void btintel_pcie_reset_work(struct work_struct *wk)\n@@ -3090,11 +3090,15 @@ static void btintel_pcie_reset_work(struct work_struct *wk)\n \n \tbt_dev_dbg(data-\u003ehdev, \"Release bluetooth interface\");\n \n-\t/* Both reset paths follow the same contract: on success they\n-\t * destroy 'data' via device_reprobe() (a fresh probe re-INIT_WORKs\n-\t * the dump workers with disable count 0), so enable_work() must\n-\t * NOT be called on the success path. Only the FLR path can fail\n-\t * with 'data' still alive, in which case we balance the\n+\t/* Both reset paths follow the same contract: on success the\n+\t * deferred re-probe scheduled with device_schedule_reprobe()\n+\t * destroys 'data' by re-running .probe() (which re-INIT_WORKs the\n+\t * dump workers with disable count 0), so enable_work() must NOT be\n+\t * called on the success path. 'data' stays alive until the deferred\n+\t * detach runs; in this window new activity is fenced by\n+\t * BTINTEL_PCIE_RECOVERY_IN_PROGRESS, the masked interrupts and the\n+\t * disabled dump workers. Only the FLR path can fail with no\n+\t * re-probe scheduled, in which case we balance the\n \t * disable_work_sync() calls above so a later successful reset is\n \t * not permanently blocked.\n \t *\n@@ -3460,13 +3464,12 @@ static void btintel_pcie_remove(struct pci_dev *pdev)\n \tdisable_work_sync(\u0026data-\u003efwtrigger_work);\n \tdisable_work_sync(\u0026data-\u003embox_work);\n \n-\t/* Cancel pending reset work. Skip only when remove() is called from\n-\t * within the reset work itself (PLDR device_reprobe path) to avoid\n-\t * deadlock. current_work() returns the work_struct of the caller if\n-\t * we are in a workqueue context.\n+\t/* The deferred re-probe triggers .remove() from the driver core's\n+\t * work item, never from reset_work itself, so this no longer runs\n+\t * nested in reset_work; disable_work_sync() also guarantees the\n+\t * reset work has fully returned before 'data' is freed.\n \t */\n-\tif (current_work() != \u0026data-\u003ereset_work)\n-\t\tdisable_work_sync(\u0026data-\u003ereset_work);\n+\tdisable_work_sync(\u0026data-\u003ereset_work);\n \n \tbtintel_pcie_disable_interrupts(data);\n \ndiff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c\nindex b1999e14aadef..3fde1d5a5ae99 100644\n--- a/drivers/bluetooth/hci_h5.c\n+++ b/drivers/bluetooth/hci_h5.c\n@@ -990,7 +990,7 @@ static int h5_btrtl_setup(struct h5 *h5)\n static void h5_btrtl_open(struct h5 *h5)\n {\n \t/*\n-\t * Since h5_btrtl_resume() does a device_reprobe() the suspend handling\n+\t * Since h5_btrtl_resume() schedules a device re-probe the suspend handling\n \t * done by the hci_suspend_notifier is not necessary; it actually causes\n \t * delays and a bunch of errors to get logged, so disable it.\n \t */\n@@ -1049,46 +1049,15 @@ static int h5_btrtl_suspend(struct h5 *h5)\n \treturn 0;\n }\n \n-struct h5_btrtl_reprobe {\n-\tstruct device *dev;\n-\tstruct work_struct work;\n-};\n-\n-static void h5_btrtl_reprobe_worker(struct work_struct *work)\n-{\n-\tstruct h5_btrtl_reprobe *reprobe =\n-\t\tcontainer_of(work, struct h5_btrtl_reprobe, work);\n-\tint ret;\n-\n-\tret = device_reprobe(reprobe-\u003edev);\n-\tif (ret \u0026\u0026 ret != -EPROBE_DEFER)\n-\t\tdev_err(reprobe-\u003edev, \"Reprobe error %d\\n\", ret);\n-\n-\tput_device(reprobe-\u003edev);\n-\tkfree(reprobe);\n-\tmodule_put(THIS_MODULE);\n-}\n-\n static int h5_btrtl_resume(struct h5 *h5)\n {\n-\tif (test_bit(H5_WAKEUP_DISABLE, \u0026h5-\u003eflags)) {\n-\t\tstruct h5_btrtl_reprobe *reprobe;\n-\n-\t\treprobe = kzalloc_obj(*reprobe);\n-\t\tif (!reprobe)\n-\t\t\treturn -ENOMEM;\n-\n-\t\t__module_get(THIS_MODULE);\n+\tif (test_bit(H5_WAKEUP_DISABLE, \u0026h5-\u003eflags))\n+\t\treturn device_schedule_reprobe(\u0026h5-\u003ehu-\u003eserdev-\u003edev, 0);\n \n-\t\tINIT_WORK(\u0026reprobe-\u003ework, h5_btrtl_reprobe_worker);\n-\t\treprobe-\u003edev = get_device(\u0026h5-\u003ehu-\u003eserdev-\u003edev);\n-\t\tqueue_work(system_long_wq, \u0026reprobe-\u003ework);\n-\t} else {\n-\t\tgpiod_set_value_cansleep(h5-\u003edevice_wake_gpio, 1);\n+\tgpiod_set_value_cansleep(h5-\u003edevice_wake_gpio, 1);\n \n-\t\tif (test_bit(H5_HW_FLOW_CONTROL, \u0026h5-\u003eflags))\n-\t\t\tserdev_device_set_flow_control(h5-\u003ehu-\u003eserdev, true);\n-\t}\n+\tif (test_bit(H5_HW_FLOW_CONTROL, \u0026h5-\u003eflags))\n+\t\tserdev_device_set_flow_control(h5-\u003ehu-\u003eserdev, true);\n \n \treturn 0;\n }\ndiff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c\nindex 73aae11250421..5ae734cb90272 100644\n--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c\n+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c\n@@ -78,47 +78,11 @@ void iwl_trans_free_restart_list(void)\n \t}\n }\n \n-struct iwl_trans_reprobe {\n-\tstruct device *dev;\n-\tstruct delayed_work work;\n-};\n-\n-static void iwl_trans_reprobe_wk(struct work_struct *wk)\n-{\n-\tstruct iwl_trans_reprobe *reprobe;\n-\n-\treprobe = container_of(wk, typeof(*reprobe), work.work);\n-\n-\tif (device_reprobe(reprobe-\u003edev))\n-\t\tdev_err(reprobe-\u003edev, \"reprobe failed!\\n\");\n-\tput_device(reprobe-\u003edev);\n-\tkfree(reprobe);\n-\tmodule_put(THIS_MODULE);\n-}\n-\n static void iwl_trans_schedule_reprobe(struct iwl_trans *trans,\n \t\t\t\t unsigned int delay_ms)\n {\n-\tstruct iwl_trans_reprobe *reprobe;\n-\n-\t/*\n-\t * get a module reference to avoid doing this while unloading\n-\t * anyway and to avoid scheduling a work with code that's\n-\t * being removed.\n-\t */\n-\tif (!try_module_get(THIS_MODULE)) {\n-\t\tIWL_ERR(trans, \"Module is being unloaded - abort\\n\");\n-\t\treturn;\n-\t}\n-\n-\treprobe = kzalloc_obj(*reprobe);\n-\tif (!reprobe) {\n-\t\tmodule_put(THIS_MODULE);\n-\t\treturn;\n-\t}\n-\treprobe-\u003edev = get_device(trans-\u003edev);\n-\tINIT_DELAYED_WORK(\u0026reprobe-\u003ework, iwl_trans_reprobe_wk);\n-\tschedule_delayed_work(\u0026reprobe-\u003ework, msecs_to_jiffies(delay_ms));\n+\tif (device_schedule_reprobe(trans-\u003edev, delay_ms))\n+\t\tIWL_ERR(trans, \"Could not schedule reprobe\\n\");\n }\n \n #define IWL_TRANS_RESET_OK_TIME\t7 /* seconds */\ndiff --git a/include/linux/device.h b/include/linux/device.h\nindex 7b2baffdd2f55..1cdd40a6a48da 100644\n--- a/include/linux/device.h\n+++ b/include/linux/device.h\n@@ -1312,6 +1312,8 @@ int __must_check device_attach(struct device *dev);\n int __must_check driver_attach(const struct device_driver *drv);\n void device_initial_probe(struct device *dev);\n int __must_check device_reprobe(struct device *dev);\n+int __must_check device_schedule_reprobe(struct device *dev,\n+\t\t\t\t\t unsigned int delay_ms);\n \n bool device_is_bound(struct device *dev);\n \n"
} |
| 2/1 | 2026/08/21 03:21 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": [
"BT_HCIUART",
"BT_HCIUART_3WIRE",
"SERIAL_DEV_BUS"
],
"FocusSymbols": [
"device_schedule_reprobe",
"device_reprobe_work_fn"
],
"Reasoning": "The patch introduces a new function `device_schedule_reprobe` to the driver core, which allows scheduling a deferred detach and re-probe of a device. This is a functional change in the core driver model that can be reached and fuzzed. The function is used by several drivers, including the `hci_h5` serial driver, which can be reached in virtualized environments.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 7f673fef7486a698b94cf291d658beda0ea5574a
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 21 03:21:25 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/base/base.h b/drivers/base/base.h
index a5b7abc10ff02..6234e37de7e99 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -106,6 +106,10 @@ struct driver_private {
* @dead: This device is currently either in the process of or has been
* removed from the system. Any asynchronous events scheduled for this
* device should exit without taking any action.
+ * @shutdown_done: Set once device_shutdown() has reached this device, under
+ * the device lock, before any shutdown callback runs. Read under the
+ * device lock. A deferred re-probe scheduled with
+ * device_schedule_reprobe() must not detach the device anymore.
*
* Nothing outside of the driver core should ever touch these fields.
*/
@@ -120,6 +124,7 @@ struct device_private {
char *deferred_probe_reason;
struct device *device;
u8 dead:1;
+ u8 shutdown_done:1;
};
#define to_device_private_parent(obj) \
container_of(obj, struct device_private, knode_parent)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 4d026682944f2..8a7dbe4e8362b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -4906,6 +4906,9 @@ void device_shutdown(void)
device_lock(parent);
device_lock(dev);
+ if (dev->p)
+ dev->p->shutdown_done = true;
+
/* Don't allow any more runtime suspends */
pm_runtime_get_noresume(dev);
pm_runtime_barrier(dev);
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 60c005223844d..d765e1ae5614a 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1436,3 +1436,105 @@ void driver_detach(const struct device_driver *drv)
put_device(dev);
}
}
+
+struct device_reprobe {
+ struct delayed_work work;
+ struct device *dev;
+ struct device *parent;
+ const struct device_driver *drv;
+};
+
+static void device_reprobe_work_fn(struct work_struct *work)
+{
+ struct device_reprobe *rp = container_of(work, struct device_reprobe,
+ work.work);
+ struct device *dev = rp->dev;
+ struct device *parent = rp->parent;
+ bool detached = false;
+ int ret;
+
+ __device_driver_lock(dev, parent);
+ /*
+ * rp->drv is only ever compared, never dereferenced: the driver it
+ * points to may have been unregistered and freed by now.
+ */
+ if (!dev->p->dead && !dev->p->shutdown_done &&
+ dev->driver && dev->driver == rp->drv) {
+ __device_release_driver(dev, parent);
+ detached = true;
+ }
+ __device_driver_unlock(dev, parent);
+
+ if (detached) {
+ /*
+ * device_attach() must run with the parent locked on buses
+ * that require it, mirroring bus_rescan_devices_helper().
+ */
+ if (parent && dev->bus->need_parent_lock)
+ device_lock(parent);
+ ret = device_attach(dev);
+ if (ret < 0)
+ dev_err_probe(dev, ret,
+ "re-probe failed, device left unbound\n");
+ if (parent && dev->bus->need_parent_lock)
+ device_unlock(parent);
+ }
+
+ put_device(dev);
+ put_device(parent);
+ kfree(rp);
+}
+
+/**
+ * device_schedule_reprobe - schedule a deferred detach and re-probe
+ * @dev: device to detach and re-probe
+ * @delay_ms: delay in milliseconds before the re-probe runs
+ *
+ * Schedule a detach and re-probe of @dev after @delay_ms milliseconds.
+ * The re-probe is skipped if, by the time the scheduled work runs, the
+ * device has been removed, the system shutdown sequence has reached the
+ * device, or @dev is no longer bound to the driver that was bound at
+ * scheduling time. In particular an administrative unbind is never
+ * undone by a stale re-probe.
+ *
+ * The work function is built-in text, so the bound driver may call this
+ * from its own code without holding a module reference. If the driver
+ * module is unloaded before the work runs, driver unregistration unbinds
+ * @dev first and the scheduled work does nothing.
+ *
+ * Multiple pending re-probes for the same device are individually safe;
+ * a caller that wants at most one pending re-probe must gate scheduling
+ * itself.
+ *
+ * May only be called from process context.
+ *
+ * Returns: 0 on success, -EINVAL if @dev is not a registered device
+ * bound to a driver, -ENOMEM on allocation failure.
+ */
+int device_schedule_reprobe(struct device *dev, unsigned int delay_ms)
+{
+ struct device_reprobe *rp;
+
+ if (!dev->bus || !dev->p || !device_is_registered(dev))
+ return -EINVAL;
+ if (!dev->driver)
+ return -EINVAL;
+
+ rp = kzalloc_obj(*rp);
+ if (!rp)
+ return -ENOMEM;
+
+ rp->dev = get_device(dev);
+ /*
+ * Pin the parent too: the work locks it, and an unregister of @dev
+ * would otherwise drop the last reference before the work runs.
+ */
+ rp->parent = get_device(dev->parent);
+ rp->drv = READ_ONCE(dev->driver);
+ INIT_DELAYED_WORK(&rp->work, device_reprobe_work_fn);
+ queue_delayed_work(system_dfl_wq, &rp->work,
+ msecs_to_jiffies(delay_ms));
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(device_schedule_reprobe);
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index baa621b3fef93..29be05d414298 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -3012,7 +3012,7 @@ static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data)
* BT needs pci_save_state()/pci_restore_state() because the BT driver
* is still partially attached when the _PRR runs (it hasn't been unbound yet).
* The PCI device needs to remain minimally functional so that
- * device_reprobe(&pdev->dev) can work afterward
+ * the deferred re-probe of the BT device can work afterward
*/
ret = btintel_pcie_acpi_reset_method(data);
@@ -3023,14 +3023,16 @@ static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data)
}
if (!ret) {
- if (device_reprobe(&pdev->dev))
- BT_ERR("BT reprobe failed for BDF:%s", pci_name(pdev));
+ if (device_schedule_reprobe(&pdev->dev, 0))
+ BT_ERR("BT reprobe scheduling failed for BDF:%s",
+ pci_name(pdev));
}
}
/*
- * Issue a Function Level Reset and hand teardown/re-init off to the PCI
- * core via device_reprobe(), mirroring the PLDR path's contract.
+ * Issue a Function Level Reset and hand teardown/re-init off to the
+ * driver core via device_schedule_reprobe(), mirroring the PLDR path's
+ * contract.
*
* Caller must hold pci_lock_rescan_remove() and must have already
* disabled interrupts and drained both rx_work and coredump_work.
@@ -3052,14 +3054,12 @@ static int btintel_pcie_perform_flr(struct btintel_pcie_data *data)
return err;
}
- /* device_reprobe() always detaches the driver first (running
- * .remove(), which frees 'data'); any re-probe failure leaves the
- * device unbound but 'data' is already gone, so just log it.
- */
- if (device_reprobe(&pdev->dev))
- BT_ERR("BT reprobe failed for BDF:%s", pci_name(pdev));
+ err = device_schedule_reprobe(&pdev->dev, 0);
+ if (err)
+ BT_ERR("BT reprobe scheduling failed for BDF:%s",
+ pci_name(pdev));
- return 0;
+ return err;
}
static void btintel_pcie_reset_work(struct work_struct *wk)
@@ -3090,11 +3090,15 @@ static void btintel_pcie_reset_work(struct work_struct *wk)
bt_dev_dbg(data->hdev, "Release bluetooth interface");
- /* Both reset paths follow the same contract: on success they
- * destroy 'data' via device_reprobe() (a fresh probe re-INIT_WORKs
- * the dump workers with disable count 0), so enable_work() must
- * NOT be called on the success path. Only the FLR path can fail
- * with 'data' still alive, in which case we balance the
+ /* Both reset paths follow the same contract: on success the
+ * deferred re-probe scheduled with device_schedule_reprobe()
+ * destroys 'data' by re-running .probe() (which re-INIT_WORKs the
+ * dump workers with disable count 0), so enable_work() must NOT be
+ * called on the success path. 'data' stays alive until the deferred
+ * detach runs; in this window new activity is fenced by
+ * BTINTEL_PCIE_RECOVERY_IN_PROGRESS, the masked interrupts and the
+ * disabled dump workers. Only the FLR path can fail with no
+ * re-probe scheduled, in which case we balance the
* disable_work_sync() calls above so a later successful reset is
* not permanently blocked.
*
@@ -3460,13 +3464,12 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
disable_work_sync(&data->fwtrigger_work);
disable_work_sync(&data->mbox_work);
- /* Cancel pending reset work. Skip only when remove() is called from
- * within the reset work itself (PLDR device_reprobe path) to avoid
- * deadlock. current_work() returns the work_struct of the caller if
- * we are in a workqueue context.
+ /* The deferred re-probe triggers .remove() from the driver core's
+ * work item, never from reset_work itself, so this no longer runs
+ * nested in reset_work; disable_work_sync() also guarantees the
+ * reset work has fully returned before 'data' is freed.
*/
- if (current_work() != &data->reset_work)
- disable_work_sync(&data->reset_work);
+ disable_work_sync(&data->reset_work);
btintel_pcie_disable_interrupts(data);
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index b1999e14aadef..3fde1d5a5ae99 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -990,7 +990,7 @@ static int h5_btrtl_setup(struct h5 *h5)
static void h5_btrtl_open(struct h5 *h5)
{
/*
- * Since h5_btrtl_resume() does a device_reprobe() the suspend handling
+ * Since h5_btrtl_resume() schedules a device re-probe the suspend handling
* done by the hci_suspend_notifier is not necessary; it actually causes
* delays and a bunch of errors to get logged, so disable it.
*/
@@ -1049,46 +1049,15 @@ static int h5_btrtl_suspend(struct h5 *h5)
return 0;
}
-struct h5_btrtl_reprobe {
- struct device *dev;
- struct work_struct work;
-};
-
-static void h5_btrtl_reprobe_worker(struct work_struct *work)
-{
- struct h5_btrtl_reprobe *reprobe =
- container_of(work, struct h5_btrtl_reprobe, work);
- int ret;
-
- ret = device_reprobe(reprobe->dev);
- if (ret && ret != -EPROBE_DEFER)
- dev_err(reprobe->dev, "Reprobe error %d\n", ret);
-
- put_device(reprobe->dev);
- kfree(reprobe);
- module_put(THIS_MODULE);
-}
-
static int h5_btrtl_resume(struct h5 *h5)
{
- if (test_bit(H5_WAKEUP_DISABLE, &h5->flags)) {
- struct h5_btrtl_reprobe *reprobe;
-
- reprobe = kzalloc_obj(*reprobe);
- if (!reprobe)
- return -ENOMEM;
-
- __module_get(THIS_MODULE);
+ if (test_bit(H5_WAKEUP_DISABLE, &h5->flags))
+ return device_schedule_reprobe(&h5->hu->serdev->dev, 0);
- INIT_WORK(&reprobe->work, h5_btrtl_reprobe_worker);
- reprobe->dev = get_device(&h5->hu->serdev->dev);
- queue_work(system_long_wq, &reprobe->work);
- } else {
- gpiod_set_value_cansleep(h5->device_wake_gpio, 1);
+ gpiod_set_value_cansleep(h5->device_wake_gpio, 1);
- if (test_bit(H5_HW_FLOW_CONTROL, &h5->flags))
- serdev_device_set_flow_control(h5->hu->serdev, true);
- }
+ if (test_bit(H5_HW_FLOW_CONTROL, &h5->flags))
+ serdev_device_set_flow_control(h5->hu->serdev, true);
return 0;
}
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
index 73aae11250421..5ae734cb90272 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
@@ -78,47 +78,11 @@ void iwl_trans_free_restart_list(void)
}
}
-struct iwl_trans_reprobe {
- struct device *dev;
- struct delayed_work work;
-};
-
-static void iwl_trans_reprobe_wk(struct work_struct *wk)
-{
- struct iwl_trans_reprobe *reprobe;
-
- reprobe = container_of(wk, typeof(*reprobe), work.work);
-
- if (device_reprobe(reprobe->dev))
- dev_err(reprobe->dev, "reprobe failed!\n");
- put_device(reprobe->dev);
- kfree(reprobe);
- module_put(THIS_MODULE);
-}
-
static void iwl_trans_schedule_reprobe(struct iwl_trans *trans,
unsigned int delay_ms)
{
- struct iwl_trans_reprobe *reprobe;
-
- /*
- * get a module reference to avoid doing this while unloading
- * anyway and to avoid scheduling a work with code that's
- * being removed.
- */
- if (!try_module_get(THIS_MODULE)) {
- IWL_ERR(trans, "Module is being unloaded - abort\n");
- return;
- }
-
- reprobe = kzalloc_obj(*reprobe);
- if (!reprobe) {
- module_put(THIS_MODULE);
- return;
- }
- reprobe->dev = get_device(trans->dev);
- INIT_DELAYED_WORK(&reprobe->work, iwl_trans_reprobe_wk);
- schedule_delayed_work(&reprobe->work, msecs_to_jiffies(delay_ms));
+ if (device_schedule_reprobe(trans->dev, delay_ms))
+ IWL_ERR(trans, "Could not schedule reprobe\n");
}
#define IWL_TRANS_RESET_OK_TIME 7 /* seconds */
diff --git a/include/linux/device.h b/include/linux/device.h
index 7b2baffdd2f55..1cdd40a6a48da 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1312,6 +1312,8 @@ int __must_check device_attach(struct device *dev);
int __must_check driver_attach(const struct device_driver *drv);
void device_initial_probe(struct device *dev);
int __must_check device_reprobe(struct device *dev);
+int __must_check device_schedule_reprobe(struct device *dev,
+ unsigned int delay_ms);
bool device_is_bound(struct device *dev);
|
| 3/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6638 output: 35 thoughts: 411 Thoughts: **Analyzing the New `device_schedule_reprobe` Patch** Okay, so I'm looking at this patch that introduces `device_schedule_reprobe` – it seems they're making a significant change. They've dropped custom reprobe scheduling in favor of this generic function within the driver core (`drivers/base/dd.c`). That's a core change, and immediately my mind goes to fuzzing; the driver core is absolutely reachable and a prime target. The new function, `device_schedule_reprobe`, is the key, obviously. I need to understand its reachability, especially in virtualized environments. From a quick scan, I see it's called from `btintel_pcie.c`, `hci_h5.c`, and `iwl-trans.c`. Hmm, `btintel` and `iwlwifi` are PCIe drivers, so that makes sense, but `hci_h5` is a serial driver. Can I even get to `hci_h5` from QEMU? Ah, yes, `hci_uart`. Okay, so `device_schedule_reprobe` *is* potentially reachable from within a virtualized environment. Now, I need to confirm its accessibility. Let me check `drivers/bluetooth/hci_h5.c` and also `drivers/base/dd.c`. Alright, looks like `device_schedule_reprobe` is exported, meaning any driver can call it. Definitely worth fuzzing, that's a central driver function. Okay, let's nail down the configuration options. For the core function itself, `device_schedule_reprobe` is in `drivers/base/dd.c`, so it's always built. For `hci_h5`, I need to check for `BT_HCIUART_3WIRE`. Let me take a look at `drivers/bluetooth/Kconfig` to confirm. |
| 4/2 | 2026/08/21 03:21 | tool | grepper |
0mArgs:{
"Expression": "config BT_HCIUART_3WIRE",
"PathPrefix": "drivers/bluetooth/Kconfig"
}Results: {
"Output": "drivers/bluetooth/Kconfig=175=config BT_HCIUART_LL\n--\ndrivers/bluetooth/Kconfig-186-\ndrivers/bluetooth/Kconfig:187:config BT_HCIUART_3WIRE\ndrivers/bluetooth/Kconfig-188-\tbool \"Three-wire UART (H5) protocol support\"\n"
} |
| 5/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7584 output: 35 thoughts: 18 Thoughts: Here's my summary, as though I'm thinking through this process: **Diving into the Dependencies of BT\_HCIUART\_3WIRE** Okay, so I need to understand what this `BT_HCIUART_3WIRE` configuration option actually *does* in the grand scheme of things. That's a vital first step, right? What other components or features is it intimately connected to? I need to build a mental map of its dependencies. Is it dependent on some underlying hardware abstraction? Perhaps specific UART drivers or pin configurations? Or maybe some other higher-level Bluetooth protocol stacks? I need to think this through and figure out the chain of connections this thing has with the wider system. I know this will dictate the broader system requirements. |
| 6/2 | 2026/08/21 03:21 | tool | grepper |
0mArgs:{
"Expression": "config BT_HCIUART_3WIRE",
"PathPrefix": "drivers/bluetooth/Kconfig"
}Results: {
"Output": "drivers/bluetooth/Kconfig=175=config BT_HCIUART_LL\n--\ndrivers/bluetooth/Kconfig-186-\ndrivers/bluetooth/Kconfig:187:config BT_HCIUART_3WIRE\ndrivers/bluetooth/Kconfig-188-\tbool \"Three-wire UART (H5) protocol support\"\n"
} |
| 7/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7888 output: 34 thoughts: 11 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Kconfig Checkpoint** Okay, hold on a minute. Before I dive any deeper into this, I need to get a handle on the configuration. I can't just blindly proceed; I've got to understand how this component is actually being... well, configured. I need to go read the Kconfig file. That's the crucial first step. I need to grok what the maintainer's options are. What variables am I going to have to consider? |
| 8/2 | 2026/08/21 03:21 | tool | read-file |
0mArgs:{
"File": "drivers/bluetooth/Kconfig",
"FirstLine": 180,
"LineCount": 20
}Results: {
"Contents": " 180:\t\t HCILL (HCI Low Level) is a serial protocol for communication\n 181:\t\t between Bluetooth device and host. This protocol is required for\n 182:\t\t serial Bluetooth devices that are based on Texas Instruments'\n 183:\t\t BRF chips.\n 184:\t\n 185:\t\t Say Y here to compile support for HCILL protocol.\n 186:\t\n 187:\tconfig BT_HCIUART_3WIRE\n 188:\t\tbool \"Three-wire UART (H5) protocol support\"\n 189:\t\tdepends on BT_HCIUART\n 190:\t\tdepends on BT_HCIUART_SERDEV\n 191:\t\tselect CRC_CCITT\n 192:\t\thelp\n 193:\t\t The HCI Three-wire UART Transport Layer makes it possible to\n 194:\t\t user the Bluetooth HCI over a serial port interface. The HCI\n 195:\t\t Three-wire UART Transport Layer assumes that the UART\n 196:\t\t communication may have bit errors, overrun errors or burst\n 197:\t\t errors and thereby making CTS/RTS lines unnecessary.\n 198:\t\n 199:\t\t Say Y here to compile support for Three-wire UART protocol.\n"
} |
| 9/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8379 output: 33 thoughts: 43 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: **Analyzing Bluetooth HCI UART Configuration Dependencies** Alright, let's break this down. It looks like `BT_HCIUART_3WIRE` is built on top of `BT_HCIUART`, and that in turn relies on `BT_HCIUART_SERDEV`. This is pretty standard; it's a common layering pattern for Bluetooth HCI UART implementations. So, before I dig deeper into `BT_HCIUART_3WIRE`, I need to fully understand what `BT_HCIUART` provides, and how it's structured. I'll need to confirm that its feature set and design choices are solid. That way, any issues I uncover can be quickly tied back to the fundamental building blocks of the configuration. |
| 10/2 | 2026/08/21 03:21 | tool | grepper |
0mArgs:{
"Expression": "config BT_HCIUART$",
"PathPrefix": "drivers/bluetooth/Kconfig"
}Results: {
"Output": "drivers/bluetooth/Kconfig=93=config BT_HCIBTSDIO\n--\ndrivers/bluetooth/Kconfig-103-\ndrivers/bluetooth/Kconfig:104:config BT_HCIUART\ndrivers/bluetooth/Kconfig-105-\ttristate \"HCI UART driver\"\n"
} |
| 11/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8711 output: 34 thoughts: 11 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm deep in my domain of expertise: **Diving into BT_HCIUART** Alright, time to crack open the `BT_HCIUART` code again. This likely means I need to refresh my understanding of how the Bluetooth Host Controller Interface over UART is being implemented in this specific context. I'm probably looking for a specific issue or perhaps I'm integrating a new component and need to understand the data flow. Is it for debugging a connection problem? Maybe I'm optimizing power consumption. The acronym immediately brings up all sorts of potential avenues to explore. Time to get my head back in the game and trace the nuances of this UART-based HCI. I expect to be scrutinizing the interrupt handling, framing, and data buffer management. Let's see what gems are buried within this code. |
| 12/2 | 2026/08/21 03:21 | tool | read-file |
0mArgs:{
"File": "drivers/bluetooth/Kconfig",
"FirstLine": 100,
"LineCount": 20
}Results: {
"Contents": " 100:\t\n 101:\t\t Say Y here to compile support for Bluetooth SDIO devices into the\n 102:\t\t kernel or say M to compile it as module (btsdio).\n 103:\t\n 104:\tconfig BT_HCIUART\n 105:\t\ttristate \"HCI UART driver\"\n 106:\t\tdepends on SERIAL_DEV_BUS || !SERIAL_DEV_BUS\n 107:\t\tdepends on NVMEM || !NVMEM\n 108:\t\tdepends on POWER_SEQUENCING || !POWER_SEQUENCING\n 109:\t\tdepends on TTY\n 110:\t\thelp\n 111:\t\t Bluetooth HCI UART driver.\n 112:\t\t This driver is required if you want to use Bluetooth devices with\n 113:\t\t serial port interface. You will also need this driver if you have\n 114:\t\t UART based Bluetooth PCMCIA and CF devices like Xircom Credit Card\n 115:\t\t adapter and BrainBoxes Bluetooth PC Card.\n 116:\t\n 117:\t\t Say Y here to compile support for Bluetooth UART devices into the\n 118:\t\t kernel or say M to compile it as module (hci_uart).\n 119:\t\n"
} |
| 13/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9265 output: 35 thoughts: 12 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm deep in my domain of expertise: **Checking a Specific Configuration Variable** Alright, let me just double-check something. I'm deep into this analysis and I need to make sure I haven't missed anything. I've been focusing on the overall architecture, but a small detail can sometimes be the source of a large problem. Specifically, I'm thinking about the low-level UART serial device configuration. I need to quickly confirm that the `BT_HCIUART_SERDEV` setting is what I expect it to be. This impacts Bluetooth host controller interface (HCI) UART serial device. That is an important part of the stack, and, if not configured correctly, it could explain some weird behavior I'm seeing. I'm going to have to dive into that. |
| 14/2 | 2026/08/21 03:21 | tool | grepper |
0mArgs:{
"Expression": "config BT_HCIUART_SERDEV",
"PathPrefix": "drivers/bluetooth/Kconfig"
}Results: {
"Output": "drivers/bluetooth/Kconfig=104=config BT_HCIUART\n--\ndrivers/bluetooth/Kconfig-119-\ndrivers/bluetooth/Kconfig:120:config BT_HCIUART_SERDEV\ndrivers/bluetooth/Kconfig-121-\tbool\n"
} |
| 15/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9572 output: 34 thoughts: 14 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: **Initial Assessment: Decoding `BT_HCIUART_SERDEV`** Alright, let's dive into this. The notation `BT_HCIUART_SERDEV` immediately screams a specific area of interest: Bluetooth, Host Controller Interface (HCI), UART communication, and serial device drivers. My gut feeling is this is probably related to the low-level interactions between a Bluetooth controller (likely integrated or external) and the host system, focusing on the serial communication channel used to transmit HCI commands and data. I'm expecting to find details about the driver's initialization, how it handles framing of HCI packets over the UART, flow control mechanisms (if any), error handling, and perhaps even power management aspects. The "SERDEV" portion definitely suggests a standard Linux serial device driver interface, meaning it should integrate relatively seamlessly with the broader serial framework. I'll need to look for how this driver hooks into the standard Linux kernel serial driver layer and what specific configurations it uses to customize the UART communication for Bluetooth. Hopefully, the code comments are thorough enough to guide me through the flow control mechanisms and interrupt handling. |
| 16/2 | 2026/08/21 03:21 | tool | read-file |
0mArgs:{
"File": "drivers/bluetooth/Kconfig",
"FirstLine": 115,
"LineCount": 15
}Results: {
"Contents": " 115:\t\t adapter and BrainBoxes Bluetooth PC Card.\n 116:\t\n 117:\t\t Say Y here to compile support for Bluetooth UART devices into the\n 118:\t\t kernel or say M to compile it as module (hci_uart).\n 119:\t\n 120:\tconfig BT_HCIUART_SERDEV\n 121:\t\tbool\n 122:\t\tdepends on SERIAL_DEV_BUS \u0026\u0026 BT_HCIUART\n 123:\t\tdefault y\n 124:\t\n 125:\tconfig BT_HCIUART_H4\n 126:\t\tbool \"UART (H4) protocol support\"\n 127:\t\tdepends on BT_HCIUART\n 128:\t\thelp\n 129:\t\t UART (H4) is serial protocol for communication between Bluetooth\n"
} |
| 17/2 | 2026/08/21 03:21 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10096 output: 35 thoughts: 300 Thoughts: **Fuzzing Device Reprobe in the Linux Kernel** Okay, so I'm looking at this patch and immediately, `SERIAL_DEV_BUS` jumps out as a key element. It's essential to understand where this function is. Now, about `device_schedule_reprobe` itself... It lives in `drivers/base/dd.c`, which is always compiled. That's a good starting point. This patch is essentially introducing a new function to the driver core, `device_schedule_reprobe`, enabling a deferred detach and re-probe. It's a functional change in the driver model, a definite target for fuzzing. My primary focus here is definitely `device_schedule_reprobe`. Let me quickly confirm if it's exported. Ah, yes, `EXPORT_SYMBOL_GPL(device_schedule_reprobe);`. That's important; it's accessible. Since it's a core function, it's definitely worthwhile to spend some time fuzzing it. Hold on a minute... Let me see where this function is called. Right, it's used in `btintel_pcie`, `hci_h5`, and `iwlwifi`. `btintel_pcie` and `iwlwifi` are both PCIe drivers. And `hci_h5` is a serial driver. Okay, can I actually reach `hci_h5` inside of QEMU? Yes, via `hci_uart` and `serdev`. Excellent, that’s great news! So, the optimal configuration for fuzzing this would be to enable `BT_HCIUART`, `BT_HCIUART_3WIRE`, and, of course, `SERIAL_DEV_BUS`. Just to be safe, let me double-check `SERIAL_DEV_BUS`... |
| 18/2 | 2026/08/21 03:22 | tool | grepper |
0mArgs:{
"Expression": "config SERIAL_DEV_BUS",
"PathPrefix": "drivers/tty/serdev/Kconfig"
}Results: {
"Output": "drivers/tty/serdev/Kconfig-4-#\ndrivers/tty/serdev/Kconfig:5:menuconfig SERIAL_DEV_BUS\ndrivers/tty/serdev/Kconfig-6-\ttristate \"Serial device bus\"\n"
} |
| 19/2 | 2026/08/21 03:22 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10883 output: 156 thoughts: 118 Thoughts: **Refining the Probe Process** Okay, so I'm honing in on the crucial function here – it's definitely `device_schedule_reprobe`. That's the heart of the matter, so I need to make sure that's a key focus. Right, first thing is to add `device_schedule_reprobe` to `FocusSymbols`. That's done. Now, for configuration, I need to make sure the right hardware is enabled to work with this. I'll add `BT_HCIUART`, `BT_HCIUART_3WIRE`, and `SERIAL_DEV_BUS` to `EnableConfigs` . Perfect, that takes care of the comms. Now, I just need to double-check that `device_schedule_reprobe` is the *only* core thing being added here. Gotta be precise. Checking... yep, looks like I've also got `device_reprobe_work_fn`. Makes sense - it’s probably the worker that's run as a result of the schedule. I need to make sure both functions are clearly understood by the system. And for that reason, both are also going to `FocusSymbols`. |
| 20/2 | 2026/08/21 03:22 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"BT_HCIUART",
"BT_HCIUART_3WIRE",
"SERIAL_DEV_BUS"
],
"FocusSymbols": [
"device_schedule_reprobe",
"device_reprobe_work_fn"
],
"Reasoning": "The patch introduces a new function `device_schedule_reprobe` to the driver core, which allows scheduling a deferred detach and re-probe of a device. This is a functional change in the core driver model that can be reached and fuzzed. The function is used by several drivers, including the `hci_h5` serial driver, which can be reached in virtualized environments.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"BT_HCIUART",
"BT_HCIUART_3WIRE",
"SERIAL_DEV_BUS"
],
"FocusSymbols": [
"device_schedule_reprobe",
"device_reprobe_work_fn"
],
"Reasoning": "The patch introduces a new function `device_schedule_reprobe` to the driver core, which allows scheduling a deferred detach and re-probe of a device. This is a functional change in the core driver model that can be reached and fuzzed. The function is used by several drivers, including the `hci_h5` serial driver, which can be reached in virtualized environments.",
"WorthFuzzing": true
} |
| 21/1 | 2026/08/21 03:22 | action | If |
0mArgs:{
"WorthFuzzing": true
}Results: null |
| 22/2 | 2026/08/21 03:22 | agent | kmsan-evaluator |
0mModel:best-expensive Args: null Results: {
"KMSANReasoning": "The patch introduces a new function `device_schedule_reprobe` to standardise deferred device reprobing across drivers, replacing custom work items in `btintel_pcie`, `hci_h5`, and `iwlwifi`. It also adds a `shutdown_done` flag to prevent reprobing devices during system shutdown. All memory allocations (e.g., `struct device_reprobe` via `kzalloc_obj`) are fully zero-initialized. The changes are strictly confined to internal kernel device lifecycle management, driver binding/unbinding, and workqueue scheduling. There are no modifications to structures copied to user space, no new network packet parsing, and no complex data structures where uninitialized fields could be read or leaked. Any potential bugs introduced by these changes would be related to object lifetimes (use-after-free), locking (deadlocks), or null pointer dereferences, all of which are effectively caught by KASAN, LOCKDEP, and standard kernel debugging tools. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit 7f673fef7486a698b94cf291d658beda0ea5574a
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Aug 21 03:21:25 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/base/base.h b/drivers/base/base.h
index a5b7abc10ff02..6234e37de7e99 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -106,6 +106,10 @@ struct driver_private {
* @dead: This device is currently either in the process of or has been
* removed from the system. Any asynchronous events scheduled for this
* device should exit without taking any action.
+ * @shutdown_done: Set once device_shutdown() has reached this device, under
+ * the device lock, before any shutdown callback runs. Read under the
+ * device lock. A deferred re-probe scheduled with
+ * device_schedule_reprobe() must not detach the device anymore.
*
* Nothing outside of the driver core should ever touch these fields.
*/
@@ -120,6 +124,7 @@ struct device_private {
char *deferred_probe_reason;
struct device *device;
u8 dead:1;
+ u8 shutdown_done:1;
};
#define to_device_private_parent(obj) \
container_of(obj, struct device_private, knode_parent)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 4d026682944f2..8a7dbe4e8362b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -4906,6 +4906,9 @@ void device_shutdown(void)
device_lock(parent);
device_lock(dev);
+ if (dev->p)
+ dev->p->shutdown_done = true;
+
/* Don't allow any more runtime suspends */
pm_runtime_get_noresume(dev);
pm_runtime_barrier(dev);
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 60c005223844d..d765e1ae5614a 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1436,3 +1436,105 @@ void driver_detach(const struct device_driver *drv)
put_device(dev);
}
}
+
+struct device_reprobe {
+ struct delayed_work work;
+ struct device *dev;
+ struct device *parent;
+ const struct device_driver *drv;
+};
+
+static void device_reprobe_work_fn(struct work_struct *work)
+{
+ struct device_reprobe *rp = container_of(work, struct device_reprobe,
+ work.work);
+ struct device *dev = rp->dev;
+ struct device *parent = rp->parent;
+ bool detached = false;
+ int ret;
+
+ __device_driver_lock(dev, parent);
+ /*
+ * rp->drv is only ever compared, never dereferenced: the driver it
+ * points to may have been unregistered and freed by now.
+ */
+ if (!dev->p->dead && !dev->p->shutdown_done &&
+ dev->driver && dev->driver == rp->drv) {
+ __device_release_driver(dev, parent);
+ detached = true;
+ }
+ __device_driver_unlock(dev, parent);
+
+ if (detached) {
+ /*
+ * device_attach() must run with the parent locked on buses
+ * that require it, mirroring bus_rescan_devices_helper().
+ */
+ if (parent && dev->bus->need_parent_lock)
+ device_lock(parent);
+ ret = device_attach(dev);
+ if (ret < 0)
+ dev_err_probe(dev, ret,
+ "re-probe failed, device left unbound\n");
+ if (parent && dev->bus->need_parent_lock)
+ device_unlock(parent);
+ }
+
+ put_device(dev);
+ put_device(parent);
+ kfree(rp);
+}
+
+/**
+ * device_schedule_reprobe - schedule a deferred detach and re-probe
+ * @dev: device to detach and re-probe
+ * @delay_ms: delay in milliseconds before the re-probe runs
+ *
+ * Schedule a detach and re-probe of @dev after @delay_ms milliseconds.
+ * The re-probe is skipped if, by the time the scheduled work runs, the
+ * device has been removed, the system shutdown sequence has reached the
+ * device, or @dev is no longer bound to the driver that was bound at
+ * scheduling time. In particular an administrative unbind is never
+ * undone by a stale re-probe.
+ *
+ * The work function is built-in text, so the bound driver may call this
+ * from its own code without holding a module reference. If the driver
+ * module is unloaded before the work runs, driver unregistration unbinds
+ * @dev first and the scheduled work does nothing.
+ *
+ * Multiple pending re-probes for the same device are individually safe;
+ * a caller that wants at most one pending re-probe must gate scheduling
+ * itself.
+ *
+ * May only be called from process context.
+ *
+ * Returns: 0 on success, -EINVAL if @dev is not a registered device
+ * bound to a driver, -ENOMEM on allocation failure.
+ */
+int device_schedule_reprobe(struct device *dev, unsigned int delay_ms)
+{
+ struct device_reprobe *rp;
+
+ if (!dev->bus || !dev->p || !device_is_registered(dev))
+ return -EINVAL;
+ if (!dev->driver)
+ return -EINVAL;
+
+ rp = kzalloc_obj(*rp);
+ if (!rp)
+ return -ENOMEM;
+
+ rp->dev = get_device(dev);
+ /*
+ * Pin the parent too: the work locks it, and an unregister of @dev
+ * would otherwise drop the last reference before the work runs.
+ */
+ rp->parent = get_device(dev->parent);
+ rp->drv = READ_ONCE(dev->driver);
+ INIT_DELAYED_WORK(&rp->work, device_reprobe_work_fn);
+ queue_delayed_work(system_dfl_wq, &rp->work,
+ msecs_to_jiffies(delay_ms));
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(device_schedule_reprobe);
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index baa621b3fef93..29be05d414298 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -3012,7 +3012,7 @@ static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data)
* BT needs pci_save_state()/pci_restore_state() because the BT driver
* is still partially attached when the _PRR runs (it hasn't been unbound yet).
* The PCI device needs to remain minimally functional so that
- * device_reprobe(&pdev->dev) can work afterward
+ * the deferred re-probe of the BT device can work afterward
*/
ret = btintel_pcie_acpi_reset_method(data);
@@ -3023,14 +3023,16 @@ static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data)
}
if (!ret) {
- if (device_reprobe(&pdev->dev))
- BT_ERR("BT reprobe failed for BDF:%s", pci_name(pdev));
+ if (device_schedule_reprobe(&pdev->dev, 0))
+ BT_ERR("BT reprobe scheduling failed for BDF:%s",
+ pci_name(pdev));
}
}
/*
- * Issue a Function Level Reset and hand teardown/re-init off to the PCI
- * core via device_reprobe(), mirroring the PLDR path's contract.
+ * Issue a Function Level Reset and hand teardown/re-init off to the
+ * driver core via device_schedule_reprobe(), mirroring the PLDR path's
+ * contract.
*
* Caller must hold pci_lock_rescan_remove() and must have already
* disabled interrupts and drained both rx_work and coredump_work.
@@ -3052,14 +3054,12 @@ static int btintel_pcie_perform_flr(struct btintel_pcie_data *data)
return err;
}
- /* device_reprobe() always detaches the driver first (running
- * .remove(), which frees 'data'); any re-probe failure leaves the
- * device unbound but 'data' is already gone, so just log it.
- */
- if (device_reprobe(&pdev->dev))
- BT_ERR("BT reprobe failed for BDF:%s", pci_name(pdev));
+ err = device_schedule_reprobe(&pdev->dev, 0);
+ if (err)
+ BT_ERR("BT reprobe scheduling failed for BDF:%s",
+ pci_name(pdev));
- return 0;
+ return err;
}
static void btintel_pcie_reset_work(struct work_struct *wk)
@@ -3090,11 +3090,15 @@ static void btintel_pcie_reset_work(struct work_struct *wk)
bt_dev_dbg(data->hdev, "Release bluetooth interface");
- /* Both reset paths follow the same contract: on success they
- * destroy 'data' via device_reprobe() (a fresh probe re-INIT_WORKs
- * the dump workers with disable count 0), so enable_work() must
- * NOT be called on the success path. Only the FLR path can fail
- * with 'data' still alive, in which case we balance the
+ /* Both reset paths follow the same contract: on success the
+ * deferred re-probe scheduled with device_schedule_reprobe()
+ * destroys 'data' by re-running .probe() (which re-INIT_WORKs the
+ * dump workers with disable count 0), so enable_work() must NOT be
+ * called on the success path. 'data' stays alive until the deferred
+ * detach runs; in this window new activity is fenced by
+ * BTINTEL_PCIE_RECOVERY_IN_PROGRESS, the masked interrupts and the
+ * disabled dump workers. Only the FLR path can fail with no
+ * re-probe scheduled, in which case we balance the
* disable_work_sync() calls above so a later successful reset is
* not permanently blocked.
*
@@ -3460,13 +3464,12 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
disable_work_sync(&data->fwtrigger_work);
disable_work_sync(&data->mbox_work);
- /* Cancel pending reset work. Skip only when remove() is called from
- * within the reset work itself (PLDR device_reprobe path) to avoid
- * deadlock. current_work() returns the work_struct of the caller if
- * we are in a workqueue context.
+ /* The deferred re-probe triggers .remove() from the driver core's
+ * work item, never from reset_work itself, so this no longer runs
+ * nested in reset_work; disable_work_sync() also guarantees the
+ * reset work has fully returned before 'data' is freed.
*/
- if (current_work() != &data->reset_work)
- disable_work_sync(&data->reset_work);
+ disable_work_sync(&data->reset_work);
btintel_pcie_disable_interrupts(data);
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index b1999e14aadef..3fde1d5a5ae99 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -990,7 +990,7 @@ static int h5_btrtl_setup(struct h5 *h5)
static void h5_btrtl_open(struct h5 *h5)
{
/*
- * Since h5_btrtl_resume() does a device_reprobe() the suspend handling
+ * Since h5_btrtl_resume() schedules a device re-probe the suspend handling
* done by the hci_suspend_notifier is not necessary; it actually causes
* delays and a bunch of errors to get logged, so disable it.
*/
@@ -1049,46 +1049,15 @@ static int h5_btrtl_suspend(struct h5 *h5)
return 0;
}
-struct h5_btrtl_reprobe {
- struct device *dev;
- struct work_struct work;
-};
-
-static void h5_btrtl_reprobe_worker(struct work_struct *work)
-{
- struct h5_btrtl_reprobe *reprobe =
- container_of(work, struct h5_btrtl_reprobe, work);
- int ret;
-
- ret = device_reprobe(reprobe->dev);
- if (ret && ret != -EPROBE_DEFER)
- dev_err(reprobe->dev, "Reprobe error %d\n", ret);
-
- put_device(reprobe->dev);
- kfree(reprobe);
- module_put(THIS_MODULE);
-}
-
static int h5_btrtl_resume(struct h5 *h5)
{
- if (test_bit(H5_WAKEUP_DISABLE, &h5->flags)) {
- struct h5_btrtl_reprobe *reprobe;
-
- reprobe = kzalloc_obj(*reprobe);
- if (!reprobe)
- return -ENOMEM;
-
- __module_get(THIS_MODULE);
+ if (test_bit(H5_WAKEUP_DISABLE, &h5->flags))
+ return device_schedule_reprobe(&h5->hu->serdev->dev, 0);
- INIT_WORK(&reprobe->work, h5_btrtl_reprobe_worker);
- reprobe->dev = get_device(&h5->hu->serdev->dev);
- queue_work(system_long_wq, &reprobe->work);
- } else {
- gpiod_set_value_cansleep(h5->device_wake_gpio, 1);
+ gpiod_set_value_cansleep(h5->device_wake_gpio, 1);
- if (test_bit(H5_HW_FLOW_CONTROL, &h5->flags))
- serdev_device_set_flow_control(h5->hu->serdev, true);
- }
+ if (test_bit(H5_HW_FLOW_CONTROL, &h5->flags))
+ serdev_device_set_flow_control(h5->hu->serdev, true);
return 0;
}
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
index 73aae11250421..5ae734cb90272 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
@@ -78,47 +78,11 @@ void iwl_trans_free_restart_list(void)
}
}
-struct iwl_trans_reprobe {
- struct device *dev;
- struct delayed_work work;
-};
-
-static void iwl_trans_reprobe_wk(struct work_struct *wk)
-{
- struct iwl_trans_reprobe *reprobe;
-
- reprobe = container_of(wk, typeof(*reprobe), work.work);
-
- if (device_reprobe(reprobe->dev))
- dev_err(reprobe->dev, "reprobe failed!\n");
- put_device(reprobe->dev);
- kfree(reprobe);
- module_put(THIS_MODULE);
-}
-
static void iwl_trans_schedule_reprobe(struct iwl_trans *trans,
unsigned int delay_ms)
{
- struct iwl_trans_reprobe *reprobe;
-
- /*
- * get a module reference to avoid doing this while unloading
- * anyway and to avoid scheduling a work with code that's
- * being removed.
- */
- if (!try_module_get(THIS_MODULE)) {
- IWL_ERR(trans, "Module is being unloaded - abort\n");
- return;
- }
-
- reprobe = kzalloc_obj(*reprobe);
- if (!reprobe) {
- module_put(THIS_MODULE);
- return;
- }
- reprobe->dev = get_device(trans->dev);
- INIT_DELAYED_WORK(&reprobe->work, iwl_trans_reprobe_wk);
- schedule_delayed_work(&reprobe->work, msecs_to_jiffies(delay_ms));
+ if (device_schedule_reprobe(trans->dev, delay_ms))
+ IWL_ERR(trans, "Could not schedule reprobe\n");
}
#define IWL_TRANS_RESET_OK_TIME 7 /* seconds */
diff --git a/include/linux/device.h b/include/linux/device.h
index 7b2baffdd2f55..1cdd40a6a48da 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1312,6 +1312,8 @@ int __must_check device_attach(struct device *dev);
int __must_check driver_attach(const struct device_driver *drv);
void device_initial_probe(struct device *dev);
int __must_check device_reprobe(struct device *dev);
+int __must_check device_schedule_reprobe(struct device *dev,
+ unsigned int delay_ms);
bool device_is_bound(struct device *dev);
|
| 23/3 | 2026/08/21 03:22 | llm | kmsan-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6635 output: 18 thoughts: 693 Thoughts: **Analyzing the Device Reprobe Patch for Potential Uninitialized Memory Issues** Okay, so I'm looking at this patch and, right off the bat, it seems like a straightforward refactor to consolidate device reprobing logic. The main goal here is to replace custom reprobe mechanisms in several drivers (like `btintel_pcie`, `hci_h5`, and `iwlwifi`) with a single, unified function, `device_schedule_reprobe` in `drivers/base/dd.c`. The patch also includes a `shutdown_done` flag to prevent reprobing devices that have already been shut down. Given my understanding of kernel internals, the description strongly suggests this is primarily about cleanup and race condition fixing, especially around module unloading and device lifecycle. It *seems* like there are no new user-space interfaces or complex data structures being introduced, which is good. That typically means fewer avenues for uninitialized memory to sneak in. They're explicitly claiming no changes that would expose uninitialized memory through bounds checks, lengths, etc. This is very encouraging from a security perspective. Therefore, my initial impression is that this patch *shouldn't* introduce any uninitialized memory risks that would trigger a KMSAN warning. KASAN and other standard bug detectors should be sufficient to catch any potential issues like use-after-free or NULL pointer dereferences that might be introduced during this refactoring. So far, so good. Now, let's take a closer look at that `device_schedule_reprobe` function. Specifically, that `kzalloc_obj(*rp)` call is giving me pause. Wait, that looks unusual. `kzalloc_obj`? Is that a macro? I typically use `kzalloc(sizeof(*rp), GFP_KERNEL)`. Maybe I misread it, or is it a custom macro? This isn't standard, I'm pretty sure. Let me double-check the code. Wait, hold on. `kzalloc_obj` is not a standard Linux kernel API. This is concerning, it needs to be understood. Let me check if it's in the kernel. Wait, `kzalloc_obj` is not a standard macro. Ah, wait, this might be a macro introduced recently or, potentially, a typo in the patch description. Let me do a quick grep search to confirm. |
| 24/3 | 2026/08/21 03:22 | tool | grepper |
0mArgs:{
"Expression": "kzalloc_obj"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 79273 lines.\nUse more precise expression if possible.\n\nDocumentation/core-api/list.rst=103=list:\n--\nDocumentation/core-api/list.rst-114-\nDocumentation/core-api/list.rst:115: grock = kzalloc_obj(*grock);\nDocumentation/core-api/list.rst-116- if (!grock)\n--\nDocumentation/core-api/list.rst-125-\nDocumentation/core-api/list.rst:126: dimitri = kzalloc_obj(*dimitri);\nDocumentation/core-api/list.rst-127- if (!dimitri)\n--\nDocumentation/driver-api/mailbox.rst=45=a message and a callback function to the API and return immediately).\n--\nDocumentation/driver-api/mailbox.rst-89-\nDocumentation/driver-api/mailbox.rst:90:\t\tdc_sync = kzalloc_obj(*dc_sync);\nDocumentation/driver-api/mailbox.rst:91:\t\tdc_async = kzalloc_obj(*dc_async);\nDocumentation/driver-api/mailbox.rst-92-\n--\nDocumentation/driver-api/media/v4l2-fh.rst=26=Example:\n--\nDocumentation/driver-api/media/v4l2-fh.rst-44-\nDocumentation/driver-api/media/v4l2-fh.rst:45:\t\tmy_fh = kzalloc_obj(*my_fh);\nDocumentation/driver-api/media/v4l2-fh.rst-46-\n--\nDocumentation/process/coding-style.rst=938=The kernel provides the following general purpose memory allocators:\nDocumentation/process/coding-style.rst:939:kmalloc(), kzalloc(), kmalloc_objs(), kzalloc_objs(), vmalloc(), and\nDocumentation/process/coding-style.rst-940-vzalloc(). Please refer to the API documentation for further information\n--\nDocumentation/process/coding-style.rst=964=The preferred form for allocating a zeroed array is the following:\n--\nDocumentation/process/coding-style.rst-967-\nDocumentation/process/coding-style.rst:968:\tp = kzalloc_objs(*p, n, ...);\nDocumentation/process/coding-style.rst-969-\n--\nDocumentation/process/deprecated.rst=398=become, respectively::\n--\nDocumentation/process/deprecated.rst-400-\tptr = kmalloc_obj(*ptr [, gfp] );\nDocumentation/process/deprecated.rst:401:\tptr = kzalloc_obj(*ptr [, gfp] );\nDocumentation/process/deprecated.rst-402-\tptr = kmalloc_objs(*ptr, count [, gfp] );\nDocumentation/process/deprecated.rst:403:\tptr = kzalloc_objs(*ptr, count [, gfp] );\nDocumentation/process/deprecated.rst-404-\tptr = kmalloc_flex(*ptr, flex_member, count [, gfp] );\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst=208=to details explained in the following section.\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-268- /* allocate a chip-specific data with zero filled */\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst:269: chip = kzalloc_obj(*chip);\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-270- if (chip == NULL)\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst=623=After allocating a card instance via :c:func:`snd_card_new()`\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-630- .....\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst:631: chip = kzalloc_obj(*chip);\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-632-\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst=698=destructor and PCI entries. Example code is shown first, below::\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-749-\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst:750: chip = kzalloc_obj(*chip);\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-751- if (chip == NULL) {\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst=3823=chip data individually::\n--\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-3835- ....\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst:3836: chip = kzalloc_obj(*chip);\nDocumentation/sound/kernel-api/writing-an-alsa-driver.rst-3837- ....\n--\nDocumentation/translations/zh_CN/video4linux/v4l2-framework.txt=794=int my_open(struct file *file)\n--\nDocumentation/translations/zh_CN/video4linux/v4l2-framework.txt-801-\nDocumentation/translations/zh_CN/video4linux/v4l2-framework.txt:802:\tmy_fh = kzalloc_obj(*my_fh);\nDocumentation/translations/zh_CN/video4linux/v4l2-framework.txt-803-\n--\narch/alpha/kernel/module.c=64=module_frob_arch_sections(Elf64_Ehdr *hdr, Elf64_Shdr *sechdrs,\n--\narch/alpha/kernel/module.c-95-\tnsyms = symtab-\u003esh_size / sizeof(Elf64_Sym);\narch/alpha/kernel/module.c:96:\tchains = kzalloc_objs(struct got_entry, nsyms);\narch/alpha/kernel/module.c-97-\tif (!chains) {\n--\narch/alpha/kernel/setup.c=390=register_cpus(void)\n--\narch/alpha/kernel/setup.c-394-\tfor_each_possible_cpu(i) {\narch/alpha/kernel/setup.c:395:\t\tstruct cpu *p = kzalloc_obj(*p);\narch/alpha/kernel/setup.c-396-\t\tif (!p)\n--\narch/arc/net/bpf_jit_core.c=1120=static int jit_prepare_final_mem_alloc(struct jit_context *ctx)\n--\narch/arc/net/bpf_jit_core.c-1131-\tif (ctx-\u003eneed_extra_pass) {\narch/arc/net/bpf_jit_core.c:1132:\t\tctx-\u003ejit_data = kzalloc_obj(*ctx-\u003ejit_data);\narch/arc/net/bpf_jit_core.c-1133-\t\tif (!ctx-\u003ejit_data)\n--\narch/arm/common/locomo.c=220=locomo_init_one_child(struct locomo *lchip, struct locomo_dev_info *info)\n--\narch/arm/common/locomo.c-224-\narch/arm/common/locomo.c:225:\tdev = kzalloc_obj(struct locomo_dev);\narch/arm/common/locomo.c-226-\tif (!dev) {\n--\narch/arm/common/locomo.c=356=__locomo_probe(struct device *me, struct resource *mem, int irq)\n--\narch/arm/common/locomo.c-362-\narch/arm/common/locomo.c:363:\tlchip = kzalloc_obj(struct locomo);\narch/arm/common/locomo.c-364-\tif (!lchip)\n--\narch/arm/common/sa1111.c=733=sa1111_init_one_child(struct sa1111 *sachip, struct resource *parent,\n--\narch/arm/common/sa1111.c-739-\narch/arm/common/sa1111.c:740:\tdev = kzalloc_obj(struct sa1111_dev);\narch/arm/common/sa1111.c-741-\tif (!dev) {\n--\narch/arm/common/scoop.c=178=static int scoop_probe(struct platform_device *pdev)\n--\narch/arm/common/scoop.c-187-\narch/arm/common/scoop.c:188:\tdevptr = kzalloc_obj(struct scoop_dev);\narch/arm/common/scoop.c-189-\tif (!devptr)\n--\narch/arm/kernel/smp.c=108=static int secondary_biglittle_prepare(unsigned int cpu)\n--\narch/arm/kernel/smp.c-110-\tif (!cpu_vtable[cpu])\narch/arm/kernel/smp.c:111:\t\tcpu_vtable[cpu] = kzalloc_obj(*cpu_vtable[cpu]);\narch/arm/kernel/smp.c-112-\n--\narch/arm/kernel/vdso.c=169=static int __init vdso_init(void)\n--\narch/arm/kernel/vdso.c-181-\t/* Allocate the VDSO text pagelist */\narch/arm/kernel/vdso.c:182:\tvdso_text_pagelist = kzalloc_objs(struct page *, text_pages);\narch/arm/kernel/vdso.c-183-\tif (vdso_text_pagelist == NULL)\n--\narch/arm/mach-footbridge/dc21285.c=261=int __init dc21285_setup(int nr, struct pci_sys_data *sys)\n--\narch/arm/mach-footbridge/dc21285.c-264-\narch/arm/mach-footbridge/dc21285.c:265:\tres = kzalloc_objs(struct resource, 2);\narch/arm/mach-footbridge/dc21285.c-266-\tif (!res) {\n--\narch/arm/mach-footbridge/ebsa285.c=69=static int __init ebsa285_leds_init(void)\n--\narch/arm/mach-footbridge/ebsa285.c-86-\narch/arm/mach-footbridge/ebsa285.c:87:\t\tled = kzalloc_obj(*led);\narch/arm/mach-footbridge/ebsa285.c-88-\t\tif (!led)\n--\narch/arm/mach-footbridge/netwinder-hw.c=720=static int __init netwinder_leds_init(void)\n--\narch/arm/mach-footbridge/netwinder-hw.c-729-\narch/arm/mach-footbridge/netwinder-hw.c:730:\t\tled = kzalloc_obj(*led);\narch/arm/mach-footbridge/netwinder-hw.c-731-\t\tif (!led)\n--\narch/arm/mach-imx/mmdc.c=473=static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base,\n--\narch/arm/mach-imx/mmdc.c-479-\narch/arm/mach-imx/mmdc.c:480:\tpmu_mmdc = kzalloc_obj(*pmu_mmdc);\narch/arm/mach-imx/mmdc.c-481-\tif (!pmu_mmdc) {\n--\narch/arm/mach-mvebu/board-v7.c=114=static void __init i2c_quirk(void)\n--\narch/arm/mach-mvebu/board-v7.c-129-\narch/arm/mach-mvebu/board-v7.c:130:\t\tnew_compat = kzalloc_obj(*new_compat);\narch/arm/mach-mvebu/board-v7.c-131-\n--\narch/arm/mach-mvebu/coherency.c=163=static void __init armada_375_380_coherency_init(struct device_node *np)\n--\narch/arm/mach-mvebu/coherency.c-187-\narch/arm/mach-mvebu/coherency.c:188:\t\tp = kzalloc_obj(*p);\narch/arm/mach-mvebu/coherency.c-189-\t\tp-\u003ename = kstrdup(\"arm,io-coherent\", GFP_KERNEL);\n--\narch/arm/mach-mvebu/mvebu-soc-id.c=148=static int __init mvebu_soc_device(void)\n--\narch/arm/mach-mvebu/mvebu-soc-id.c-156-\narch/arm/mach-mvebu/mvebu-soc-id.c:157:\tsoc_dev_attr = kzalloc_obj(*soc_dev_attr);\narch/arm/mach-mvebu/mvebu-soc-id.c-158-\tif (!soc_dev_attr)\n--\narch/arm/mach-mxs/mach-mxs.c=380=static void __init mxs_machine_init(void)\n--\narch/arm/mach-mxs/mach-mxs.c-389-\narch/arm/mach-mxs/mach-mxs.c:390:\tsoc_dev_attr = kzalloc_obj(*soc_dev_attr);\narch/arm/mach-mxs/mach-mxs.c-391-\tif (!soc_dev_attr)\n--\narch/arm/mach-omap1/dma.c=294=static int __init omap1_system_dma_init(void)\n--\narch/arm/mach-omap1/dma.c-321-\narch/arm/mach-omap1/dma.c:322:\td = kzalloc_obj(*d);\narch/arm/mach-omap1/dma.c-323-\tif (!d) {\n--\narch/arm/mach-omap1/mcbsp.c=292=static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count,\n--\narch/arm/mach-omap1/mcbsp.c-296-\narch/arm/mach-omap1/mcbsp.c:297:\tomap_mcbsp_devices = kzalloc_objs(struct platform_device *, size);\narch/arm/mach-omap1/mcbsp.c-298-\tif (!omap_mcbsp_devices) {\n--\narch/arm/mach-omap1/timer.c=51=static int __init omap1_dm_timer_init(void)\n--\narch/arm/mach-omap1/timer.c-127-\narch/arm/mach-omap1/timer.c:128:\t\tpdata = kzalloc_obj(*pdata);\narch/arm/mach-omap1/timer.c-129-\t\tif (!pdata) {\n--\narch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c=230=void omap2xxx_clkt_vps_init(void)\n--\narch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c-239-\narch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c:240:\thw = kzalloc_obj(*hw);\narch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c-241-\tif (!hw)\n--\narch/arm/mach-omap2/id.c=786=void __init omap_soc_device_init(void)\n--\narch/arm/mach-omap2/id.c-790-\narch/arm/mach-omap2/id.c:791:\tsoc_dev_attr = kzalloc_obj(*soc_dev_attr);\narch/arm/mach-omap2/id.c-792-\tif (!soc_dev_attr)\n--\narch/arm/mach-omap2/omap_device.c=131=static int omap_device_build_from_dt(struct platform_device *pdev)\n--\narch/arm/mach-omap2/omap_device.c-158-\narch/arm/mach-omap2/omap_device.c:159:\thwmods = kzalloc_objs(struct omap_hwmod *, oh_cnt);\narch/arm/mach-omap2/omap_device.c-160-\tif (!hwmods) {\n--\narch/arm/mach-omap2/omap_hwmod.c=3381=static int omap_hwmod_allocate_module(struct device *dev, struct omap_hwmod *oh,\n--\narch/arm/mach-omap2/omap_hwmod.c-3394-\narch/arm/mach-omap2/omap_hwmod.c:3395:\tsysc = kzalloc_obj(*sysc);\narch/arm/mach-omap2/omap_hwmod.c-3396-\tif (!sysc)\n--\narch/arm/mach-omap2/omap_hwmod.c-3424-\tif (list_empty(\u0026oh-\u003eslave_ports)) {\narch/arm/mach-omap2/omap_hwmod.c:3425:\t\toi = kzalloc_obj(*oi);\narch/arm/mach-omap2/omap_hwmod.c-3426-\t\tif (!oi)\n--\narch/arm/mach-omap2/omap_hwmod.c=3513=int omap_hwmod_init_module(struct device *dev,\n--\narch/arm/mach-omap2/omap_hwmod.c-3527-\tif (!oh) {\narch/arm/mach-omap2/omap_hwmod.c:3528:\t\toh = kzalloc_obj(*oh);\narch/arm/mach-omap2/omap_hwmod.c-3529-\t\tif (!oh)\n--\narch/arm/mach-omap2/omap_hwmod.c-3538-\narch/arm/mach-omap2/omap_hwmod.c:3539:\t\toh-\u003eclass = kzalloc_obj(*oh-\u003eclass);\narch/arm/mach-omap2/omap_hwmod.c-3540-\t\tif (!oh-\u003eclass) {\n--\narch/arm/mach-omap2/pm33xx-core.c=379=static int __init amx3_idle_init(struct device_node *cpu_node, int cpu)\n--\narch/arm/mach-omap2/pm33xx-core.c-412-\narch/arm/mach-omap2/pm33xx-core.c:413:\tidle_states = kzalloc_objs(*idle_states, state_count);\narch/arm/mach-omap2/pm33xx-core.c-414-\tif (!idle_states)\n--\narch/arm/mach-omap2/sr_device.c=30=static void __init sr_set_nvalues(struct omap_volt_data *volt_data,\n--\narch/arm/mach-omap2/sr_device.c-41-\narch/arm/mach-omap2/sr_device.c:42:\tnvalue_table = kzalloc_objs(*nvalue_table, count);\narch/arm/mach-omap2/sr_device.c-43-\tif (!nvalue_table)\n--\narch/arm/mach-orion5x/pci.c=139=static int __init pcie_setup(struct pci_sys_data *sys)\n--\narch/arm/mach-orion5x/pci.c-171-\t */\narch/arm/mach-orion5x/pci.c:172:\tres = kzalloc_obj(struct resource);\narch/arm/mach-orion5x/pci.c-173-\tif (!res)\n--\narch/arm/mach-orion5x/pci.c=466=static int __init pci_setup(struct pci_sys_data *sys)\n--\narch/arm/mach-orion5x/pci.c-492-\t */\narch/arm/mach-orion5x/pci.c:493:\tres = kzalloc_obj(struct resource);\narch/arm/mach-orion5x/pci.c-494-\tif (!res)\n--\narch/arm/mach-rpc/ecard.c=689=static struct expansion_card *__init ecard_alloc_card(int type, int slot)\n--\narch/arm/mach-rpc/ecard.c-694-\narch/arm/mach-rpc/ecard.c:695:\tec = kzalloc_obj(ecard_t);\narch/arm/mach-rpc/ecard.c-696-\tif (!ec) {\n--\narch/arm/mach-sa1100/clock.c=93=int __init sa11xx_clk_init(void)\n--\narch/arm/mach-sa1100/clock.c-109-\narch/arm/mach-sa1100/clock.c:110:\thw = kzalloc_obj(*hw);\narch/arm/mach-sa1100/clock.c-111-\tif (!hw)\n--\narch/arm/mach-sa1100/clock.c-131-\narch/arm/mach-sa1100/clock.c:132:\thw = kzalloc_obj(*hw);\narch/arm/mach-sa1100/clock.c-133-\tif (!hw)\n--\narch/arm/mach-sa1100/generic.c=317=int __init sa11x0_register_fixed_regulator(int n,\n--\narch/arm/mach-sa1100/generic.c-323-\narch/arm/mach-sa1100/generic.c:324:\tcfg-\u003einit_data = id = kzalloc_obj(*cfg-\u003einit_data);\narch/arm/mach-sa1100/generic.c-325-\tif (!cfg-\u003einit_data)\n--\narch/arm/mach-sa1100/neponset.c=225=static int neponset_probe(struct platform_device *dev)\n--\narch/arm/mach-sa1100/neponset.c-278-\narch/arm/mach-sa1100/neponset.c:279:\td = kzalloc_obj(*d);\narch/arm/mach-sa1100/neponset.c-280-\tif (!d) {\n--\narch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c=141=static int __init rcar_gen2_regulator_quirk(void)\n--\narch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c-166-\narch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c:167:\t\tquirk = kzalloc_obj(*quirk);\narch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c-168-\t\tif (!quirk) {\n--\narch/arm/mach-versatile/spc.c=393=static int ve_spc_populate_opps(uint32_t cluster)\n--\narch/arm/mach-versatile/spc.c-397-\narch/arm/mach-versatile/spc.c:398:\topps = kzalloc_objs(*opps, MAX_OPPS);\narch/arm/mach-versatile/spc.c-399-\tif (!opps)\n--\narch/arm/mach-versatile/spc.c=442=int __init ve_spc_init(void __iomem *baseaddr, u32 a15_clusid, int irq)\n--\narch/arm/mach-versatile/spc.c-444-\tint ret;\narch/arm/mach-versatile/spc.c:445:\tinfo = kzalloc_obj(*info);\narch/arm/mach-versatile/spc.c-446-\tif (!info)\n--\narch/arm/mach-versatile/spc.c=523=static struct clk *ve_spc_clk_register(struct device *cpu_dev)\n--\narch/arm/mach-versatile/spc.c-527-\narch/arm/mach-versatile/spc.c:528:\tspc = kzalloc_obj(*spc);\narch/arm/mach-versatile/spc.c-529-\tif (!spc)\n--\narch/arm/mach-versatile/versatile.c=123=static void __init versatile_dt_pci_init(void)\n--\narch/arm/mach-versatile/versatile.c-144-\narch/arm/mach-versatile/versatile.c:145:\tnewprop = kzalloc_obj(*newprop);\narch/arm/mach-versatile/versatile.c-146-\tif (!newprop)\n--\narch/arm/mach-zynq/common.c=105=static void __init zynq_init_machine(void)\n--\narch/arm/mach-zynq/common.c-110-\narch/arm/mach-zynq/common.c:111:\tsoc_dev_attr = kzalloc_obj(*soc_dev_attr);\narch/arm/mach-zynq/common.c-112-\tif (!soc_dev_attr)\n--\narch/arm/mm/cache-l2x0-pmu.c=503=static __init int l2x0_pmu_init(void)\n--\narch/arm/mm/cache-l2x0-pmu.c-509-\narch/arm/mm/cache-l2x0-pmu.c:510:\tl2x0_pmu = kzalloc_obj(*l2x0_pmu);\narch/arm/mm/cache-l2x0-pmu.c-511-\tif (!l2x0_pmu) {\n--\narch/arm/mm/cache-uniphier.c=315=static int __init __uniphier_cache_init(struct device_node *np,\n--\narch/arm/mm/cache-uniphier.c-344-\narch/arm/mm/cache-uniphier.c:345:\tdata = kzalloc_obj(*data);\narch/arm/mm/cache-uniphier.c-346-\tif (!data)\n--\narch/arm/mm/dma-mapping.c=533=static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,\n--\narch/arm/mm/dma-mapping.c-560-\narch/arm/mm/dma-mapping.c:561:\tbuf = kzalloc_obj(*buf,\narch/arm/mm/dma-mapping.c-562-\t\t\t gfp \u0026 ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM));\n--\narch/arm/mm/dma-mapping.c=1487=arm_iommu_create_mapping(struct device *dev, dma_addr_t base, u64 size)\n--\narch/arm/mm/dma-mapping.c-1506-\narch/arm/mm/dma-mapping.c:1507:\tmapping = kzalloc_obj(struct dma_iommu_mapping);\narch/arm/mm/dma-mapping.c-1508-\tif (!mapping)\n--\narch/arm/xen/enlighten.c=316=int __init arch_xen_unpopulated_init(struct resource **res)\n--\narch/arm/xen/enlighten.c-343-\narch/arm/xen/enlighten.c:344:\tregs = kzalloc_objs(*regs, nr_reg);\narch/arm/xen/enlighten.c-345-\tif (!regs) {\n--\narch/arm/xen/enlighten.c-387-\narch/arm/xen/enlighten.c:388:\t\ttmp_res = kzalloc_obj(*tmp_res);\narch/arm/xen/enlighten.c-389-\t\tif (!tmp_res) {\n--\narch/arm/xen/p2m.c=150=bool __set_phys_to_machine_multi(unsigned long pfn,\n--\narch/arm/xen/p2m.c-178-\narch/arm/xen/p2m.c:179:\tp2m_entry = kzalloc_obj(*p2m_entry, GFP_NOWAIT);\narch/arm/xen/p2m.c-180-\tif (!p2m_entry)\n--\narch/arm64/kernel/vdso.c=68=static int __init __vdso_init(enum vdso_abi abi)\n--\narch/arm64/kernel/vdso.c-83-\narch/arm64/kernel/vdso.c:84:\tvdso_pagelist = kzalloc_objs(struct page *, vdso_info[abi].vdso_pages);\narch/arm64/kernel/vdso.c-85-\tif (vdso_pagelist == NULL)\n--\narch/arm64/kvm/mmu.c=480=static int share_pfn_hyp(u64 pfn)\n--\narch/arm64/kvm/mmu.c-492-\narch/arm64/kvm/mmu.c:493:\tthis = kzalloc_obj(*this);\narch/arm64/kvm/mmu.c-494-\tif (!this) {\n--\narch/arm64/kvm/mmu.c=981=int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long type)\n--\narch/arm64/kvm/mmu.c-1007-\narch/arm64/kvm/mmu.c:1008:\tpgt = kzalloc_obj(*pgt, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/mmu.c-1009-\tif (!pgt)\n--\narch/arm64/kvm/mmu.c=1180=int topup_hyp_memcache(struct kvm_hyp_memcache *mc, unsigned long min_pages)\n--\narch/arm64/kvm/mmu.c-1185-\tif (!mc-\u003emapping) {\narch/arm64/kvm/mmu.c:1186:\t\tmc-\u003emapping = kzalloc_obj(struct pkvm_mapping,\narch/arm64/kvm/mmu.c-1187-\t\t\t\t\t GFP_KERNEL_ACCOUNT);\n--\narch/arm64/kvm/mmu.c=2510=int __init kvm_mmu_init(u32 hyp_va_bits)\n--\narch/arm64/kvm/mmu.c-2543-\narch/arm64/kvm/mmu.c:2544:\thyp_pgtable = kzalloc_obj(*hyp_pgtable);\narch/arm64/kvm/mmu.c-2545-\tif (!hyp_pgtable) {\n--\narch/arm64/kvm/nested.c=1328=int kvm_vcpu_allocate_vncr_tlb(struct kvm_vcpu *vcpu)\n--\narch/arm64/kvm/nested.c-1333-\tif (!vcpu-\u003earch.vncr_tlb) {\narch/arm64/kvm/nested.c:1334:\t\tstruct vncr_tlb *vt = kzalloc_obj(*vcpu-\u003earch.vncr_tlb,\narch/arm64/kvm/nested.c-1335-\t\t\t\t\t\t GFP_KERNEL_ACCOUNT);\n--\narch/arm64/kvm/nested.c=1793=int kvm_init_nv_sysregs(struct kvm_vcpu *vcpu)\n--\narch/arm64/kvm/nested.c-1802-\narch/arm64/kvm/nested.c:1803:\tkvm-\u003earch.sysreg_masks = kzalloc_obj(*(kvm-\u003earch.sysreg_masks),\narch/arm64/kvm/nested.c-1804-\t\t\t\t\t GFP_KERNEL_ACCOUNT);\n--\narch/arm64/kvm/ptdump.c=116=static struct kvm_ptdump_guest_state *kvm_ptdump_parser_create(struct kvm_s2_mmu *mmu)\n--\narch/arm64/kvm/ptdump.c-121-\narch/arm64/kvm/ptdump.c:122:\tst = kzalloc_obj(struct kvm_ptdump_guest_state, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/ptdump.c-123-\tif (!st)\n--\narch/arm64/kvm/vgic/vgic-init.c=207=static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)\n--\narch/arm64/kvm/vgic/vgic-init.c-213-\tdist-\u003eactive_spis = (atomic_t)ATOMIC_INIT(0);\narch/arm64/kvm/vgic/vgic-init.c:214:\tdist-\u003espis = kzalloc_objs(struct vgic_irq, nr_spis, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-init.c-215-\tif (!dist-\u003espis)\n--\narch/arm64/kvm/vgic/vgic-init.c=316=static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type)\n--\narch/arm64/kvm/vgic/vgic-init.c-331-\narch/arm64/kvm/vgic/vgic-init.c:332:\tvgic_cpu-\u003eprivate_irqs = kzalloc_objs(struct vgic_irq,\narch/arm64/kvm/vgic/vgic-init.c-333-\t\t\t\t\t num_private_irqs,\n--\narch/arm64/kvm/vgic/vgic-irqfd.c=142=int kvm_vgic_setup_default_irq_routing(struct kvm *kvm)\n--\narch/arm64/kvm/vgic/vgic-irqfd.c-148-\narch/arm64/kvm/vgic/vgic-irqfd.c:149:\tentries = kzalloc_objs(*entries, nr, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-irqfd.c-150-\tif (!entries)\n--\narch/arm64/kvm/vgic/vgic-its.c=76=static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,\n--\narch/arm64/kvm/vgic/vgic-its.c-87-\narch/arm64/kvm/vgic/vgic-its.c:88:\tirq = kzalloc_obj(struct vgic_irq, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-its.c-89-\tif (!irq)\n--\narch/arm64/kvm/vgic/vgic-its.c=971=static int vgic_its_alloc_collection(struct vgic_its *its,\n--\narch/arm64/kvm/vgic/vgic-its.c-976-\narch/arm64/kvm/vgic/vgic-its.c:977:\tcollection = kzalloc_obj(*collection, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-its.c-978-\tif (!collection)\n--\narch/arm64/kvm/vgic/vgic-its.c=1015=static struct its_ite *vgic_its_alloc_ite(struct its_device *device,\n--\narch/arm64/kvm/vgic/vgic-its.c-1020-\narch/arm64/kvm/vgic/vgic-its.c:1021:\tite = kzalloc_obj(*ite, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-its.c-1022-\tif (!ite)\n--\narch/arm64/kvm/vgic/vgic-its.c=1142=static struct its_device *vgic_its_alloc_device(struct vgic_its *its,\n--\narch/arm64/kvm/vgic/vgic-its.c-1147-\narch/arm64/kvm/vgic/vgic-its.c:1148:\tdevice = kzalloc_obj(*device, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-its.c-1149-\tif (!device)\n--\narch/arm64/kvm/vgic/vgic-its.c=1855=static int vgic_its_create(struct kvm_device *dev, u32 type)\n--\narch/arm64/kvm/vgic/vgic-its.c-1862-\narch/arm64/kvm/vgic/vgic-its.c:1863:\tits = kzalloc_obj(struct vgic_its, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-its.c-1864-\tif (!its)\n--\narch/arm64/kvm/vgic/vgic-mmio-v3.c=886=static int vgic_v3_alloc_redist_region(struct kvm *kvm, uint32_t index,\n--\narch/arm64/kvm/vgic/vgic-mmio-v3.c-931-\narch/arm64/kvm/vgic/vgic-mmio-v3.c:932:\trdreg = kzalloc_obj(*rdreg, GFP_KERNEL_ACCOUNT);\narch/arm64/kvm/vgic/vgic-mmio-v3.c-933-\tif (!rdreg)\n--\narch/arm64/kvm/vgic/vgic-v4.c=242=int vgic_v4_init(struct kvm *kvm)\n--\narch/arm64/kvm/vgic/vgic-v4.c-258-\narch/arm64/kvm/vgic/vgic-v4.c:259:\tdist-\u003eits_vm.vpes = kzalloc_objs(*dist-\u003eits_vm.vpes, nr_vcpus,\narch/arm64/kvm/vgic/vgic-v4.c-260-\t\t\t\t\t GFP_KERNEL_ACCOUNT);\n--\narch/arm64/net/bpf_jit_comp.c=2080=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\n--\narch/arm64/net/bpf_jit_comp.c-2101-\tif (!jit_data) {\narch/arm64/net/bpf_jit_comp.c:2102:\t\tjit_data = kzalloc_obj(*jit_data);\narch/arm64/net/bpf_jit_comp.c-2103-\t\tif (!jit_data)\n--\narch/csky/kernel/vdso.c=17=static int __init vdso_init(void)\n--\narch/csky/kernel/vdso.c-22-\tvdso_pagelist =\narch/csky/kernel/vdso.c:23:\t\tkzalloc_objs(struct page *, vdso_pages);\narch/csky/kernel/vdso.c-24-\tif (unlikely(vdso_pagelist == NULL)) {\n--\narch/loongarch/kernel/setup.c=466=static int __init add_legacy_isa_io(struct fwnode_handle *fwnode,\n--\narch/loongarch/kernel/setup.c-472-\narch/loongarch/kernel/setup.c:473:\trange = kzalloc_obj(*range, GFP_ATOMIC);\narch/loongarch/kernel/setup.c-474-\tif (!range)\n--\narch/loongarch/kernel/vdso.c=45=static int __init init_vdso(void)\n--\narch/loongarch/kernel/vdso.c-55-\tvdso_info.code_mapping.pages =\narch/loongarch/kernel/vdso.c:56:\t\tkzalloc_objs(struct page *, vdso_info.size / PAGE_SIZE);\narch/loongarch/kernel/vdso.c-57-\n--\narch/loongarch/kvm/intc/eiointc.c=614=static int kvm_eiointc_create(struct kvm_device *dev, u32 type)\n--\narch/loongarch/kvm/intc/eiointc.c-624-\narch/loongarch/kvm/intc/eiointc.c:625:\ts = kzalloc_obj(struct loongarch_eiointc);\narch/loongarch/kvm/intc/eiointc.c-626-\tif (!s)\n--\narch/loongarch/kvm/intc/ipi.c=394=static int kvm_ipi_create(struct kvm_device *dev, u32 type)\n--\narch/loongarch/kvm/intc/ipi.c-411-\narch/loongarch/kvm/intc/ipi.c:412:\ts = kzalloc_obj(struct loongarch_ipi);\narch/loongarch/kvm/intc/ipi.c-413-\tif (!s)\n\n"
} |
| 25/3 | 2026/08/21 03:22 | llm | kmsan-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18754 output: 240 thoughts: 703 Thoughts: **KMSAN Assessment: No New Risks Detected** Okay, so looking at this patch, my initial thought was to dig into that `kzalloc_obj(*rp)` macro. Right, it's basically a `kzalloc` for the object `rp` points to – that's memory allocation and zeroing, which is important. The code then sets up `rp->dev`, `rp->parent`, `rp->drv`, and initializes the delayed work queue item, all good so far. The work function itself then uses and frees `rp`. It doesn’t seem like any uninitialized memory is getting leaked to user space or used in any unexpected control flow paths. It's all internal to the driver core and device lifecycles. Let's do a full scan of all the changes. Looks like the patch also modifies a bunch of other files: `drivers/base/base.h`, `drivers/base/core.c`, `drivers/base/dd.c`, `drivers/bluetooth/btintel_pcie.c`, `drivers/bluetooth/hci_h5.c`, `drivers/net/wireless/intel/iwlwifi/iwl-trans.c`, and `include/linux/device.h`. Okay, these all seem to be related to the new `device_schedule_reprobe` function, which looks like it's aimed at standardizing deferred device reprobing across drivers. Also see the addition of a `shutdown_done` flag. The patch replaces custom reprobe items with this more generic call. There's nothing new being sent to userspace, no complex new data structures are being allocated where you could read uninitialized fields, and no changes that would expose uninitialized memory. It's really just about how the driver core manages devices. So, the changes seem straightforward: we are introducing a new unified method to reschedule devices. It looks to be a clean refactor that's replacing custom workqueue items with `device_schedule_reprobe`. It adds the `shutdown_done` flag to prevent reprobing devices during system shutdown. The memory for the probe item is allocated with `kzalloc_obj`, so it's zero-initialized. The changes are all confined to the driver core, device binding/unbinding, workqueue scheduling and lifecycle. The *only* real risks here are the usual suspects - use-after-free, locking issues (deadlocks), or NULL pointer dereferences. KASAN, LOCKDEP, and the standard kernel debugging tools should be more than sufficient to find those kinds of bugs. KMSAN isn't needed here. No uninitialized memory issues are introduced. I will set `NeedsKMSAN` to `false`. |
| 26/3 | 2026/08/21 03:22 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch introduces a new function `device_schedule_reprobe` to standardise deferred device reprobing across drivers, replacing custom work items in `btintel_pcie`, `hci_h5`, and `iwlwifi`. It also adds a `shutdown_done` flag to prevent reprobing devices during system shutdown. All memory allocations (e.g., `struct device_reprobe` via `kzalloc_obj`) are fully zero-initialized. The changes are strictly confined to internal kernel device lifecycle management, driver binding/unbinding, and workqueue scheduling. There are no modifications to structures copied to user space, no new network packet parsing, and no complex data structures where uninitialized fields could be read or leaked. Any potential bugs introduced by these changes would be related to object lifetimes (use-after-free), locking (deadlocks), or null pointer dereferences, all of which are effectively caught by KASAN, LOCKDEP, and standard kernel debugging tools. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch introduces a new function `device_schedule_reprobe` to standardise deferred device reprobing across drivers, replacing custom work items in `btintel_pcie`, `hci_h5`, and `iwlwifi`. It also adds a `shutdown_done` flag to prevent reprobing devices during system shutdown. All memory allocations (e.g., `struct device_reprobe` via `kzalloc_obj`) are fully zero-initialized. The changes are strictly confined to internal kernel device lifecycle management, driver binding/unbinding, and workqueue scheduling. There are no modifications to structures copied to user space, no new network packet parsing, and no complex data structures where uninitialized fields could be read or leaked. Any potential bugs introduced by these changes would be related to object lifetimes (use-after-free), locking (deadlocks), or null pointer dereferences, all of which are effectively caught by KASAN, LOCKDEP, and standard kernel debugging tools. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|