AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies error handling in the probe functions of Broadcom SoC-specific Ethernet platform drivers (ASP 2.0, SYSTEMPORT, and GENET). These platform devices are tied to specific Broadcom hardware/SoCs and are not present or emulated in standard virtualized environments (like QEMU 'pc', 'q35', or 'virt' machines) used for fuzzing. Therefore, the modified probe paths are unreachable.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 10ebef01dd0706f4260c04a2c0e810cf6cf5ff3f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Aug 20 12:25:03 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.c b/drivers/net/ethernet/broadcom/asp2/bcmasp.c\nindex 972474893a6bc..02e88adf49391 100644\n--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c\n+++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c\n@@ -1094,7 +1094,7 @@ static int bcmasp_get_and_request_irq(struct bcmasp_priv *priv, int i)\n \tstruct platform_device *pdev = priv-\u003epdev;\n \tint irq, ret;\n \n-\tirq = platform_get_irq_optional(pdev, i);\n+\tirq = platform_get_irq(pdev, i);\n \tif (irq \u003c 0)\n \t\treturn irq;\n \n@@ -1106,21 +1106,20 @@ static int bcmasp_get_and_request_irq(struct bcmasp_priv *priv, int i)\n \treturn irq;\n }\n \n-static void bcmasp_init_wol(struct bcmasp_priv *priv)\n+static int bcmasp_init_wol(struct bcmasp_priv *priv)\n {\n \tstruct platform_device *pdev = priv-\u003epdev;\n-\tstruct device *dev = \u0026pdev-\u003edev;\n \tint irq;\n \n \tirq = bcmasp_get_and_request_irq(priv, 1);\n-\tif (irq \u003c 0) {\n-\t\tdev_warn(dev, \"Failed to init WoL irq: %d\\n\", irq);\n-\t\treturn;\n-\t}\n+\tif (irq \u003c 0)\n+\t\treturn irq;\n \n \tpriv-\u003ewol_irq = irq;\n \tpriv-\u003ewol_irq_enabled_mask = 0;\n \tdevice_set_wakeup_capable(\u0026pdev-\u003edev, 1);\n+\n+\treturn 0;\n }\n \n void bcmasp_enable_wol(struct bcmasp_intf *intf, bool en)\n@@ -1321,7 +1320,9 @@ static int bcmasp_probe(struct platform_device *pdev)\n \n \tbcmasp_core_init_filters(priv);\n \n-\tbcmasp_init_wol(priv);\n+\tret = bcmasp_init_wol(priv);\n+\tif (ret)\n+\t\tgoto err_clock_disable;\n \n \tports_node = of_find_node_by_name(dev-\u003eof_node, \"ethernet-ports\");\n \tif (!ports_node) {\ndiff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c\nindex 4d06c6ba66418..2acaffccdb084 100644\n--- a/drivers/net/ethernet/broadcom/bcmsysport.c\n+++ b/drivers/net/ethernet/broadcom/bcmsysport.c\n@@ -2499,14 +2499,22 @@ static int bcm_sysport_probe(struct platform_device *pdev)\n \tpriv-\u003enum_rx_desc_words = params-\u003enum_rx_desc_words;\n \n \tpriv-\u003eirq0 = platform_get_irq(pdev, 0);\n+\tif (priv-\u003eirq0 \u003c 0) {\n+\t\tret = priv-\u003eirq0;\n+\t\tgoto err_free_netdev;\n+\t}\n \tif (!priv-\u003eis_lite) {\n \t\tpriv-\u003eirq1 = platform_get_irq(pdev, 1);\n \t\tpriv-\u003ewol_irq = platform_get_irq_optional(pdev, 2);\n \t} else {\n \t\tpriv-\u003ewol_irq = platform_get_irq_optional(pdev, 1);\n \t}\n-\tif (priv-\u003eirq0 \u003c= 0 || (priv-\u003eirq1 \u003c= 0 \u0026\u0026 !priv-\u003eis_lite)) {\n-\t\tret = -EINVAL;\n+\tif (priv-\u003eirq1 \u003c 0 \u0026\u0026 !priv-\u003eis_lite) {\n+\t\tret = priv-\u003eirq1;\n+\t\tgoto err_free_netdev;\n+\t}\n+\tif (priv-\u003ewol_irq \u003c 0 \u0026\u0026 priv-\u003ewol_irq != -ENXIO) {\n+\t\tret = priv-\u003ewol_irq;\n \t\tgoto err_free_netdev;\n \t}\n \ndiff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c\nindex a2305e6428d1f..c1c66a52efd0c 100644\n--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c\n+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c\n@@ -3993,7 +3993,7 @@ static int bcmgenet_probe(struct platform_device *pdev)\n \t\tgoto err;\n \t}\n \tpriv-\u003ewol_irq = platform_get_irq_optional(pdev, 2);\n-\tif (priv-\u003ewol_irq == -EPROBE_DEFER) {\n+\tif (priv-\u003ewol_irq \u003c 0 \u0026\u0026 priv-\u003ewol_irq != -ENXIO) {\n \t\terr = priv-\u003ewol_irq;\n \t\tgoto err;\n \t}\n@@ -4033,8 +4033,10 @@ static int bcmgenet_probe(struct platform_device *pdev)\n \tif (priv-\u003ewol_irq \u003e 0) {\n \t\terr = devm_request_irq(\u0026pdev-\u003edev, priv-\u003ewol_irq,\n \t\t\t\t       bcmgenet_wol_isr, 0, dev-\u003ename, priv);\n-\t\tif (!err)\n-\t\t\tdevice_set_wakeup_capable(\u0026pdev-\u003edev, 1);\n+\t\tif (err)\n+\t\t\tgoto err;\n+\n+\t\tdevice_set_wakeup_capable(\u0026pdev-\u003edev, 1);\n \t}\n \n \t/* Set the needed headroom to account for any possible\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies error handling in the probe functions of Broadcom SoC-specific Ethernet platform drivers (ASP 2.0, SYSTEMPORT, and GENET). These platform devices are tied to specific Broadcom hardware/SoCs and are not present or emulated in standard virtualized environments (like QEMU 'pc', 'q35', or 'virt' machines) used for fuzzing. Therefore, the modified probe paths are unreachable.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 10ebef01dd0706f4260c04a2c0e810cf6cf5ff3f
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Aug 20 12:25:03 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.c b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
index 972474893a6bc..02e88adf49391 100644
--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c
+++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
@@ -1094,7 +1094,7 @@ static int bcmasp_get_and_request_irq(struct bcmasp_priv *priv, int i)
 	struct platform_device *pdev = priv->pdev;
 	int irq, ret;
 
-	irq = platform_get_irq_optional(pdev, i);
+	irq = platform_get_irq(pdev, i);
 	if (irq < 0)
 		return irq;
 
@@ -1106,21 +1106,20 @@ static int bcmasp_get_and_request_irq(struct bcmasp_priv *priv, int i)
 	return irq;
 }
 
-static void bcmasp_init_wol(struct bcmasp_priv *priv)
+static int bcmasp_init_wol(struct bcmasp_priv *priv)
 {
 	struct platform_device *pdev = priv->pdev;
-	struct device *dev = &pdev->dev;
 	int irq;
 
 	irq = bcmasp_get_and_request_irq(priv, 1);
-	if (irq < 0) {
-		dev_warn(dev, "Failed to init WoL irq: %d\n", irq);
-		return;
-	}
+	if (irq < 0)
+		return irq;
 
 	priv->wol_irq = irq;
 	priv->wol_irq_enabled_mask = 0;
 	device_set_wakeup_capable(&pdev->dev, 1);
+
+	return 0;
 }
 
 void bcmasp_enable_wol(struct bcmasp_intf *intf, bool en)
@@ -1321,7 +1320,9 @@ static int bcmasp_probe(struct platform_device *pdev)
 
 	bcmasp_core_init_filters(priv);
 
-	bcmasp_init_wol(priv);
+	ret = bcmasp_init_wol(priv);
+	if (ret)
+		goto err_clock_disable;
 
 	ports_node = of_find_node_by_name(dev->of_node, "ethernet-ports");
 	if (!ports_node) {
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 4d06c6ba66418..2acaffccdb084 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2499,14 +2499,22 @@ static int bcm_sysport_probe(struct platform_device *pdev)
 	priv->num_rx_desc_words = params->num_rx_desc_words;
 
 	priv->irq0 = platform_get_irq(pdev, 0);
+	if (priv->irq0 < 0) {
+		ret = priv->irq0;
+		goto err_free_netdev;
+	}
 	if (!priv->is_lite) {
 		priv->irq1 = platform_get_irq(pdev, 1);
 		priv->wol_irq = platform_get_irq_optional(pdev, 2);
 	} else {
 		priv->wol_irq = platform_get_irq_optional(pdev, 1);
 	}
-	if (priv->irq0 <= 0 || (priv->irq1 <= 0 && !priv->is_lite)) {
-		ret = -EINVAL;
+	if (priv->irq1 < 0 && !priv->is_lite) {
+		ret = priv->irq1;
+		goto err_free_netdev;
+	}
+	if (priv->wol_irq < 0 && priv->wol_irq != -ENXIO) {
+		ret = priv->wol_irq;
 		goto err_free_netdev;
 	}
 
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index a2305e6428d1f..c1c66a52efd0c 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3993,7 +3993,7 @@ static int bcmgenet_probe(struct platform_device *pdev)
 		goto err;
 	}
 	priv->wol_irq = platform_get_irq_optional(pdev, 2);
-	if (priv->wol_irq == -EPROBE_DEFER) {
+	if (priv->wol_irq < 0 && priv->wol_irq != -ENXIO) {
 		err = priv->wol_irq;
 		goto err;
 	}
@@ -4033,8 +4033,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
 	if (priv->wol_irq > 0) {
 		err = devm_request_irq(&pdev->dev, priv->wol_irq,
 				       bcmgenet_wol_isr, 0, dev->name, priv);
-		if (!err)
-			device_set_wakeup_capable(&pdev->dev, 1);
+		if (err)
+			goto err;
+
+		device_set_wakeup_capable(&pdev->dev, 1);
 	}
 
 	/* Set the needed headroom to account for any possible

gemini-3.1-pro-preview

null

null

							input: 3404
							output: 121
							thoughts: 1398
						

**WorthFuzzing Assessment: Broadcom Ethernet Driver Patch**

Okay, so I've got this patch that touches three Broadcom Ethernet drivers: `bcmasp.c`, `bcmsysport.c`, and `bcmgenet.c`. The changes are all about how IRQs are fetched and handled during device probe – essentially, better error handling in those `probe` functions. My first thought is, are these drivers even reachable in a standard fuzzing setup? They are platform drivers for Broadcom hardware, and that immediately raises a red flag. These are platform devices, meaning they are specific to a particular System on a Chip (SoC), like you'd find in a Raspberry Pi or a Broadcom set-top box.

My initial line of inquiry is whether QEMU can emulate the relevant hardware, the Raspberry Pi 4 is a possibility but not the default for syzkaller. Does QEMU even emulate GENET? Yes, but syzkaller usually boots arm64 as `virt` not the raspi4b emulation. Syzkaller generally leans toward `q35` or `pc` (x86) or `virt` (arm64). I consider whether syzkaller might have some pseudo-syscalls to inject or instantiate platform drivers. But no, that doesn't seem to be the case in a standard setup.

The changes are all confined to `probe` functions. Those functions only get executed when the device is actually present and matched. If the hardware isn't present in the virtualized environment, those probe functions are never going to run. Can I trick the system into creating a platform device from userspace? Maybe, with sysfs or device tree overlays, but that's not the syzkaller way unless specifically supported.

I tried to quickly look for syzkaller descriptions to check if these drivers are used in a defined fashion. No luck, the tools are limited in searching those descriptions.

Essentially, I'm trying to figure out if these code paths, as modified by the patch, are even *possible* to trigger within a virtualized environment like GCE or QEMU, even with emulated hardware. Given that these are Broadcom SoC Ethernet drivers (platform devices), they require the specific SoC hardware or device tree nodes to be present and standard setups don't have that. My conclusion is that they're not reachable in standard virtualized setups.

Based on that, and given the prompt, I'm returning `WorthFuzzing=false`. The patch modifies code paths that are effectively unreachable in the standard testing environments. I double-checked to confirm they are platform drivers, not PCI. It's a no-go.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies error handling in the probe functions of Broadcom SoC-specific Ethernet platform drivers (ASP 2.0, SYSTEMPORT, and GENET). These platform devices are tied to specific Broadcom hardware/SoCs and are not present or emulated in standard virtualized environments (like QEMU 'pc', 'q35', or 'virt' machines) used for fuzzing. Therefore, the modified probe paths are unreachable.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies error handling in the probe functions of Broadcom SoC-specific Ethernet platform drivers (ASP 2.0, SYSTEMPORT, and GENET). These platform devices are tied to specific Broadcom hardware/SoCs and are not present or emulated in standard virtualized environments (like QEMU 'pc', 'q35', or 'virt' machines) used for fuzzing. Therefore, the modified probe paths are unreachable.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null