AI Trajectory

null

{
  "EnableConfigs": [
    "OF",
    "OF_RESERVED_MEM",
    "OF_EARLY_FLATTREE"
  ],
  "FocusSymbols": [
    "fdt_scan_reserved_mem",
    "fdt_scan_reserved_mem_late",
    "memblock_overlaps_nomap"
  ],
  "KMSANReasoning": "The patch modifies early boot device tree reserved memory logic, adding tracking for failed reservations and checking for overlaps with nomap regions. It does not introduce any new data structures copied to user space, nor does it involve complex allocations where uninitialized memory could be exposed. Standard KASAN is sufficient to catch any potential memory corruption or out-of-bounds bugs in this code.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies device tree reserved memory initialization and adds a check for overlapping `nomap` memory regions. This is core kernel boot logic reachable in virtualized environments like QEMU (especially on architectures using Device Tree like ARM64 and RISC-V).",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit d0b5beeb1a13ba3d81f167d5e460f84dcffed8a7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Aug 18 10:27:46 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c\nindex 8c9d6395d6a39..0090fa86dd10c 100644\n--- a/drivers/of/of_reserved_mem.c\n+++ b/drivers/of/of_reserved_mem.c\n@@ -32,6 +32,30 @@ static struct reserved_mem *reserved_mem __refdata = reserved_mem_array;\n static int total_reserved_mem_cnt = MAX_RESERVED_REGIONS;\n static int reserved_mem_count;\n \n+static int reserve_failed_nodes[MAX_RESERVED_REGIONS] __initdata;\n+static int reserve_failed_nodes_cnt __initdata;\n+\n+static bool __init reserved_mem_node_reserve_failed(int node)\n+{\n+\tint i;\n+\n+\tfor (i = 0; i \u003c reserve_failed_nodes_cnt; i++)\n+\t\tif (reserve_failed_nodes[i] == node)\n+\t\t\treturn true;\n+\treturn false;\n+}\n+\n+static bool __init record_reserve_failed_node(int node, const char *uname)\n+{\n+\tif (reserve_failed_nodes_cnt == MAX_RESERVED_REGIONS) {\n+\t\tpr_err(\"too many failed regions, '%s' reservation failed\\n\", uname);\n+\t\treturn false;\n+\t}\n+\n+\treserve_failed_nodes[reserve_failed_nodes_cnt++] = node;\n+\treturn true;\n+}\n+\n static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,\n \tphys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap,\n \tphys_addr_t *res_base)\n@@ -112,7 +136,8 @@ static int __init alloc_reserved_mem_array(void)\n }\n \n static void fdt_init_reserved_mem_node(unsigned long node, const char *uname,\n-\t\t\t\t       phys_addr_t base, phys_addr_t size);\n+\t\t\t\t       phys_addr_t base, phys_addr_t size,\n+\t\t\t\t       bool dynamic);\n static int fdt_validate_reserved_mem_node(unsigned long node,\n \t\t\t\t\t  phys_addr_t *align);\n static int fdt_fixup_reserved_mem_node(unsigned long node,\n@@ -128,11 +153,17 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,\n \t\t * if the region isn't memory as it won't be mapped.\n \t\t */\n \t\tif (memblock_overlaps_region(\u0026memblock.memory, base, size) \u0026\u0026\n-\t\t    memblock_is_region_reserved(base, size))\n+\t\t    (memblock_is_region_reserved(base, size) ||\n+\t\t     memblock_overlaps_nomap(base, size)))\n \t\t\treturn -EBUSY;\n \n \t\treturn memblock_mark_nomap(base, size);\n \t}\n+\n+\tif (memblock_is_region_reserved(base, size) ||\n+\t    memblock_overlaps_nomap(base, size))\n+\t\treturn -EBUSY;\n+\n \treturn memblock_reserve(base, size);\n }\n \n@@ -141,7 +172,8 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,\n  * first entry in 'reg' property\n  */\n static int __init __reserved_mem_reserve_reg(unsigned long node,\n-\t\t\t\t\t     const char *uname)\n+\t\t\t\t\t     const char *uname,\n+\t\t\t\t\t     bool *should_record_failed_node)\n {\n \tphys_addr_t base, size;\n \tint len, err;\n@@ -149,6 +181,8 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,\n \tbool nomap;\n \tu64 b, s;\n \n+\t*should_record_failed_node = false;\n+\n \tprop = of_flat_dt_get_addr_size_prop(node, \"reg\", \u0026len);\n \tif (!prop || !len)\n \t\treturn -ENOENT;\n@@ -167,14 +201,20 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,\n \tbase = b;\n \tsize = s;\n \n-\tif (size \u0026\u0026 early_init_dt_reserve_memory(base, size, nomap) == 0) {\n-\t\tfdt_fixup_reserved_mem_node(node, base, size);\n-\t\tpr_debug(\"Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\\n\",\n-\t\t\t uname, \u0026base, (unsigned long)(size / SZ_1M));\n-\t} else {\n+\tif (!size)\n+\t\treturn -EINVAL;\n+\n+\terr = early_init_dt_reserve_memory(base, size, nomap);\n+\tif (err) {\n+\t\t*should_record_failed_node = true;\n \t\tpr_err(\"Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\\n\",\n \t\t       uname, \u0026base, (unsigned long)(size / SZ_1M));\n+\t\treturn err;\n \t}\n+\n+\tfdt_fixup_reserved_mem_node(node, base, size);\n+\tpr_debug(\"Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\\n\",\n+\t\t uname, \u0026base, (unsigned long)(size / SZ_1M));\n \treturn 0;\n }\n \n@@ -306,10 +346,14 @@ void __init fdt_scan_reserved_mem_late(void)\n \t\tbase = b;\n \t\tsize = s;\n \n-\t\tif (size) {\n-\t\t\tuname = fdt_get_name(fdt, child, NULL);\n-\t\t\tfdt_init_reserved_mem_node(child, uname, base, size);\n-\t\t}\n+\t\tif (!size)\n+\t\t\tcontinue;\n+\n+\t\tif (reserved_mem_node_reserve_failed(child))\n+\t\t\tcontinue;\n+\n+\t\tuname = fdt_get_name(fdt, child, NULL);\n+\t\tfdt_init_reserved_mem_node(child, uname, base, size, false);\n \t}\n \n \t/* check for overlapping reserved regions */\n@@ -349,6 +393,7 @@ int __init fdt_scan_reserved_mem(void)\n \n \tfdt_for_each_subnode(child, fdt, node) {\n \t\tconst char *uname;\n+\t\tbool should_record_failed_node;\n \t\tint err;\n \n \t\tif (!of_fdt_device_is_available(fdt, child))\n@@ -356,9 +401,14 @@ int __init fdt_scan_reserved_mem(void)\n \n \t\tuname = fdt_get_name(fdt, child, NULL);\n \n-\t\terr = __reserved_mem_reserve_reg(child, uname);\n+\t\terr = __reserved_mem_reserve_reg(child, uname,\n+\t\t\t\t\t\t \u0026should_record_failed_node);\n \t\tif (!err)\n \t\t\tcount++;\n+\t\telse if (should_record_failed_node \u0026\u0026\n+\t\t\t !record_reserve_failed_node(child, uname))\n+\t\t\t/* Keep a slot for the untracked node's late initialization. */\n+\t\t\tcount++;\n \n \t\t/*\n \t\t * Save the nodes for the dynamically-placed regions\n@@ -518,7 +568,7 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unam\n \t}\n \n \tfdt_fixup_reserved_mem_node(node, base, size);\n-\tfdt_init_reserved_mem_node(node, uname, base, size);\n+\tfdt_init_reserved_mem_node(node, uname, base, size, true);\n \n \treturn 0;\n }\n@@ -627,13 +677,15 @@ static int __init __reserved_mem_init_node(struct reserved_mem *rmem,\n  * @uname: name of the reserved memory node\n  * @base: base address of the reserved memory region\n  * @size: size of the reserved memory region\n+ * @dynamic: whether the region was dynamically allocated\n  *\n  * This function calls the region-specific initialization function for a\n  * reserved memory region and saves all region-specific data to the\n  * reserved_mem array to allow of_reserved_mem_lookup() to find it.\n  */\n static void __init fdt_init_reserved_mem_node(unsigned long node, const char *uname,\n-\t\t\t\t\t      phys_addr_t base, phys_addr_t size)\n+\t\t\t\t\t      phys_addr_t base, phys_addr_t size,\n+\t\t\t\t\t      bool dynamic)\n {\n \tint err = 0;\n \tbool nomap;\n@@ -657,9 +709,10 @@ static void __init fdt_init_reserved_mem_node(unsigned long node, const char *un\n \t\tpr_info(\"node %s compatible matching fail\\n\", rmem-\u003ename);\n \t\trmem-\u003ename = NULL;\n \n-\t\tif (nomap)\n+\t\tif (dynamic \u0026\u0026 nomap)\n \t\t\tmemblock_clear_nomap(rmem-\u003ebase, rmem-\u003esize);\n-\t\telse\n+\n+\t\tif (dynamic || !nomap)\n \t\t\tmemblock_phys_free(rmem-\u003ebase, rmem-\u003esize);\n \t\treturn;\n \t} else {\ndiff --git a/include/linux/memblock.h b/include/linux/memblock.h\nindex d62db9e776cf9..27d68fbb31575 100644\n--- a/include/linux/memblock.h\n+++ b/include/linux/memblock.h\n@@ -148,6 +148,7 @@ int memblock_physmem_add(phys_addr_t base, phys_addr_t size);\n void memblock_trim_memory(phys_addr_t align);\n unsigned long memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1,\n \t\t\t\t     phys_addr_t base2, phys_addr_t size2);\n+bool memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size);\n bool memblock_overlaps_region(struct memblock_type *type,\n \t\t\t      phys_addr_t base, phys_addr_t size);\n bool memblock_validate_numa_coverage(unsigned long threshold_bytes);\ndiff --git a/mm/memblock.c b/mm/memblock.c\nindex 9ce86349a29fa..4cabfe365ac46 100644\n--- a/mm/memblock.c\n+++ b/mm/memblock.c\n@@ -202,6 +202,20 @@ memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1, phys_addr_t base2,\n \treturn ((base1 \u003c (base2 + size2)) \u0026\u0026 (base2 \u003c (base1 + size1)));\n }\n \n+bool __init memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size)\n+{\n+\tstruct memblock_region *region;\n+\n+\tmemblock_cap_size(base, \u0026size);\n+\tfor_each_mem_region(region) {\n+\t\tif (memblock_is_nomap(region) \u0026\u0026\n+\t\t    memblock_addrs_overlap(base, size, region-\u003ebase, region-\u003esize))\n+\t\t\treturn true;\n+\t}\n+\n+\treturn false;\n+}\n+\n bool __init_memblock memblock_overlaps_region(struct memblock_type *type,\n \t\t\t\t\tphys_addr_t base, phys_addr_t size)\n {\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "OF",
    "OF_RESERVED_MEM",
    "OF_EARLY_FLATTREE"
  ],
  "FocusSymbols": [
    "fdt_scan_reserved_mem",
    "fdt_scan_reserved_mem_late",
    "memblock_overlaps_nomap"
  ],
  "Reasoning": "The patch modifies device tree reserved memory initialization and adds a check for overlapping `nomap` memory regions. This is core kernel boot logic reachable in virtualized environments like QEMU (especially on architectures using Device Tree like ARM64 and RISC-V).",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit d0b5beeb1a13ba3d81f167d5e460f84dcffed8a7
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 18 10:27:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 8c9d6395d6a39..0090fa86dd10c 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -32,6 +32,30 @@ static struct reserved_mem *reserved_mem __refdata = reserved_mem_array;
 static int total_reserved_mem_cnt = MAX_RESERVED_REGIONS;
 static int reserved_mem_count;
 
+static int reserve_failed_nodes[MAX_RESERVED_REGIONS] __initdata;
+static int reserve_failed_nodes_cnt __initdata;
+
+static bool __init reserved_mem_node_reserve_failed(int node)
+{
+	int i;
+
+	for (i = 0; i < reserve_failed_nodes_cnt; i++)
+		if (reserve_failed_nodes[i] == node)
+			return true;
+	return false;
+}
+
+static bool __init record_reserve_failed_node(int node, const char *uname)
+{
+	if (reserve_failed_nodes_cnt == MAX_RESERVED_REGIONS) {
+		pr_err("too many failed regions, '%s' reservation failed\n", uname);
+		return false;
+	}
+
+	reserve_failed_nodes[reserve_failed_nodes_cnt++] = node;
+	return true;
+}
+
 static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
 	phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap,
 	phys_addr_t *res_base)
@@ -112,7 +136,8 @@ static int __init alloc_reserved_mem_array(void)
 }
 
 static void fdt_init_reserved_mem_node(unsigned long node, const char *uname,
-				       phys_addr_t base, phys_addr_t size);
+				       phys_addr_t base, phys_addr_t size,
+				       bool dynamic);
 static int fdt_validate_reserved_mem_node(unsigned long node,
 					  phys_addr_t *align);
 static int fdt_fixup_reserved_mem_node(unsigned long node,
@@ -128,11 +153,17 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,
 		 * if the region isn't memory as it won't be mapped.
 		 */
 		if (memblock_overlaps_region(&memblock.memory, base, size) &&
-		    memblock_is_region_reserved(base, size))
+		    (memblock_is_region_reserved(base, size) ||
+		     memblock_overlaps_nomap(base, size)))
 			return -EBUSY;
 
 		return memblock_mark_nomap(base, size);
 	}
+
+	if (memblock_is_region_reserved(base, size) ||
+	    memblock_overlaps_nomap(base, size))
+		return -EBUSY;
+
 	return memblock_reserve(base, size);
 }
 
@@ -141,7 +172,8 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,
  * first entry in 'reg' property
  */
 static int __init __reserved_mem_reserve_reg(unsigned long node,
-					     const char *uname)
+					     const char *uname,
+					     bool *should_record_failed_node)
 {
 	phys_addr_t base, size;
 	int len, err;
@@ -149,6 +181,8 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,
 	bool nomap;
 	u64 b, s;
 
+	*should_record_failed_node = false;
+
 	prop = of_flat_dt_get_addr_size_prop(node, "reg", &len);
 	if (!prop || !len)
 		return -ENOENT;
@@ -167,14 +201,20 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,
 	base = b;
 	size = s;
 
-	if (size && early_init_dt_reserve_memory(base, size, nomap) == 0) {
-		fdt_fixup_reserved_mem_node(node, base, size);
-		pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n",
-			 uname, &base, (unsigned long)(size / SZ_1M));
-	} else {
+	if (!size)
+		return -EINVAL;
+
+	err = early_init_dt_reserve_memory(base, size, nomap);
+	if (err) {
+		*should_record_failed_node = true;
 		pr_err("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n",
 		       uname, &base, (unsigned long)(size / SZ_1M));
+		return err;
 	}
+
+	fdt_fixup_reserved_mem_node(node, base, size);
+	pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n",
+		 uname, &base, (unsigned long)(size / SZ_1M));
 	return 0;
 }
 
@@ -306,10 +346,14 @@ void __init fdt_scan_reserved_mem_late(void)
 		base = b;
 		size = s;
 
-		if (size) {
-			uname = fdt_get_name(fdt, child, NULL);
-			fdt_init_reserved_mem_node(child, uname, base, size);
-		}
+		if (!size)
+			continue;
+
+		if (reserved_mem_node_reserve_failed(child))
+			continue;
+
+		uname = fdt_get_name(fdt, child, NULL);
+		fdt_init_reserved_mem_node(child, uname, base, size, false);
 	}
 
 	/* check for overlapping reserved regions */
@@ -349,6 +393,7 @@ int __init fdt_scan_reserved_mem(void)
 
 	fdt_for_each_subnode(child, fdt, node) {
 		const char *uname;
+		bool should_record_failed_node;
 		int err;
 
 		if (!of_fdt_device_is_available(fdt, child))
@@ -356,9 +401,14 @@ int __init fdt_scan_reserved_mem(void)
 
 		uname = fdt_get_name(fdt, child, NULL);
 
-		err = __reserved_mem_reserve_reg(child, uname);
+		err = __reserved_mem_reserve_reg(child, uname,
+						 &should_record_failed_node);
 		if (!err)
 			count++;
+		else if (should_record_failed_node &&
+			 !record_reserve_failed_node(child, uname))
+			/* Keep a slot for the untracked node's late initialization. */
+			count++;
 
 		/*
 		 * Save the nodes for the dynamically-placed regions
@@ -518,7 +568,7 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unam
 	}
 
 	fdt_fixup_reserved_mem_node(node, base, size);
-	fdt_init_reserved_mem_node(node, uname, base, size);
+	fdt_init_reserved_mem_node(node, uname, base, size, true);
 
 	return 0;
 }
@@ -627,13 +677,15 @@ static int __init __reserved_mem_init_node(struct reserved_mem *rmem,
  * @uname: name of the reserved memory node
  * @base: base address of the reserved memory region
  * @size: size of the reserved memory region
+ * @dynamic: whether the region was dynamically allocated
  *
  * This function calls the region-specific initialization function for a
  * reserved memory region and saves all region-specific data to the
  * reserved_mem array to allow of_reserved_mem_lookup() to find it.
  */
 static void __init fdt_init_reserved_mem_node(unsigned long node, const char *uname,
-					      phys_addr_t base, phys_addr_t size)
+					      phys_addr_t base, phys_addr_t size,
+					      bool dynamic)
 {
 	int err = 0;
 	bool nomap;
@@ -657,9 +709,10 @@ static void __init fdt_init_reserved_mem_node(unsigned long node, const char *un
 		pr_info("node %s compatible matching fail\n", rmem->name);
 		rmem->name = NULL;
 
-		if (nomap)
+		if (dynamic && nomap)
 			memblock_clear_nomap(rmem->base, rmem->size);
-		else
+
+		if (dynamic || !nomap)
 			memblock_phys_free(rmem->base, rmem->size);
 		return;
 	} else {
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index d62db9e776cf9..27d68fbb31575 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -148,6 +148,7 @@ int memblock_physmem_add(phys_addr_t base, phys_addr_t size);
 void memblock_trim_memory(phys_addr_t align);
 unsigned long memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1,
 				     phys_addr_t base2, phys_addr_t size2);
+bool memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size);
 bool memblock_overlaps_region(struct memblock_type *type,
 			      phys_addr_t base, phys_addr_t size);
 bool memblock_validate_numa_coverage(unsigned long threshold_bytes);
diff --git a/mm/memblock.c b/mm/memblock.c
index 9ce86349a29fa..4cabfe365ac46 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -202,6 +202,20 @@ memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1, phys_addr_t base2,
 	return ((base1 < (base2 + size2)) && (base2 < (base1 + size1)));
 }
 
+bool __init memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size)
+{
+	struct memblock_region *region;
+
+	memblock_cap_size(base, &size);
+	for_each_mem_region(region) {
+		if (memblock_is_nomap(region) &&
+		    memblock_addrs_overlap(base, size, region->base, region->size))
+			return true;
+	}
+
+	return false;
+}
+
 bool __init_memblock memblock_overlaps_region(struct memblock_type *type,
 					phys_addr_t base, phys_addr_t size)
 {

gemini-3.1-pro-preview

null

null

							input: 4785
							output: 22
							thoughts: 403
						

**Analyzing a Patch: Reserved Memory and Fuzzing Potential**

Okay, so I'm looking at this patch that touches `drivers/of/of_reserved_mem.c` and `mm/memblock.c`. It looks like it's adding some tracking for failed reserved memory nodes in the OF code and introduces a new `memblock_overlaps_nomap` function in the memory block code. This immediately makes me think about device tree (OF) reserved memory initialization. The question is, is this code even relevant in a virtualized environment? And the answer is yes, absolutely. OF is pretty common in ARM/ARM64 QEMU setups, and I've seen it used on x86 and other architectures too.

The next thought is, is this something we can fuzz? The patch touches `early_init_dt_reserve_memory`, `__reserved_mem_reserve_reg`, `fdt_scan_reserved_mem_late`, `fdt_scan_reserved_mem`, `fdt_init_reserved_mem_node`, and adds `memblock_overlaps_nomap`. Okay, these are all `__init` functions. That's a bit of a hurdle. Syzkaller is usually focused on syscalls, network packets, USB, and things that happen after the system is up and running. But wait... can syzkaller fuzz device trees somehow? I remember it *can* fuzz device trees, but I thought that was through `syz_mount_image` or something similar? Actually, device trees are typically provided at boot, aren't they? So the question is: can we get to these early initialization functions with syzkaller?

The key here is whether we can load device tree *overlays* at runtime, maybe through configfs or something similar. If we can, then perhaps we can trigger `fdt_scan_reserved_mem` or `fdt_init_reserved_mem_node` that way. Time to check for that. Let's start with a search for `fdt_scan_reserved_mem` and see where that leads.

{
  "Expression": "fdt_scan_reserved_mem"
}

{
  "Output": "arch/arc/mm/init.c=101=void __init setup_arch_memory(void)\n--\narch/arc/mm/init.c-135-\tearly_init_fdt_reserve_self();\narch/arc/mm/init.c:136:\tearly_init_fdt_scan_reserved_mem();\narch/arc/mm/init.c-137-\n--\narch/arm/mm/init.c=180=void __init arm_memblock_init(const struct machine_desc *mdesc)\n--\narch/arm/mm/init.c-192-\narch/arm/mm/init.c:193:\tearly_init_fdt_scan_reserved_mem();\narch/arm/mm/init.c-194-\n--\narch/arm64/mm/init.c=196=void __init arm64_memblock_init(void)\n--\narch/arm64/mm/init.c-299-\narch/arm64/mm/init.c:300:\tearly_init_fdt_scan_reserved_mem();\narch/arm64/mm/init.c-301-}\n--\narch/csky/kernel/setup.c=62=static void __init csky_memblock_init(void)\n--\narch/csky/kernel/setup.c-70-\tearly_init_fdt_reserve_self();\narch/csky/kernel/setup.c:71:\tearly_init_fdt_scan_reserved_mem();\narch/csky/kernel/setup.c-72-\n--\narch/loongarch/kernel/setup.c=355=void __init platform_init(void)\n--\narch/loongarch/kernel/setup.c-366-\narch/loongarch/kernel/setup.c:367:\tearly_init_fdt_scan_reserved_mem();\narch/loongarch/kernel/setup.c-368-\tunflatten_and_copy_device_tree();\n--\narch/microblaze/mm/init.c=165=asmlinkage void __init mmu_init(void)\n--\narch/microblaze/mm/init.c-232-\narch/microblaze/mm/init.c:233:\tearly_init_fdt_scan_reserved_mem();\narch/microblaze/mm/init.c-234-\n--\narch/mips/kernel/setup.c=633=static void __init arch_mem_init(char **cmdline_p)\n--\narch/mips/kernel/setup.c-650-\tearly_init_fdt_reserve_self();\narch/mips/kernel/setup.c:651:\tearly_init_fdt_scan_reserved_mem();\narch/mips/kernel/setup.c-652-\n--\narch/nios2/kernel/setup.c=159=void __init setup_arch(char **cmdline_p)\n--\narch/nios2/kernel/setup.c-185-\tearly_init_fdt_reserve_self();\narch/nios2/kernel/setup.c:186:\tearly_init_fdt_scan_reserved_mem();\narch/nios2/kernel/setup.c-187-\n--\narch/openrisc/kernel/setup.c=46=static void __init setup_memory(void)\n--\narch/openrisc/kernel/setup.c-88-\tearly_init_fdt_reserve_self();\narch/openrisc/kernel/setup.c:89:\tearly_init_fdt_scan_reserved_mem();\narch/openrisc/kernel/setup.c-90-\n--\narch/powerpc/kernel/prom.c=644=static void __init early_reserve_mem_dt(void)\n--\narch/powerpc/kernel/prom.c-650-\tearly_init_fdt_reserve_self();\narch/powerpc/kernel/prom.c:651:\tearly_init_fdt_scan_reserved_mem();\narch/powerpc/kernel/prom.c-652-\n--\narch/riscv/mm/init.c=217=static void __init setup_bootmem(void)\n--\narch/riscv/mm/init.c-297-\t */\narch/riscv/mm/init.c:298:\tearly_init_fdt_scan_reserved_mem();\narch/riscv/mm/init.c-299-\n--\narch/sh/boards/of-generic.c=112=static void __init sh_of_mem_reserve(void)\n--\narch/sh/boards/of-generic.c-114-\tearly_init_fdt_reserve_self();\narch/sh/boards/of-generic.c:115:\tearly_init_fdt_scan_reserved_mem();\narch/sh/boards/of-generic.c-116-}\n--\narch/um/kernel/dtb.c=13=void uml_dtb_init(void)\n--\narch/um/kernel/dtb.c-25-\narch/um/kernel/dtb.c:26:\t\tearly_init_fdt_scan_reserved_mem();\narch/um/kernel/dtb.c-27-\t}\n--\narch/xtensa/mm/init.c=40=void __init bootmem_init(void)\n--\narch/xtensa/mm/init.c-49-\narch/xtensa/mm/init.c:50:\tearly_init_fdt_scan_reserved_mem();\narch/xtensa/mm/init.c-51-\n--\ndrivers/of/fdt.c=472=static void __init fdt_reserve_elfcorehdr(void)\n--\ndrivers/of/fdt.c-488-/**\ndrivers/of/fdt.c:489: * early_init_fdt_scan_reserved_mem() - create reserved memory regions\ndrivers/of/fdt.c-490- *\n--\ndrivers/of/fdt.c-494- */\ndrivers/of/fdt.c:495:void __init early_init_fdt_scan_reserved_mem(void)\ndrivers/of/fdt.c-496-{\n--\ndrivers/of/fdt.c-504-\tfdt_reserve_elfcorehdr();\ndrivers/of/fdt.c:505:\tfdt_scan_reserved_mem();\ndrivers/of/fdt.c-506-\n--\ndrivers/of/fdt.c=1282=void __init unflatten_device_tree(void)\n--\ndrivers/of/fdt.c-1286-\t/* Save the statically-placed regions in the reserved_mem array */\ndrivers/of/fdt.c:1287:\tfdt_scan_reserved_mem_late();\ndrivers/of/fdt.c-1288-\n--\ndrivers/of/of_private.h=182=static inline struct device_node *__of_get_dma_parent(const struct device_node *np)\n--\ndrivers/of/of_private.h-187-\ndrivers/of/of_private.h:188:int fdt_scan_reserved_mem(void);\ndrivers/of/of_private.h:189:void __init fdt_scan_reserved_mem_late(void);\ndrivers/of/of_private.h-190-\n--\ndrivers/of/of_reserved_mem.c=267=static void __init __rmem_check_for_overlap(void)\n--\ndrivers/of/of_reserved_mem.c-294-/**\ndrivers/of/of_reserved_mem.c:295: * fdt_scan_reserved_mem_late() - Scan FDT and initialize remaining reserved\ndrivers/of/of_reserved_mem.c-296- * memory regions.\n--\ndrivers/of/of_reserved_mem.c-302- */\ndrivers/of/of_reserved_mem.c:303:void __init fdt_scan_reserved_mem_late(void)\ndrivers/of/of_reserved_mem.c-304-{\n--\ndrivers/of/of_reserved_mem.c=363=static int __init __reserved_mem_alloc_size(unsigned long node, const char *uname);\n--\ndrivers/of/of_reserved_mem.c-365-/*\ndrivers/of/of_reserved_mem.c:366: * fdt_scan_reserved_mem() - reserve and allocate memory occupied by\ndrivers/of/of_reserved_mem.c-367- * reserved memory regions.\n--\ndrivers/of/of_reserved_mem.c-374- */\ndrivers/of/of_reserved_mem.c:375:int __init fdt_scan_reserved_mem(void)\ndrivers/of/of_reserved_mem.c-376-{\n--\ninclude/linux/of_fdt.h=74=extern int early_init_dt_scan_chosen_stdout(void);\ninclude/linux/of_fdt.h:75:extern void early_init_fdt_scan_reserved_mem(void);\ninclude/linux/of_fdt.h-76-extern void early_init_fdt_reserve_self(void);\n--\ninclude/linux/of_fdt.h=98=static inline int early_init_dt_scan_chosen_stdout(void) { return -ENODEV; }\ninclude/linux/of_fdt.h:99:static inline void early_init_fdt_scan_reserved_mem(void) {}\ninclude/linux/of_fdt.h-100-static inline void early_init_fdt_reserve_self(void) {}\n"
}

gemini-3.1-pro-preview

null

null

							input: 8124
							output: 19
							thoughts: 291
						

**My Line of Reasoning on Syzkaller and Device Tree Fuzzing**

Okay, so I'm looking at these `fdt_scan_reserved_mem` functions, and they're called really early on, during the boot process. They're `__init` functions, which immediately makes me wonder if syzkaller can even touch them. Syzkaller, from what I know, works its magic by generating syscalls, which obviously happen *after* the kernel is up and running. So, the direct approach is probably out.

But hang on… I seem to recall something about syzkaller and device trees. Doesn't it have some capability in that realm? Does it feed a custom DT to the kernel at boot, or via some sneaky mechanism I'm forgetting? I do recall `syz_mount_image`, but that's for filesystems, right? Definitely not for DTs.

Alright, let's step back. Does syzkaller actually *fuzz* device trees? I briefly remember some support, perhaps through something like `syz_init_net_word`? No, that doesn't feel right.

Aha! Now it's clicking. Syzkaller *does* fuzz device trees, but it's done during boot. The way it works, I believe, is it can pass a fuzzed DTB to the kernel when a VM is launched. The syzkaller architecture is set up to handle VMs booting with these fuzzed DTBs. My memory is correct, because tools like `syz-fuzzer` can pass a DTB to QEMU.

So, does syzkaller do this with DTs? I remember syzkaller had DT fuzzing support, that's what I am thinking. I should check to see if there are any syzkaller pseudo-syscalls dedicated for DT interaction.

no matches

{
  "Expression": "syz_.*dt"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 8846
							output: 22
							thoughts: 604
						

**Fuzzing Feasibility Analysis**

Okay, so this patch seems interesting. My initial thought is, "Wait, syzkaller does fuzz device trees, doesn't it?" I'm pretty sure it generates them and feeds them to QEMU. That's the key. Let's see... the patch is touching `of_reserved_mem.c` and `memblock.c`. The changes involve `memblock_overlaps_nomap` and modifications to `early_init_dt_reserve_memory`.

Now, the question is whether this code is even *reachable* in a typical QEMU-based setup, because that's what the prompt cares about. Thankfully, QEMU relies on device trees for ARM, ARM64, and RISC-V, so the answer is yes, this code *is* reachable.

The prompt outlines specific scenarios that disqualify fuzzing. Let's see... documentation changes, decorative stuff like logging, and unreachable code paths are no-gos. Vendor-specific drivers requiring physical hardware? Nope. Teardown callbacks that only run during hot-unplug? Also no. But this patch looks like it's impacting core kernel logic, specifically `drivers/of/of_reserved_mem.c` and `mm/memblock.c`. That's a good sign.

The prompt states if it modifies reachable core kernel logic or drivers, I need to verify it can be executed using code search tools, and then return "WorthFuzzing=true." Excellent.

Alright, back to syzkaller and DTBs. It seems my initial hunch was correct. It does fuzz them, by generating them and passing them to the kernel.

So, this looks promising. It's core kernel logic, reachable via QEMU, and syzkaller *can* fuzz device trees. I'll need to check for any specific `CONFIG_` options that might be required. Let's see... `drivers/of/of_reserved_mem.c` requires `CONFIG_OF_RESERVED_MEM`, which will be checked via the Kconfig files. This looks like a definite "WorthFuzzing=true".

{
  "Expression": "config OF_RESERVED_MEM"
}

{
  "Output": "drivers/of/Kconfig=95=config OF_IRQ\n--\ndrivers/of/Kconfig-98-\ndrivers/of/Kconfig:99:config OF_RESERVED_MEM\ndrivers/of/Kconfig-100-\tdef_bool OF_EARLY_FLATTREE\n"
}

gemini-3.1-pro-preview

null

null

							input: 10016
							output: 23
							thoughts: 38
						

**Examining the Memory Reservation Strategy**

Okay, so I see that `OF_RESERVED_MEM` is directly tied to `OF_EARLY_FLATTREE`. That's a key dependency to understand. We need to dissect the implications of this connection, especially if we are dealing with memory reservation strategies. Let's delve into what `OF_EARLY_FLATTREE` actually entails to understand how it impacts our memory management. Understanding the interaction here is crucial. I need to fully grasp the relationship between these two configurations.

{
  "Expression": "config OF_EARLY_FLATTREE"
}

{
  "Output": "drivers/of/Kconfig=64=config OF_FLATTREE\n--\ndrivers/of/Kconfig-69-\ndrivers/of/Kconfig:70:config OF_EARLY_FLATTREE\ndrivers/of/Kconfig-71-\tdef_bool OF \u0026\u0026 !(SPARC || ALPHA || HEXAGON || M68K || PARISC || S390)\n"
}

gemini-3.1-pro-preview

null

null

							input: 10292
							output: 23
							thoughts: 415
						

**Fuzzing Focus: Reserved Memory in Early Boot**

Okay, so this change primarily deals with reserved memory and Device Tree (DT) initialization, which, if I understand correctly, is enabled by default on most architectures using the "OF" flag. My focus is going to be on identifying the most relevant kernel functions for fuzzing, keeping in mind the need to avoid generic hot-path functions, and instead focusing on non-static, non-inlined API entrypoints. That's the key. I need to make sure the fuzzing isn't skewed.

The patch touches a few key areas in the early boot sequence. I know that because it references things that happen early, and the functions are all marked `__init`. Specifically, it modifies these functions: `early_init_dt_reserve_memory`, `__reserved_mem_reserve_reg`, `fdt_scan_reserved_mem_late`, `fdt_scan_reserved_mem`, `fdt_init_reserved_mem_node`, and adds `memblock_overlaps_nomap`.

Now, considering the instructions, I need to list the *non-static* functions that have been modified or added. I want the things that have explicit symbol addresses. Looking at the code, it's pretty clear:

*   `fdt_scan_reserved_mem_late`
*   `fdt_scan_reserved_mem`
*   `memblock_overlaps_nomap`

Now let me double check the function signatures. `fdt_scan_reserved_mem` is defined as `int __init fdt_scan_reserved_mem(void)`, so it's a candidate. `fdt_scan_reserved_mem_late` is `void __init fdt_scan_reserved_mem_late(void)`, and `memblock_overlaps_nomap` is `bool __init memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size)`.

I also see that `memblock_overlaps_nomap` is global, which is important because it means it can be reached. I wonder if the others are as well...

{
  "Expression": "early_init_dt_reserve_memory"
}

{
  "Output": "drivers/of/of_reserved_mem.c=143=static int fdt_fixup_reserved_mem_node(unsigned long node,\n--\ndrivers/of/of_reserved_mem.c-145-\ndrivers/of/of_reserved_mem.c:146:static int __init early_init_dt_reserve_memory(phys_addr_t base,\ndrivers/of/of_reserved_mem.c-147-\t\t\t\t\t       phys_addr_t size, bool nomap)\n--\ndrivers/of/of_reserved_mem.c=174=static int __init __reserved_mem_reserve_reg(unsigned long node,\n--\ndrivers/of/of_reserved_mem.c-206-\ndrivers/of/of_reserved_mem.c:207:\terr = early_init_dt_reserve_memory(base, size, nomap);\ndrivers/of/of_reserved_mem.c-208-\tif (err) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 11441
							output: 22
							thoughts: 263
						

**My Assessment of the Reserved Memory Code and Syzkaller's Reach**

Okay, so I'm looking at these functions: `early_init_dt_reserve_memory`, `__reserved_mem_reserve_reg`, and `fdt_init_reserved_mem_node` – they're all declared as static. That's immediately interesting, because that suggests they're likely internal to the module and probably not directly accessible for fuzzing via standard interfaces. The "non-static" functions, namely `fdt_scan_reserved_mem`, `fdt_scan_reserved_mem_late`, and `memblock_overlaps_nomap`, are where things get more interesting.

My immediate question is, "Can syzkaller even touch these?" These functions are executed during early boot, and syzkaller's coverage collection, as I understand it, starts *after* the kernel is up and running, usually in the init process or later. That means any `__init` functions are likely to be freed before syzkaller even has a chance to monitor them. It's that whole `__init` section being freed and the fact that coverage collection isn't active during that early boot phase that really makes it a dead end for syzkaller.

Now, wait a minute, I seem to remember something about KCOV. Doesn't that get enabled early? Okay, yes, KCOV *is* initialized during boot. But syzkaller only collects coverage for the threads it controls, right? And this early boot code runs in the init task, long before syzkaller even starts up. So KCOV, as far as syzkaller is concerned, is a no-go for this code as well.

Therefore, the obvious conclusion is, and it's frustrating, syzkaller probably can't fuzz this early boot code. I can't think of any obvious way that syzkaller could gain access to those functions in their normal state. However, maybe there's a back door. I have to verify that these functions are *only* called during early boot.

So, let's investigate: Is `fdt_scan_reserved_mem` called anywhere else in the code? Let's check.

{
  "Expression": "fdt_scan_reserved_mem"
}

{
  "Output": "arch/arc/mm/init.c=101=void __init setup_arch_memory(void)\n--\narch/arc/mm/init.c-135-\tearly_init_fdt_reserve_self();\narch/arc/mm/init.c:136:\tearly_init_fdt_scan_reserved_mem();\narch/arc/mm/init.c-137-\n--\narch/arm/mm/init.c=180=void __init arm_memblock_init(const struct machine_desc *mdesc)\n--\narch/arm/mm/init.c-192-\narch/arm/mm/init.c:193:\tearly_init_fdt_scan_reserved_mem();\narch/arm/mm/init.c-194-\n--\narch/arm64/mm/init.c=196=void __init arm64_memblock_init(void)\n--\narch/arm64/mm/init.c-299-\narch/arm64/mm/init.c:300:\tearly_init_fdt_scan_reserved_mem();\narch/arm64/mm/init.c-301-}\n--\narch/csky/kernel/setup.c=62=static void __init csky_memblock_init(void)\n--\narch/csky/kernel/setup.c-70-\tearly_init_fdt_reserve_self();\narch/csky/kernel/setup.c:71:\tearly_init_fdt_scan_reserved_mem();\narch/csky/kernel/setup.c-72-\n--\narch/loongarch/kernel/setup.c=355=void __init platform_init(void)\n--\narch/loongarch/kernel/setup.c-366-\narch/loongarch/kernel/setup.c:367:\tearly_init_fdt_scan_reserved_mem();\narch/loongarch/kernel/setup.c-368-\tunflatten_and_copy_device_tree();\n--\narch/microblaze/mm/init.c=165=asmlinkage void __init mmu_init(void)\n--\narch/microblaze/mm/init.c-232-\narch/microblaze/mm/init.c:233:\tearly_init_fdt_scan_reserved_mem();\narch/microblaze/mm/init.c-234-\n--\narch/mips/kernel/setup.c=633=static void __init arch_mem_init(char **cmdline_p)\n--\narch/mips/kernel/setup.c-650-\tearly_init_fdt_reserve_self();\narch/mips/kernel/setup.c:651:\tearly_init_fdt_scan_reserved_mem();\narch/mips/kernel/setup.c-652-\n--\narch/nios2/kernel/setup.c=159=void __init setup_arch(char **cmdline_p)\n--\narch/nios2/kernel/setup.c-185-\tearly_init_fdt_reserve_self();\narch/nios2/kernel/setup.c:186:\tearly_init_fdt_scan_reserved_mem();\narch/nios2/kernel/setup.c-187-\n--\narch/openrisc/kernel/setup.c=46=static void __init setup_memory(void)\n--\narch/openrisc/kernel/setup.c-88-\tearly_init_fdt_reserve_self();\narch/openrisc/kernel/setup.c:89:\tearly_init_fdt_scan_reserved_mem();\narch/openrisc/kernel/setup.c-90-\n--\narch/powerpc/kernel/prom.c=644=static void __init early_reserve_mem_dt(void)\n--\narch/powerpc/kernel/prom.c-650-\tearly_init_fdt_reserve_self();\narch/powerpc/kernel/prom.c:651:\tearly_init_fdt_scan_reserved_mem();\narch/powerpc/kernel/prom.c-652-\n--\narch/riscv/mm/init.c=217=static void __init setup_bootmem(void)\n--\narch/riscv/mm/init.c-297-\t */\narch/riscv/mm/init.c:298:\tearly_init_fdt_scan_reserved_mem();\narch/riscv/mm/init.c-299-\n--\narch/sh/boards/of-generic.c=112=static void __init sh_of_mem_reserve(void)\n--\narch/sh/boards/of-generic.c-114-\tearly_init_fdt_reserve_self();\narch/sh/boards/of-generic.c:115:\tearly_init_fdt_scan_reserved_mem();\narch/sh/boards/of-generic.c-116-}\n--\narch/um/kernel/dtb.c=13=void uml_dtb_init(void)\n--\narch/um/kernel/dtb.c-25-\narch/um/kernel/dtb.c:26:\t\tearly_init_fdt_scan_reserved_mem();\narch/um/kernel/dtb.c-27-\t}\n--\narch/xtensa/mm/init.c=40=void __init bootmem_init(void)\n--\narch/xtensa/mm/init.c-49-\narch/xtensa/mm/init.c:50:\tearly_init_fdt_scan_reserved_mem();\narch/xtensa/mm/init.c-51-\n--\ndrivers/of/fdt.c=472=static void __init fdt_reserve_elfcorehdr(void)\n--\ndrivers/of/fdt.c-488-/**\ndrivers/of/fdt.c:489: * early_init_fdt_scan_reserved_mem() - create reserved memory regions\ndrivers/of/fdt.c-490- *\n--\ndrivers/of/fdt.c-494- */\ndrivers/of/fdt.c:495:void __init early_init_fdt_scan_reserved_mem(void)\ndrivers/of/fdt.c-496-{\n--\ndrivers/of/fdt.c-504-\tfdt_reserve_elfcorehdr();\ndrivers/of/fdt.c:505:\tfdt_scan_reserved_mem();\ndrivers/of/fdt.c-506-\n--\ndrivers/of/fdt.c=1282=void __init unflatten_device_tree(void)\n--\ndrivers/of/fdt.c-1286-\t/* Save the statically-placed regions in the reserved_mem array */\ndrivers/of/fdt.c:1287:\tfdt_scan_reserved_mem_late();\ndrivers/of/fdt.c-1288-\n--\ndrivers/of/of_private.h=182=static inline struct device_node *__of_get_dma_parent(const struct device_node *np)\n--\ndrivers/of/of_private.h-187-\ndrivers/of/of_private.h:188:int fdt_scan_reserved_mem(void);\ndrivers/of/of_private.h:189:void __init fdt_scan_reserved_mem_late(void);\ndrivers/of/of_private.h-190-\n--\ndrivers/of/of_reserved_mem.c=267=static void __init __rmem_check_for_overlap(void)\n--\ndrivers/of/of_reserved_mem.c-294-/**\ndrivers/of/of_reserved_mem.c:295: * fdt_scan_reserved_mem_late() - Scan FDT and initialize remaining reserved\ndrivers/of/of_reserved_mem.c-296- * memory regions.\n--\ndrivers/of/of_reserved_mem.c-302- */\ndrivers/of/of_reserved_mem.c:303:void __init fdt_scan_reserved_mem_late(void)\ndrivers/of/of_reserved_mem.c-304-{\n--\ndrivers/of/of_reserved_mem.c=363=static int __init __reserved_mem_alloc_size(unsigned long node, const char *uname);\n--\ndrivers/of/of_reserved_mem.c-365-/*\ndrivers/of/of_reserved_mem.c:366: * fdt_scan_reserved_mem() - reserve and allocate memory occupied by\ndrivers/of/of_reserved_mem.c-367- * reserved memory regions.\n--\ndrivers/of/of_reserved_mem.c-374- */\ndrivers/of/of_reserved_mem.c:375:int __init fdt_scan_reserved_mem(void)\ndrivers/of/of_reserved_mem.c-376-{\n--\ninclude/linux/of_fdt.h=74=extern int early_init_dt_scan_chosen_stdout(void);\ninclude/linux/of_fdt.h:75:extern void early_init_fdt_scan_reserved_mem(void);\ninclude/linux/of_fdt.h-76-extern void early_init_fdt_reserve_self(void);\n--\ninclude/linux/of_fdt.h=98=static inline int early_init_dt_scan_chosen_stdout(void) { return -ENODEV; }\ninclude/linux/of_fdt.h:99:static inline void early_init_fdt_scan_reserved_mem(void) {}\ninclude/linux/of_fdt.h-100-static inline void early_init_fdt_reserve_self(void) {}\n"
}

gemini-3.1-pro-preview

null

null

							input: 14667
							output: 21
							thoughts: 483
						

**Early Boot Code and Syzkaller Fuzzing**

Okay, so this code is only called from `early_init_fdt_scan_reserved_mem`, which itself is only called during the architecture setup, very early in the boot process. My immediate thought is, can syzkaller even touch this? It seems unlikely because syzkaller usually gets coverage feedback from user-space processes via KCOV, and that's not active at this stage.

But wait, I remember something about syzkaller doing "boot fuzzing" or "DT fuzzing" where it passes a fuzzed Device Tree Blob (DTB) to QEMU and checks for kernel crashes during the boot. Does syzkaller actually *do* this? I can't remember if it has a `sys/linux/devicetree` entry... I don't think so, but it definitely can be configured for boot process fuzzing.

Now, the prompt specifically says that if this code modifies core kernel logic, drivers, or architectures, I need to verify that the code can be executed and then determine if it is WorthFuzzing=true. Well, this is definitely reachable core kernel logic, so I need to check some things.

First, I should check for any required `CONFIG_` options. I see that `OF_RESERVED_MEM` is enabled by default if `OF_EARLY_FLATTREE` is enabled. And, further, `OF_EARLY_FLATTREE` is enabled by default if `OF` is enabled and the architecture isn't something obscure like SPARC or ALPHA. So it looks like `OF` is the main configuration option to look for. Let's list `OF` and `OF_RESERVED_MEM` in the `EnableConfigs`. Although, hold on, `OF_RESERVED_MEM` is just `def_bool OF_EARLY_FLATTREE`, so I don't technically need to explicitly enable it, but it shouldn't hurt to have it there.

Now, I'll check if `memblock_overlaps_nomap` is exported. Nope, it's just a global variable. Okay, so I should focus on the following symbols: `fdt_scan_reserved_mem`, `fdt_scan_reserved_mem_late`, and `memblock_overlaps_nomap`.

I should probably quickly review the driver file `drivers/of/of_reserved_mem.c` one more time, just to make sure I don't miss anything.

{
  "Expression": "memblock_overlaps_nomap"
}

{
  "Output": "drivers/of/of_reserved_mem.c=146=static int __init early_init_dt_reserve_memory(phys_addr_t base,\n--\ndrivers/of/of_reserved_mem.c-156-\t\t    (memblock_is_region_reserved(base, size) ||\ndrivers/of/of_reserved_mem.c:157:\t\t     memblock_overlaps_nomap(base, size)))\ndrivers/of/of_reserved_mem.c-158-\t\t\treturn -EBUSY;\n--\ndrivers/of/of_reserved_mem.c-163-\tif (memblock_is_region_reserved(base, size) ||\ndrivers/of/of_reserved_mem.c:164:\t    memblock_overlaps_nomap(base, size))\ndrivers/of/of_reserved_mem.c-165-\t\treturn -EBUSY;\n--\ninclude/linux/memblock.h=149=unsigned long memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1,\ninclude/linux/memblock.h-150-\t\t\t\t     phys_addr_t base2, phys_addr_t size2);\ninclude/linux/memblock.h:151:bool memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size);\ninclude/linux/memblock.h-152-bool memblock_overlaps_region(struct memblock_type *type,\n--\nmm/memblock.c=199=memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1, phys_addr_t base2,\n--\nmm/memblock.c-204-\nmm/memblock.c:205:bool __init memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size)\nmm/memblock.c-206-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 16197
							output: 21
							thoughts: 198
						

**Fuzzing `memblock_overlaps_nomap` - A Promising Target**

Okay, let's see... I've spotted `memblock_overlaps_nomap` in `mm/memblock.c`. Hmm, I'm thinking, could this be fuzzable? It does look like a potential target. The key here is that it's an `__init` function, which is often a good indicator of initial system setup. Because it's within the core kernel logic – specifically, related to device tree parsing and memory block reservation, it’s definitely reachable within a QEMU environment. This makes it a solid candidate.

Given all this, I'm going to set `WorthFuzzing` to `true`. This warrants further investigation. I'm going to prioritize these symbols: `fdt_scan_reserved_mem`, `fdt_scan_reserved_mem_late`, and, of course, the target function itself: `memblock_overlaps_nomap`.

Now, I need to make sure I'm enabling the right configuration options. I'm going to start with `OF` and `OF_RESERVED_MEM`. Let me just double-check that `OF_RESERVED_MEM` is correct for this. Yes, looking at the code, `drivers/of/of_reserved_mem.c` is compiled based on that config setting. Good.

{
  "Expression": "of_reserved_mem.o"
}

{
  "Output": "drivers/of/Makefile=10=obj-$(CONFIG_OF_UNITTEST) += unittest.o\ndrivers/of/Makefile:11:obj-$(CONFIG_OF_RESERVED_MEM) += of_reserved_mem.o\ndrivers/of/Makefile-12-obj-$(CONFIG_OF_RESOLVE)  += resolver.o\n"
}

gemini-3.1-pro-preview

null

null

							input: 16810
							output: 141
							thoughts: 377
						

**My Assessment of the Patch's Worthiness for Fuzzing**

Okay, so the patch touches on `CONFIG_OF_RESERVED_MEM`. I should also consider `CONFIG_OF_EARLY_FLATTREE`, as it seems related. I'll include both `OF`, `OF_RESERVED_MEM`, and `OF_EARLY_FLATTREE` in my evaluation.

Wait, the instructions explicitly state that I should return `WorthFuzzing=false` if the changes are unreachable in virtualized environments like GCE or QEMU, even with software-emulated hardware. But this is definitely reachable in QEMU, particularly on ARM, ARM64, and RISC-V systems that leverage the Device Tree.

Now, let's see which functions are being modified or added and if they are static.
I can see that `fdt_init_reserved_mem_node`, `__reserved_mem_reserve_reg`, `early_init_dt_reserve_memory`, `record_reserve_failed_node` and `reserved_mem_node_reserve_failed` are static functions.
This suggests they are not the primary focus of the changes.

The non-static functions that are modified or added are:
*   `fdt_scan_reserved_mem`
*   `fdt_scan_reserved_mem_late`
*   `memblock_overlaps_nomap`

These three seem to be the core additions and changes within the patch. They're my *FocusSymbols*.

Ultimately, the patch is about changes to the Device Tree's reserved memory initialization and introduces a check for overlapping `nomap` memory regions. This is *fundamental* kernel boot logic, and importantly, is definitely reachable in environments like QEMU, especially on ARM64 and RISC-V, which heavily utilize the Device Tree.

Time to call `set-results`.

{
  "EnableConfigs": [
    "OF",
    "OF_RESERVED_MEM",
    "OF_EARLY_FLATTREE"
  ],
  "FocusSymbols": [
    "fdt_scan_reserved_mem",
    "fdt_scan_reserved_mem_late",
    "memblock_overlaps_nomap"
  ],
  "Reasoning": "The patch modifies device tree reserved memory initialization and adds a check for overlapping `nomap` memory regions. This is core kernel boot logic reachable in virtualized environments like QEMU (especially on architectures using Device Tree like ARM64 and RISC-V).",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "OF",
    "OF_RESERVED_MEM",
    "OF_EARLY_FLATTREE"
  ],
  "FocusSymbols": [
    "fdt_scan_reserved_mem",
    "fdt_scan_reserved_mem_late",
    "memblock_overlaps_nomap"
  ],
  "Reasoning": "The patch modifies device tree reserved memory initialization and adds a check for overlapping `nomap` memory regions. This is core kernel boot logic reachable in virtualized environments like QEMU (especially on architectures using Device Tree like ARM64 and RISC-V).",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

best-expensive

null

{
  "KMSANReasoning": "The patch modifies early boot device tree reserved memory logic, adding tracking for failed reservations and checking for overlaps with nomap regions. It does not introduce any new data structures copied to user space, nor does it involve complex allocations where uninitialized memory could be exposed. Standard KASAN is sufficient to catch any potential memory corruption or out-of-bounds bugs in this code.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit d0b5beeb1a13ba3d81f167d5e460f84dcffed8a7
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 18 10:27:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 8c9d6395d6a39..0090fa86dd10c 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -32,6 +32,30 @@ static struct reserved_mem *reserved_mem __refdata = reserved_mem_array;
 static int total_reserved_mem_cnt = MAX_RESERVED_REGIONS;
 static int reserved_mem_count;
 
+static int reserve_failed_nodes[MAX_RESERVED_REGIONS] __initdata;
+static int reserve_failed_nodes_cnt __initdata;
+
+static bool __init reserved_mem_node_reserve_failed(int node)
+{
+	int i;
+
+	for (i = 0; i < reserve_failed_nodes_cnt; i++)
+		if (reserve_failed_nodes[i] == node)
+			return true;
+	return false;
+}
+
+static bool __init record_reserve_failed_node(int node, const char *uname)
+{
+	if (reserve_failed_nodes_cnt == MAX_RESERVED_REGIONS) {
+		pr_err("too many failed regions, '%s' reservation failed\n", uname);
+		return false;
+	}
+
+	reserve_failed_nodes[reserve_failed_nodes_cnt++] = node;
+	return true;
+}
+
 static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
 	phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap,
 	phys_addr_t *res_base)
@@ -112,7 +136,8 @@ static int __init alloc_reserved_mem_array(void)
 }
 
 static void fdt_init_reserved_mem_node(unsigned long node, const char *uname,
-				       phys_addr_t base, phys_addr_t size);
+				       phys_addr_t base, phys_addr_t size,
+				       bool dynamic);
 static int fdt_validate_reserved_mem_node(unsigned long node,
 					  phys_addr_t *align);
 static int fdt_fixup_reserved_mem_node(unsigned long node,
@@ -128,11 +153,17 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,
 		 * if the region isn't memory as it won't be mapped.
 		 */
 		if (memblock_overlaps_region(&memblock.memory, base, size) &&
-		    memblock_is_region_reserved(base, size))
+		    (memblock_is_region_reserved(base, size) ||
+		     memblock_overlaps_nomap(base, size)))
 			return -EBUSY;
 
 		return memblock_mark_nomap(base, size);
 	}
+
+	if (memblock_is_region_reserved(base, size) ||
+	    memblock_overlaps_nomap(base, size))
+		return -EBUSY;
+
 	return memblock_reserve(base, size);
 }
 
@@ -141,7 +172,8 @@ static int __init early_init_dt_reserve_memory(phys_addr_t base,
  * first entry in 'reg' property
  */
 static int __init __reserved_mem_reserve_reg(unsigned long node,
-					     const char *uname)
+					     const char *uname,
+					     bool *should_record_failed_node)
 {
 	phys_addr_t base, size;
 	int len, err;
@@ -149,6 +181,8 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,
 	bool nomap;
 	u64 b, s;
 
+	*should_record_failed_node = false;
+
 	prop = of_flat_dt_get_addr_size_prop(node, "reg", &len);
 	if (!prop || !len)
 		return -ENOENT;
@@ -167,14 +201,20 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,
 	base = b;
 	size = s;
 
-	if (size && early_init_dt_reserve_memory(base, size, nomap) == 0) {
-		fdt_fixup_reserved_mem_node(node, base, size);
-		pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n",
-			 uname, &base, (unsigned long)(size / SZ_1M));
-	} else {
+	if (!size)
+		return -EINVAL;
+
+	err = early_init_dt_reserve_memory(base, size, nomap);
+	if (err) {
+		*should_record_failed_node = true;
 		pr_err("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n",
 		       uname, &base, (unsigned long)(size / SZ_1M));
+		return err;
 	}
+
+	fdt_fixup_reserved_mem_node(node, base, size);
+	pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n",
+		 uname, &base, (unsigned long)(size / SZ_1M));
 	return 0;
 }
 
@@ -306,10 +346,14 @@ void __init fdt_scan_reserved_mem_late(void)
 		base = b;
 		size = s;
 
-		if (size) {
-			uname = fdt_get_name(fdt, child, NULL);
-			fdt_init_reserved_mem_node(child, uname, base, size);
-		}
+		if (!size)
+			continue;
+
+		if (reserved_mem_node_reserve_failed(child))
+			continue;
+
+		uname = fdt_get_name(fdt, child, NULL);
+		fdt_init_reserved_mem_node(child, uname, base, size, false);
 	}
 
 	/* check for overlapping reserved regions */
@@ -349,6 +393,7 @@ int __init fdt_scan_reserved_mem(void)
 
 	fdt_for_each_subnode(child, fdt, node) {
 		const char *uname;
+		bool should_record_failed_node;
 		int err;
 
 		if (!of_fdt_device_is_available(fdt, child))
@@ -356,9 +401,14 @@ int __init fdt_scan_reserved_mem(void)
 
 		uname = fdt_get_name(fdt, child, NULL);
 
-		err = __reserved_mem_reserve_reg(child, uname);
+		err = __reserved_mem_reserve_reg(child, uname,
+						 &should_record_failed_node);
 		if (!err)
 			count++;
+		else if (should_record_failed_node &&
+			 !record_reserve_failed_node(child, uname))
+			/* Keep a slot for the untracked node's late initialization. */
+			count++;
 
 		/*
 		 * Save the nodes for the dynamically-placed regions
@@ -518,7 +568,7 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unam
 	}
 
 	fdt_fixup_reserved_mem_node(node, base, size);
-	fdt_init_reserved_mem_node(node, uname, base, size);
+	fdt_init_reserved_mem_node(node, uname, base, size, true);
 
 	return 0;
 }
@@ -627,13 +677,15 @@ static int __init __reserved_mem_init_node(struct reserved_mem *rmem,
  * @uname: name of the reserved memory node
  * @base: base address of the reserved memory region
  * @size: size of the reserved memory region
+ * @dynamic: whether the region was dynamically allocated
  *
  * This function calls the region-specific initialization function for a
  * reserved memory region and saves all region-specific data to the
  * reserved_mem array to allow of_reserved_mem_lookup() to find it.
  */
 static void __init fdt_init_reserved_mem_node(unsigned long node, const char *uname,
-					      phys_addr_t base, phys_addr_t size)
+					      phys_addr_t base, phys_addr_t size,
+					      bool dynamic)
 {
 	int err = 0;
 	bool nomap;
@@ -657,9 +709,10 @@ static void __init fdt_init_reserved_mem_node(unsigned long node, const char *un
 		pr_info("node %s compatible matching fail\n", rmem->name);
 		rmem->name = NULL;
 
-		if (nomap)
+		if (dynamic && nomap)
 			memblock_clear_nomap(rmem->base, rmem->size);
-		else
+
+		if (dynamic || !nomap)
 			memblock_phys_free(rmem->base, rmem->size);
 		return;
 	} else {
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index d62db9e776cf9..27d68fbb31575 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -148,6 +148,7 @@ int memblock_physmem_add(phys_addr_t base, phys_addr_t size);
 void memblock_trim_memory(phys_addr_t align);
 unsigned long memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1,
 				     phys_addr_t base2, phys_addr_t size2);
+bool memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size);
 bool memblock_overlaps_region(struct memblock_type *type,
 			      phys_addr_t base, phys_addr_t size);
 bool memblock_validate_numa_coverage(unsigned long threshold_bytes);
diff --git a/mm/memblock.c b/mm/memblock.c
index 9ce86349a29fa..4cabfe365ac46 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -202,6 +202,20 @@ memblock_addrs_overlap(phys_addr_t base1, phys_addr_t size1, phys_addr_t base2,
 	return ((base1 < (base2 + size2)) && (base2 < (base1 + size1)));
 }
 
+bool __init memblock_overlaps_nomap(phys_addr_t base, phys_addr_t size)
+{
+	struct memblock_region *region;
+
+	memblock_cap_size(base, &size);
+	for_each_mem_region(region) {
+		if (memblock_is_nomap(region) &&
+		    memblock_addrs_overlap(base, size, region->base, region->size))
+			return true;
+	}
+
+	return false;
+}
+
 bool __init_memblock memblock_overlaps_region(struct memblock_type *type,
 					phys_addr_t base, phys_addr_t size)
 {

gemini-3.1-pro-preview

null

null

							input: 4782
							output: 101
							thoughts: 554
						

**My Assessment of the Memory Safety Implications**

Okay, let's break down this patch. I see modifications in `drivers/of/of_reserved_mem.c` and `mm/memblock.c`, which immediately flags my attention – anything touching memory management or Device Tree is worth a closer look. The core change seems to be around handling failed reserved memory nodes, tracking them with `reserve_failed_nodes`, and preventing their later initialization in `fdt_scan_reserved_mem_late`. There's also a check for `memblock_overlaps_nomap` and some adjustments to how memory is freed in `fdt_init_reserved_mem_node`.

My immediate concern is always uninitialized memory reads. So, I need to verify if this patch introduces any new risks. Let's see... the `reserve_failed_nodes` array is statically allocated and `__initdata`, which means it's guaranteed to be zero-initialized. The `reserve_failed_nodes_cnt` variable is also `__initdata` and zeroed. `record_reserve_failed_node` is the function that populates this array, and `reserved_mem_node_reserve_failed` checks it. I'm not seeing any red flags so far.

Now, let's consider user-space exposure. No new structures are being exposed, and no complex data structures with potentially uninitialized fields are being allocated. The patch doesn't appear to introduce any changes to bounds checks or buffer lengths that could lead to someone reading uninitialized memory in existing buffers. The focus is clearly on early boot memory reservation.

The patch seems fine. I'm not seeing anything that would necessitate KMSAN (Kernel Memory Sanitizer). KASAN (Kernel Address Sanitizer) and standard tooling are sufficient for this early boot logic. The risks I see are the typical memory corruption issues.

To be extra sure, let's quickly review the `fdt_init_reserved_mem_node` changes. The code now looks like this:

```c
-		if (nomap)
+		if (dynamic && nomap)
 			memblock_clear_nomap(rmem->base, rmem->size);
-		else
+
+		if (dynamic || !nomap)
 			memblock_phys_free(rmem->base, rmem->size);
```

This just changes when memory is freed or has `nomap` cleared in cases of failure. It doesn't appear to be touching uninitialized memory.

**Conclusion: NeedsKMSAN = false.** The patch focuses on improving early boot Device Tree reserved memory logic, particularly by tracking and handling failed reservations and by adding a check for `nomap` overlaps. The changes don't introduce any new structures copied to user space or complex allocations with uninitialized memory risks. Standard KASAN is suitable for addressing any potential memory corruption bugs in this area.

{
  "KMSANReasoning": "The patch modifies early boot device tree reserved memory logic, adding tracking for failed reservations and checking for overlaps with nomap regions. It does not introduce any new data structures copied to user space, nor does it involve complex allocations where uninitialized memory could be exposed. Standard KASAN is sufficient to catch any potential memory corruption or out-of-bounds bugs in this code.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch modifies early boot device tree reserved memory logic, adding tracking for failed reservations and checking for overlaps with nomap regions. It does not introduce any new data structures copied to user space, nor does it involve complex allocations where uninitialized memory could be exposed. Standard KASAN is sufficient to catch any potential memory corruption or out-of-bounds bugs in this code.",
  "NeedsKMSAN": false
}