| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/10/16 02:44 | flow | patch-triage |
2mArgs:null Results: {
"EnableConfigs": [
"AMT",
"IP_MULTICAST",
"INET",
"IPV6"
],
"FocusSymbols": [
"amt_tunnel_get_or_create",
"amt_update_handler",
"amt_request_handler",
"amt_tunnel_expire",
"amt_dev_stop",
"amt_group_work",
"amt_source_work",
"amt_membership_query_handler",
"amt_rcv",
"amt_dev_xmit"
],
"KMSANReasoning": "The patch addresses lifetime management, concurrency/race conditions, and denial-of-service vectors in the AMT (Automatic Multicast Tunneling) driver (drivers/net/amt.c). Specifically, it introduces 'dead' flags and adjusts locking to prevent use-after-free and double-free races during workqueue execution and device teardown, defers tunnel allocation until membership updates are cryptographically authenticated via rotated siphash keys, and converts netdev stats increments to DEV_STATS_INC().\n\nKASAN vs KMSAN applicability:\n- KASAN/LOCKDEP: Any remaining or introduced concurrency bugs, lifecycle issues, or races would manifest as use-after-free (UAF), double-free, or locking inconsistencies, which are actively monitored by KASAN and LOCKDEP.\n- KMSAN: There are no uninitialized memory risks. All structures containing modified or new fields (amt_tunnel_list, amt_source_node, amt_group_node, amt_dev) are allocated using kzalloc, kzalloc_obj, or netdev private allocation (which zeroes memory). The new siphash key array (amt-\u003ekey[4]) is seeded via get_random_bytes() upon device open and rotated securely. No uninitialized kernel memory or padding is exposed or copied to user space. Therefore, a dedicated KMSAN fuzzing session is not justified.",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies drivers/net/amt.c, a virtual network device driver for Automatic Multicast Tunneling. It addresses concurrency, memory lifecycle, race conditions, and DoS vectors by restructuring tunnel allocation (moving it from request to update handler after MAC verification), altering delayed work handlers with dead flags and lock ordering, implementing 4-generation key rotation for SipHash, and reworking device shutdown. This code is fully reachable in standard QEMU environments via rtnetlink and UDP/IP networking.",
"WorthFuzzing": true
} |
| 1/1 | 2026/10/16 02:44 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 8dfd7565b506320bdb64910e1551f65f88be4485\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Oct 16 02:44:22 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/amt.c b/drivers/net/amt.c\nindex b53f8ec556615..ba2734c672f78 100644\n--- a/drivers/net/amt.c\n+++ b/drivers/net/amt.c\n@@ -215,9 +215,14 @@ static struct amt_group_node *amt_lookup_group(struct amt_tunnel_list *tunnel,\n \n static void amt_destroy_source(struct amt_source_node *snode)\n {\n-\tstruct amt_group_node *gnode = snode-\u003egnode;\n+\tstruct amt_group_node *gnode;\n \tstruct amt_tunnel_list *tunnel;\n \n+\tif (READ_ONCE(snode-\u003edead))\n+\t\treturn;\n+\tWRITE_ONCE(snode-\u003edead, true);\n+\tgnode = snode-\u003egnode;\n+\n \ttunnel = gnode-\u003etunnel_list;\n \n \tif (!gnode-\u003ev6) {\n@@ -249,6 +254,9 @@ static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode)\n \tstruct hlist_node *t;\n \tint i;\n \n+\tif (READ_ONCE(gnode-\u003edead))\n+\t\treturn;\n+\tWRITE_ONCE(gnode-\u003edead, true);\n \tif (cancel_delayed_work(\u0026gnode-\u003egroup_timer))\n \t\tdev_put(amt-\u003edev);\n \thlist_del_rcu(\u0026gnode-\u003enode);\n@@ -282,25 +290,32 @@ static void amt_source_work(struct work_struct *work)\n \tstruct amt_source_node *snode = container_of(to_delayed_work(work),\n \t\t\t\t\t\t struct amt_source_node,\n \t\t\t\t\t\t source_timer);\n-\tstruct amt_group_node *gnode = snode-\u003egnode;\n-\tstruct amt_dev *amt = gnode-\u003eamt;\n+\tstruct amt_group_node *gnode;\n+\tstruct amt_dev *amt;\n \tstruct amt_tunnel_list *tunnel;\n \n-\ttunnel = gnode-\u003etunnel_list;\n-\tspin_lock_bh(\u0026tunnel-\u003elock);\n \trcu_read_lock();\n+\tgnode = READ_ONCE(snode-\u003egnode);\n+\tamt = READ_ONCE(gnode-\u003eamt);\n+\ttunnel = READ_ONCE(gnode-\u003etunnel_list);\n+\tspin_lock_bh(\u0026tunnel-\u003elock);\n+\tif (READ_ONCE(snode-\u003edead) || READ_ONCE(gnode-\u003edead)) {\n+\t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n+\t\trcu_read_unlock();\n+\t\treturn;\n+\t}\n \tif (gnode-\u003efilter_mode == MCAST_INCLUDE) {\n \t\tamt_destroy_source(snode);\n \t\tif (!gnode-\u003enr_sources)\n \t\t\tamt_del_group(amt, gnode);\n \t} else {\n-\t\t/* When a router filter-mode for a group is EXCLUDE,\n-\t\t * source records are only deleted when the group timer expires\n+\t\t/* When a router filter-mode for the group is EXCLUDE, source\n+\t\t * records are only deleted when the group timer expires.\n \t\t */\n \t\tsnode-\u003estatus = AMT_SOURCE_STATUS_D_FWD;\n \t}\n-\trcu_read_unlock();\n \tspin_unlock_bh(\u0026tunnel-\u003elock);\n+\trcu_read_unlock();\n }\n \n static void amt_act_src(struct amt_tunnel_list *tunnel,\n@@ -403,26 +418,35 @@ static void amt_group_work(struct work_struct *work)\n \tstruct amt_group_node *gnode = container_of(to_delayed_work(work),\n \t\t\t\t\t\t struct amt_group_node,\n \t\t\t\t\t\t group_timer);\n-\tstruct amt_tunnel_list *tunnel = gnode-\u003etunnel_list;\n-\tstruct amt_dev *amt = gnode-\u003eamt;\n+\tstruct amt_tunnel_list *tunnel;\n+\tstruct amt_dev *amt;\n \tstruct amt_source_node *snode;\n \tbool delete_group = true;\n \tstruct hlist_node *t;\n \tint i, buckets;\n \n+\trcu_read_lock();\n+\ttunnel = READ_ONCE(gnode-\u003etunnel_list);\n+\tamt = READ_ONCE(gnode-\u003eamt);\n \tbuckets = amt-\u003ehash_buckets;\n \n \tspin_lock_bh(\u0026tunnel-\u003elock);\n+\tif (READ_ONCE(gnode-\u003edead)) {\n+\t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n+\t\trcu_read_unlock();\n+\t\tdev_put(amt-\u003edev);\n+\t\treturn;\n+\t}\n \tif (gnode-\u003efilter_mode == MCAST_INCLUDE) {\n \t\t/* Not Used */\n \t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n-\t\tgoto out;\n+\t\trcu_read_unlock();\n+\t\tdev_put(amt-\u003edev);\n+\t\treturn;\n \t}\n \n-\trcu_read_lock();\n-\tfor (i = 0; i \u003c buckets; i++) {\n-\t\thlist_for_each_entry_safe(snode, t,\n-\t\t\t\t\t \u0026gnode-\u003esources[i], node) {\n+\tfor (i = 0; i \u003c buckets; i++)\n+\t\thlist_for_each_entry_safe(snode, t, \u0026gnode-\u003esources[i], node) {\n \t\t\tif (!delayed_work_pending(\u0026snode-\u003esource_timer) ||\n \t\t\t snode-\u003estatus == AMT_SOURCE_STATUS_D_FWD) {\n \t\t\t\tamt_destroy_source(snode);\n@@ -431,14 +455,12 @@ static void amt_group_work(struct work_struct *work)\n \t\t\t\tsnode-\u003estatus = AMT_SOURCE_STATUS_FWD;\n \t\t\t}\n \t\t}\n-\t}\n \tif (delete_group)\n \t\tamt_del_group(amt, gnode);\n \telse\n \t\tgnode-\u003efilter_mode = MCAST_INCLUDE;\n-\trcu_read_unlock();\n \tspin_unlock_bh(\u0026tunnel-\u003elock);\n-out:\n+\trcu_read_unlock();\n \tdev_put(amt-\u003edev);\n }\n \n@@ -628,7 +650,7 @@ static void amt_send_discovery(struct amt_dev *amt)\n \t\t\t\t IPPROTO_UDP, 0,\n \t\t\t\t amt-\u003estream_dev-\u003eifindex);\n \tif (IS_ERR(rt)) {\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tgoto out;\n \t}\n \n@@ -638,7 +660,7 @@ static void amt_send_discovery(struct amt_dev *amt)\n \tskb = netdev_alloc_skb_ip_align(amt-\u003edev, len);\n \tif (!skb) {\n \t\tip_rt_put(rt);\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tgoto out;\n \t}\n \n@@ -683,7 +705,7 @@ static void amt_send_discovery(struct amt_dev *amt)\n \tip_send_check(iph);\n \terr = ip_local_out(amt-\u003enet, sk, skb);\n \tif (unlikely(net_xmit_eval(err)))\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \n \tamt_update_gw_status(amt, AMT_STATUS_SENT_DISCOVERY, true);\n out:\n@@ -719,7 +741,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)\n \t\t\t\t IPPROTO_UDP, 0,\n \t\t\t\t amt-\u003estream_dev-\u003eifindex);\n \tif (IS_ERR(rt)) {\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tgoto out;\n \t}\n \n@@ -729,7 +751,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)\n \tskb = netdev_alloc_skb_ip_align(amt-\u003edev, len);\n \tif (!skb) {\n \t\tip_rt_put(rt);\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tgoto out;\n \t}\n \n@@ -776,7 +798,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)\n \tip_send_check(iph);\n \terr = ip_local_out(amt-\u003enet, sk, skb);\n \tif (unlikely(net_xmit_eval(err)))\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \n out:\n \trcu_read_unlock();\n@@ -784,11 +806,16 @@ static void amt_send_request(struct amt_dev *amt, bool v6)\n \n static bool amt_send_membership_query(struct amt_dev *amt,\n \t\t\t\t struct sk_buff *skb,\n-\t\t\t\t struct amt_tunnel_list *tunnel,\n+\t\t\t\t __be32 daddr, __be16 dport,\n+\t\t\t\t __be32 nonce, u64 mac,\n \t\t\t\t bool v6);\n \n-static void amt_send_igmp_gq(struct amt_dev *amt,\n-\t\t\t struct amt_tunnel_list *tunnel)\n+/* The destination is passed by value rather than as a tunnel: the requesting\n+ * source is not authenticated yet and no tunnel state exists for it - see\n+ * amt_request_handler().\n+ */\n+static void amt_send_igmp_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,\n+\t\t\t __be32 nonce, u64 mac)\n {\n \tstruct sk_buff *skb;\n \n@@ -797,8 +824,9 @@ static void amt_send_igmp_gq(struct amt_dev *amt,\n \t\treturn;\n \n \tskb_pull(skb, sizeof(struct ethhdr));\n-\tif (amt_send_membership_query(amt, skb, tunnel, false)) {\n-\t\tamt-\u003edev-\u003estats.tx_dropped++;\n+\tif (amt_send_membership_query(amt, skb, daddr, dport, nonce, mac,\n+\t\t\t\t false)) {\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_dropped);\n \t\tkfree_skb(skb);\n \t}\n }\n@@ -842,7 +870,7 @@ static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)\n \n \tif (ipv6_dev_get_saddr(amt-\u003enet, amt-\u003edev, \u0026ip6h-\u003edaddr, 0,\n \t\t\t \u0026ip6h-\u003esaddr)) {\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tkfree_skb(skb);\n \t\treturn NULL;\n \t}\n@@ -876,7 +904,8 @@ static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)\n \treturn skb;\n }\n \n-static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)\n+static void amt_send_mld_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,\n+\t\t\t __be32 nonce, u64 mac)\n {\n \tstruct sk_buff *skb;\n \n@@ -885,13 +914,15 @@ static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)\n \t\treturn;\n \n \tskb_pull(skb, sizeof(struct ethhdr));\n-\tif (amt_send_membership_query(amt, skb, tunnel, true)) {\n-\t\tamt-\u003edev-\u003estats.tx_dropped++;\n+\tif (amt_send_membership_query(amt, skb, daddr, dport, nonce, mac,\n+\t\t\t\t true)) {\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_dropped);\n \t\tkfree_skb(skb);\n \t}\n }\n #else\n-static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)\n+static void amt_send_mld_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,\n+\t\t\t __be32 nonce, u64 mac)\n {\n }\n #endif\n@@ -925,7 +956,14 @@ static void amt_secret_work(struct work_struct *work)\n \t\t\t\t\t secret_wq);\n \n \tspin_lock_bh(\u0026amt-\u003elock);\n-\tget_random_bytes(\u0026amt-\u003ekey, sizeof(siphash_key_t));\n+\t/* Keep three previous generations for a 180-240s MAC lifetime.\n+\t * Its 180s floor exceeds the advertised QQIC (amt-\u003eqi, 125s),\n+\t * allowing the gateway to renew its MAC with a periodic Request.\n+\t */\n+\tamt-\u003ekey[3] = amt-\u003ekey[2];\n+\tamt-\u003ekey[2] = amt-\u003ekey[1];\n+\tamt-\u003ekey[1] = amt-\u003ekey[0];\n+\tget_random_bytes(\u0026amt-\u003ekey[0], sizeof(siphash_key_t));\n \tspin_unlock_bh(\u0026amt-\u003elock);\n \tmod_delayed_work(amt_wq, \u0026amt-\u003esecret_wq,\n \t\t\t msecs_to_jiffies(AMT_SECRET_TIMEOUT));\n@@ -1115,9 +1153,16 @@ static void amt_send_multicast_data(struct amt_dev *amt,\n \t\t\t 0);\n }\n \n+/* Send a Membership Query to a source that has not been authenticated yet.\n+ *\n+ * No per-source state exists at this point and none is created: the nonce and\n+ * the keyed MAC are carried in the Query and recomputed from the Membership\n+ * Update when it comes back, so everything this needs is passed by value.\n+ */\n static bool amt_send_membership_query(struct amt_dev *amt,\n \t\t\t\t struct sk_buff *skb,\n-\t\t\t\t struct amt_tunnel_list *tunnel,\n+\t\t\t\t __be32 daddr, __be16 dport,\n+\t\t\t\t __be32 nonce, u64 mac,\n \t\t\t\t bool v6)\n {\n \tstruct amt_header_membership_query *amtmq;\n@@ -1138,13 +1183,13 @@ static bool amt_send_membership_query(struct amt_dev *amt,\n \tskb_reset_inner_headers(skb);\n \tmemset(\u0026fl4, 0, sizeof(struct flowi4));\n \tfl4.flowi4_oif = amt-\u003estream_dev-\u003eifindex;\n-\tfl4.daddr = tunnel-\u003eip4;\n+\tfl4.daddr = daddr;\n \tfl4.saddr = amt-\u003elocal_ip;\n \tfl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS);\n \tfl4.flowi4_proto = IPPROTO_UDP;\n \trt = ip_route_output_key(amt-\u003enet, \u0026fl4);\n \tif (IS_ERR(rt)) {\n-\t\tnetdev_dbg(amt-\u003edev, \"no route to %pI4\\n\", \u0026tunnel-\u003eip4);\n+\t\tnetdev_dbg(amt-\u003edev, \"no route to %pI4\\n\", \u0026daddr);\n \t\treturn true;\n \t}\n \n@@ -1154,8 +1199,8 @@ static bool amt_send_membership_query(struct amt_dev *amt,\n \tamtmq-\u003ereserved = 0;\n \tamtmq-\u003el\t= 0;\n \tamtmq-\u003eg\t= 0;\n-\tamtmq-\u003enonce\t= tunnel-\u003enonce;\n-\tamtmq-\u003eresponse_mac = tunnel-\u003emac;\n+\tamtmq-\u003enonce\t= nonce;\n+\tamtmq-\u003eresponse_mac = mac;\n \n \tif (!v6)\n \t\tskb_set_inner_protocol(skb, htons(ETH_P_IP));\n@@ -1168,11 +1213,10 @@ static bool amt_send_membership_query(struct amt_dev *amt,\n \t\t\t ip4_dst_hoplimit(\u0026rt-\u003edst),\n \t\t\t 0,\n \t\t\t amt-\u003erelay_port,\n-\t\t\t tunnel-\u003esource_port,\n+\t\t\t dport,\n \t\t\t false,\n \t\t\t false,\n \t\t\t 0);\n-\tamt_update_relay_status(tunnel, AMT_STATUS_SENT_QUERY, true);\n \treturn false;\n }\n \n@@ -1236,7 +1280,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)\n \t\tgroup.ip6 = ipv6_hdr(skb)-\u003edaddr;\n #endif\n \t} else {\n-\t\tdev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(dev, tx_errors);\n \t\tgoto free;\n \t}\n \n@@ -1249,12 +1293,21 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)\n \t\t/* Gateway only passes IGMP/MLD packets */\n \t\tif (!report)\n \t\t\tgoto free;\n+\t\t/* A validated report can only be forwarded after the relay's\n+\t\t * family-specific Membership Query supplies the state echoed\n+\t\t * by the Membership Update. Log this readiness failure before\n+\t\t * the shared drop path accounts it.\n+\t\t */\n \t\tif ((!v6 \u0026\u0026 !READ_ONCE(amt-\u003eready4)) ||\n-\t\t (v6 \u0026\u0026 !READ_ONCE(amt-\u003eready6)))\n+\t\t (v6 \u0026\u0026 !READ_ONCE(amt-\u003eready6))) {\n+\t\t\tnetdev_dbg(dev, \"drop %s report: waiting for Membership Query\\n\",\n+\t\t\t\t v6 ? \"MLD\" : \"IGMP\");\n \t\t\tgoto free;\n+\t\t}\n \t\tif (amt_send_membership_update(amt, skb, v6))\n \t\t\tgoto free;\n-\t\tgoto unlock;\n+\t\t/* Sent: the tunnel consumed the skb. Not a drop. */\n+\t\treturn NETDEV_TX_OK;\n \t} else if (amt-\u003emode == AMT_MODE_RELAY) {\n \t\tif (!data)\n \t\t\tgoto free;\n@@ -1283,8 +1336,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)\n \treturn NETDEV_TX_OK;\n free:\n \tdev_kfree_skb(skb);\n-unlock:\n-\tdev-\u003estats.tx_dropped++;\n+\tDEV_STATS_INC(dev, tx_dropped);\n \treturn NETDEV_TX_OK;\n }\n \n@@ -1328,8 +1380,30 @@ static void amt_tunnel_expire(struct work_struct *work)\n \t\t\t\t\t\t struct amt_tunnel_list,\n \t\t\t\t\t\t gc_wq);\n \tstruct amt_dev *amt = tunnel-\u003eamt;\n+\tunsigned long deadline;\n \n \tspin_lock_bh(\u0026amt-\u003elock);\n+\t/* amt_dev_stop() has taken ownership of the teardown. */\n+\tif (READ_ONCE(tunnel-\u003edead)) {\n+\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\treturn;\n+\t}\n+\t/* A Membership Update may have refreshed the tunnel after this work\n+\t * was queued. Re-arm from last_seen rather than letting\n+\t * amt_update_handler() re-arm gc_wq: this handler is then the only\n+\t * context that frees the tunnel on the timeout path; amt_dev_stop()\n+\t * still owns teardown during device shutdown.\n+\t */\n+\tdeadline = READ_ONCE(tunnel-\u003elast_seen) +\n+\t\t msecs_to_jiffies(amt_gmi(amt)) * 3;\n+\tif (time_before(jiffies, deadline)) {\n+\t\tmod_delayed_work(amt_wq, \u0026tunnel-\u003egc_wq, deadline - jiffies);\n+\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\treturn;\n+\t}\n+\tspin_lock_bh(\u0026tunnel-\u003elock);\n+\tWRITE_ONCE(tunnel-\u003edead, true);\n+\tspin_unlock_bh(\u0026tunnel-\u003elock);\n \trcu_read_lock();\n \tlist_del_rcu(\u0026tunnel-\u003elist);\n \tamt-\u003enr_tunnels--;\n@@ -2369,6 +2443,10 @@ static bool amt_membership_query_handler(struct amt_dev *amt,\n \tif (amtmq-\u003ereserved || amtmq-\u003eversion)\n \t\treturn true;\n \n+\t/* A deferred query may outlive a relay address change. */\n+\tif (ip_hdr(skb)-\u003esaddr != READ_ONCE(amt-\u003eremote_ip))\n+\t\treturn true;\n+\n \tif (amtmq-\u003enonce != amt-\u003enonce)\n \t\treturn true;\n \n@@ -2461,16 +2539,106 @@ static bool amt_membership_query_handler(struct amt_dev *amt,\n \treturn false;\n }\n \n+/* The tunnel of the gateway endpoint @saddr:@sport, or NULL. */\n+static struct amt_tunnel_list *amt_tunnel_lookup(struct amt_dev *amt,\n+\t\t\t\t\t\t __be32 saddr, __be16 sport)\n+{\n+\tstruct amt_tunnel_list *tunnel;\n+\n+\tlist_for_each_entry_rcu(tunnel, \u0026amt-\u003etunnel_list, list)\n+\t\tif (tunnel-\u003eip4 == saddr \u0026\u0026 tunnel-\u003esource_port == sport)\n+\t\t\treturn tunnel;\n+\treturn NULL;\n+}\n+\n+/* Look up the tunnel for a source whose Membership Update has already been\n+ * authenticated, creating it on first contact.\n+ *\n+ * This is now the only place tunnel state is allocated, so amt-\u003emax_tunnels\n+ * bounds the number of *verified* gateways rather than the number of\n+ * unverified Requests anyone can send. A fixed per-source cap additionally\n+ * stops one verified source address from monopolising the table.\n+ */\n+static struct amt_tunnel_list *amt_tunnel_get_or_create(struct amt_dev *amt,\n+\t\t\t\t\t\t\t__be32 saddr,\n+\t\t\t\t\t\t\t__be16 sport)\n+{\n+\tstruct amt_tunnel_list *tunnel;\n+\tint per_src = 0;\n+\tint i;\n+\n+\ttunnel = amt_tunnel_lookup(amt, saddr, sport);\n+\tif (tunnel)\n+\t\treturn tunnel;\n+\n+\tspin_lock_bh(\u0026amt-\u003elock);\n+\n+\t/* Re-check under the lock in case a concurrent Update won the race, and\n+\t * count how many tunnels this source already holds on the same walk.\n+\t */\n+\tlist_for_each_entry(tunnel, \u0026amt-\u003etunnel_list, list) {\n+\t\tif (tunnel-\u003eip4 != saddr)\n+\t\t\tcontinue;\n+\t\tif (tunnel-\u003esource_port == sport) {\n+\t\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\t\treturn tunnel;\n+\t\t}\n+\t\tper_src++;\n+\t}\n+\n+\tif (amt-\u003enr_tunnels \u003e= amt-\u003emax_tunnels ||\n+\t per_src \u003e= AMT_MAX_TUNNELS_PER_SRC) {\n+\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\treturn NULL;\n+\t}\n+\n+\tif (!netif_running(amt-\u003edev)) {\n+\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\treturn NULL;\n+\t}\n+\n+\ttunnel = kzalloc(sizeof(*tunnel) +\n+\t\t\t (sizeof(struct hlist_head) * amt-\u003ehash_buckets),\n+\t\t\t GFP_ATOMIC);\n+\tif (!tunnel) {\n+\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\treturn NULL;\n+\t}\n+\n+\ttunnel-\u003esource_port = sport;\n+\ttunnel-\u003eip4 = saddr;\n+\ttunnel-\u003eamt = amt;\n+\tspin_lock_init(\u0026tunnel-\u003elock);\n+\tfor (i = 0; i \u003c amt-\u003ehash_buckets; i++)\n+\t\tINIT_HLIST_HEAD(\u0026tunnel-\u003egroups[i]);\n+\n+\ttunnel-\u003elast_seen = jiffies;\n+\tINIT_DELAYED_WORK(\u0026tunnel-\u003egc_wq, amt_tunnel_expire);\n+\t__amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_UPDATE, false);\n+\n+\t/* Publish only once the entry is fully initialised. */\n+\tlist_add_tail_rcu(\u0026tunnel-\u003elist, \u0026amt-\u003etunnel_list);\n+\tamt-\u003enr_tunnels++;\n+\tmod_delayed_work(amt_wq, \u0026tunnel-\u003egc_wq,\n+\t\t\t msecs_to_jiffies(amt_gmi(amt)) * 3);\n+\tspin_unlock_bh(\u0026amt-\u003elock);\n+\n+\treturn tunnel;\n+}\n+\n static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)\n {\n \tstruct amt_header_membership_update *amtmu;\n \tstruct amt_tunnel_list *tunnel;\n \tstruct ethhdr *eth;\n \tstruct iphdr *iph;\n-\tint len, hdr_size;\n+\tsiphash_key_t key[4];\n+\tint len, hdr_size, i;\n \tu64 response_mac;\n+\tbool verified = false;\n \t__be32 saddr;\n \t__be32 nonce;\n+\t__be16 sport;\n \n \tsaddr = ip_hdr(skb)-\u003esaddr;\n \n@@ -2484,30 +2652,58 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)\n \n \tnonce = amtmu-\u003enonce;\n \tresponse_mac = amtmu-\u003eresponse_mac;\n+\t/* Snapshot the tunnel endpoint port before the encap is stripped. */\n+\tsport = udp_hdr(skb)-\u003esource;\n \n-\tif (iptunnel_pull_header(skb, hdr_size, skb-\u003eprotocol, false))\n-\t\treturn true;\n+\t/* Recompute the MAC handed out in the Membership Query. Four live\n+\t * secrets cover 180-240s, exceeding the advertised QQIC (amt-\u003eqi,\n+\t * 125s), so a periodic Request can renew the MAC before it expires.\n+\t * Authenticate before decapsulation or allocating tunnel state.\n+\t */\n+\tspin_lock_bh(\u0026amt-\u003elock);\n+\tfor (i = 0; i \u003c ARRAY_SIZE(key); i++)\n+\t\tkey[i] = amt-\u003ekey[i];\n+\tspin_unlock_bh(\u0026amt-\u003elock);\n \n-\tskb_reset_network_header(skb);\n+\tfor (i = 0; i \u003c ARRAY_SIZE(key); i++) {\n+\t\tu64 mac = siphash_3u32((__force u32)saddr,\n+\t\t\t\t (__force u32)sport,\n+\t\t\t\t (__force u32)nonce,\n+\t\t\t\t \u0026key[i]) \u003e\u003e 16;\n \n-\tlist_for_each_entry_rcu(tunnel, \u0026amt-\u003etunnel_list, list) {\n-\t\tif (tunnel-\u003eip4 == saddr) {\n-\t\t\tif ((nonce == tunnel-\u003enonce \u0026\u0026\n-\t\t\t response_mac == tunnel-\u003emac)) {\n-\t\t\t\tmod_delayed_work(amt_wq, \u0026tunnel-\u003egc_wq,\n-\t\t\t\t\t\t msecs_to_jiffies(amt_gmi(amt))\n-\t\t\t\t\t\t\t\t * 3);\n-\t\t\t\tgoto report;\n-\t\t\t} else {\n-\t\t\t\tnetdev_dbg(amt-\u003edev, \"Invalid MAC\\n\");\n-\t\t\t\treturn true;\n-\t\t\t}\n+\t\tif (response_mac == mac) {\n+\t\t\tverified = true;\n+\t\t\tbreak;\n \t\t}\n \t}\n \n-\treturn true;\n+\tif (!verified) {\n+\t\tnetdev_dbg(amt-\u003edev, \"Invalid MAC\\n\");\n+\t\treturn true;\n+\t}\n+\n+\ttunnel = amt_tunnel_get_or_create(amt, saddr, sport);\n+\tif (!tunnel) {\n+\t\t/* Out of tunnel slots. Unlike the Request path this reply only\n+\t\t * ever goes to a source that proved it received our Query,\n+\t\t * so it\n+\t\t * cannot be used to reflect at a spoofed third party.\n+\t\t */\n+\t\ticmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);\n+\t\treturn true;\n+\t}\n+\n+\t/* Refresh liveness only. gc_wq is re-armed by amt_tunnel_expire()\n+\t * itself from last_seen, never from here, so this cannot re-queue the\n+\t * work of a tunnel that is being freed.\n+\t */\n+\tWRITE_ONCE(tunnel-\u003elast_seen, jiffies);\n+\n+\tif (iptunnel_pull_header(skb, hdr_size, skb-\u003eprotocol, false))\n+\t\treturn true;\n+\n+\tskb_reset_network_header(skb);\n \n-report:\n \tif (!pskb_may_pull(skb, sizeof(*iph)))\n \t\treturn true;\n \n@@ -2522,6 +2718,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)\n \t\t}\n \n \t\tspin_lock_bh(\u0026tunnel-\u003elock);\n+\t\tif (READ_ONCE(tunnel-\u003edead)) {\n+\t\t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n+\t\t\treturn true;\n+\t\t}\n \t\tamt_igmp_report_handler(amt, skb, tunnel);\n \t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n \n@@ -2542,6 +2742,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)\n \t\t}\n \n \t\tspin_lock_bh(\u0026tunnel-\u003elock);\n+\t\tif (READ_ONCE(tunnel-\u003edead)) {\n+\t\t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n+\t\t\treturn true;\n+\t\t}\n \t\tamt_mld_report_handler(amt, skb, tunnel);\n \t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n \n@@ -2601,7 +2805,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,\n \t\t\t\t IPPROTO_UDP, 0,\n \t\t\t\t amt-\u003estream_dev-\u003eifindex);\n \tif (IS_ERR(rt)) {\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tgoto out;\n \t}\n \n@@ -2611,7 +2815,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,\n \tskb = netdev_alloc_skb_ip_align(amt-\u003edev, len);\n \tif (!skb) {\n \t\tip_rt_put(rt);\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \t\tgoto out;\n \t}\n \n@@ -2657,7 +2861,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,\n \tip_send_check(iph);\n \terr = ip_local_out(amt-\u003enet, sk, skb);\n \tif (unlikely(net_xmit_eval(err)))\n-\t\tamt-\u003edev-\u003estats.tx_errors++;\n+\t\tDEV_STATS_INC(amt-\u003edev, tx_errors);\n \n out:\n \trcu_read_unlock();\n@@ -2684,15 +2888,29 @@ static bool amt_discovery_handler(struct amt_dev *amt, struct sk_buff *skb)\n \treturn false;\n }\n \n+/* Handle an AMT Relay Membership Request.\n+ *\n+ * The source of a Request is unauthenticated: it is a bare UDP datagram with a\n+ * trivially spoofable source address. Allocating tunnel state here let an\n+ * attacker fill the table from spoofed addresses, and let one spoofed packet\n+ * overwrite the nonce/MAC of an established tunnel and cut that gateway off.\n+ *\n+ * Nothing needs to be remembered at this point. Every input to the keyed MAC\n+ * is carried in the packet or is device state, so the MAC is generated here,\n+ * echoed back by the gateway in its Membership Update, and recomputed and\n+ * verified there - see amt_update_handler(). Tunnel state is created only once\n+ * that verification succeeds.\n+ */\n static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb)\n {\n \tstruct amt_header_request *amtrh;\n \tstruct amt_tunnel_list *tunnel;\n-\tunsigned long long key;\n \tstruct udphdr *udph;\n \tstruct iphdr *iph;\n+\tsiphash_key_t key;\n+\tbool full, have = false;\n+\tint per_src = 0;\n \tu64 mac;\n-\tint i;\n \n \tif (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtrh)))\n \t\treturn true;\n@@ -2704,59 +2922,40 @@ static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb)\n \tif (amtrh-\u003ereserved1 || amtrh-\u003ereserved2 || amtrh-\u003eversion)\n \t\treturn true;\n \n-\tlist_for_each_entry_rcu(tunnel, \u0026amt-\u003etunnel_list, list)\n-\t\tif (tunnel-\u003eip4 == iph-\u003esaddr)\n-\t\t\tgoto send;\n-\n-\tspin_lock_bh(\u0026amt-\u003elock);\n-\tif (amt-\u003enr_tunnels \u003e= amt-\u003emax_tunnels) {\n-\t\tspin_unlock_bh(\u0026amt-\u003elock);\n-\t\ticmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);\n+\tif (!netif_running(amt-\u003edev) || !netif_running(amt-\u003estream_dev))\n \t\treturn true;\n-\t}\n \n-\ttunnel = kzalloc(sizeof(*tunnel) +\n-\t\t\t (sizeof(struct hlist_head) * amt-\u003ehash_buckets),\n-\t\t\t GFP_ATOMIC);\n-\tif (!tunnel) {\n-\t\tspin_unlock_bh(\u0026amt-\u003elock);\n-\t\treturn true;\n+\t/* Snapshot the secret and tunnel limits on the same locked walk. */\n+\tspin_lock_bh(\u0026amt-\u003elock);\n+\tkey = amt-\u003ekey[0];\n+\tfull = amt-\u003enr_tunnels \u003e= amt-\u003emax_tunnels;\n+\tlist_for_each_entry(tunnel, \u0026amt-\u003etunnel_list, list) {\n+\t\tif (tunnel-\u003eip4 != iph-\u003esaddr)\n+\t\t\tcontinue;\n+\t\tper_src++;\n+\t\tif (tunnel-\u003esource_port == udph-\u003esource)\n+\t\t\thave = true;\n \t}\n-\n-\ttunnel-\u003esource_port = udph-\u003esource;\n-\ttunnel-\u003eip4 = iph-\u003esaddr;\n-\n-\tmemcpy(\u0026key, \u0026tunnel-\u003ekey, sizeof(unsigned long long));\n-\ttunnel-\u003eamt = amt;\n-\tspin_lock_init(\u0026tunnel-\u003elock);\n-\tfor (i = 0; i \u003c amt-\u003ehash_buckets; i++)\n-\t\tINIT_HLIST_HEAD(\u0026tunnel-\u003egroups[i]);\n-\n-\tINIT_DELAYED_WORK(\u0026tunnel-\u003egc_wq, amt_tunnel_expire);\n-\n-\tlist_add_tail_rcu(\u0026tunnel-\u003elist, \u0026amt-\u003etunnel_list);\n-\ttunnel-\u003ekey = amt-\u003ekey;\n-\t__amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_REQUEST, true);\n-\tamt-\u003enr_tunnels++;\n-\tmod_delayed_work(amt_wq, \u0026tunnel-\u003egc_wq,\n-\t\t\t msecs_to_jiffies(amt_gmi(amt)));\n \tspin_unlock_bh(\u0026amt-\u003elock);\n \n-send:\n-\ttunnel-\u003enonce = amtrh-\u003enonce;\n-\tmac = siphash_3u32((__force u32)tunnel-\u003eip4,\n-\t\t\t (__force u32)tunnel-\u003esource_port,\n-\t\t\t (__force u32)tunnel-\u003enonce,\n-\t\t\t \u0026tunnel-\u003ekey);\n-\ttunnel-\u003emac = mac \u003e\u003e 16;\n-\n-\tif (!netif_running(amt-\u003edev) || !netif_running(amt-\u003estream_dev))\n+\t/* Withhold the Query when a new endpoint cannot get a tunnel, so the\n+\t * gateway rediscovers. Existing endpoints must still renew their MAC.\n+\t * Drop silently: an unauthenticated Request must not reflect ICMP.\n+\t */\n+\tif (!have \u0026\u0026 (full || per_src \u003e= AMT_MAX_TUNNELS_PER_SRC))\n \t\treturn true;\n \n+\tmac = siphash_3u32((__force u32)iph-\u003esaddr,\n+\t\t\t (__force u32)udph-\u003esource,\n+\t\t\t (__force u32)amtrh-\u003enonce,\n+\t\t\t \u0026key) \u003e\u003e 16;\n+\n \tif (!amtrh-\u003ep)\n-\t\tamt_send_igmp_gq(amt, tunnel);\n+\t\tamt_send_igmp_gq(amt, iph-\u003esaddr, udph-\u003esource, amtrh-\u003enonce,\n+\t\t\t\t mac);\n \telse\n-\t\tamt_send_mld_gq(amt, tunnel);\n+\t\tamt_send_mld_gq(amt, iph-\u003esaddr, udph-\u003esource, amtrh-\u003enonce,\n+\t\t\t\tmac);\n \n \treturn false;\n }\n@@ -2833,7 +3032,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)\n \t\t\t}\n \t\t\tgoto out;\n \t\tcase AMT_MSG_MULTICAST_DATA:\n-\t\t\tif (saddr != remote_ip) {\n+\t\t\tif (!remote_ip || saddr != remote_ip) {\n \t\t\t\tnetdev_dbg(amt-\u003edev, \"Invalid Relay IP\\n\");\n \t\t\t\terr = true;\n \t\t\t\tgoto drop;\n@@ -2844,7 +3043,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)\n \t\t\telse\n \t\t\t\tgoto out;\n \t\tcase AMT_MSG_MEMBERSHIP_QUERY:\n-\t\t\tif (saddr != remote_ip) {\n+\t\t\tif (!remote_ip || saddr != remote_ip) {\n \t\t\t\tnetdev_dbg(amt-\u003edev, \"Invalid Relay IP\\n\");\n \t\t\t\terr = true;\n \t\t\t\tgoto drop;\n@@ -3024,6 +3223,14 @@ static int amt_dev_open(struct net_device *dev)\n \tenable_delayed_work(\u0026amt-\u003ediscovery_wq);\n \tenable_delayed_work(\u0026amt-\u003ereq_wq);\n \n+\t/* Seed the keys before amt_socket_create() enables the encap receive\n+\t * path, so a Request or Update that arrives immediately is never\n+\t * verified against an all-zero (predictable) secret.\n+\t */\n+\tspin_lock_bh(\u0026amt-\u003elock);\n+\tget_random_bytes(\u0026amt-\u003ekey, sizeof(amt-\u003ekey));\n+\tspin_unlock_bh(\u0026amt-\u003elock);\n+\n \terr = amt_socket_create(amt);\n \tif (err) {\n \t\tdisable_delayed_work(\u0026amt-\u003ereq_wq);\n@@ -3034,7 +3241,6 @@ static int amt_dev_open(struct net_device *dev)\n \tamt-\u003ereq_cnt = 0;\n \tWRITE_ONCE(amt-\u003eremote_ip, 0);\n \tamt-\u003enonce = 0;\n-\tget_random_bytes(\u0026amt-\u003ekey, sizeof(siphash_key_t));\n \n \tamt-\u003estatus = AMT_STATUS_INIT;\n \tif (amt-\u003emode == AMT_MODE_GATEWAY) {\n@@ -3050,7 +3256,7 @@ static int amt_dev_open(struct net_device *dev)\n static int amt_dev_stop(struct net_device *dev)\n {\n \tstruct amt_dev *amt = netdev_priv(dev);\n-\tstruct amt_tunnel_list *tunnel, *tmp;\n+\tstruct amt_tunnel_list *tunnel;\n \tstruct sk_buff *skb;\n \tstruct sock *sk;\n \tint i;\n@@ -3079,9 +3285,34 @@ static int amt_dev_stop(struct net_device *dev)\n \tamt-\u003ereq_cnt = 0;\n \tWRITE_ONCE(amt-\u003eremote_ip, 0);\n \n-\tlist_for_each_entry_safe(tunnel, tmp, \u0026amt-\u003etunnel_list, list) {\n-\t\tlist_del_rcu(\u0026tunnel-\u003elist);\n-\t\tamt-\u003enr_tunnels--;\n+\t/* Mark every tunnel dead first, so a concurrent amt_tunnel_expire()\n+\t * sees -\u003edead and bails instead of freeing a tunnel in parallel; this\n+\t * path is then the sole freer.\n+\t */\n+\tspin_lock_bh(\u0026amt-\u003elock);\n+\tlist_for_each_entry(tunnel, \u0026amt-\u003etunnel_list, list) {\n+\t\tspin_lock_bh(\u0026tunnel-\u003elock);\n+\t\tWRITE_ONCE(tunnel-\u003edead, true);\n+\t\tspin_unlock_bh(\u0026tunnel-\u003elock);\n+\t}\n+\tspin_unlock_bh(\u0026amt-\u003elock);\n+\n+\t/* Unlink one tunnel at a time with list_del_rcu() rather than splicing\n+\t * the list onto a local head: a lockless reader walking tunnel_list\n+\t * must always terminate at \u0026amt-\u003etunnel_list, never at a stack head.\n+\t */\n+\tfor (;;) {\n+\t\tspin_lock_bh(\u0026amt-\u003elock);\n+\t\ttunnel = list_first_entry_or_null(\u0026amt-\u003etunnel_list,\n+\t\t\t\t\t\t struct amt_tunnel_list, list);\n+\t\tif (tunnel) {\n+\t\t\tlist_del_rcu(\u0026tunnel-\u003elist);\n+\t\t\tamt-\u003enr_tunnels--;\n+\t\t}\n+\t\tspin_unlock_bh(\u0026amt-\u003elock);\n+\t\tif (!tunnel)\n+\t\t\tbreak;\n+\n \t\tcancel_delayed_work_sync(\u0026tunnel-\u003egc_wq);\n \t\tamt_clear_groups(tunnel);\n \t\tkfree_rcu(tunnel, rcu);\n@@ -3152,9 +3383,9 @@ static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = {\n \t[IFLA_AMT_RELAY_PORT]\t= { .type = NLA_U16 },\n \t[IFLA_AMT_GATEWAY_PORT]\t= { .type = NLA_U16 },\n \t[IFLA_AMT_LINK]\t\t= { .type = NLA_U32 },\n-\t[IFLA_AMT_LOCAL_IP]\t= { .len = sizeof_field(struct iphdr, daddr) },\n+\t[IFLA_AMT_LOCAL_IP]\t= NLA_POLICY_EXACT_LEN(sizeof(__be32)),\n \t[IFLA_AMT_REMOTE_IP]\t= { .len = sizeof_field(struct iphdr, daddr) },\n-\t[IFLA_AMT_DISCOVERY_IP]\t= { .len = sizeof_field(struct iphdr, daddr) },\n+\t[IFLA_AMT_DISCOVERY_IP]\t= NLA_POLICY_EXACT_LEN(sizeof(__be32)),\n \t[IFLA_AMT_MAX_TUNNELS]\t= { .type = NLA_U32 },\n };\n \ndiff --git a/include/net/amt.h b/include/net/amt.h\nindex 2846dde0cadce..1b4283efa0fc8 100644\n--- a/include/net/amt.h\n+++ b/include/net/amt.h\n@@ -240,12 +240,18 @@ struct amt_tunnel_list {\n \tu32\t\t\tnr_sources;\n \tenum amt_status\t\tstatus;\n \tstruct delayed_work\tgc_wq;\n+\t/* Last time this tunnel was refreshed. gc_wq\n+\t * re-arms itself from this rather than being re-armed by the Update\n+\t * path, so the Update path cannot re-queue work for a tunnel that\n+\t * amt_tunnel_expire() is freeing on the timeout path.\n+\t */\n+\tunsigned long\t\tlast_seen;\n+\t/* Set under amt-\u003elock by whichever freer reaches the tunnel first;\n+\t * the other then leaves it alone, so the tunnel is freed exactly once.\n+\t */\n+\tbool\t\t\tdead;\n \t__be16\t\t\tsource_port;\n \t__be32\t\t\tip4;\n-\t__be32\t\t\tnonce;\n-\tsiphash_key_t\t\tkey;\n-\tu64\t\t\tmac:48,\n-\t\t\t\treserved:16;\n \tstruct rcu_head\t\trcu;\n \tstruct hlist_head\tgroups[];\n };\n@@ -282,6 +288,8 @@ struct amt_source_node {\n #define AMT_SOURCE_OLD\t0\n #define AMT_SOURCE_NEW\t1\n \tu8\t\t\tflags;\n+\t/* Protected by gnode-\u003etunnel_list-\u003elock. */\n+\tbool\t\t\tdead;\n \tstruct rcu_head\t\trcu;\n };\n \n@@ -296,6 +304,8 @@ struct amt_group_node {\n \tstruct amt_tunnel_list\t*tunnel_list;\n \tstruct hlist_node\tnode;\n \tstruct delayed_work group_timer;\n+\t/* Protected by tunnel_list-\u003elock. */\n+\tbool\t\t\tdead;\n \tstruct rcu_head\t\trcu;\n \tstruct hlist_head\tsources[];\n };\n@@ -325,8 +335,10 @@ struct amt_dev {\n \tstruct work_struct\tevent_wq;\n \t/* AMT status */\n \tenum amt_status\t\tstatus;\n-\t/* Generated key */\n-\tsiphash_key_t\t\tkey;\n+\t/* Current key and three previous generations keep MACs valid for\n+\t * 180-240s, beyond the advertised QQIC (see amt_secret_work()).\n+\t */\n+\tsiphash_key_t\t\tkey[4];\n \tstruct sock\t __rcu *sk;\n \tu32\t\t\tmax_groups;\n \tu32\t\t\tmax_sources;\n@@ -383,6 +395,10 @@ struct amt_dev {\n #define AMT_SECRET_TIMEOUT\t60000\n #define IANA_AMT_UDP_PORT\t2268\n #define AMT_MAX_TUNNELS 128\n+/* Fixed per-source cap stops one verified source address from monopolising\n+ * the AMT_MAX_TUNNELS-slot table.\n+ */\n+#define AMT_MAX_TUNNELS_PER_SRC 16\n #define AMT_MAX_REQS\t\t128\n #define AMT_GW_HLEN (sizeof(struct iphdr) + \\\n \t\t sizeof(struct udphdr) + \\\n"
} |
| 2/1 | 2026/10/16 02:44 | agent | patch-evaluator |
1mModel:core Args: null Results: {
"EnableConfigs": [
"AMT",
"IP_MULTICAST",
"INET",
"IPV6"
],
"FocusSymbols": [
"amt_tunnel_get_or_create",
"amt_update_handler",
"amt_request_handler",
"amt_tunnel_expire",
"amt_dev_stop",
"amt_group_work",
"amt_source_work",
"amt_membership_query_handler",
"amt_rcv",
"amt_dev_xmit"
],
"Reasoning": "The patch modifies drivers/net/amt.c, a virtual network device driver for Automatic Multicast Tunneling. It addresses concurrency, memory lifecycle, race conditions, and DoS vectors by restructuring tunnel allocation (moving it from request to update handler after MAC verification), altering delayed work handlers with dead flags and lock ordering, implementing 4-generation key rotation for SipHash, and reworking device shutdown. This code is fully reachable in standard QEMU environments via rtnetlink and UDP/IP networking.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 8dfd7565b506320bdb64910e1551f65f88be4485
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Oct 16 02:44:22 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index b53f8ec556615..ba2734c672f78 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -215,9 +215,14 @@ static struct amt_group_node *amt_lookup_group(struct amt_tunnel_list *tunnel,
static void amt_destroy_source(struct amt_source_node *snode)
{
- struct amt_group_node *gnode = snode->gnode;
+ struct amt_group_node *gnode;
struct amt_tunnel_list *tunnel;
+ if (READ_ONCE(snode->dead))
+ return;
+ WRITE_ONCE(snode->dead, true);
+ gnode = snode->gnode;
+
tunnel = gnode->tunnel_list;
if (!gnode->v6) {
@@ -249,6 +254,9 @@ static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode)
struct hlist_node *t;
int i;
+ if (READ_ONCE(gnode->dead))
+ return;
+ WRITE_ONCE(gnode->dead, true);
if (cancel_delayed_work(&gnode->group_timer))
dev_put(amt->dev);
hlist_del_rcu(&gnode->node);
@@ -282,25 +290,32 @@ static void amt_source_work(struct work_struct *work)
struct amt_source_node *snode = container_of(to_delayed_work(work),
struct amt_source_node,
source_timer);
- struct amt_group_node *gnode = snode->gnode;
- struct amt_dev *amt = gnode->amt;
+ struct amt_group_node *gnode;
+ struct amt_dev *amt;
struct amt_tunnel_list *tunnel;
- tunnel = gnode->tunnel_list;
- spin_lock_bh(&tunnel->lock);
rcu_read_lock();
+ gnode = READ_ONCE(snode->gnode);
+ amt = READ_ONCE(gnode->amt);
+ tunnel = READ_ONCE(gnode->tunnel_list);
+ spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(snode->dead) || READ_ONCE(gnode->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ rcu_read_unlock();
+ return;
+ }
if (gnode->filter_mode == MCAST_INCLUDE) {
amt_destroy_source(snode);
if (!gnode->nr_sources)
amt_del_group(amt, gnode);
} else {
- /* When a router filter-mode for a group is EXCLUDE,
- * source records are only deleted when the group timer expires
+ /* When a router filter-mode for the group is EXCLUDE, source
+ * records are only deleted when the group timer expires.
*/
snode->status = AMT_SOURCE_STATUS_D_FWD;
}
- rcu_read_unlock();
spin_unlock_bh(&tunnel->lock);
+ rcu_read_unlock();
}
static void amt_act_src(struct amt_tunnel_list *tunnel,
@@ -403,26 +418,35 @@ static void amt_group_work(struct work_struct *work)
struct amt_group_node *gnode = container_of(to_delayed_work(work),
struct amt_group_node,
group_timer);
- struct amt_tunnel_list *tunnel = gnode->tunnel_list;
- struct amt_dev *amt = gnode->amt;
+ struct amt_tunnel_list *tunnel;
+ struct amt_dev *amt;
struct amt_source_node *snode;
bool delete_group = true;
struct hlist_node *t;
int i, buckets;
+ rcu_read_lock();
+ tunnel = READ_ONCE(gnode->tunnel_list);
+ amt = READ_ONCE(gnode->amt);
buckets = amt->hash_buckets;
spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(gnode->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ rcu_read_unlock();
+ dev_put(amt->dev);
+ return;
+ }
if (gnode->filter_mode == MCAST_INCLUDE) {
/* Not Used */
spin_unlock_bh(&tunnel->lock);
- goto out;
+ rcu_read_unlock();
+ dev_put(amt->dev);
+ return;
}
- rcu_read_lock();
- for (i = 0; i < buckets; i++) {
- hlist_for_each_entry_safe(snode, t,
- &gnode->sources[i], node) {
+ for (i = 0; i < buckets; i++)
+ hlist_for_each_entry_safe(snode, t, &gnode->sources[i], node) {
if (!delayed_work_pending(&snode->source_timer) ||
snode->status == AMT_SOURCE_STATUS_D_FWD) {
amt_destroy_source(snode);
@@ -431,14 +455,12 @@ static void amt_group_work(struct work_struct *work)
snode->status = AMT_SOURCE_STATUS_FWD;
}
}
- }
if (delete_group)
amt_del_group(amt, gnode);
else
gnode->filter_mode = MCAST_INCLUDE;
- rcu_read_unlock();
spin_unlock_bh(&tunnel->lock);
-out:
+ rcu_read_unlock();
dev_put(amt->dev);
}
@@ -628,7 +650,7 @@ static void amt_send_discovery(struct amt_dev *amt)
IPPROTO_UDP, 0,
amt->stream_dev->ifindex);
if (IS_ERR(rt)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -638,7 +660,7 @@ static void amt_send_discovery(struct amt_dev *amt)
skb = netdev_alloc_skb_ip_align(amt->dev, len);
if (!skb) {
ip_rt_put(rt);
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -683,7 +705,7 @@ static void amt_send_discovery(struct amt_dev *amt)
ip_send_check(iph);
err = ip_local_out(amt->net, sk, skb);
if (unlikely(net_xmit_eval(err)))
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
amt_update_gw_status(amt, AMT_STATUS_SENT_DISCOVERY, true);
out:
@@ -719,7 +741,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
IPPROTO_UDP, 0,
amt->stream_dev->ifindex);
if (IS_ERR(rt)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -729,7 +751,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
skb = netdev_alloc_skb_ip_align(amt->dev, len);
if (!skb) {
ip_rt_put(rt);
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -776,7 +798,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
ip_send_check(iph);
err = ip_local_out(amt->net, sk, skb);
if (unlikely(net_xmit_eval(err)))
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
out:
rcu_read_unlock();
@@ -784,11 +806,16 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
static bool amt_send_membership_query(struct amt_dev *amt,
struct sk_buff *skb,
- struct amt_tunnel_list *tunnel,
+ __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac,
bool v6);
-static void amt_send_igmp_gq(struct amt_dev *amt,
- struct amt_tunnel_list *tunnel)
+/* The destination is passed by value rather than as a tunnel: the requesting
+ * source is not authenticated yet and no tunnel state exists for it - see
+ * amt_request_handler().
+ */
+static void amt_send_igmp_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac)
{
struct sk_buff *skb;
@@ -797,8 +824,9 @@ static void amt_send_igmp_gq(struct amt_dev *amt,
return;
skb_pull(skb, sizeof(struct ethhdr));
- if (amt_send_membership_query(amt, skb, tunnel, false)) {
- amt->dev->stats.tx_dropped++;
+ if (amt_send_membership_query(amt, skb, daddr, dport, nonce, mac,
+ false)) {
+ DEV_STATS_INC(amt->dev, tx_dropped);
kfree_skb(skb);
}
}
@@ -842,7 +870,7 @@ static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)
if (ipv6_dev_get_saddr(amt->net, amt->dev, &ip6h->daddr, 0,
&ip6h->saddr)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
kfree_skb(skb);
return NULL;
}
@@ -876,7 +904,8 @@ static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)
return skb;
}
-static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)
+static void amt_send_mld_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac)
{
struct sk_buff *skb;
@@ -885,13 +914,15 @@ static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)
return;
skb_pull(skb, sizeof(struct ethhdr));
- if (amt_send_membership_query(amt, skb, tunnel, true)) {
- amt->dev->stats.tx_dropped++;
+ if (amt_send_membership_query(amt, skb, daddr, dport, nonce, mac,
+ true)) {
+ DEV_STATS_INC(amt->dev, tx_dropped);
kfree_skb(skb);
}
}
#else
-static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)
+static void amt_send_mld_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac)
{
}
#endif
@@ -925,7 +956,14 @@ static void amt_secret_work(struct work_struct *work)
secret_wq);
spin_lock_bh(&amt->lock);
- get_random_bytes(&amt->key, sizeof(siphash_key_t));
+ /* Keep three previous generations for a 180-240s MAC lifetime.
+ * Its 180s floor exceeds the advertised QQIC (amt->qi, 125s),
+ * allowing the gateway to renew its MAC with a periodic Request.
+ */
+ amt->key[3] = amt->key[2];
+ amt->key[2] = amt->key[1];
+ amt->key[1] = amt->key[0];
+ get_random_bytes(&amt->key[0], sizeof(siphash_key_t));
spin_unlock_bh(&amt->lock);
mod_delayed_work(amt_wq, &amt->secret_wq,
msecs_to_jiffies(AMT_SECRET_TIMEOUT));
@@ -1115,9 +1153,16 @@ static void amt_send_multicast_data(struct amt_dev *amt,
0);
}
+/* Send a Membership Query to a source that has not been authenticated yet.
+ *
+ * No per-source state exists at this point and none is created: the nonce and
+ * the keyed MAC are carried in the Query and recomputed from the Membership
+ * Update when it comes back, so everything this needs is passed by value.
+ */
static bool amt_send_membership_query(struct amt_dev *amt,
struct sk_buff *skb,
- struct amt_tunnel_list *tunnel,
+ __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac,
bool v6)
{
struct amt_header_membership_query *amtmq;
@@ -1138,13 +1183,13 @@ static bool amt_send_membership_query(struct amt_dev *amt,
skb_reset_inner_headers(skb);
memset(&fl4, 0, sizeof(struct flowi4));
fl4.flowi4_oif = amt->stream_dev->ifindex;
- fl4.daddr = tunnel->ip4;
+ fl4.daddr = daddr;
fl4.saddr = amt->local_ip;
fl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS);
fl4.flowi4_proto = IPPROTO_UDP;
rt = ip_route_output_key(amt->net, &fl4);
if (IS_ERR(rt)) {
- netdev_dbg(amt->dev, "no route to %pI4\n", &tunnel->ip4);
+ netdev_dbg(amt->dev, "no route to %pI4\n", &daddr);
return true;
}
@@ -1154,8 +1199,8 @@ static bool amt_send_membership_query(struct amt_dev *amt,
amtmq->reserved = 0;
amtmq->l = 0;
amtmq->g = 0;
- amtmq->nonce = tunnel->nonce;
- amtmq->response_mac = tunnel->mac;
+ amtmq->nonce = nonce;
+ amtmq->response_mac = mac;
if (!v6)
skb_set_inner_protocol(skb, htons(ETH_P_IP));
@@ -1168,11 +1213,10 @@ static bool amt_send_membership_query(struct amt_dev *amt,
ip4_dst_hoplimit(&rt->dst),
0,
amt->relay_port,
- tunnel->source_port,
+ dport,
false,
false,
0);
- amt_update_relay_status(tunnel, AMT_STATUS_SENT_QUERY, true);
return false;
}
@@ -1236,7 +1280,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
group.ip6 = ipv6_hdr(skb)->daddr;
#endif
} else {
- dev->stats.tx_errors++;
+ DEV_STATS_INC(dev, tx_errors);
goto free;
}
@@ -1249,12 +1293,21 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
/* Gateway only passes IGMP/MLD packets */
if (!report)
goto free;
+ /* A validated report can only be forwarded after the relay's
+ * family-specific Membership Query supplies the state echoed
+ * by the Membership Update. Log this readiness failure before
+ * the shared drop path accounts it.
+ */
if ((!v6 && !READ_ONCE(amt->ready4)) ||
- (v6 && !READ_ONCE(amt->ready6)))
+ (v6 && !READ_ONCE(amt->ready6))) {
+ netdev_dbg(dev, "drop %s report: waiting for Membership Query\n",
+ v6 ? "MLD" : "IGMP");
goto free;
+ }
if (amt_send_membership_update(amt, skb, v6))
goto free;
- goto unlock;
+ /* Sent: the tunnel consumed the skb. Not a drop. */
+ return NETDEV_TX_OK;
} else if (amt->mode == AMT_MODE_RELAY) {
if (!data)
goto free;
@@ -1283,8 +1336,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
return NETDEV_TX_OK;
free:
dev_kfree_skb(skb);
-unlock:
- dev->stats.tx_dropped++;
+ DEV_STATS_INC(dev, tx_dropped);
return NETDEV_TX_OK;
}
@@ -1328,8 +1380,30 @@ static void amt_tunnel_expire(struct work_struct *work)
struct amt_tunnel_list,
gc_wq);
struct amt_dev *amt = tunnel->amt;
+ unsigned long deadline;
spin_lock_bh(&amt->lock);
+ /* amt_dev_stop() has taken ownership of the teardown. */
+ if (READ_ONCE(tunnel->dead)) {
+ spin_unlock_bh(&amt->lock);
+ return;
+ }
+ /* A Membership Update may have refreshed the tunnel after this work
+ * was queued. Re-arm from last_seen rather than letting
+ * amt_update_handler() re-arm gc_wq: this handler is then the only
+ * context that frees the tunnel on the timeout path; amt_dev_stop()
+ * still owns teardown during device shutdown.
+ */
+ deadline = READ_ONCE(tunnel->last_seen) +
+ msecs_to_jiffies(amt_gmi(amt)) * 3;
+ if (time_before(jiffies, deadline)) {
+ mod_delayed_work(amt_wq, &tunnel->gc_wq, deadline - jiffies);
+ spin_unlock_bh(&amt->lock);
+ return;
+ }
+ spin_lock_bh(&tunnel->lock);
+ WRITE_ONCE(tunnel->dead, true);
+ spin_unlock_bh(&tunnel->lock);
rcu_read_lock();
list_del_rcu(&tunnel->list);
amt->nr_tunnels--;
@@ -2369,6 +2443,10 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
if (amtmq->reserved || amtmq->version)
return true;
+ /* A deferred query may outlive a relay address change. */
+ if (ip_hdr(skb)->saddr != READ_ONCE(amt->remote_ip))
+ return true;
+
if (amtmq->nonce != amt->nonce)
return true;
@@ -2461,16 +2539,106 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
return false;
}
+/* The tunnel of the gateway endpoint @saddr:@sport, or NULL. */
+static struct amt_tunnel_list *amt_tunnel_lookup(struct amt_dev *amt,
+ __be32 saddr, __be16 sport)
+{
+ struct amt_tunnel_list *tunnel;
+
+ list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list)
+ if (tunnel->ip4 == saddr && tunnel->source_port == sport)
+ return tunnel;
+ return NULL;
+}
+
+/* Look up the tunnel for a source whose Membership Update has already been
+ * authenticated, creating it on first contact.
+ *
+ * This is now the only place tunnel state is allocated, so amt->max_tunnels
+ * bounds the number of *verified* gateways rather than the number of
+ * unverified Requests anyone can send. A fixed per-source cap additionally
+ * stops one verified source address from monopolising the table.
+ */
+static struct amt_tunnel_list *amt_tunnel_get_or_create(struct amt_dev *amt,
+ __be32 saddr,
+ __be16 sport)
+{
+ struct amt_tunnel_list *tunnel;
+ int per_src = 0;
+ int i;
+
+ tunnel = amt_tunnel_lookup(amt, saddr, sport);
+ if (tunnel)
+ return tunnel;
+
+ spin_lock_bh(&amt->lock);
+
+ /* Re-check under the lock in case a concurrent Update won the race, and
+ * count how many tunnels this source already holds on the same walk.
+ */
+ list_for_each_entry(tunnel, &amt->tunnel_list, list) {
+ if (tunnel->ip4 != saddr)
+ continue;
+ if (tunnel->source_port == sport) {
+ spin_unlock_bh(&amt->lock);
+ return tunnel;
+ }
+ per_src++;
+ }
+
+ if (amt->nr_tunnels >= amt->max_tunnels ||
+ per_src >= AMT_MAX_TUNNELS_PER_SRC) {
+ spin_unlock_bh(&amt->lock);
+ return NULL;
+ }
+
+ if (!netif_running(amt->dev)) {
+ spin_unlock_bh(&amt->lock);
+ return NULL;
+ }
+
+ tunnel = kzalloc(sizeof(*tunnel) +
+ (sizeof(struct hlist_head) * amt->hash_buckets),
+ GFP_ATOMIC);
+ if (!tunnel) {
+ spin_unlock_bh(&amt->lock);
+ return NULL;
+ }
+
+ tunnel->source_port = sport;
+ tunnel->ip4 = saddr;
+ tunnel->amt = amt;
+ spin_lock_init(&tunnel->lock);
+ for (i = 0; i < amt->hash_buckets; i++)
+ INIT_HLIST_HEAD(&tunnel->groups[i]);
+
+ tunnel->last_seen = jiffies;
+ INIT_DELAYED_WORK(&tunnel->gc_wq, amt_tunnel_expire);
+ __amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_UPDATE, false);
+
+ /* Publish only once the entry is fully initialised. */
+ list_add_tail_rcu(&tunnel->list, &amt->tunnel_list);
+ amt->nr_tunnels++;
+ mod_delayed_work(amt_wq, &tunnel->gc_wq,
+ msecs_to_jiffies(amt_gmi(amt)) * 3);
+ spin_unlock_bh(&amt->lock);
+
+ return tunnel;
+}
+
static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
{
struct amt_header_membership_update *amtmu;
struct amt_tunnel_list *tunnel;
struct ethhdr *eth;
struct iphdr *iph;
- int len, hdr_size;
+ siphash_key_t key[4];
+ int len, hdr_size, i;
u64 response_mac;
+ bool verified = false;
__be32 saddr;
__be32 nonce;
+ __be16 sport;
saddr = ip_hdr(skb)->saddr;
@@ -2484,30 +2652,58 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
nonce = amtmu->nonce;
response_mac = amtmu->response_mac;
+ /* Snapshot the tunnel endpoint port before the encap is stripped. */
+ sport = udp_hdr(skb)->source;
- if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false))
- return true;
+ /* Recompute the MAC handed out in the Membership Query. Four live
+ * secrets cover 180-240s, exceeding the advertised QQIC (amt->qi,
+ * 125s), so a periodic Request can renew the MAC before it expires.
+ * Authenticate before decapsulation or allocating tunnel state.
+ */
+ spin_lock_bh(&amt->lock);
+ for (i = 0; i < ARRAY_SIZE(key); i++)
+ key[i] = amt->key[i];
+ spin_unlock_bh(&amt->lock);
- skb_reset_network_header(skb);
+ for (i = 0; i < ARRAY_SIZE(key); i++) {
+ u64 mac = siphash_3u32((__force u32)saddr,
+ (__force u32)sport,
+ (__force u32)nonce,
+ &key[i]) >> 16;
- list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) {
- if (tunnel->ip4 == saddr) {
- if ((nonce == tunnel->nonce &&
- response_mac == tunnel->mac)) {
- mod_delayed_work(amt_wq, &tunnel->gc_wq,
- msecs_to_jiffies(amt_gmi(amt))
- * 3);
- goto report;
- } else {
- netdev_dbg(amt->dev, "Invalid MAC\n");
- return true;
- }
+ if (response_mac == mac) {
+ verified = true;
+ break;
}
}
- return true;
+ if (!verified) {
+ netdev_dbg(amt->dev, "Invalid MAC\n");
+ return true;
+ }
+
+ tunnel = amt_tunnel_get_or_create(amt, saddr, sport);
+ if (!tunnel) {
+ /* Out of tunnel slots. Unlike the Request path this reply only
+ * ever goes to a source that proved it received our Query,
+ * so it
+ * cannot be used to reflect at a spoofed third party.
+ */
+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+ return true;
+ }
+
+ /* Refresh liveness only. gc_wq is re-armed by amt_tunnel_expire()
+ * itself from last_seen, never from here, so this cannot re-queue the
+ * work of a tunnel that is being freed.
+ */
+ WRITE_ONCE(tunnel->last_seen, jiffies);
+
+ if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false))
+ return true;
+
+ skb_reset_network_header(skb);
-report:
if (!pskb_may_pull(skb, sizeof(*iph)))
return true;
@@ -2522,6 +2718,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
}
spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(tunnel->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ return true;
+ }
amt_igmp_report_handler(amt, skb, tunnel);
spin_unlock_bh(&tunnel->lock);
@@ -2542,6 +2742,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
}
spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(tunnel->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ return true;
+ }
amt_mld_report_handler(amt, skb, tunnel);
spin_unlock_bh(&tunnel->lock);
@@ -2601,7 +2805,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
IPPROTO_UDP, 0,
amt->stream_dev->ifindex);
if (IS_ERR(rt)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -2611,7 +2815,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
skb = netdev_alloc_skb_ip_align(amt->dev, len);
if (!skb) {
ip_rt_put(rt);
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -2657,7 +2861,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
ip_send_check(iph);
err = ip_local_out(amt->net, sk, skb);
if (unlikely(net_xmit_eval(err)))
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
out:
rcu_read_unlock();
@@ -2684,15 +2888,29 @@ static bool amt_discovery_handler(struct amt_dev *amt, struct sk_buff *skb)
return false;
}
+/* Handle an AMT Relay Membership Request.
+ *
+ * The source of a Request is unauthenticated: it is a bare UDP datagram with a
+ * trivially spoofable source address. Allocating tunnel state here let an
+ * attacker fill the table from spoofed addresses, and let one spoofed packet
+ * overwrite the nonce/MAC of an established tunnel and cut that gateway off.
+ *
+ * Nothing needs to be remembered at this point. Every input to the keyed MAC
+ * is carried in the packet or is device state, so the MAC is generated here,
+ * echoed back by the gateway in its Membership Update, and recomputed and
+ * verified there - see amt_update_handler(). Tunnel state is created only once
+ * that verification succeeds.
+ */
static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb)
{
struct amt_header_request *amtrh;
struct amt_tunnel_list *tunnel;
- unsigned long long key;
struct udphdr *udph;
struct iphdr *iph;
+ siphash_key_t key;
+ bool full, have = false;
+ int per_src = 0;
u64 mac;
- int i;
if (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtrh)))
return true;
@@ -2704,59 +2922,40 @@ static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb)
if (amtrh->reserved1 || amtrh->reserved2 || amtrh->version)
return true;
- list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list)
- if (tunnel->ip4 == iph->saddr)
- goto send;
-
- spin_lock_bh(&amt->lock);
- if (amt->nr_tunnels >= amt->max_tunnels) {
- spin_unlock_bh(&amt->lock);
- icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+ if (!netif_running(amt->dev) || !netif_running(amt->stream_dev))
return true;
- }
- tunnel = kzalloc(sizeof(*tunnel) +
- (sizeof(struct hlist_head) * amt->hash_buckets),
- GFP_ATOMIC);
- if (!tunnel) {
- spin_unlock_bh(&amt->lock);
- return true;
+ /* Snapshot the secret and tunnel limits on the same locked walk. */
+ spin_lock_bh(&amt->lock);
+ key = amt->key[0];
+ full = amt->nr_tunnels >= amt->max_tunnels;
+ list_for_each_entry(tunnel, &amt->tunnel_list, list) {
+ if (tunnel->ip4 != iph->saddr)
+ continue;
+ per_src++;
+ if (tunnel->source_port == udph->source)
+ have = true;
}
-
- tunnel->source_port = udph->source;
- tunnel->ip4 = iph->saddr;
-
- memcpy(&key, &tunnel->key, sizeof(unsigned long long));
- tunnel->amt = amt;
- spin_lock_init(&tunnel->lock);
- for (i = 0; i < amt->hash_buckets; i++)
- INIT_HLIST_HEAD(&tunnel->groups[i]);
-
- INIT_DELAYED_WORK(&tunnel->gc_wq, amt_tunnel_expire);
-
- list_add_tail_rcu(&tunnel->list, &amt->tunnel_list);
- tunnel->key = amt->key;
- __amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_REQUEST, true);
- amt->nr_tunnels++;
- mod_delayed_work(amt_wq, &tunnel->gc_wq,
- msecs_to_jiffies(amt_gmi(amt)));
spin_unlock_bh(&amt->lock);
-send:
- tunnel->nonce = amtrh->nonce;
- mac = siphash_3u32((__force u32)tunnel->ip4,
- (__force u32)tunnel->source_port,
- (__force u32)tunnel->nonce,
- &tunnel->key);
- tunnel->mac = mac >> 16;
-
- if (!netif_running(amt->dev) || !netif_running(amt->stream_dev))
+ /* Withhold the Query when a new endpoint cannot get a tunnel, so the
+ * gateway rediscovers. Existing endpoints must still renew their MAC.
+ * Drop silently: an unauthenticated Request must not reflect ICMP.
+ */
+ if (!have && (full || per_src >= AMT_MAX_TUNNELS_PER_SRC))
return true;
+ mac = siphash_3u32((__force u32)iph->saddr,
+ (__force u32)udph->source,
+ (__force u32)amtrh->nonce,
+ &key) >> 16;
+
if (!amtrh->p)
- amt_send_igmp_gq(amt, tunnel);
+ amt_send_igmp_gq(amt, iph->saddr, udph->source, amtrh->nonce,
+ mac);
else
- amt_send_mld_gq(amt, tunnel);
+ amt_send_mld_gq(amt, iph->saddr, udph->source, amtrh->nonce,
+ mac);
return false;
}
@@ -2833,7 +3032,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
}
goto out;
case AMT_MSG_MULTICAST_DATA:
- if (saddr != remote_ip) {
+ if (!remote_ip || saddr != remote_ip) {
netdev_dbg(amt->dev, "Invalid Relay IP\n");
err = true;
goto drop;
@@ -2844,7 +3043,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
else
goto out;
case AMT_MSG_MEMBERSHIP_QUERY:
- if (saddr != remote_ip) {
+ if (!remote_ip || saddr != remote_ip) {
netdev_dbg(amt->dev, "Invalid Relay IP\n");
err = true;
goto drop;
@@ -3024,6 +3223,14 @@ static int amt_dev_open(struct net_device *dev)
enable_delayed_work(&amt->discovery_wq);
enable_delayed_work(&amt->req_wq);
+ /* Seed the keys before amt_socket_create() enables the encap receive
+ * path, so a Request or Update that arrives immediately is never
+ * verified against an all-zero (predictable) secret.
+ */
+ spin_lock_bh(&amt->lock);
+ get_random_bytes(&amt->key, sizeof(amt->key));
+ spin_unlock_bh(&amt->lock);
+
err = amt_socket_create(amt);
if (err) {
disable_delayed_work(&amt->req_wq);
@@ -3034,7 +3241,6 @@ static int amt_dev_open(struct net_device *dev)
amt->req_cnt = 0;
WRITE_ONCE(amt->remote_ip, 0);
amt->nonce = 0;
- get_random_bytes(&amt->key, sizeof(siphash_key_t));
amt->status = AMT_STATUS_INIT;
if (amt->mode == AMT_MODE_GATEWAY) {
@@ -3050,7 +3256,7 @@ static int amt_dev_open(struct net_device *dev)
static int amt_dev_stop(struct net_device *dev)
{
struct amt_dev *amt = netdev_priv(dev);
- struct amt_tunnel_list *tunnel, *tmp;
+ struct amt_tunnel_list *tunnel;
struct sk_buff *skb;
struct sock *sk;
int i;
@@ -3079,9 +3285,34 @@ static int amt_dev_stop(struct net_device *dev)
amt->req_cnt = 0;
WRITE_ONCE(amt->remote_ip, 0);
- list_for_each_entry_safe(tunnel, tmp, &amt->tunnel_list, list) {
- list_del_rcu(&tunnel->list);
- amt->nr_tunnels--;
+ /* Mark every tunnel dead first, so a concurrent amt_tunnel_expire()
+ * sees ->dead and bails instead of freeing a tunnel in parallel; this
+ * path is then the sole freer.
+ */
+ spin_lock_bh(&amt->lock);
+ list_for_each_entry(tunnel, &amt->tunnel_list, list) {
+ spin_lock_bh(&tunnel->lock);
+ WRITE_ONCE(tunnel->dead, true);
+ spin_unlock_bh(&tunnel->lock);
+ }
+ spin_unlock_bh(&amt->lock);
+
+ /* Unlink one tunnel at a time with list_del_rcu() rather than splicing
+ * the list onto a local head: a lockless reader walking tunnel_list
+ * must always terminate at &amt->tunnel_list, never at a stack head.
+ */
+ for (;;) {
+ spin_lock_bh(&amt->lock);
+ tunnel = list_first_entry_or_null(&amt->tunnel_list,
+ struct amt_tunnel_list, list);
+ if (tunnel) {
+ list_del_rcu(&tunnel->list);
+ amt->nr_tunnels--;
+ }
+ spin_unlock_bh(&amt->lock);
+ if (!tunnel)
+ break;
+
cancel_delayed_work_sync(&tunnel->gc_wq);
amt_clear_groups(tunnel);
kfree_rcu(tunnel, rcu);
@@ -3152,9 +3383,9 @@ static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = {
[IFLA_AMT_RELAY_PORT] = { .type = NLA_U16 },
[IFLA_AMT_GATEWAY_PORT] = { .type = NLA_U16 },
[IFLA_AMT_LINK] = { .type = NLA_U32 },
- [IFLA_AMT_LOCAL_IP] = { .len = sizeof_field(struct iphdr, daddr) },
+ [IFLA_AMT_LOCAL_IP] = NLA_POLICY_EXACT_LEN(sizeof(__be32)),
[IFLA_AMT_REMOTE_IP] = { .len = sizeof_field(struct iphdr, daddr) },
- [IFLA_AMT_DISCOVERY_IP] = { .len = sizeof_field(struct iphdr, daddr) },
+ [IFLA_AMT_DISCOVERY_IP] = NLA_POLICY_EXACT_LEN(sizeof(__be32)),
[IFLA_AMT_MAX_TUNNELS] = { .type = NLA_U32 },
};
diff --git a/include/net/amt.h b/include/net/amt.h
index 2846dde0cadce..1b4283efa0fc8 100644
--- a/include/net/amt.h
+++ b/include/net/amt.h
@@ -240,12 +240,18 @@ struct amt_tunnel_list {
u32 nr_sources;
enum amt_status status;
struct delayed_work gc_wq;
+ /* Last time this tunnel was refreshed. gc_wq
+ * re-arms itself from this rather than being re-armed by the Update
+ * path, so the Update path cannot re-queue work for a tunnel that
+ * amt_tunnel_expire() is freeing on the timeout path.
+ */
+ unsigned long last_seen;
+ /* Set under amt->lock by whichever freer reaches the tunnel first;
+ * the other then leaves it alone, so the tunnel is freed exactly once.
+ */
+ bool dead;
__be16 source_port;
__be32 ip4;
- __be32 nonce;
- siphash_key_t key;
- u64 mac:48,
- reserved:16;
struct rcu_head rcu;
struct hlist_head groups[];
};
@@ -282,6 +288,8 @@ struct amt_source_node {
#define AMT_SOURCE_OLD 0
#define AMT_SOURCE_NEW 1
u8 flags;
+ /* Protected by gnode->tunnel_list->lock. */
+ bool dead;
struct rcu_head rcu;
};
@@ -296,6 +304,8 @@ struct amt_group_node {
struct amt_tunnel_list *tunnel_list;
struct hlist_node node;
struct delayed_work group_timer;
+ /* Protected by tunnel_list->lock. */
+ bool dead;
struct rcu_head rcu;
struct hlist_head sources[];
};
@@ -325,8 +335,10 @@ struct amt_dev {
struct work_struct event_wq;
/* AMT status */
enum amt_status status;
- /* Generated key */
- siphash_key_t key;
+ /* Current key and three previous generations keep MACs valid for
+ * 180-240s, beyond the advertised QQIC (see amt_secret_work()).
+ */
+ siphash_key_t key[4];
struct sock __rcu *sk;
u32 max_groups;
u32 max_sources;
@@ -383,6 +395,10 @@ struct amt_dev {
#define AMT_SECRET_TIMEOUT 60000
#define IANA_AMT_UDP_PORT 2268
#define AMT_MAX_TUNNELS 128
+/* Fixed per-source cap stops one verified source address from monopolising
+ * the AMT_MAX_TUNNELS-slot table.
+ */
+#define AMT_MAX_TUNNELS_PER_SRC 16
#define AMT_MAX_REQS 128
#define AMT_GW_HLEN (sizeof(struct iphdr) + \
sizeof(struct udphdr) + \
|
| 3/2 | 2026/10/16 02:44 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14854 output: 27 thoughts: 111 Thoughts: **Analyzing a Kernel Patch Series** Okay, so I need to evaluate a patch series submitted for the kernel, specifically concerning the AMT implementation. My initial approach will be to pinpoint exactly where this patch touches. Looks like it's modifying `drivers/net/amt.c` and `include/net/amt.h`. Right, AMT – Automatic Multicast Tunneling, as per RFC 7450. Now, I'm going to dig into the git changes to understand the scope and the specifics of the modification. I'll probably grep for `CONFIG_AMT` immediately; that's the obvious configuration option I'm looking for. Alternatively, I can check what config options enable the `drivers/net/amt.c` driver directly, which can give me some context, if the patches don't contain enough information. To determine how AMT is being configured in this specific context, I'll leverage a `grepper` run. This should quickly reveal the relevant configuration options and dependencies. This information will inform my assessment of the patch's impact and if it's correct. |
| 4/2 | 2026/10/16 02:44 | tool | grepper |
0mArgs:{
"Expression": "amt\\.o",
"PathPrefixes": [
"drivers/net"
]
}Results: {
"Output": "drivers/net/Makefile=17=obj-$(CONFIG_MACSEC) += macsec.o\ndrivers/net/Makefile:18:obj-$(CONFIG_AMT) += amt.o\ndrivers/net/Makefile-19-obj-$(CONFIG_MACVLAN) += macvlan.o\n"
} |
| 5/2 | 2026/10/16 02:44 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 15303 output: 26 thoughts: 34 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm deep in the kernel network driver code: **Checking the AMT Configuration** Alright, so I'm looking at the `drivers/net/Makefile` and I see this line: `obj-$(CONFIG_AMT) += amt.o`. This tells me that the `amt.o` object file, which likely contains the AMT (Adaptive Multicast Transport) driver code, will be included in the build *conditionally*. The condition is based on the `CONFIG_AMT` Kconfig symbol. My next immediate thought is to understand the implications of this configuration. What does `CONFIG_AMT` actually control? Is it enabled by default? What dependencies does it have? Are there any specific hardware requirements or platform considerations tied to it? Essentially, I need to know how this driver is controlled and what it enables. So, my next step is *definitely* going to be to open up the relevant Kconfig file and dive into the definition of `CONFIG_AMT`. Understanding the Kconfig entry will provide the context I need. It will give me the help text, dependencies, default settings, and any other relevant information. I need to know how this driver is being *configured* and how it relates to the bigger picture. |
| 6/2 | 2026/10/16 02:44 | tool | grepper |
0mArgs:{
"Expression": "config AMT",
"PathPrefixes": [
"drivers/net"
]
}Results: {
"Output": "drivers/net/Kconfig=289=config PFCP\n--\ndrivers/net/Kconfig-301-\ndrivers/net/Kconfig:302:config AMT\ndrivers/net/Kconfig-303-\ttristate \"Automatic Multicast Tunneling (AMT)\"\n"
} |
| 7/2 | 2026/10/16 02:44 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 15712 output: 34 thoughts: 22 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue: **Investigating Network Driver Configuration Dependencies** Alright, I'm diving into the network driver configuration. My initial approach is to check the `Kconfig` file within the `drivers/net` directory. Specifically, I'm honing in around line 302. This seems like a common area for exploring dependencies or relationships between different network driver options or features. I'm likely expecting to find conditional logic, "depends on" statements, or maybe even cross-references to other configuration settings that dictate which drivers get built or enabled. I want to quickly grasp how this specific configuration option interacts with the broader network stack and identify any potential conflicts or prerequisites. Let's see what we can find. |
| 8/2 | 2026/10/16 02:44 | tool | read-file |
0mArgs:{
"File": "drivers/net/Kconfig",
"FirstLine": 300,
"LineCount": 20
}Results: {
"Contents": " 300:\t\t will be called pfcp.\n 301:\t\n 302:\tconfig AMT\n 303:\t\ttristate \"Automatic Multicast Tunneling (AMT)\"\n 304:\t\tdepends on INET \u0026\u0026 IP_MULTICAST\n 305:\t\tselect NET_UDP_TUNNEL\n 306:\t\thelp\n 307:\t\t This allows one to create AMT(Automatic Multicast Tunneling)\n 308:\t\t virtual interfaces that provide multicast tunneling.\n 309:\t\t There are two roles, Gateway, and Relay.\n 310:\t\t Gateway Encapsulates IGMP/MLD traffic from listeners to the Relay.\n 311:\t\t Gateway Decapsulates multicast traffic from the Relay to Listeners.\n 312:\t\t Relay Encapsulates multicast traffic from Sources to Gateway.\n 313:\t\t Relay Decapsulates IGMP/MLD traffic from Gateway.\n 314:\t\n 315:\t\t To compile this drivers as a module, choose M here: the module\n 316:\t\t will be called amt.\n 317:\t\n 318:\tconfig MACSEC\n 319:\t\ttristate \"IEEE 802.1AE MAC-level encryption (MACsec)\"\n"
} |
| 9/2 | 2026/10/16 02:44 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 16270 output: 36 thoughts: 77 Thoughts: Okay, let me break this down. **My Analysis of AMT (Automatic Multicast Tunneling) Dependencies and Implementation** Right, so I'm seeing that the `CONFIG_AMT` configuration option is contingent on both `INET` and `IP_MULTICAST` being enabled. That's the starting point. This suggests that AMT is deeply intertwined with standard IP networking and relies heavily on multicast capabilities. The first logical question is, is AMT itself a virtual network device, and the text definitively states that it is. It creates these virtual interfaces for multicast tunneling. Next, I need to understand *how* these virtual interfaces are created. The text points directly to `rtnl_link_ops`, which strongly suggests that the standard Netlink interface for managing network links is the mechanism at play here. This is exactly what I would expect in a well-designed network device implementation. Now, my next step is clear: I need to dig into the creation and usage of these AMT devices. I want to see the specific code paths, data structures, and interactions with `rtnl_link_ops` to fully grasp the implementation details. I need to understand how these interfaces are brought up, configured, how they interact with the multicast routing infrastructure, and how they actually tunnel multicast traffic. That's where I need to focus my efforts to get a complete picture of the implementation. |
| 10/2 | 2026/10/16 02:44 | tool | grepper |
0mArgs:{
"Expression": "rtnl_link_ops.*amt",
"PathPrefixes": [
"drivers/net/amt.c"
]
}Results: {
"Output": "drivers/net/amt.c=3577=static int amt_fill_info(struct sk_buff *skb, const struct net_device *dev)\n--\ndrivers/net/amt.c-3610-\ndrivers/net/amt.c:3611:static struct rtnl_link_ops amt_link_ops __read_mostly = {\ndrivers/net/amt.c-3612-\t.kind\t\t= \"amt\",\n"
} |
| 11/2 | 2026/10/16 02:44 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 16789 output: 30 thoughts: 1822 Thoughts: **AMT Driver Patch Analysis and Fuzzing Strategy** Okay, so AMT devices are netlink rtnetlink virtual devices, which is great because syzkaller can interact with them directly using netlink or UDP. I need to see if syzkaller has built-in support or if it can use generic rtnl descriptions for device creation. This patch is interesting. It's a significant refactoring of the AMT driver. Looking at the changes: there's careful handling of `dead` flags to prevent use-after-free and race conditions in `amt_destroy_source`, `amt_del_group`, `amt_source_work`, and `amt_group_work`. The reordering of locks and checks in `amt_source_work` looks crucial for preventing race conditions. There's also the move to `DEV_STATS_INC` and passing values directly (instead of pointers) for communication with igmp/mld queries. The shift from a single key to four key generations in `amt_secret_work` is a clear security enhancement. The way that tunnels are now allocated, only in `amt_tunnel_get_or_create` after MAC verification, is a major improvement over the old, less secure method. There's also the new `AMT_MAX_TUNNELS_PER_SRC` limit, a good defense against DoS. The updates in `amt_update_handler` with the MAC validation and `last_seen` update are important, and the new stateless `amt_request_handler` is a fundamental change, with added checks like the source address comparison in `amt_rcv`. This looks like a complete overhaul of the tunnel lifecycle. Finally, the new `amt_dev_open`, `amt_dev_stop`, and the `NLA_POLICY_EXACT_LEN` configuration are all part of a larger cleanup. Given that this driver runs in a standard Linux environment and is a virtual network device, it's definitely reachable. The changes address race conditions, UAFs, and possible DoS vectors. This makes it definitely worth fuzzing, based on the criteria in Section 3, because it's a refactoring of reachable code and touches core networking. From Section 4, it looks like the focus symbols should be the functions that actually implement the logic that's being added or changed. I'll need to focus on things like `amt_tunnel_get_or_create`, `amt_tunnel_expire`, `amt_request_handler`, `amt_update_handler`, `amt_membership_query_handler`, `amt_source_work`, `amt_group_work`, `amt_secret_work`, `amt_dev_xmit`, `amt_rcv`, `amt_dev_open`, and `amt_dev_stop`. Checking the object file, I can see that the majority of these are non-static and not inlined, so they should be good focus symbols. These are directly implementing the altered logic in AMT. Next, I need to check the configurations involved, searching for `#ifdef` and `IS_ENABLED` in `drivers/net/amt.c` and its dependencies. This will help determine what configurations need to be enabled during fuzzing. |
| 12/2 | 2026/10/16 02:44 | tool | grepper |
0mArgs:{
"Expression": "CONFIG_",
"PathPrefixes": [
"drivers/net/amt.c"
]
}Results: {
"Output": "drivers/net/amt.c=75=static struct igmpv3_grec igmpv3_zero_grec;\ndrivers/net/amt.c-76-\ndrivers/net/amt.c:77:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-78-#define MLD2_ALL_NODE_INIT { { { 0xff, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 } } }\n--\ndrivers/net/amt.c=216=static void amt_destroy_source(struct amt_source_node *snode)\n--\ndrivers/net/amt.c-232-\t\t\t \u0026gnode-\u003egroup_addr.ip4);\ndrivers/net/amt.c:233:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-234-\t} else {\n--\ndrivers/net/amt.c=251=static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode)\n--\ndrivers/net/amt.c-267-\t\t\t \u0026gnode-\u003egroup_addr.ip4);\ndrivers/net/amt.c:268:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-269-\telse\n--\ndrivers/net/amt.c=321=static void amt_act_src(struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c-362-\t\t\t action_str[act]);\ndrivers/net/amt.c:363:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-364-\telse\n--\ndrivers/net/amt.c=478=static struct amt_group_node *amt_add_group(struct amt_dev *amt,\n--\ndrivers/net/amt.c-514-\t\t\t \u0026gnode-\u003egroup_addr.ip4);\ndrivers/net/amt.c:515:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-516-\telse\n--\ndrivers/net/amt.c=817=static void amt_send_igmp_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,\n--\ndrivers/net/amt.c-833-\ndrivers/net/amt.c:834:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-835-static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)\n--\ndrivers/net/amt.c=1223=static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)\n--\ndrivers/net/amt.c-1228-\tunion amt_addr group = {0,};\ndrivers/net/amt.c:1229:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1230-\tstruct ipv6hdr *ip6h;\n--\ndrivers/net/amt.c-1259-\t\tgroup.ip4 = ip_hdr(skb)-\u003edaddr;\ndrivers/net/amt.c:1260:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1261-\t} else if (iph-\u003eversion == 6) {\n--\ndrivers/net/amt.c-1320-\t\t\t\t\t\tgoto found;\ndrivers/net/amt.c:1321:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1322-\t\t\t\t} else {\n--\ndrivers/net/amt.c=1416=static void amt_cleanup_srcs(struct amt_dev *amt,\n--\ndrivers/net/amt.c-1440-\t\t\t\t\t \u0026gnode-\u003egroup_addr.ip4);\ndrivers/net/amt.c:1441:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1442-\t\t\telse\n--\ndrivers/net/amt.c=1452=static void amt_add_srcs(struct amt_dev *amt, struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c-1457-\tstruct amt_source_node *snode;\ndrivers/net/amt.c:1458:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1459-\tstruct mld2_grec *mld_grec;\n--\ndrivers/net/amt.c-1469-\t} else {\ndrivers/net/amt.c:1470:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1471-\t\tmld_grec = grec;\n--\ndrivers/net/amt.c-1481-\t\t\tsrc.ip4 = igmp_grec-\u003egrec_src[i];\ndrivers/net/amt.c:1482:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1483-\t\telse\n--\ndrivers/net/amt.c-1501-\t\t\t\t\t \u0026gnode-\u003egroup_addr.ip4);\ndrivers/net/amt.c:1502:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1503-\t\t\telse\n--\ndrivers/net/amt.c=1532=static void amt_lookup_act_srcs(struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c-1542-\tstruct igmpv3_grec *igmp_grec;\ndrivers/net/amt.c:1543:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1544-\tstruct mld2_grec *mld_grec;\n--\ndrivers/net/amt.c-1554-\t} else {\ndrivers/net/amt.c:1555:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1556-\t\tmld_grec = grec;\n--\ndrivers/net/amt.c-1569-\t\t\t\tsrc.ip4 = igmp_grec-\u003egrec_src[i];\ndrivers/net/amt.c:1570:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1571-\t\t\telse\n--\ndrivers/net/amt.c-1592-\t\t\t\tsrc.ip4 = igmp_grec-\u003egrec_src[i];\ndrivers/net/amt.c:1593:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1594-\t\t\telse\n--\ndrivers/net/amt.c-1613-\t\t\t\t\t\tsrc.ip4 = igmp_grec-\u003egrec_src[j];\ndrivers/net/amt.c:1614:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1615-\t\t\t\t\telse\n--\ndrivers/net/amt.c=1626=out_sub:;\n--\ndrivers/net/amt.c-1634-\t\t\t\tsrc.ip4 = igmp_grec-\u003egrec_src[i];\ndrivers/net/amt.c:1635:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-1636-\t\t\telse\n--\ndrivers/net/amt.c=2134=static void amt_igmp_report_handler(struct amt_dev *amt, struct sk_buff *skb,\n--\ndrivers/net/amt.c-2153-\ndrivers/net/amt.c:2154:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-2155-/* RFC 3810\n--\ndrivers/net/amt.c=2356=static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb)\n--\ndrivers/net/amt.c-2395-\t\tip_eth_mc_map(iph-\u003edaddr, eth-\u003eh_dest);\ndrivers/net/amt.c:2396:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-2397-\t} else if (iph-\u003eversion == 6) {\n--\ndrivers/net/amt.c=2427=static bool amt_membership_query_handler(struct amt_dev *amt,\n--\ndrivers/net/amt.c-2493-\t\tip_eth_mc_map(iph-\u003edaddr, eth-\u003eh_dest);\ndrivers/net/amt.c:2494:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-2495-\t} else if (iph-\u003eversion == 6) {\n--\ndrivers/net/amt.c=2629=static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)\n--\ndrivers/net/amt.c-2734-\t\tip_eth_mc_map(iph-\u003edaddr, eth-\u003eh_dest);\ndrivers/net/amt.c:2735:#if IS_ENABLED(CONFIG_IPV6)\ndrivers/net/amt.c-2736-\t} else if (iph-\u003eversion == 6) {\n"
} |
| 13/2 | 2026/10/16 02:44 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 21695 output: 20 thoughts: 259 Thoughts: **AMT and IPv6 Integration** Okay, so I'm looking at this diff, specifically the changes surrounding AMT (Automatic Multicast Tunneling). The key thing jumping out at me is the conditional compilation based on `CONFIG_IPV6`. It's pretty clear that enabling IPv6 functionality, which includes MLD (Multicast Listener Discovery) queries, also enables support for IPv6 multicast in AMT. I'm seeing that the `amt_build_mld_gq` function is only defined when IPv6 is enabled, and the `amt_send_mld_gq` function has different behavior based on the `CONFIG_IPV6` flag. One of them is a no-op when IPv6 isn't enabled. The Kconfig entry confirms this, stating that the AMT feature is a tristate, depending on `INET` and `IP_MULTICAST`, and also selects `NET_UDP_TUNNEL`. It's worth noting here that `IPV6` enables MLD queries, which suggests a tight coupling between IPv6 and this MLD-specific functionality. Given this configuration, I should look into how `IP_MULTICAST` is handled, especially in the context of IPv4, to get a holistic view of the multicast architecture. I should check how `IP_MULTICAST` is defined and used. |
| 14/2 | 2026/10/16 02:45 | tool | grepper |
0mArgs:{
"Expression": "config IP_MULTICAST"
}Results: {
"Output": "net/ipv4/Kconfig-4-#\nnet/ipv4/Kconfig:5:config IP_MULTICAST\nnet/ipv4/Kconfig-6-\tbool \"IP: multicasting\"\n"
} |
| 15/2 | 2026/10/16 02:45 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 22315 output: 237 thoughts: 797 Thoughts: **AMT Driver: Focused Analysis and Fuzzing Strategy** Okay, let's take a look at this. First, I need to verify which configurations are relevant. I see `AMT`, `INET`, `IP_MULTICAST`, and `IPV6`. Given that `NET_UDP_TUNNEL` is selected by `AMT`, that feels right too. Now, let's dive into the core changes within `drivers/net/amt.c`. I'm going to quickly review the modified and added functions. A lot here… I see modifications to: `amt_destroy_source`, `amt_del_group`, `amt_source_work`, `amt_group_work`, `amt_send_discovery`, `amt_send_request`, `amt_send_membership_query`, `amt_send_igmp_gq`, `amt_send_mld_gq`, `amt_secret_work`, `amt_dev_xmit`, `amt_tunnel_expire`, `amt_membership_query_handler`, `amt_update_handler`, `amt_request_handler`, `amt_rcv`, `amt_dev_open`, and `amt_dev_stop`. And two additions, `amt_tunnel_lookup` and `amt_tunnel_get_or_create`. It's clear these are all specifically part of the AMT driver. No generic functions here. That's good; it keeps the scope focused. Now, let's identify the most significant symbols that capture the new and modified logic. I think these really highlight the meat of the changes: * `amt_request_handler`: Completely reworked to be stateless. * `amt_update_handler`: Now performs MAC verification across four key generations and handles tunnel allocation. * `amt_tunnel_get_or_create`: New function dealing with tunnel allocation, per-source limits, and RCU list insertion. * `amt_tunnel_expire`: Re-arms timer logic, incorporates dead flag synchronization. * `amt_membership_query_handler`: This checks `remote_ip` and handles queries. * `amt_dev_stop`: This has reworked tunnel cleanup and dead flagging. * `amt_dev_xmit`: This handles gateway mode and stats. * `amt_group_work`: Checks the dead flag, handles cleanup. * `amt_source_work`: Checks the dead flag, now with lock ordering. * `amt_rcv`: Dispatches incoming AMT packets. Let's double-check the configs one more time: `AMT`, `IP_MULTICAST`, `INET`, and `IPV6`. Okay, time to review the instructions. I need to make sure I'm setting this up correctly. * `WorthFuzzing`: True * `FocusSymbols`: Ready to go * `EnableConfigs`: I have them without the `CONFIG_` prefix. * `Reasoning`: Got it. Is `WorthFuzzing` true? Absolutely. This patch digs deep into `drivers/net/amt.c`, dealing with an important virtual network device (AMT – Automatic Multicast Tunneling). It's grappling with concurrency, race conditions, timer management, state machine transitions, the potential for DoS vulnerabilities, and memory lifetime concerns (dead flags, locking, RCU list management, tunnel allocation, and key rotation). This code is absolutely reachable in standard virtualized environments (QEMU/GCE), no special hardware needed. Netlink device creation, UDP packet reception, and xmit are all entry points. Now I'm ready to prepare the call to `set-results`. |
| 16/2 | 2026/10/16 02:45 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"AMT",
"IP_MULTICAST",
"INET",
"IPV6"
],
"FocusSymbols": [
"amt_tunnel_get_or_create",
"amt_update_handler",
"amt_request_handler",
"amt_tunnel_expire",
"amt_dev_stop",
"amt_group_work",
"amt_source_work",
"amt_membership_query_handler",
"amt_rcv",
"amt_dev_xmit"
],
"Reasoning": "The patch modifies drivers/net/amt.c, a virtual network device driver for Automatic Multicast Tunneling. It addresses concurrency, memory lifecycle, race conditions, and DoS vectors by restructuring tunnel allocation (moving it from request to update handler after MAC verification), altering delayed work handlers with dead flags and lock ordering, implementing 4-generation key rotation for SipHash, and reworking device shutdown. This code is fully reachable in standard QEMU environments via rtnetlink and UDP/IP networking.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"AMT",
"IP_MULTICAST",
"INET",
"IPV6"
],
"FocusSymbols": [
"amt_tunnel_get_or_create",
"amt_update_handler",
"amt_request_handler",
"amt_tunnel_expire",
"amt_dev_stop",
"amt_group_work",
"amt_source_work",
"amt_membership_query_handler",
"amt_rcv",
"amt_dev_xmit"
],
"Reasoning": "The patch modifies drivers/net/amt.c, a virtual network device driver for Automatic Multicast Tunneling. It addresses concurrency, memory lifecycle, race conditions, and DoS vectors by restructuring tunnel allocation (moving it from request to update handler after MAC verification), altering delayed work handlers with dead flags and lock ordering, implementing 4-generation key rotation for SipHash, and reworking device shutdown. This code is fully reachable in standard QEMU environments via rtnetlink and UDP/IP networking.",
"WorthFuzzing": true
} |
| 17/1 | 2026/10/16 02:45 | action | If |
1mArgs:{
"WorthFuzzing": true
}Results: null |
| 18/2 | 2026/10/16 02:45 | agent | kmsan-evaluator |
1mModel:core Args: null Results: {
"KMSANReasoning": "The patch addresses lifetime management, concurrency/race conditions, and denial-of-service vectors in the AMT (Automatic Multicast Tunneling) driver (drivers/net/amt.c). Specifically, it introduces 'dead' flags and adjusts locking to prevent use-after-free and double-free races during workqueue execution and device teardown, defers tunnel allocation until membership updates are cryptographically authenticated via rotated siphash keys, and converts netdev stats increments to DEV_STATS_INC().\n\nKASAN vs KMSAN applicability:\n- KASAN/LOCKDEP: Any remaining or introduced concurrency bugs, lifecycle issues, or races would manifest as use-after-free (UAF), double-free, or locking inconsistencies, which are actively monitored by KASAN and LOCKDEP.\n- KMSAN: There are no uninitialized memory risks. All structures containing modified or new fields (amt_tunnel_list, amt_source_node, amt_group_node, amt_dev) are allocated using kzalloc, kzalloc_obj, or netdev private allocation (which zeroes memory). The new siphash key array (amt-\u003ekey[4]) is seeded via get_random_bytes() upon device open and rotated securely. No uninitialized kernel memory or padding is exposed or copied to user space. Therefore, a dedicated KMSAN fuzzing session is not justified.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 8dfd7565b506320bdb64910e1551f65f88be4485
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Oct 16 02:44:22 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index b53f8ec556615..ba2734c672f78 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -215,9 +215,14 @@ static struct amt_group_node *amt_lookup_group(struct amt_tunnel_list *tunnel,
static void amt_destroy_source(struct amt_source_node *snode)
{
- struct amt_group_node *gnode = snode->gnode;
+ struct amt_group_node *gnode;
struct amt_tunnel_list *tunnel;
+ if (READ_ONCE(snode->dead))
+ return;
+ WRITE_ONCE(snode->dead, true);
+ gnode = snode->gnode;
+
tunnel = gnode->tunnel_list;
if (!gnode->v6) {
@@ -249,6 +254,9 @@ static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode)
struct hlist_node *t;
int i;
+ if (READ_ONCE(gnode->dead))
+ return;
+ WRITE_ONCE(gnode->dead, true);
if (cancel_delayed_work(&gnode->group_timer))
dev_put(amt->dev);
hlist_del_rcu(&gnode->node);
@@ -282,25 +290,32 @@ static void amt_source_work(struct work_struct *work)
struct amt_source_node *snode = container_of(to_delayed_work(work),
struct amt_source_node,
source_timer);
- struct amt_group_node *gnode = snode->gnode;
- struct amt_dev *amt = gnode->amt;
+ struct amt_group_node *gnode;
+ struct amt_dev *amt;
struct amt_tunnel_list *tunnel;
- tunnel = gnode->tunnel_list;
- spin_lock_bh(&tunnel->lock);
rcu_read_lock();
+ gnode = READ_ONCE(snode->gnode);
+ amt = READ_ONCE(gnode->amt);
+ tunnel = READ_ONCE(gnode->tunnel_list);
+ spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(snode->dead) || READ_ONCE(gnode->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ rcu_read_unlock();
+ return;
+ }
if (gnode->filter_mode == MCAST_INCLUDE) {
amt_destroy_source(snode);
if (!gnode->nr_sources)
amt_del_group(amt, gnode);
} else {
- /* When a router filter-mode for a group is EXCLUDE,
- * source records are only deleted when the group timer expires
+ /* When a router filter-mode for the group is EXCLUDE, source
+ * records are only deleted when the group timer expires.
*/
snode->status = AMT_SOURCE_STATUS_D_FWD;
}
- rcu_read_unlock();
spin_unlock_bh(&tunnel->lock);
+ rcu_read_unlock();
}
static void amt_act_src(struct amt_tunnel_list *tunnel,
@@ -403,26 +418,35 @@ static void amt_group_work(struct work_struct *work)
struct amt_group_node *gnode = container_of(to_delayed_work(work),
struct amt_group_node,
group_timer);
- struct amt_tunnel_list *tunnel = gnode->tunnel_list;
- struct amt_dev *amt = gnode->amt;
+ struct amt_tunnel_list *tunnel;
+ struct amt_dev *amt;
struct amt_source_node *snode;
bool delete_group = true;
struct hlist_node *t;
int i, buckets;
+ rcu_read_lock();
+ tunnel = READ_ONCE(gnode->tunnel_list);
+ amt = READ_ONCE(gnode->amt);
buckets = amt->hash_buckets;
spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(gnode->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ rcu_read_unlock();
+ dev_put(amt->dev);
+ return;
+ }
if (gnode->filter_mode == MCAST_INCLUDE) {
/* Not Used */
spin_unlock_bh(&tunnel->lock);
- goto out;
+ rcu_read_unlock();
+ dev_put(amt->dev);
+ return;
}
- rcu_read_lock();
- for (i = 0; i < buckets; i++) {
- hlist_for_each_entry_safe(snode, t,
- &gnode->sources[i], node) {
+ for (i = 0; i < buckets; i++)
+ hlist_for_each_entry_safe(snode, t, &gnode->sources[i], node) {
if (!delayed_work_pending(&snode->source_timer) ||
snode->status == AMT_SOURCE_STATUS_D_FWD) {
amt_destroy_source(snode);
@@ -431,14 +455,12 @@ static void amt_group_work(struct work_struct *work)
snode->status = AMT_SOURCE_STATUS_FWD;
}
}
- }
if (delete_group)
amt_del_group(amt, gnode);
else
gnode->filter_mode = MCAST_INCLUDE;
- rcu_read_unlock();
spin_unlock_bh(&tunnel->lock);
-out:
+ rcu_read_unlock();
dev_put(amt->dev);
}
@@ -628,7 +650,7 @@ static void amt_send_discovery(struct amt_dev *amt)
IPPROTO_UDP, 0,
amt->stream_dev->ifindex);
if (IS_ERR(rt)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -638,7 +660,7 @@ static void amt_send_discovery(struct amt_dev *amt)
skb = netdev_alloc_skb_ip_align(amt->dev, len);
if (!skb) {
ip_rt_put(rt);
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -683,7 +705,7 @@ static void amt_send_discovery(struct amt_dev *amt)
ip_send_check(iph);
err = ip_local_out(amt->net, sk, skb);
if (unlikely(net_xmit_eval(err)))
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
amt_update_gw_status(amt, AMT_STATUS_SENT_DISCOVERY, true);
out:
@@ -719,7 +741,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
IPPROTO_UDP, 0,
amt->stream_dev->ifindex);
if (IS_ERR(rt)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -729,7 +751,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
skb = netdev_alloc_skb_ip_align(amt->dev, len);
if (!skb) {
ip_rt_put(rt);
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -776,7 +798,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
ip_send_check(iph);
err = ip_local_out(amt->net, sk, skb);
if (unlikely(net_xmit_eval(err)))
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
out:
rcu_read_unlock();
@@ -784,11 +806,16 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
static bool amt_send_membership_query(struct amt_dev *amt,
struct sk_buff *skb,
- struct amt_tunnel_list *tunnel,
+ __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac,
bool v6);
-static void amt_send_igmp_gq(struct amt_dev *amt,
- struct amt_tunnel_list *tunnel)
+/* The destination is passed by value rather than as a tunnel: the requesting
+ * source is not authenticated yet and no tunnel state exists for it - see
+ * amt_request_handler().
+ */
+static void amt_send_igmp_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac)
{
struct sk_buff *skb;
@@ -797,8 +824,9 @@ static void amt_send_igmp_gq(struct amt_dev *amt,
return;
skb_pull(skb, sizeof(struct ethhdr));
- if (amt_send_membership_query(amt, skb, tunnel, false)) {
- amt->dev->stats.tx_dropped++;
+ if (amt_send_membership_query(amt, skb, daddr, dport, nonce, mac,
+ false)) {
+ DEV_STATS_INC(amt->dev, tx_dropped);
kfree_skb(skb);
}
}
@@ -842,7 +870,7 @@ static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)
if (ipv6_dev_get_saddr(amt->net, amt->dev, &ip6h->daddr, 0,
&ip6h->saddr)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
kfree_skb(skb);
return NULL;
}
@@ -876,7 +904,8 @@ static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt)
return skb;
}
-static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)
+static void amt_send_mld_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac)
{
struct sk_buff *skb;
@@ -885,13 +914,15 @@ static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)
return;
skb_pull(skb, sizeof(struct ethhdr));
- if (amt_send_membership_query(amt, skb, tunnel, true)) {
- amt->dev->stats.tx_dropped++;
+ if (amt_send_membership_query(amt, skb, daddr, dport, nonce, mac,
+ true)) {
+ DEV_STATS_INC(amt->dev, tx_dropped);
kfree_skb(skb);
}
}
#else
-static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel)
+static void amt_send_mld_gq(struct amt_dev *amt, __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac)
{
}
#endif
@@ -925,7 +956,14 @@ static void amt_secret_work(struct work_struct *work)
secret_wq);
spin_lock_bh(&amt->lock);
- get_random_bytes(&amt->key, sizeof(siphash_key_t));
+ /* Keep three previous generations for a 180-240s MAC lifetime.
+ * Its 180s floor exceeds the advertised QQIC (amt->qi, 125s),
+ * allowing the gateway to renew its MAC with a periodic Request.
+ */
+ amt->key[3] = amt->key[2];
+ amt->key[2] = amt->key[1];
+ amt->key[1] = amt->key[0];
+ get_random_bytes(&amt->key[0], sizeof(siphash_key_t));
spin_unlock_bh(&amt->lock);
mod_delayed_work(amt_wq, &amt->secret_wq,
msecs_to_jiffies(AMT_SECRET_TIMEOUT));
@@ -1115,9 +1153,16 @@ static void amt_send_multicast_data(struct amt_dev *amt,
0);
}
+/* Send a Membership Query to a source that has not been authenticated yet.
+ *
+ * No per-source state exists at this point and none is created: the nonce and
+ * the keyed MAC are carried in the Query and recomputed from the Membership
+ * Update when it comes back, so everything this needs is passed by value.
+ */
static bool amt_send_membership_query(struct amt_dev *amt,
struct sk_buff *skb,
- struct amt_tunnel_list *tunnel,
+ __be32 daddr, __be16 dport,
+ __be32 nonce, u64 mac,
bool v6)
{
struct amt_header_membership_query *amtmq;
@@ -1138,13 +1183,13 @@ static bool amt_send_membership_query(struct amt_dev *amt,
skb_reset_inner_headers(skb);
memset(&fl4, 0, sizeof(struct flowi4));
fl4.flowi4_oif = amt->stream_dev->ifindex;
- fl4.daddr = tunnel->ip4;
+ fl4.daddr = daddr;
fl4.saddr = amt->local_ip;
fl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS);
fl4.flowi4_proto = IPPROTO_UDP;
rt = ip_route_output_key(amt->net, &fl4);
if (IS_ERR(rt)) {
- netdev_dbg(amt->dev, "no route to %pI4\n", &tunnel->ip4);
+ netdev_dbg(amt->dev, "no route to %pI4\n", &daddr);
return true;
}
@@ -1154,8 +1199,8 @@ static bool amt_send_membership_query(struct amt_dev *amt,
amtmq->reserved = 0;
amtmq->l = 0;
amtmq->g = 0;
- amtmq->nonce = tunnel->nonce;
- amtmq->response_mac = tunnel->mac;
+ amtmq->nonce = nonce;
+ amtmq->response_mac = mac;
if (!v6)
skb_set_inner_protocol(skb, htons(ETH_P_IP));
@@ -1168,11 +1213,10 @@ static bool amt_send_membership_query(struct amt_dev *amt,
ip4_dst_hoplimit(&rt->dst),
0,
amt->relay_port,
- tunnel->source_port,
+ dport,
false,
false,
0);
- amt_update_relay_status(tunnel, AMT_STATUS_SENT_QUERY, true);
return false;
}
@@ -1236,7 +1280,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
group.ip6 = ipv6_hdr(skb)->daddr;
#endif
} else {
- dev->stats.tx_errors++;
+ DEV_STATS_INC(dev, tx_errors);
goto free;
}
@@ -1249,12 +1293,21 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
/* Gateway only passes IGMP/MLD packets */
if (!report)
goto free;
+ /* A validated report can only be forwarded after the relay's
+ * family-specific Membership Query supplies the state echoed
+ * by the Membership Update. Log this readiness failure before
+ * the shared drop path accounts it.
+ */
if ((!v6 && !READ_ONCE(amt->ready4)) ||
- (v6 && !READ_ONCE(amt->ready6)))
+ (v6 && !READ_ONCE(amt->ready6))) {
+ netdev_dbg(dev, "drop %s report: waiting for Membership Query\n",
+ v6 ? "MLD" : "IGMP");
goto free;
+ }
if (amt_send_membership_update(amt, skb, v6))
goto free;
- goto unlock;
+ /* Sent: the tunnel consumed the skb. Not a drop. */
+ return NETDEV_TX_OK;
} else if (amt->mode == AMT_MODE_RELAY) {
if (!data)
goto free;
@@ -1283,8 +1336,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
return NETDEV_TX_OK;
free:
dev_kfree_skb(skb);
-unlock:
- dev->stats.tx_dropped++;
+ DEV_STATS_INC(dev, tx_dropped);
return NETDEV_TX_OK;
}
@@ -1328,8 +1380,30 @@ static void amt_tunnel_expire(struct work_struct *work)
struct amt_tunnel_list,
gc_wq);
struct amt_dev *amt = tunnel->amt;
+ unsigned long deadline;
spin_lock_bh(&amt->lock);
+ /* amt_dev_stop() has taken ownership of the teardown. */
+ if (READ_ONCE(tunnel->dead)) {
+ spin_unlock_bh(&amt->lock);
+ return;
+ }
+ /* A Membership Update may have refreshed the tunnel after this work
+ * was queued. Re-arm from last_seen rather than letting
+ * amt_update_handler() re-arm gc_wq: this handler is then the only
+ * context that frees the tunnel on the timeout path; amt_dev_stop()
+ * still owns teardown during device shutdown.
+ */
+ deadline = READ_ONCE(tunnel->last_seen) +
+ msecs_to_jiffies(amt_gmi(amt)) * 3;
+ if (time_before(jiffies, deadline)) {
+ mod_delayed_work(amt_wq, &tunnel->gc_wq, deadline - jiffies);
+ spin_unlock_bh(&amt->lock);
+ return;
+ }
+ spin_lock_bh(&tunnel->lock);
+ WRITE_ONCE(tunnel->dead, true);
+ spin_unlock_bh(&tunnel->lock);
rcu_read_lock();
list_del_rcu(&tunnel->list);
amt->nr_tunnels--;
@@ -2369,6 +2443,10 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
if (amtmq->reserved || amtmq->version)
return true;
+ /* A deferred query may outlive a relay address change. */
+ if (ip_hdr(skb)->saddr != READ_ONCE(amt->remote_ip))
+ return true;
+
if (amtmq->nonce != amt->nonce)
return true;
@@ -2461,16 +2539,106 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
return false;
}
+/* The tunnel of the gateway endpoint @saddr:@sport, or NULL. */
+static struct amt_tunnel_list *amt_tunnel_lookup(struct amt_dev *amt,
+ __be32 saddr, __be16 sport)
+{
+ struct amt_tunnel_list *tunnel;
+
+ list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list)
+ if (tunnel->ip4 == saddr && tunnel->source_port == sport)
+ return tunnel;
+ return NULL;
+}
+
+/* Look up the tunnel for a source whose Membership Update has already been
+ * authenticated, creating it on first contact.
+ *
+ * This is now the only place tunnel state is allocated, so amt->max_tunnels
+ * bounds the number of *verified* gateways rather than the number of
+ * unverified Requests anyone can send. A fixed per-source cap additionally
+ * stops one verified source address from monopolising the table.
+ */
+static struct amt_tunnel_list *amt_tunnel_get_or_create(struct amt_dev *amt,
+ __be32 saddr,
+ __be16 sport)
+{
+ struct amt_tunnel_list *tunnel;
+ int per_src = 0;
+ int i;
+
+ tunnel = amt_tunnel_lookup(amt, saddr, sport);
+ if (tunnel)
+ return tunnel;
+
+ spin_lock_bh(&amt->lock);
+
+ /* Re-check under the lock in case a concurrent Update won the race, and
+ * count how many tunnels this source already holds on the same walk.
+ */
+ list_for_each_entry(tunnel, &amt->tunnel_list, list) {
+ if (tunnel->ip4 != saddr)
+ continue;
+ if (tunnel->source_port == sport) {
+ spin_unlock_bh(&amt->lock);
+ return tunnel;
+ }
+ per_src++;
+ }
+
+ if (amt->nr_tunnels >= amt->max_tunnels ||
+ per_src >= AMT_MAX_TUNNELS_PER_SRC) {
+ spin_unlock_bh(&amt->lock);
+ return NULL;
+ }
+
+ if (!netif_running(amt->dev)) {
+ spin_unlock_bh(&amt->lock);
+ return NULL;
+ }
+
+ tunnel = kzalloc(sizeof(*tunnel) +
+ (sizeof(struct hlist_head) * amt->hash_buckets),
+ GFP_ATOMIC);
+ if (!tunnel) {
+ spin_unlock_bh(&amt->lock);
+ return NULL;
+ }
+
+ tunnel->source_port = sport;
+ tunnel->ip4 = saddr;
+ tunnel->amt = amt;
+ spin_lock_init(&tunnel->lock);
+ for (i = 0; i < amt->hash_buckets; i++)
+ INIT_HLIST_HEAD(&tunnel->groups[i]);
+
+ tunnel->last_seen = jiffies;
+ INIT_DELAYED_WORK(&tunnel->gc_wq, amt_tunnel_expire);
+ __amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_UPDATE, false);
+
+ /* Publish only once the entry is fully initialised. */
+ list_add_tail_rcu(&tunnel->list, &amt->tunnel_list);
+ amt->nr_tunnels++;
+ mod_delayed_work(amt_wq, &tunnel->gc_wq,
+ msecs_to_jiffies(amt_gmi(amt)) * 3);
+ spin_unlock_bh(&amt->lock);
+
+ return tunnel;
+}
+
static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
{
struct amt_header_membership_update *amtmu;
struct amt_tunnel_list *tunnel;
struct ethhdr *eth;
struct iphdr *iph;
- int len, hdr_size;
+ siphash_key_t key[4];
+ int len, hdr_size, i;
u64 response_mac;
+ bool verified = false;
__be32 saddr;
__be32 nonce;
+ __be16 sport;
saddr = ip_hdr(skb)->saddr;
@@ -2484,30 +2652,58 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
nonce = amtmu->nonce;
response_mac = amtmu->response_mac;
+ /* Snapshot the tunnel endpoint port before the encap is stripped. */
+ sport = udp_hdr(skb)->source;
- if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false))
- return true;
+ /* Recompute the MAC handed out in the Membership Query. Four live
+ * secrets cover 180-240s, exceeding the advertised QQIC (amt->qi,
+ * 125s), so a periodic Request can renew the MAC before it expires.
+ * Authenticate before decapsulation or allocating tunnel state.
+ */
+ spin_lock_bh(&amt->lock);
+ for (i = 0; i < ARRAY_SIZE(key); i++)
+ key[i] = amt->key[i];
+ spin_unlock_bh(&amt->lock);
- skb_reset_network_header(skb);
+ for (i = 0; i < ARRAY_SIZE(key); i++) {
+ u64 mac = siphash_3u32((__force u32)saddr,
+ (__force u32)sport,
+ (__force u32)nonce,
+ &key[i]) >> 16;
- list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) {
- if (tunnel->ip4 == saddr) {
- if ((nonce == tunnel->nonce &&
- response_mac == tunnel->mac)) {
- mod_delayed_work(amt_wq, &tunnel->gc_wq,
- msecs_to_jiffies(amt_gmi(amt))
- * 3);
- goto report;
- } else {
- netdev_dbg(amt->dev, "Invalid MAC\n");
- return true;
- }
+ if (response_mac == mac) {
+ verified = true;
+ break;
}
}
- return true;
+ if (!verified) {
+ netdev_dbg(amt->dev, "Invalid MAC\n");
+ return true;
+ }
+
+ tunnel = amt_tunnel_get_or_create(amt, saddr, sport);
+ if (!tunnel) {
+ /* Out of tunnel slots. Unlike the Request path this reply only
+ * ever goes to a source that proved it received our Query,
+ * so it
+ * cannot be used to reflect at a spoofed third party.
+ */
+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+ return true;
+ }
+
+ /* Refresh liveness only. gc_wq is re-armed by amt_tunnel_expire()
+ * itself from last_seen, never from here, so this cannot re-queue the
+ * work of a tunnel that is being freed.
+ */
+ WRITE_ONCE(tunnel->last_seen, jiffies);
+
+ if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false))
+ return true;
+
+ skb_reset_network_header(skb);
-report:
if (!pskb_may_pull(skb, sizeof(*iph)))
return true;
@@ -2522,6 +2718,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
}
spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(tunnel->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ return true;
+ }
amt_igmp_report_handler(amt, skb, tunnel);
spin_unlock_bh(&tunnel->lock);
@@ -2542,6 +2742,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
}
spin_lock_bh(&tunnel->lock);
+ if (READ_ONCE(tunnel->dead)) {
+ spin_unlock_bh(&tunnel->lock);
+ return true;
+ }
amt_mld_report_handler(amt, skb, tunnel);
spin_unlock_bh(&tunnel->lock);
@@ -2601,7 +2805,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
IPPROTO_UDP, 0,
amt->stream_dev->ifindex);
if (IS_ERR(rt)) {
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -2611,7 +2815,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
skb = netdev_alloc_skb_ip_align(amt->dev, len);
if (!skb) {
ip_rt_put(rt);
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
goto out;
}
@@ -2657,7 +2861,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
ip_send_check(iph);
err = ip_local_out(amt->net, sk, skb);
if (unlikely(net_xmit_eval(err)))
- amt->dev->stats.tx_errors++;
+ DEV_STATS_INC(amt->dev, tx_errors);
out:
rcu_read_unlock();
@@ -2684,15 +2888,29 @@ static bool amt_discovery_handler(struct amt_dev *amt, struct sk_buff *skb)
return false;
}
+/* Handle an AMT Relay Membership Request.
+ *
+ * The source of a Request is unauthenticated: it is a bare UDP datagram with a
+ * trivially spoofable source address. Allocating tunnel state here let an
+ * attacker fill the table from spoofed addresses, and let one spoofed packet
+ * overwrite the nonce/MAC of an established tunnel and cut that gateway off.
+ *
+ * Nothing needs to be remembered at this point. Every input to the keyed MAC
+ * is carried in the packet or is device state, so the MAC is generated here,
+ * echoed back by the gateway in its Membership Update, and recomputed and
+ * verified there - see amt_update_handler(). Tunnel state is created only once
+ * that verification succeeds.
+ */
static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb)
{
struct amt_header_request *amtrh;
struct amt_tunnel_list *tunnel;
- unsigned long long key;
struct udphdr *udph;
struct iphdr *iph;
+ siphash_key_t key;
+ bool full, have = false;
+ int per_src = 0;
u64 mac;
- int i;
if (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtrh)))
return true;
@@ -2704,59 +2922,40 @@ static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb)
if (amtrh->reserved1 || amtrh->reserved2 || amtrh->version)
return true;
- list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list)
- if (tunnel->ip4 == iph->saddr)
- goto send;
-
- spin_lock_bh(&amt->lock);
- if (amt->nr_tunnels >= amt->max_tunnels) {
- spin_unlock_bh(&amt->lock);
- icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+ if (!netif_running(amt->dev) || !netif_running(amt->stream_dev))
return true;
- }
- tunnel = kzalloc(sizeof(*tunnel) +
- (sizeof(struct hlist_head) * amt->hash_buckets),
- GFP_ATOMIC);
- if (!tunnel) {
- spin_unlock_bh(&amt->lock);
- return true;
+ /* Snapshot the secret and tunnel limits on the same locked walk. */
+ spin_lock_bh(&amt->lock);
+ key = amt->key[0];
+ full = amt->nr_tunnels >= amt->max_tunnels;
+ list_for_each_entry(tunnel, &amt->tunnel_list, list) {
+ if (tunnel->ip4 != iph->saddr)
+ continue;
+ per_src++;
+ if (tunnel->source_port == udph->source)
+ have = true;
}
-
- tunnel->source_port = udph->source;
- tunnel->ip4 = iph->saddr;
-
- memcpy(&key, &tunnel->key, sizeof(unsigned long long));
- tunnel->amt = amt;
- spin_lock_init(&tunnel->lock);
- for (i = 0; i < amt->hash_buckets; i++)
- INIT_HLIST_HEAD(&tunnel->groups[i]);
-
- INIT_DELAYED_WORK(&tunnel->gc_wq, amt_tunnel_expire);
-
- list_add_tail_rcu(&tunnel->list, &amt->tunnel_list);
- tunnel->key = amt->key;
- __amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_REQUEST, true);
- amt->nr_tunnels++;
- mod_delayed_work(amt_wq, &tunnel->gc_wq,
- msecs_to_jiffies(amt_gmi(amt)));
spin_unlock_bh(&amt->lock);
-send:
- tunnel->nonce = amtrh->nonce;
- mac = siphash_3u32((__force u32)tunnel->ip4,
- (__force u32)tunnel->source_port,
- (__force u32)tunnel->nonce,
- &tunnel->key);
- tunnel->mac = mac >> 16;
-
- if (!netif_running(amt->dev) || !netif_running(amt->stream_dev))
+ /* Withhold the Query when a new endpoint cannot get a tunnel, so the
+ * gateway rediscovers. Existing endpoints must still renew their MAC.
+ * Drop silently: an unauthenticated Request must not reflect ICMP.
+ */
+ if (!have && (full || per_src >= AMT_MAX_TUNNELS_PER_SRC))
return true;
+ mac = siphash_3u32((__force u32)iph->saddr,
+ (__force u32)udph->source,
+ (__force u32)amtrh->nonce,
+ &key) >> 16;
+
if (!amtrh->p)
- amt_send_igmp_gq(amt, tunnel);
+ amt_send_igmp_gq(amt, iph->saddr, udph->source, amtrh->nonce,
+ mac);
else
- amt_send_mld_gq(amt, tunnel);
+ amt_send_mld_gq(amt, iph->saddr, udph->source, amtrh->nonce,
+ mac);
return false;
}
@@ -2833,7 +3032,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
}
goto out;
case AMT_MSG_MULTICAST_DATA:
- if (saddr != remote_ip) {
+ if (!remote_ip || saddr != remote_ip) {
netdev_dbg(amt->dev, "Invalid Relay IP\n");
err = true;
goto drop;
@@ -2844,7 +3043,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
else
goto out;
case AMT_MSG_MEMBERSHIP_QUERY:
- if (saddr != remote_ip) {
+ if (!remote_ip || saddr != remote_ip) {
netdev_dbg(amt->dev, "Invalid Relay IP\n");
err = true;
goto drop;
@@ -3024,6 +3223,14 @@ static int amt_dev_open(struct net_device *dev)
enable_delayed_work(&amt->discovery_wq);
enable_delayed_work(&amt->req_wq);
+ /* Seed the keys before amt_socket_create() enables the encap receive
+ * path, so a Request or Update that arrives immediately is never
+ * verified against an all-zero (predictable) secret.
+ */
+ spin_lock_bh(&amt->lock);
+ get_random_bytes(&amt->key, sizeof(amt->key));
+ spin_unlock_bh(&amt->lock);
+
err = amt_socket_create(amt);
if (err) {
disable_delayed_work(&amt->req_wq);
@@ -3034,7 +3241,6 @@ static int amt_dev_open(struct net_device *dev)
amt->req_cnt = 0;
WRITE_ONCE(amt->remote_ip, 0);
amt->nonce = 0;
- get_random_bytes(&amt->key, sizeof(siphash_key_t));
amt->status = AMT_STATUS_INIT;
if (amt->mode == AMT_MODE_GATEWAY) {
@@ -3050,7 +3256,7 @@ static int amt_dev_open(struct net_device *dev)
static int amt_dev_stop(struct net_device *dev)
{
struct amt_dev *amt = netdev_priv(dev);
- struct amt_tunnel_list *tunnel, *tmp;
+ struct amt_tunnel_list *tunnel;
struct sk_buff *skb;
struct sock *sk;
int i;
@@ -3079,9 +3285,34 @@ static int amt_dev_stop(struct net_device *dev)
amt->req_cnt = 0;
WRITE_ONCE(amt->remote_ip, 0);
- list_for_each_entry_safe(tunnel, tmp, &amt->tunnel_list, list) {
- list_del_rcu(&tunnel->list);
- amt->nr_tunnels--;
+ /* Mark every tunnel dead first, so a concurrent amt_tunnel_expire()
+ * sees ->dead and bails instead of freeing a tunnel in parallel; this
+ * path is then the sole freer.
+ */
+ spin_lock_bh(&amt->lock);
+ list_for_each_entry(tunnel, &amt->tunnel_list, list) {
+ spin_lock_bh(&tunnel->lock);
+ WRITE_ONCE(tunnel->dead, true);
+ spin_unlock_bh(&tunnel->lock);
+ }
+ spin_unlock_bh(&amt->lock);
+
+ /* Unlink one tunnel at a time with list_del_rcu() rather than splicing
+ * the list onto a local head: a lockless reader walking tunnel_list
+ * must always terminate at &amt->tunnel_list, never at a stack head.
+ */
+ for (;;) {
+ spin_lock_bh(&amt->lock);
+ tunnel = list_first_entry_or_null(&amt->tunnel_list,
+ struct amt_tunnel_list, list);
+ if (tunnel) {
+ list_del_rcu(&tunnel->list);
+ amt->nr_tunnels--;
+ }
+ spin_unlock_bh(&amt->lock);
+ if (!tunnel)
+ break;
+
cancel_delayed_work_sync(&tunnel->gc_wq);
amt_clear_groups(tunnel);
kfree_rcu(tunnel, rcu);
@@ -3152,9 +3383,9 @@ static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = {
[IFLA_AMT_RELAY_PORT] = { .type = NLA_U16 },
[IFLA_AMT_GATEWAY_PORT] = { .type = NLA_U16 },
[IFLA_AMT_LINK] = { .type = NLA_U32 },
- [IFLA_AMT_LOCAL_IP] = { .len = sizeof_field(struct iphdr, daddr) },
+ [IFLA_AMT_LOCAL_IP] = NLA_POLICY_EXACT_LEN(sizeof(__be32)),
[IFLA_AMT_REMOTE_IP] = { .len = sizeof_field(struct iphdr, daddr) },
- [IFLA_AMT_DISCOVERY_IP] = { .len = sizeof_field(struct iphdr, daddr) },
+ [IFLA_AMT_DISCOVERY_IP] = NLA_POLICY_EXACT_LEN(sizeof(__be32)),
[IFLA_AMT_MAX_TUNNELS] = { .type = NLA_U32 },
};
diff --git a/include/net/amt.h b/include/net/amt.h
index 2846dde0cadce..1b4283efa0fc8 100644
--- a/include/net/amt.h
+++ b/include/net/amt.h
@@ -240,12 +240,18 @@ struct amt_tunnel_list {
u32 nr_sources;
enum amt_status status;
struct delayed_work gc_wq;
+ /* Last time this tunnel was refreshed. gc_wq
+ * re-arms itself from this rather than being re-armed by the Update
+ * path, so the Update path cannot re-queue work for a tunnel that
+ * amt_tunnel_expire() is freeing on the timeout path.
+ */
+ unsigned long last_seen;
+ /* Set under amt->lock by whichever freer reaches the tunnel first;
+ * the other then leaves it alone, so the tunnel is freed exactly once.
+ */
+ bool dead;
__be16 source_port;
__be32 ip4;
- __be32 nonce;
- siphash_key_t key;
- u64 mac:48,
- reserved:16;
struct rcu_head rcu;
struct hlist_head groups[];
};
@@ -282,6 +288,8 @@ struct amt_source_node {
#define AMT_SOURCE_OLD 0
#define AMT_SOURCE_NEW 1
u8 flags;
+ /* Protected by gnode->tunnel_list->lock. */
+ bool dead;
struct rcu_head rcu;
};
@@ -296,6 +304,8 @@ struct amt_group_node {
struct amt_tunnel_list *tunnel_list;
struct hlist_node node;
struct delayed_work group_timer;
+ /* Protected by tunnel_list->lock. */
+ bool dead;
struct rcu_head rcu;
struct hlist_head sources[];
};
@@ -325,8 +335,10 @@ struct amt_dev {
struct work_struct event_wq;
/* AMT status */
enum amt_status status;
- /* Generated key */
- siphash_key_t key;
+ /* Current key and three previous generations keep MACs valid for
+ * 180-240s, beyond the advertised QQIC (see amt_secret_work()).
+ */
+ siphash_key_t key[4];
struct sock __rcu *sk;
u32 max_groups;
u32 max_sources;
@@ -383,6 +395,10 @@ struct amt_dev {
#define AMT_SECRET_TIMEOUT 60000
#define IANA_AMT_UDP_PORT 2268
#define AMT_MAX_TUNNELS 128
+/* Fixed per-source cap stops one verified source address from monopolising
+ * the AMT_MAX_TUNNELS-slot table.
+ */
+#define AMT_MAX_TUNNELS_PER_SRC 16
#define AMT_MAX_REQS 128
#define AMT_GW_HLEN (sizeof(struct iphdr) + \
sizeof(struct udphdr) + \
|
| 19/3 | 2026/10/16 02:45 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14066 output: 45 thoughts: 1404 Thoughts: **KMSAN Assessment of AMT Patch** Okay, let's break this down. This patch is touching `drivers/net/amt.c` and `include/net/amt.h`, which means we're dealing with core AMT functionality. The primary focus seems to be on shoring up race conditions and lifecycle/state issues within AMT. From my perspective, these fixes look solid, introducing `dead` flags to guard against double-free, use-after-free, and concurrent teardown scenarios, which is precisely the kind of defensive coding needed in a complex network subsystem. The proper use of RCU and spinlocks in the work functions is also critical for correctness. The changes to direct stats updates using `DEV_STATS_INC` are standard and good practice. Avoiding the tunnel structure creation on unauthenticated requests is a good optimization and security measure. However, the real question is whether this warrants KMSAN analysis. The instructions are clear: only if uninitialized memory risks are introduced or modified. Let's dig in. I need to methodically check for potential uninitialized memory leaks or reads that KASAN might miss. First, let's examine `amt_update_handler`. I see the local `key` array is populated with `amt->key`. Critically, `amt->key` is initialized in `amt_dev_open` using `get_random_bytes`, and the patch ensures elements are shuffled using `amt_secret_work`, which means the key is properly initialized. No issues there. Second, in `amt_tunnel_get_or_create`, the code uses `kzalloc`. This is a clear indicator that the allocated memory is zeroed. That's a good sign. No worries about uninitialized memory here. Third, the allocation of `struct amt_source_node` and `struct amt_group_node` is also a place to scrutinize. I'll need to use `grepper` to locate their allocations within the source, but given the existing pattern of initialization with other structures, I'm optimistic it'll be zeroed/initialized at allocation. Considering the patch's changes, I don't see any obvious introduction of uninitialized memory. The critical structures are either explicitly initialized, allocated via kzalloc, or filled through known secure means. Based on this quick analysis, **I don't believe this patch introduces any new KMSAN concerns**. KASAN, LOCKDEP, and other standard detectors should be sufficient for the bugs this patch addresses. I'd argue that setting `NeedsKMSAN` to true is unnecessary here. |
| 20/3 | 2026/10/16 02:46 | tool | grepper |
0mError:no matches Args: {
"Expression": "kzalloc.*amt_source_node|kzalloc.*amt_group_node",
"PathPrefixes": [
"drivers/net/amt.c"
]
}Results: {
"error": "no matches"
} |
| 21/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 16076 output: 39 thoughts: 31 Thoughts: Okay, here's my summarized thought process, presented as if I were thinking it: **Digging into AMT Driver Allocations** Right, time to get to the bottom of this. I need to understand how these `amt_source_node` and `amt_group_node` structs are being allocated within the `drivers/net/amt.c` file. I'm going to quickly grep through the code to identify the allocation points. The quickest way to understand this is to get a list of all calls to allocate memory for the nodes and group nodes. |
| 22/3 | 2026/10/16 02:46 | tool | grepper |
0mArgs:{
"Expression": "amt_add_group|amt_add_source",
"PathPrefixes": [
"drivers/net/amt.c"
]
}Results: {
"Output": "drivers/net/amt.c=416=static void amt_group_work(struct work_struct *work)\n--\ndrivers/net/amt.c-477- */\ndrivers/net/amt.c:478:static struct amt_group_node *amt_add_group(struct amt_dev *amt,\ndrivers/net/amt.c-479-\t\t\t\t\t struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c=2001=static void amt_igmpv2_report_handler(struct amt_dev *amt, struct sk_buff *skb,\n--\ndrivers/net/amt.c-2015-\tif (!gnode) {\ndrivers/net/amt.c:2016:\t\tgnode = amt_add_group(amt, tunnel, \u0026group, \u0026host, false);\ndrivers/net/amt.c-2017-\t\tif (!IS_ERR(gnode)) {\n--\ndrivers/net/amt.c=2056=static void amt_igmpv3_report_handler(struct amt_dev *amt, struct sk_buff *skb,\n--\ndrivers/net/amt.c-2093-\t\tif (!gnode) {\ndrivers/net/amt.c:2094:\t\t\tgnode = amt_add_group(amt, tunnel, \u0026group, \u0026host,\ndrivers/net/amt.c-2095-\t\t\t\t\t false);\n--\ndrivers/net/amt.c=2169=static void amt_mldv1_report_handler(struct amt_dev *amt, struct sk_buff *skb,\n--\ndrivers/net/amt.c-2181-\tif (!gnode) {\ndrivers/net/amt.c:2182:\t\tgnode = amt_add_group(amt, tunnel, \u0026group, \u0026host, true);\ndrivers/net/amt.c-2183-\t\tif (!IS_ERR(gnode)) {\n--\ndrivers/net/amt.c=2225=static void amt_mldv2_report_handler(struct amt_dev *amt, struct sk_buff *skb,\n--\ndrivers/net/amt.c-2262-\t\tif (!gnode) {\ndrivers/net/amt.c:2263:\t\t\tgnode = amt_add_group(amt, tunnel, \u0026group, \u0026host,\ndrivers/net/amt.c-2264-\t\t\t\t\t ETH_P_IPV6);\n"
} |
| 23/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 16878 output: 35 thoughts: 26 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience and presented in the first person: **Analyzing the `amt_add_group` Function** Alright, let's dive into this. I'm going to pull up the `amt_add_group` function and really dissect what's going on with the allocation of `amt_group_node` and the sourcing of its data. My primary concern here is efficiency, resource utilization, and potential points of contention or failure. I want to see: * How is `amt_group_node` initialized? Are we dealing with dynamic allocation (malloc, kmalloc, etc.), and if so, what's the allocation strategy? Is there any pre-allocation or object reuse happening to mitigate overhead? I'm particularly interested in memory fragmentation risks. * What about error handling? What happens if the allocation fails? Is there proper cleanup of partial operations? Are there retries or fallback mechanisms? Are error codes propagated correctly? * Now, the "sourcing" part. Where is the data for this node coming from? Is it copying data, referencing existing structures, or creating new data? What locking mechanisms are involved if it's shared data? How is the integrity of the sourced data maintained? Any potential data races I should worry about? * Are there any implicit assumptions about the environment or underlying structures that `amt_add_group` relies on? For instance, does it assume specific alignment requirements or buffer sizes? * I want to examine its interaction with the broader AMT (Active Management Technology) system. How does this function fit into the overall group management architecture? Is there any chance that it will deadlock or exhaust resources if used under concurrent conditions? * Finally, let's look for potential memory leaks, buffer overflows, or other security vulnerabilities. Anything that could be exploited to compromise the system is a red flag. I'm going to look for any missing checks. I'll be paying close attention to these aspects as I read through the code. I'm looking for robustness, performance, and maintainability. |
| 24/3 | 2026/10/16 02:46 | tool | read-file |
0mArgs:{
"File": "drivers/net/amt.c",
"FirstLine": 475,
"LineCount": 70
}Results: {
"Contents": " 475:\t * then the \"non-existent\" state is considered to have a filter mode\n 476:\t * of INCLUDE and an empty source list.\n 477:\t */\n 478:\tstatic struct amt_group_node *amt_add_group(struct amt_dev *amt,\n 479:\t\t\t\t\t\t struct amt_tunnel_list *tunnel,\n 480:\t\t\t\t\t\t union amt_addr *group,\n 481:\t\t\t\t\t\t union amt_addr *host,\n 482:\t\t\t\t\t\t bool v6)\n 483:\t{\n 484:\t\tstruct amt_group_node *gnode;\n 485:\t\tu32 hash;\n 486:\t\tint i;\n 487:\t\n 488:\t\tif (tunnel-\u003enr_groups \u003e= amt-\u003emax_groups)\n 489:\t\t\treturn ERR_PTR(-ENOSPC);\n 490:\t\n 491:\t\tgnode = kzalloc(sizeof(*gnode) +\n 492:\t\t\t\t(sizeof(struct hlist_head) * amt-\u003ehash_buckets),\n 493:\t\t\t\tGFP_ATOMIC);\n 494:\t\tif (unlikely(!gnode))\n 495:\t\t\treturn ERR_PTR(-ENOMEM);\n 496:\t\n 497:\t\tgnode-\u003eamt = amt;\n 498:\t\tgnode-\u003egroup_addr = *group;\n 499:\t\tgnode-\u003ehost_addr = *host;\n 500:\t\tgnode-\u003ev6 = v6;\n 501:\t\tgnode-\u003etunnel_list = tunnel;\n 502:\t\tgnode-\u003efilter_mode = MCAST_INCLUDE;\n 503:\t\tINIT_HLIST_NODE(\u0026gnode-\u003enode);\n 504:\t\tINIT_DELAYED_WORK(\u0026gnode-\u003egroup_timer, amt_group_work);\n 505:\t\tfor (i = 0; i \u003c amt-\u003ehash_buckets; i++)\n 506:\t\t\tINIT_HLIST_HEAD(\u0026gnode-\u003esources[i]);\n 507:\t\n 508:\t\thash = amt_group_hash(tunnel, group);\n 509:\t\thlist_add_head_rcu(\u0026gnode-\u003enode, \u0026tunnel-\u003egroups[hash]);\n 510:\t\ttunnel-\u003enr_groups++;\n 511:\t\n 512:\t\tif (!gnode-\u003ev6)\n 513:\t\t\tnetdev_dbg(amt-\u003edev, \"Join group %pI4\\n\",\n 514:\t\t\t\t \u0026gnode-\u003egroup_addr.ip4);\n 515:\t#if IS_ENABLED(CONFIG_IPV6)\n 516:\t\telse\n 517:\t\t\tnetdev_dbg(amt-\u003edev, \"Join group %pI6\\n\",\n 518:\t\t\t\t \u0026gnode-\u003egroup_addr.ip6);\n 519:\t#endif\n 520:\t\n 521:\t\treturn gnode;\n 522:\t}\n 523:\t\n 524:\tstatic struct sk_buff *amt_build_igmp_gq(struct amt_dev *amt)\n 525:\t{\n 526:\t\tu8 ra[AMT_IPHDR_OPTS] = { IPOPT_RA, 4, 0, 0 };\n 527:\t\tint hlen = LL_RESERVED_SPACE(amt-\u003edev);\n 528:\t\tint tlen = amt-\u003edev-\u003eneeded_tailroom;\n 529:\t\tstruct igmpv3_query *ihv3;\n 530:\t\tvoid *csum_start = NULL;\n 531:\t\t__sum16 *csum = NULL;\n 532:\t\tstruct sk_buff *skb;\n 533:\t\tstruct ethhdr *eth;\n 534:\t\tstruct iphdr *iph;\n 535:\t\tunsigned int len;\n 536:\t\tint offset;\n 537:\t\n 538:\t\tlen = hlen + tlen + sizeof(*iph) + AMT_IPHDR_OPTS + sizeof(*ihv3);\n 539:\t\tskb = netdev_alloc_skb_ip_align(amt-\u003edev, len);\n 540:\t\tif (!skb)\n 541:\t\t\treturn NULL;\n 542:\t\n 543:\t\tskb_reserve(skb, hlen);\n 544:\t\tskb_push(skb, sizeof(*eth));\n"
} |
| 25/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 18522 output: 35 thoughts: 35 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person: **Investigating Memory Allocation in AMT Group & Source Handling** Alright, I see `amt_add_group` is employing `kzalloc`. That rings a bell, and it prompts me to immediately consider the memory allocation strategy used in related functions, particularly those dealing with data sources. Where are source nodes allocated? Let me check `amt_add_source`, or wherever the code deals with initializing and managing source-related data structures. I need to understand if there's consistency, or potential for inefficiencies or inconsistencies, in how these closely related components manage their memory footprints. My goal is to ensure that memory usage is optimized and doesn't introduce any surprises later on. |
| 26/3 | 2026/10/16 02:46 | tool | grepper |
0mArgs:{
"Expression": "struct amt_source_node \\*",
"PathPrefixes": [
"drivers/net/amt.c"
]
}Results: {
"Output": "drivers/net/amt.c=83=static void __amt_source_gc_work(void)\ndrivers/net/amt.c-84-{\ndrivers/net/amt.c:85:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-86-\tstruct hlist_head gc_list;\n--\ndrivers/net/amt.c=114=static u32 amt_source_hash(struct amt_tunnel_list *tunnel, union amt_addr *src)\n--\ndrivers/net/amt.c-120-\ndrivers/net/amt.c:121:static bool amt_status_filter(struct amt_source_node *snode,\ndrivers/net/amt.c-122-\t\t\t enum amt_filter filter)\n--\ndrivers/net/amt.c-174-\ndrivers/net/amt.c:175:static struct amt_source_node *amt_lookup_src(struct amt_tunnel_list *tunnel,\ndrivers/net/amt.c-176-\t\t\t\t\t struct amt_group_node *gnode,\n--\ndrivers/net/amt.c-180-\tu32 hash = amt_source_hash(tunnel, src);\ndrivers/net/amt.c:181:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-182-\n--\ndrivers/net/amt.c=198=static struct amt_group_node *amt_lookup_group(struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c-215-\ndrivers/net/amt.c:216:static void amt_destroy_source(struct amt_source_node *snode)\ndrivers/net/amt.c-217-{\n--\ndrivers/net/amt.c=251=static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode)\ndrivers/net/amt.c-252-{\ndrivers/net/amt.c:253:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-254-\tstruct hlist_node *t;\n--\ndrivers/net/amt.c=288=static void amt_source_work(struct work_struct *work)\ndrivers/net/amt.c-289-{\ndrivers/net/amt.c:290:\tstruct amt_source_node *snode = container_of(to_delayed_work(work),\ndrivers/net/amt.c-291-\t\t\t\t\t\t struct amt_source_node,\n--\ndrivers/net/amt.c=321=static void amt_act_src(struct amt_tunnel_list *tunnel,\ndrivers/net/amt.c-322-\t\t\tstruct amt_group_node *gnode,\ndrivers/net/amt.c:323:\t\t\tstruct amt_source_node *snode,\ndrivers/net/amt.c-324-\t\t\tenum amt_act act)\n--\ndrivers/net/amt.c-371-\ndrivers/net/amt.c:372:static struct amt_source_node *amt_alloc_snode(struct amt_group_node *gnode,\ndrivers/net/amt.c-373-\t\t\t\t\t union amt_addr *src)\ndrivers/net/amt.c-374-{\ndrivers/net/amt.c:375:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-376-\n--\ndrivers/net/amt.c=416=static void amt_group_work(struct work_struct *work)\n--\ndrivers/net/amt.c-422-\tstruct amt_dev *amt;\ndrivers/net/amt.c:423:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-424-\tbool delete_group = true;\n--\ndrivers/net/amt.c=1416=static void amt_cleanup_srcs(struct amt_dev *amt,\n--\ndrivers/net/amt.c-1419-{\ndrivers/net/amt.c:1420:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-1421-\tstruct hlist_node *t;\n--\ndrivers/net/amt.c=1452=static void amt_add_srcs(struct amt_dev *amt, struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c-1456-\tstruct igmpv3_grec *igmp_grec;\ndrivers/net/amt.c:1457:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-1458-#if IS_ENABLED(CONFIG_IPV6)\n--\ndrivers/net/amt.c=1532=static void amt_lookup_act_srcs(struct amt_tunnel_list *tunnel,\n--\ndrivers/net/amt.c-1540-\tstruct amt_dev *amt = tunnel-\u003eamt;\ndrivers/net/amt.c:1541:\tstruct amt_source_node *snode;\ndrivers/net/amt.c-1542-\tstruct igmpv3_grec *igmp_grec;\n"
} |
| 27/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 20057 output: 35 thoughts: 12 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: **Analyzing Allocation Strategy** Alright, time to dig in. I need to get a handle on the allocation strategy here, so let's start by zeroing in on `amt_alloc_snode`. This specific variable or function—whatever it represents in this context—is clearly a critical piece of the puzzle. I immediately want to understand how this `amt_alloc_snode` factor fits into the larger picture of the system's allocation strategy. Is it tracking allocations, making decisions, or reporting results? Given the name, I'm already forming some hypotheses. I need to quickly establish its role and influence. This is where I start. Let's see what's going on with `amt_alloc_snode`. |
| 28/3 | 2026/10/16 02:46 | tool | read-file |
0mArgs:{
"File": "drivers/net/amt.c",
"FirstLine": 371,
"LineCount": 35
}Results: {
"Contents": " 371:\t\n 372:\tstatic struct amt_source_node *amt_alloc_snode(struct amt_group_node *gnode,\n 373:\t\t\t\t\t\t union amt_addr *src)\n 374:\t{\n 375:\t\tstruct amt_source_node *snode;\n 376:\t\n 377:\t\tsnode = kzalloc_obj(*snode, GFP_ATOMIC);\n 378:\t\tif (!snode)\n 379:\t\t\treturn NULL;\n 380:\t\n 381:\t\tmemcpy(\u0026snode-\u003esource_addr, src, sizeof(union amt_addr));\n 382:\t\tsnode-\u003egnode = gnode;\n 383:\t\tsnode-\u003estatus = AMT_SOURCE_STATUS_NONE;\n 384:\t\tsnode-\u003eflags = AMT_SOURCE_NEW;\n 385:\t\tINIT_HLIST_NODE(\u0026snode-\u003enode);\n 386:\t\tINIT_DELAYED_WORK(\u0026snode-\u003esource_timer, amt_source_work);\n 387:\t\n 388:\t\treturn snode;\n 389:\t}\n 390:\t\n 391:\t/* RFC 3810 - 7.2.2. Definition of Filter Timers\n 392:\t *\n 393:\t * Router Mode Filter Timer Actions/Comments\n 394:\t * ----------- ----------------- ----------------\n 395:\t *\n 396:\t * INCLUDE Not Used All listeners in\n 397:\t * INCLUDE mode.\n 398:\t *\n 399:\t * EXCLUDE Timer \u003e 0 At least one listener\n 400:\t * in EXCLUDE mode.\n 401:\t *\n 402:\t * EXCLUDE Timer == 0 No more listeners in\n 403:\t * EXCLUDE mode for the\n 404:\t * multicast address.\n 405:\t * If the Requested List\n"
} |
| 29/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 20815 output: 33 thoughts: 1440 Thoughts: **Analyzing AMT Code for Potential Uninitialized Memory** Okay, let's break this down systematically. I see `snode` is initialized with `kzalloc_obj`, so its `dead` field starts as false – good. Now, I'm focusing on potential uninitialized memory reads. Looking at `amt_send_membership_query`, I can see that the `amtmq` struct is fully initialized before use. It sets version, type, reserved, l, g, nonce, and response_mac. The `flowi4` struct `fl4` is zeroed out as well, which is good practice. Next, `amt_send_igmp_gq` calls `amt_send_membership_query`. So whatever the `membership_query` does, `igmp_gq` will also do, assuming it passes the parameters correctly. In `amt_request_handler`, `mac` is calculated using `siphash_3u32` with a `key`. I need to ensure this key is initialized. It looks like it is grabbed by the spin lock. Good. The code grabs the key from the `amt->key[0]` variable. In `amt_update_handler`, the key is *explicitly* initialized. The whole `key` array gets copied inside a spin lock. No uninitialized memory issues there. Finally, I examined `amt_policy` in relation to netlink attribute handling. The change from generic length specifications to `NLA_POLICY_EXACT_LEN` is, in fact, a *strengthening* of the code. It eliminates the possibility of passing potentially uninitialized memory. This prevents the user from influencing the data. I'm checking for any potential copies to userspace via `nla_put`, `copy_to_user`, or `amt_fill_info` within the AMT driver code to eliminate remaining possibilities. A quick search of the `drivers/net/amt.c` file should confirm that there are no such instances. In conclusion, after this scan, I don't see any obvious uninitialized memory reads. The code seems robust in this regard. |
| 30/3 | 2026/10/16 02:46 | tool | grepper |
0mArgs:{
"Expression": "amt_fill_info",
"PathPrefixes": [
"drivers/net/amt.c"
]
}Results: {
"Output": "drivers/net/amt.c=3565=static size_t amt_get_size(const struct net_device *dev)\n--\ndrivers/net/amt.c-3576-\ndrivers/net/amt.c:3577:static int amt_fill_info(struct sk_buff *skb, const struct net_device *dev)\ndrivers/net/amt.c-3578-{\n--\ndrivers/net/amt.c=3611=static struct rtnl_link_ops amt_link_ops __read_mostly = {\n--\ndrivers/net/amt.c-3620-\t.get_size = amt_get_size,\ndrivers/net/amt.c:3621:\t.fill_info = amt_fill_info,\ndrivers/net/amt.c-3622-};\n"
} |
| 31/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 22962 output: 36 thoughts: 21 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: **Analyzing `amt_fill_info` for Field Impacts** Alright, I need to get a handle on what might be going on in this area. My initial instinct is to take a close look at `amt_fill_info`. The goal is to rapidly determine if any of the recent modifications or changes, whether direct or indirect, have caused a ripple effect into this specific structure. I'm focusing on two primary areas: 1. **Direct Modification Check**: Are any of the fields *within* `amt_fill_info` themselves directly touched by the recent code changes? This could be a straight assignment, a calculation that involves a changed variable, or a call to a function that modifies these fields. 2. **Indirect Dependency Analysis**: If there aren't any direct modifications, the next line of inquiry is dependencies. Does anything *else* that has been modified, or whose behavior has changed, have some level of interaction with `amt_fill_info`? This could be a shared data structure, a function that uses a field in `amt_fill_info` in its calculation, or perhaps a sequence of operations that can lead to unexpected impacts. I'm looking for anything that could influence its state. My objective is to quickly identify any potential points of concern within `amt_fill_info`, so I can determine whether this is an area of the code that will require closer investigation. |
| 32/3 | 2026/10/16 02:46 | tool | read-file |
0mArgs:{
"File": "drivers/net/amt.c",
"FirstLine": 3575,
"LineCount": 45
}Results: {
"Contents": "3575:\t}\n3576:\t\n3577:\tstatic int amt_fill_info(struct sk_buff *skb, const struct net_device *dev)\n3578:\t{\n3579:\t\tconst struct amt_dev *amt = netdev_priv(dev);\n3580:\t\t__be32 remote_ip;\n3581:\t\n3582:\t\trcu_read_lock();\n3583:\t\tif (nla_put_u32(skb, IFLA_AMT_MODE, amt-\u003emode))\n3584:\t\t\tgoto nla_put_failure;\n3585:\t\tif (nla_put_be16(skb, IFLA_AMT_RELAY_PORT, amt-\u003erelay_port))\n3586:\t\t\tgoto nla_put_failure;\n3587:\t\tif (nla_put_be16(skb, IFLA_AMT_GATEWAY_PORT, amt-\u003egw_port))\n3588:\t\t\tgoto nla_put_failure;\n3589:\t\tif (nla_put_u32(skb, IFLA_AMT_LINK, amt-\u003estream_dev-\u003eifindex))\n3590:\t\t\tgoto nla_put_failure;\n3591:\t\tif (nla_put_in_addr(skb, IFLA_AMT_LOCAL_IP, amt-\u003elocal_ip))\n3592:\t\t\tgoto nla_put_failure;\n3593:\t\tif (nla_put_in_addr(skb, IFLA_AMT_DISCOVERY_IP, amt-\u003ediscovery_ip))\n3594:\t\t\tgoto nla_put_failure;\n3595:\t\n3596:\t\tremote_ip = READ_ONCE(amt-\u003eremote_ip);\n3597:\t\tif (remote_ip)\n3598:\t\t\tif (nla_put_in_addr(skb, IFLA_AMT_REMOTE_IP, remote_ip))\n3599:\t\t\t\tgoto nla_put_failure;\n3600:\t\tif (nla_put_u32(skb, IFLA_AMT_MAX_TUNNELS, amt-\u003emax_tunnels))\n3601:\t\t\tgoto nla_put_failure;\n3602:\t\n3603:\t\trcu_read_unlock();\n3604:\t\treturn 0;\n3605:\t\n3606:\tnla_put_failure:\n3607:\t\trcu_read_unlock();\n3608:\t\treturn -EMSGSIZE;\n3609:\t}\n3610:\t\n3611:\tstatic struct rtnl_link_ops amt_link_ops __read_mostly = {\n3612:\t\t.kind\t\t= \"amt\",\n3613:\t\t.maxtype\t= IFLA_AMT_MAX,\n3614:\t\t.policy\t\t= amt_policy,\n3615:\t\t.priv_size\t= sizeof(struct amt_dev),\n3616:\t\t.setup\t\t= amt_link_setup,\n3617:\t\t.validate\t= amt_validate,\n3618:\t\t.newlink\t= amt_newlink,\n3619:\t\t.dellink\t= amt_dellink,\n"
} |
| 33/3 | 2026/10/16 02:46 | llm | kmsan-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 24180 output: 309 thoughts: 1252 Thoughts: **KMSAN Assessment: AMT Driver Patch** Alright, let's break this down. My initial inspection of the code changes, specifically focusing on `include/net/amt.h`, has me feeling pretty confident about the KMSAN implications. The patch introduces modifications to several key structures: `amt_tunnel_list`, `amt_source_node`, `amt_group_node`, and `amt_dev`. I see the addition of fields like `last_seen`, `dead`, and the expansion of `key` to `key[4]` in `amt_dev`. My primary concern is always uninitialized memory. But, based on my analysis, that's not a risk here. All of these structures, and any associated private data, are being allocated using `kzalloc` or `kzalloc_obj`, or embedded in a `netdev` private area, which is also zero-initialized. The cryptographic keys are explicitly initialized with `get_random_bytes` during device setup, and then rotated via timer. Crucially, there's no evidence of uninitialized memory being copied to user space, used in conditional logic, or exposed through network interaction. The patch itself appears to address race conditions and use-after-free scenarios in the AMT relay due to delayed work execution and device teardown. It also modernizes authentication to prevent denial-of-service, and updates stats accounting and Netlink policy strictness. All good stuff. These types of lifecycle and concurrency bugs are, however, things that KASAN and standard kernel debuggers will catch, and are not the domain of KMSAN. To be absolutely sure, I've run through my mental checklist: 1. Kernel structures sent to user space? Nope, no uninitialized data leaking. 2. Conditional logic depending on uninitialized variables? Nope, everything is initialized before use. 3. Allocation of complex data structures with potential uninitialized fields? Nope, all zeroed. 4. Bounds checks that could lead to reads of uninitialized bytes? Nope, no buffer access changes. Therefore, `NeedsKMSAN` is unequivocally `false`. The patch's primary concerns are concurrency and lifecycle management, which are well within KASAN's purview. KMSAN isn't relevant here. |
| 34/3 | 2026/10/16 02:46 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch addresses lifetime management, concurrency/race conditions, and denial-of-service vectors in the AMT (Automatic Multicast Tunneling) driver (drivers/net/amt.c). Specifically, it introduces 'dead' flags and adjusts locking to prevent use-after-free and double-free races during workqueue execution and device teardown, defers tunnel allocation until membership updates are cryptographically authenticated via rotated siphash keys, and converts netdev stats increments to DEV_STATS_INC().\n\nKASAN vs KMSAN applicability:\n- KASAN/LOCKDEP: Any remaining or introduced concurrency bugs, lifecycle issues, or races would manifest as use-after-free (UAF), double-free, or locking inconsistencies, which are actively monitored by KASAN and LOCKDEP.\n- KMSAN: There are no uninitialized memory risks. All structures containing modified or new fields (amt_tunnel_list, amt_source_node, amt_group_node, amt_dev) are allocated using kzalloc, kzalloc_obj, or netdev private allocation (which zeroes memory). The new siphash key array (amt-\u003ekey[4]) is seeded via get_random_bytes() upon device open and rotated securely. No uninitialized kernel memory or padding is exposed or copied to user space. Therefore, a dedicated KMSAN fuzzing session is not justified.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch addresses lifetime management, concurrency/race conditions, and denial-of-service vectors in the AMT (Automatic Multicast Tunneling) driver (drivers/net/amt.c). Specifically, it introduces 'dead' flags and adjusts locking to prevent use-after-free and double-free races during workqueue execution and device teardown, defers tunnel allocation until membership updates are cryptographically authenticated via rotated siphash keys, and converts netdev stats increments to DEV_STATS_INC().\n\nKASAN vs KMSAN applicability:\n- KASAN/LOCKDEP: Any remaining or introduced concurrency bugs, lifecycle issues, or races would manifest as use-after-free (UAF), double-free, or locking inconsistencies, which are actively monitored by KASAN and LOCKDEP.\n- KMSAN: There are no uninitialized memory risks. All structures containing modified or new fields (amt_tunnel_list, amt_source_node, amt_group_node, amt_dev) are allocated using kzalloc, kzalloc_obj, or netdev private allocation (which zeroes memory). The new siphash key array (amt-\u003ekey[4]) is seeded via get_random_bytes() upon device open and rotated securely. No uninitialized kernel memory or padding is exposed or copied to user space. Therefore, a dedicated KMSAN fuzzing session is not justified.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|