AI Trajectory

null

{
  "EnableConfigs": [
    "TIPC"
  ],
  "FocusSymbols": [
    "tipc_named_node_up",
    "tipc_named_dist_cluster_scope",
    "tipc_node_dist_bulk",
    "named_distribute"
  ],
  "Reasoning": "The patch modifies the TIPC protocol's node initialization and bulk publication distribution logic, introducing a new work item and synchronization mechanism. This is a functional change in the core TIPC logic that should be fuzzed.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 07c1cb744cd69cb8fdbdd88742eb0a185bbab4a7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jul 17 23:12:49 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/tipc/core.c b/net/tipc/core.c\nindex 434e70eabe0812..ce164509d9e27a 100644\n--- a/net/tipc/core.c\n+++ b/net/tipc/core.c\n@@ -60,6 +60,7 @@ static int __net_init tipc_init_net(struct net *net)\n \ttn-\u003etrial_addr = 0;\n \ttn-\u003eaddr_trial_end = 0;\n \ttn-\u003ecapabilities = TIPC_NODE_CAPABILITIES;\n+\tatomic_set(\u0026tn-\u003efinalized, 0);\n \tINIT_WORK(\u0026tn-\u003ework, tipc_net_finalize_work);\n \tmemset(tn-\u003enode_id, 0, sizeof(tn-\u003enode_id));\n \tmemset(tn-\u003enode_id_string, 0, sizeof(tn-\u003enode_id_string));\ndiff --git a/net/tipc/core.h b/net/tipc/core.h\nindex 9ce5f9ff6cc031..76768844c80814 100644\n--- a/net/tipc/core.h\n+++ b/net/tipc/core.h\n@@ -145,6 +145,8 @@ struct tipc_net {\n \tstruct work_struct work;\n \t/* The numbers of work queues in schedule */\n \tatomic_t wq_count;\n+\t/* flag to indicate work has finished */\n+\tatomic_t finalized;\n };\n \n static inline struct tipc_net *tipc_net(struct net *net)\ndiff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c\nindex 190b49c5cbc3ec..5b0fb09226fc68 100644\n--- a/net/tipc/name_distr.c\n+++ b/net/tipc/name_distr.c\n@@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p)\n  * @pls: linked list of publication items to be packed into buffer chain\n  * @seqno: sequence number for this message\n  */\n-static void named_distribute(struct net *net, struct sk_buff_head *list,\n+static int named_distribute(struct net *net, struct sk_buff_head *list,\n \t\t\t     u32 dnode, struct list_head *pls, u16 seqno)\n {\n \tstruct publication *publ;\n@@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,\n \t\t\tskb = named_prepare_buf(net, PUBLICATION, msg_rem,\n \t\t\t\t\t\tdnode);\n \t\t\tif (!skb) {\n+\t\t\t\t__skb_queue_purge(list);\n \t\t\t\tpr_warn(\"Bulk publication failure\\n\");\n-\t\t\t\treturn;\n+\t\t\t\treturn 1;\n \t\t\t}\n \t\t\thdr = buf_msg(skb);\n \t\t\tmsg_set_bc_ack_invalid(hdr, true);\n@@ -192,9 +193,15 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,\n \t\tskb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem));\n \t\t__skb_queue_tail(list, skb);\n \t}\n+\tif (skb_queue_empty(list)) {\n+\t\tpr_warn(\"Bulk publication list empty, nothing to distribute\\n\");\n+\t\treturn 1;\n+\t}\n \thdr = buf_msg(skb_peek_tail(list));\n \tmsg_set_last_bulk(hdr);\n \tmsg_set_named_seqno(hdr, seqno);\n+\n+\treturn 0;\n }\n \n /**\n@@ -203,7 +210,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,\n  * @dnode: destination node\n  * @capabilities: peer node's capabilities\n  */\n-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)\n+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)\n {\n \tstruct name_table *nt = tipc_name_table(net);\n \tstruct tipc_net *tn = tipc_net(net);\n@@ -218,9 +225,53 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)\n \tspin_unlock_bh(\u0026tn-\u003enametbl_lock);\n \n \tread_lock_bh(\u0026nt-\u003ecluster_scope_lock);\n-\tnamed_distribute(net, \u0026head, dnode, \u0026nt-\u003ecluster_scope, seqno);\n+\t/* tipc_net_finalize_work() has not finished inserting self address to\n+\t * name table yet.\n+\t */\n+\tif (unlikely(list_empty(\u0026nt-\u003ecluster_scope))) {\n+\t\tread_unlock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\t\treturn 1;\n+\t}\n+\n+\tif (named_distribute(net, \u0026head, dnode, \u0026nt-\u003ecluster_scope, seqno)) {\n+\t\tread_unlock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\t\treturn -ENOBUFS;\n+\t}\n+\n \ttipc_node_xmit(net, \u0026head, dnode, 0);\n \tread_unlock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\treturn 0;\n+}\n+\n+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)\n+{\n+\tstruct name_table *nt = tipc_name_table(net);\n+\tstruct tipc_net *tn = tipc_net(net);\n+\tstruct sk_buff_head head;\n+\tu16 seqno;\n+\n+\t__skb_queue_head_init(\u0026head);\n+\twait_var_event(\u0026tn-\u003efinalized, atomic_read(\u0026tn-\u003efinalized));\n+\tspin_lock_bh(\u0026tn-\u003enametbl_lock);\n+\tseqno = nt-\u003esnd_nxt;\n+\tspin_unlock_bh(\u0026tn-\u003enametbl_lock);\n+\n+\tread_lock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\tif (unlikely(list_empty(\u0026nt-\u003ecluster_scope))) {\n+\t\t/* finalize is done but nothing was published (publish\n+\t\t * failed): a permanent state, nothing to synchronize.\n+\t\t */\n+\t\tread_unlock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\t\treturn 0;\n+\t}\n+\tif (named_distribute(net, \u0026head, dnode, \u0026nt-\u003ecluster_scope, seqno)) {\n+\t\tread_unlock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\t\treturn -ENOBUFS;\n+\t}\n+\ttipc_node_xmit(net, \u0026head, dnode, 0);\n+\tread_unlock_bh(\u0026nt-\u003ecluster_scope_lock);\n+\n+\treturn 0;\n }\n \n /**\ndiff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h\nindex c677f6f082dfb7..cadf4e8c3e66c2 100644\n--- a/net/tipc/name_distr.h\n+++ b/net/tipc/name_distr.h\n@@ -69,7 +69,8 @@ struct distr_item {\n \n struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ);\n struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ);\n-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);\n+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);\n+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode);\n void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq,\n \t\t    u16 *rcv_nxt, bool *open);\n void tipc_named_reinit(struct net *net);\ndiff --git a/net/tipc/net.c b/net/tipc/net.c\nindex 7e65d0b0c4a8d1..2aa8812c551add 100644\n--- a/net/tipc/net.c\n+++ b/net/tipc/net.c\n@@ -138,7 +138,10 @@ static void tipc_net_finalize(struct net *net, u32 addr)\n \ttipc_named_reinit(net);\n \ttipc_sk_reinit(net);\n \ttipc_mon_reinit_self(net);\n-\ttipc_nametbl_publish(net, \u0026ua, \u0026sk, addr);\n+\tif (!tipc_nametbl_publish(net, \u0026ua, \u0026sk, addr))\n+\t\tpr_warn(\"Failed to publish own node state\\n\");\n+\tatomic_inc(\u0026tn-\u003efinalized);\n+\twake_up_var(\u0026tn-\u003efinalized);\n }\n \n void tipc_net_finalize_work(struct work_struct *work)\ndiff --git a/net/tipc/node.c b/net/tipc/node.c\nindex 97aa970a0d83ca..428c4eacd02f1f 100644\n--- a/net/tipc/node.c\n+++ b/net/tipc/node.c\n@@ -145,6 +145,8 @@ struct tipc_node {\n #ifdef CONFIG_TIPC_CRYPTO\n \tstruct tipc_crypto *crypto_rx;\n #endif\n+\t/* Work item for bulk distribution of cluster scope publications */\n+\tstruct work_struct work;\n };\n \n /* Node FSM states and events:\n@@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp)\n #ifdef CONFIG_TIPC_CRYPTO\n \ttipc_crypto_stop(\u0026n-\u003ecrypto_rx);\n #endif\n+\tcancel_work_sync(\u0026n-\u003ework);\n \tkfree(n);\n }\n \n@@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n)\n \twrite_unlock_bh(\u0026n-\u003elock);\n }\n \n+static void tipc_node_dist_bulk(struct work_struct *work)\n+{\n+\tstruct tipc_node *node = container_of(work, struct tipc_node, work);\n+\n+\tif (tipc_named_dist_cluster_scope(node-\u003enet, node-\u003eaddr) \u003c 0) {\n+\t\tu32 bearer_id = node-\u003elink_id \u0026 0xffff;\n+\n+\t\ttipc_node_link_down(node, bearer_id, false);\n+\t}\n+\n+\ttipc_node_put(node);\n+}\n+\n static void tipc_node_write_unlock(struct tipc_node *n)\n \t__releases(n-\u003elock)\n {\n@@ -424,8 +440,22 @@ static void tipc_node_write_unlock(struct tipc_node *n)\n \tif (flags \u0026 TIPC_NOTIFY_NODE_DOWN)\n \t\ttipc_publ_notify(net, publ_list, node, n-\u003ecapabilities);\n \n-\tif (flags \u0026 TIPC_NOTIFY_NODE_UP)\n-\t\ttipc_named_node_up(net, node, n-\u003ecapabilities);\n+\tif (flags \u0026 TIPC_NOTIFY_NODE_UP) {\n+\t\tint rc = 0;\n+\n+\t\trc = tipc_named_node_up(net, node, n-\u003ecapabilities);\n+\t\t/* Defer bulk distribution to work queue */\n+\t\tif (rc \u003e 0) {\n+\t\t\ttipc_node_get(n);\n+\t\t\tif (!schedule_work(\u0026n-\u003ework))\n+\t\t\t\ttipc_node_put(n);\n+\t\t} else if (rc \u003c 0) {\n+\t\t\t/* Bring the link down to start over bulk distribution\n+\t\t\t * when the link is up again.\n+\t\t\t */\n+\t\t\ttipc_node_link_down(n, bearer_id, false);\n+\t\t}\n+\t}\n \n \tif (flags \u0026 TIPC_NOTIFY_LINK_UP) {\n \t\ttipc_mon_peer_up(net, node, bearer_id);\n@@ -564,6 +594,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,\n \tINIT_LIST_HEAD(\u0026n-\u003elist);\n \tINIT_LIST_HEAD(\u0026n-\u003epubl_list);\n \tINIT_LIST_HEAD(\u0026n-\u003econn_sks);\n+\tINIT_WORK(\u0026n-\u003ework, tipc_node_dist_bulk);\n \tskb_queue_head_init(\u0026n-\u003ebc_entry.namedq);\n \tskb_queue_head_init(\u0026n-\u003ebc_entry.inputq1);\n \t__skb_queue_head_init(\u0026n-\u003ebc_entry.arrvq);\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "TIPC"
  ],
  "FocusSymbols": [
    "tipc_named_node_up",
    "tipc_named_dist_cluster_scope",
    "tipc_node_dist_bulk",
    "named_distribute"
  ],
  "Reasoning": "The patch modifies the TIPC protocol's node initialization and bulk publication distribution logic, introducing a new work item and synchronization mechanism. This is a functional change in the core TIPC logic that should be fuzzed.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 07c1cb744cd69cb8fdbdd88742eb0a185bbab4a7
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jul 17 23:12:49 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/tipc/core.c b/net/tipc/core.c
index 434e70eabe0812..ce164509d9e27a 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -60,6 +60,7 @@ static int __net_init tipc_init_net(struct net *net)
 	tn->trial_addr = 0;
 	tn->addr_trial_end = 0;
 	tn->capabilities = TIPC_NODE_CAPABILITIES;
+	atomic_set(&tn->finalized, 0);
 	INIT_WORK(&tn->work, tipc_net_finalize_work);
 	memset(tn->node_id, 0, sizeof(tn->node_id));
 	memset(tn->node_id_string, 0, sizeof(tn->node_id_string));
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 9ce5f9ff6cc031..76768844c80814 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -145,6 +145,8 @@ struct tipc_net {
 	struct work_struct work;
 	/* The numbers of work queues in schedule */
 	atomic_t wq_count;
+	/* flag to indicate work has finished */
+	atomic_t finalized;
 };
 
 static inline struct tipc_net *tipc_net(struct net *net)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 190b49c5cbc3ec..5b0fb09226fc68 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p)
  * @pls: linked list of publication items to be packed into buffer chain
  * @seqno: sequence number for this message
  */
-static void named_distribute(struct net *net, struct sk_buff_head *list,
+static int named_distribute(struct net *net, struct sk_buff_head *list,
 			     u32 dnode, struct list_head *pls, u16 seqno)
 {
 	struct publication *publ;
@@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
 			skb = named_prepare_buf(net, PUBLICATION, msg_rem,
 						dnode);
 			if (!skb) {
+				__skb_queue_purge(list);
 				pr_warn("Bulk publication failure\n");
-				return;
+				return 1;
 			}
 			hdr = buf_msg(skb);
 			msg_set_bc_ack_invalid(hdr, true);
@@ -192,9 +193,15 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
 		skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem));
 		__skb_queue_tail(list, skb);
 	}
+	if (skb_queue_empty(list)) {
+		pr_warn("Bulk publication list empty, nothing to distribute\n");
+		return 1;
+	}
 	hdr = buf_msg(skb_peek_tail(list));
 	msg_set_last_bulk(hdr);
 	msg_set_named_seqno(hdr, seqno);
+
+	return 0;
 }
 
 /**
@@ -203,7 +210,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
  * @dnode: destination node
  * @capabilities: peer node's capabilities
  */
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
 {
 	struct name_table *nt = tipc_name_table(net);
 	struct tipc_net *tn = tipc_net(net);
@@ -218,9 +225,53 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
 	spin_unlock_bh(&tn->nametbl_lock);
 
 	read_lock_bh(&nt->cluster_scope_lock);
-	named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
+	/* tipc_net_finalize_work() has not finished inserting self address to
+	 * name table yet.
+	 */
+	if (unlikely(list_empty(&nt->cluster_scope))) {
+		read_unlock_bh(&nt->cluster_scope_lock);
+		return 1;
+	}
+
+	if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+		read_unlock_bh(&nt->cluster_scope_lock);
+		return -ENOBUFS;
+	}
+
 	tipc_node_xmit(net, &head, dnode, 0);
 	read_unlock_bh(&nt->cluster_scope_lock);
+	return 0;
+}
+
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
+{
+	struct name_table *nt = tipc_name_table(net);
+	struct tipc_net *tn = tipc_net(net);
+	struct sk_buff_head head;
+	u16 seqno;
+
+	__skb_queue_head_init(&head);
+	wait_var_event(&tn->finalized, atomic_read(&tn->finalized));
+	spin_lock_bh(&tn->nametbl_lock);
+	seqno = nt->snd_nxt;
+	spin_unlock_bh(&tn->nametbl_lock);
+
+	read_lock_bh(&nt->cluster_scope_lock);
+	if (unlikely(list_empty(&nt->cluster_scope))) {
+		/* finalize is done but nothing was published (publish
+		 * failed): a permanent state, nothing to synchronize.
+		 */
+		read_unlock_bh(&nt->cluster_scope_lock);
+		return 0;
+	}
+	if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+		read_unlock_bh(&nt->cluster_scope_lock);
+		return -ENOBUFS;
+	}
+	tipc_node_xmit(net, &head, dnode, 0);
+	read_unlock_bh(&nt->cluster_scope_lock);
+
+	return 0;
 }
 
 /**
diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h
index c677f6f082dfb7..cadf4e8c3e66c2 100644
--- a/net/tipc/name_distr.h
+++ b/net/tipc/name_distr.h
@@ -69,7 +69,8 @@ struct distr_item {
 
 struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ);
 struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ);
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode);
 void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq,
 		    u16 *rcv_nxt, bool *open);
 void tipc_named_reinit(struct net *net);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7e65d0b0c4a8d1..2aa8812c551add 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -138,7 +138,10 @@ static void tipc_net_finalize(struct net *net, u32 addr)
 	tipc_named_reinit(net);
 	tipc_sk_reinit(net);
 	tipc_mon_reinit_self(net);
-	tipc_nametbl_publish(net, &ua, &sk, addr);
+	if (!tipc_nametbl_publish(net, &ua, &sk, addr))
+		pr_warn("Failed to publish own node state\n");
+	atomic_inc(&tn->finalized);
+	wake_up_var(&tn->finalized);
 }
 
 void tipc_net_finalize_work(struct work_struct *work)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 97aa970a0d83ca..428c4eacd02f1f 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -145,6 +145,8 @@ struct tipc_node {
 #ifdef CONFIG_TIPC_CRYPTO
 	struct tipc_crypto *crypto_rx;
 #endif
+	/* Work item for bulk distribution of cluster scope publications */
+	struct work_struct work;
 };
 
 /* Node FSM states and events:
@@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp)
 #ifdef CONFIG_TIPC_CRYPTO
 	tipc_crypto_stop(&n->crypto_rx);
 #endif
+	cancel_work_sync(&n->work);
 	kfree(n);
 }
 
@@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n)
 	write_unlock_bh(&n->lock);
 }
 
+static void tipc_node_dist_bulk(struct work_struct *work)
+{
+	struct tipc_node *node = container_of(work, struct tipc_node, work);
+
+	if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) {
+		u32 bearer_id = node->link_id & 0xffff;
+
+		tipc_node_link_down(node, bearer_id, false);
+	}
+
+	tipc_node_put(node);
+}
+
 static void tipc_node_write_unlock(struct tipc_node *n)
 	__releases(n->lock)
 {
@@ -424,8 +440,22 @@ static void tipc_node_write_unlock(struct tipc_node *n)
 	if (flags & TIPC_NOTIFY_NODE_DOWN)
 		tipc_publ_notify(net, publ_list, node, n->capabilities);
 
-	if (flags & TIPC_NOTIFY_NODE_UP)
-		tipc_named_node_up(net, node, n->capabilities);
+	if (flags & TIPC_NOTIFY_NODE_UP) {
+		int rc = 0;
+
+		rc = tipc_named_node_up(net, node, n->capabilities);
+		/* Defer bulk distribution to work queue */
+		if (rc > 0) {
+			tipc_node_get(n);
+			if (!schedule_work(&n->work))
+				tipc_node_put(n);
+		} else if (rc < 0) {
+			/* Bring the link down to start over bulk distribution
+			 * when the link is up again.
+			 */
+			tipc_node_link_down(n, bearer_id, false);
+		}
+	}
 
 	if (flags & TIPC_NOTIFY_LINK_UP) {
 		tipc_mon_peer_up(net, node, bearer_id);
@@ -564,6 +594,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
 	INIT_LIST_HEAD(&n->list);
 	INIT_LIST_HEAD(&n->publ_list);
 	INIT_LIST_HEAD(&n->conn_sks);
+	INIT_WORK(&n->work, tipc_node_dist_bulk);
 	skb_queue_head_init(&n->bc_entry.namedq);
 	skb_queue_head_init(&n->bc_entry.inputq1);
 	__skb_queue_head_init(&n->bc_entry.arrvq);

gemini-3.1-pro-preview

null

null

							input: 5006
							output: 17
							thoughts: 201
						

**Analyzing a TIPC Patch**

Okay, so I'm looking at this patch for the TIPC subsystem in the Linux kernel. Seems like a solid functional change; it's getting deep into the core logic. Specifically, they've introduced a `finalized` atomic variable in `struct tipc_net` and a `work` item in `struct tipc_node`. Interesting...this points to handling some sort of bulk publication distribution at the cluster level. The modifications to `tipc_named_node_up` to return an integer instead of void, and the addition of `tipc_named_dist_cluster_scope` further confirms my suspicion that they're addressing a race condition or synchronization issue, probably during node initialization and initial publication distribution.

The patch also has changes in `tipc_node_write_unlock` to handle the return value of `tipc_named_node_up` and schedule that work item. Smart; that likely ties the unlocking to a deferred processing step, which is a common way to avoid contention.

Before I dig into the specifics of the code, I should probably check the relevant Kconfig options. Let's see...I think `default_api:grepper` should give me a quick route to the TIPC Kconfig. Gotta get the configuration context right.

{
  "Expression": "config TIPC"
}

{
  "Output": "net/tipc/Kconfig-5-\nnet/tipc/Kconfig:6:menuconfig TIPC\nnet/tipc/Kconfig-7-\ttristate \"The TIPC Protocol\"\n--\nnet/tipc/Kconfig-23-\nnet/tipc/Kconfig:24:config TIPC_MEDIA_IB\nnet/tipc/Kconfig-25-\tbool \"InfiniBand media type support\"\n--\nnet/tipc/Kconfig-29-\t  IP-over-InfiniBand devices.\nnet/tipc/Kconfig:30:config TIPC_MEDIA_UDP\nnet/tipc/Kconfig-31-\tbool \"IP/UDP media type support\"\n--\nnet/tipc/Kconfig-37-\nnet/tipc/Kconfig:38:config TIPC_CRYPTO\nnet/tipc/Kconfig-39-\tbool \"TIPC encryption support\"\n--\nnet/tipc/Kconfig-52-\nnet/tipc/Kconfig:53:config TIPC_DIAG\nnet/tipc/Kconfig-54-\ttristate \"TIPC: socket monitoring interface\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 5789
							output: 120
							thoughts: 401
						

**Fuzzing Strategy for TIPC Core Functionality**

Okay, here's what I'm thinking. This patch is definitely centered around the `TIPC` configuration – that's the main driver. Looking at the file modifications, it's hitting the core of the TIPC implementation: `core.c`, `name_distr.c`, `net.c`, and `node.c`. This suggests it's digging into how TIPC nodes are initialized, how names are distributed across the network, and the overall network management.

The listed function changes are the key here: `tipc_init_net`, `named_distribute`, `tipc_named_node_up`, `tipc_named_dist_cluster_scope`, `tipc_net_finalize`, `tipc_node_free`, `tipc_node_dist_bulk`, `tipc_node_write_unlock`, and `tipc_node_create`. Specifically, `tipc_named_node_up`, `tipc_named_dist_cluster_scope`, `tipc_node_dist_bulk`, and `named_distribute` jump out at me as potential trouble spots, so I'm focusing on those.

Now, just to be sure, I need to confirm that `TIPC` is the only config required to hit this code. Yep, it seems that `TIPC` alone is the trigger, no other dependencies. Also, with TIPC being a network protocol, I'm confident that these functions are reachable – likely through socket APIs and netlink interactions, the standard way to interact with these subsystems. The changes are in how nodes connect and name information is disseminated, so that makes sense.

So, I'm going to set up my fuzzing strategy like this:

*   `WorthFuzzing`: `true` – because this patch touches core network logic with functions for distributing network data that are of interest for fuzzing.
*   `EnableConfigs`: `["TIPC"]` – to activate the correct code.
*   `FocusSymbols`: `["tipc_named_node_up", "tipc_named_dist_cluster_scope", "tipc_node_dist_bulk", "named_distribute"]` – the functions that seem most likely to expose vulnerabilities.
*   `Reasoning`: "The patch modifies the TIPC protocol's node initialization and bulk publication distribution logic, introducing a new work item and synchronization mechanism. This is a functional change in the core TIPC logic that should be fuzzed." – that summarizes why these functions are important.

{
  "EnableConfigs": [
    "TIPC"
  ],
  "FocusSymbols": [
    "tipc_named_node_up",
    "tipc_named_dist_cluster_scope",
    "tipc_node_dist_bulk",
    "named_distribute"
  ],
  "Reasoning": "The patch modifies the TIPC protocol's node initialization and bulk publication distribution logic, introducing a new work item and synchronization mechanism. This is a functional change in the core TIPC logic that should be fuzzed.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "TIPC"
  ],
  "FocusSymbols": [
    "tipc_named_node_up",
    "tipc_named_dist_cluster_scope",
    "tipc_node_dist_bulk",
    "named_distribute"
  ],
  "Reasoning": "The patch modifies the TIPC protocol's node initialization and bulk publication distribution logic, introducing a new work item and synchronization mechanism. This is a functional change in the core TIPC logic that should be fuzzed.",
  "WorthFuzzing": true
}