| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/29 15:22 | flow | patch-triage |
7mArgs:null Results: {
"EnableConfigs": [
"NET_DEV_REFCNT_TRACKER",
"KALLSYMS",
"DEBUG_KERNEL",
"NET"
],
"FocusSymbols": [
"save_netdev_trace_buffer"
],
"KMSANReasoning": "The patch introduces an in-kernel net_device reference count tracking/debugging mechanism using a static trace buffer list and stack trace captures. \n\n1. No data is copied to user space (no copy_to_user, put_user, netlink attributes, socket options, etc.); all output is printed to the kernel log via printk/stack_trace_print.\n2. All trace buffers and stack arrays are either zero-initialized (static BSS buffer pool and zeroed stack buffers) or explicitly written up to the count returned by stack_trace_save() before any reads or comparisons.\n3. Length parameters (nr_entries, trimmed_entries) are strictly maintained such that only initialized stack trace entries are ever accessed by memcmp, memmove, and stack_trace_print.\n4. Any potential synchronization, list corruption, or use-after-free issues arising from RCU/raw spinlock usage would be caught by KASAN or LOCKDEP.\n\nTherefore, the changes do not introduce or expose uninitialized memory reads or kernel info-leaks, and a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false,
"Reasoning": "The patch implements a network device reference count trace buffer tracking mechanism under CONFIG_NET_DEV_REFCNT_TRACKER and CONFIG_KALLSYMS. It saves stack traces on __dev_hold() and __dev_put(), managing an RCU list of trace buffers with a raw spinlock and memory comparisons, which affects core network device lifecycle operations.",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/29 15:22 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 47bb9c9cd4497eff28463ea205f165241c0b158b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sat Aug 29 15:22:55 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/linux/netdevice.h b/include/linux/netdevice.h\nindex 87cafc932e9e6..d518338cd0749 100644\n--- a/include/linux/netdevice.h\n+++ b/include/linux/netdevice.h\n@@ -2153,6 +2153,8 @@ enum netdev_reg_state {\n *\n *\tFIXME: cleanup struct net_device such that network protocol info\n *\tmoves out.\n+ *\n+ *\t@netdev_trace_buffer_list: Linked list for debugging refcount leak.\n */\n \n struct net_device {\n@@ -2312,6 +2314,9 @@ struct net_device {\n #if IS_ENABLED(CONFIG_TLS_DEVICE)\n \tconst struct tlsdev_ops *tlsdev_ops;\n #endif\n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+\tstruct list_head\tnetdev_trace_buffer_list;\n+#endif\n \n \tunsigned int\t\toperstate;\n \tunsigned char\t\tlink_mode;\n@@ -4498,9 +4503,16 @@ static inline bool dev_nit_active(const struct net_device *dev)\n \n void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+void save_netdev_trace_buffer(struct net_device *dev, int delta);\n+#else\n+static inline void save_netdev_trace_buffer(struct net_device *dev, int delta) { }\n+#endif\n+\n static inline void __dev_put(struct net_device *dev)\n {\n \tif (dev) {\n+\t\tsave_netdev_trace_buffer(dev, -1);\n #ifdef CONFIG_PCPU_DEV_REFCNT\n \t\tthis_cpu_dec(*dev-\u003epcpu_refcnt);\n #else\n@@ -4512,6 +4524,7 @@ static inline void __dev_put(struct net_device *dev)\n static inline void __dev_hold(struct net_device *dev)\n {\n \tif (dev) {\n+\t\tsave_netdev_trace_buffer(dev, 1);\n #ifdef CONFIG_PCPU_DEV_REFCNT\n \t\tthis_cpu_inc(*dev-\u003epcpu_refcnt);\n #else\ndiff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c\nindex 96848fc1f02b8..20c4c92708b8c 100644\n--- a/kernel/rcu/tree.c\n+++ b/kernel/rcu/tree.c\n@@ -2566,6 +2566,10 @@ static bool rcu_do_batch_check_time(long count, long tlimit,\n \t local_clock() \u003e= tlimit;\n }\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+static noinline void rcu_do_batch(struct rcu_data *rdp);\n+#endif\n+\n /*\n * Invoke any RCU callbacks that have made it to the end of their grace\n * period. Throttle as specified by rdp-\u003eblimit.\ndiff --git a/kernel/softirq.c b/kernel/softirq.c\nindex 7980a4a232f9f..ad98895632880 100644\n--- a/kernel/softirq.c\n+++ b/kernel/softirq.c\n@@ -599,6 +599,10 @@ static inline bool lockdep_softirq_start(void) { return false; }\n static inline void lockdep_softirq_end(bool in_hardirq) { }\n #endif\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+static noinline void handle_softirqs(bool ksirqd);\n+#endif\n+\n static void handle_softirqs(bool ksirqd)\n {\n \tunsigned long end = jiffies + MAX_SOFTIRQ_TIME;\ndiff --git a/kernel/workqueue.c b/kernel/workqueue.c\nindex 3c034cbc5bb30..60daae1c6f17f 100644\n--- a/kernel/workqueue.c\n+++ b/kernel/workqueue.c\n@@ -3259,6 +3259,10 @@ static bool manage_workers(struct worker *worker)\n \treturn true;\n }\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+static noinline void process_one_work(struct worker *worker, struct work_struct *work);\n+#endif\n+\n /**\n * process_one_work - process single work\n * @worker: self\ndiff --git a/net/core/dev.c b/net/core/dev.c\nindex 38336858c168f..93a7594d586e3 100644\n--- a/net/core/dev.c\n+++ b/net/core/dev.c\n@@ -11639,6 +11639,14 @@ int netdev_refcnt_read(const struct net_device *dev)\n }\n EXPORT_SYMBOL(netdev_refcnt_read);\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+static void dump_netdev_trace_buffer(const struct net_device *dev);\n+static void erase_netdev_trace_buffer(const struct net_device *dev);\n+#else\n+static inline void dump_netdev_trace_buffer(const struct net_device *dev) { }\n+static inline void erase_netdev_trace_buffer(const struct net_device *dev) { }\n+#endif\n+\n int netdev_unregister_timeout_secs __read_mostly = 10;\n \n #define WAIT_REFS_MIN_MSECS 1\n@@ -11721,6 +11729,7 @@ static struct net_device *netdev_wait_allrefs_any(struct list_head *list)\n \t\t\t\tpr_emerg(\"unregister_netdevice: waiting for %s to become free. Usage count = %d\\n\",\n \t\t\t\t\t dev-\u003ename, netdev_refcnt_read(dev));\n \t\t\t\tref_tracker_dir_print(\u0026dev-\u003erefcnt_tracker, 10);\n+\t\t\t\tdump_netdev_trace_buffer(dev);\n \t\t\t}\n \n \t\t\twarning_time = jiffies;\n@@ -12121,6 +12130,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,\n \n \tdev-\u003epriv_len = sizeof_priv;\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+\tINIT_LIST_HEAD(\u0026dev-\u003enetdev_trace_buffer_list);\n+#endif\n \tref_tracker_dir_init(\u0026dev-\u003erefcnt_tracker, 128, \"netdev\");\n #ifdef CONFIG_PCPU_DEV_REFCNT\n \tdev-\u003epcpu_refcnt = alloc_percpu(int);\n@@ -12223,6 +12235,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,\n free_pcpu:\n #ifdef CONFIG_PCPU_DEV_REFCNT\n \tfree_percpu(dev-\u003epcpu_refcnt);\n+\terase_netdev_trace_buffer(dev);\n free_dev:\n #endif\n \tref_tracker_dir_exit(\u0026dev-\u003erefcnt_tracker);\n@@ -12292,6 +12305,7 @@ void free_netdev(struct net_device *dev)\n \tfree_percpu(dev-\u003epcpu_refcnt);\n \tdev-\u003epcpu_refcnt = NULL;\n #endif\n+\terase_netdev_trace_buffer(dev);\n \tfree_percpu(dev-\u003ecore_stats);\n \tdev-\u003ecore_stats = NULL;\n \tfree_percpu(dev-\u003exdp_bulkq);\n@@ -13418,6 +13432,12 @@ static struct smp_hotplug_thread backlog_threads = {\n \t.setup\t\t\t= backlog_napi_setup,\n };\n \n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+static void __init net_dev_refcnt_tracker_init(void);\n+#else\n+static void __init net_dev_refcnt_tracker_init(void) { };\n+#endif\n+\n /*\n * This is called single threaded during boot, so no need\n * to take the rtnl semaphore.\n@@ -13426,6 +13446,7 @@ static int __init net_dev_init(void)\n {\n \tint i, rc = -ENOMEM;\n \n+\tnet_dev_refcnt_tracker_init();\n \tBUG_ON(!dev_boot_phase);\n \n \tnet_dev_struct_check();\n@@ -13529,3 +13550,254 @@ static int __init net_dev_init(void)\n }\n \n subsys_initcall(net_dev_init);\n+\n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+\n+#define NETDEV_TRACE_BUFFER_SIZE 32768\n+static struct netdev_trace_buffer {\n+\tstruct list_head list;\n+\tatomic_t count;\n+\tint trimmed_entries;\n+\tint nr_entries;\n+\tunsigned long entries[20];\n+} netdev_trace_buffer[NETDEV_TRACE_BUFFER_SIZE];\n+static LIST_HEAD(netdev_trace_buffer_list);\n+static DEFINE_RAW_SPINLOCK(netdev_trace_buffer_lock);\n+static bool netdev_trace_buffer_exhausted;\n+static unsigned long start_of_handle_softirqs __ro_after_init;\n+static unsigned long end_of_handle_softirqs __ro_after_init;\n+\n+static int netdev_trace_buffer_init(void)\n+{\n+\tint i;\n+\n+\tfor (i = 0; i \u003c NETDEV_TRACE_BUFFER_SIZE; i++)\n+\t\tlist_add_tail(\u0026netdev_trace_buffer[i].list, \u0026netdev_trace_buffer_list);\n+\treturn 0;\n+}\n+pure_initcall(netdev_trace_buffer_init);\n+\n+static int trim_netdev_trace(unsigned long *entries, int nr_entries)\n+{\n+\tchar buffer[KSYM_SYMBOL_LEN] = { };\n+\tchar *cp;\n+\tint i;\n+\n+\tfor (i = 0; i \u003c nr_entries; i++) {\n+\t\tsprint_symbol_no_offset(buffer, entries[i]);\n+\t\tcp = strchr(buffer, ' ');\n+\t\tif (cp)\n+\t\t\t*cp = '\\0';\n+\t\tif (buffer[0] == 'p') {\n+\t\t\tif (!strcmp(buffer, \"process_one_work\"))\n+\t\t\t\treturn i + 1;\n+\t\t} else if (buffer[0] == 'k') {\n+\t\t\tif (!strcmp(buffer, \"ksys_unshare\"))\n+\t\t\t\treturn i + 1;\n+\t\t} else if (buffer[0] == 's') {\n+\t\t\tif (!strcmp(buffer, \"sock_sendmsg_nosec\") ||\n+\t\t\t !strcmp(buffer, \"sock_recvmsg_nosec\"))\n+\t\t\t\treturn i + 1;\n+\t\t} else if (buffer[0] == 'r') {\n+\t\t\tif (!strcmp(buffer, \"rcu_do_batch\"))\n+\t\t\t\treturn i + 1;\n+\t\t} else if (buffer[0] == '_') {\n+\t\t\tif (!strcmp(buffer, \"__sys_bind\") ||\n+\t\t\t !strcmp(buffer, \"__sock_release\") ||\n+\t\t\t !strcmp(buffer, \"__sys_bpf\"))\n+\t\t\t\treturn i + 1;\n+\t\t} else {\n+\t\t\tif (!strcmp(buffer, \"do_sock_setsockopt\"))\n+\t\t\t\treturn i + 1;\n+\t\t}\n+\t}\n+\treturn nr_entries;\n+}\n+\n+static void dump_netdev_trace_buffer(const struct net_device *dev)\n+{\n+\tstruct netdev_trace_buffer *ptr, *tmp;\n+\tint count, balance = 0, pos = 0;\n+\n+\t/* Update trimmed_entries field. Do not modify nr_entries field\n+\t * in case save_netdev_trace_buffer() is called again.\n+\t */\n+\tlist_for_each_entry_rcu(ptr, \u0026dev-\u003enetdev_trace_buffer_list, list,\n+\t\t\t\t/* list elements can't go away. */ 1) {\n+\t\tif (ptr-\u003etrimmed_entries == ptr-\u003enr_entries)\n+\t\t\tptr-\u003etrimmed_entries = trim_netdev_trace(ptr-\u003eentries, ptr-\u003enr_entries);\n+\t}\n+\t/* Merge duplicated entries using trimmed_entries field. */\n+\tlist_for_each_entry_rcu(ptr, \u0026dev-\u003enetdev_trace_buffer_list, list,\n+\t\t\t\t/* list elements can't go away. */ 1) {\n+\t\t/* Skip empty entries. */\n+\t\tif (!atomic_read(\u0026ptr-\u003ecount))\n+\t\t\tcontinue;\n+\t\ttmp = ptr;\n+\t\tlist_for_each_entry_continue_rcu(tmp, \u0026dev-\u003enetdev_trace_buffer_list, list) {\n+\t\t\tif (ptr-\u003etrimmed_entries != tmp-\u003etrimmed_entries ||\n+\t\t\t memcmp(ptr-\u003eentries, tmp-\u003eentries,\n+\t\t\t\t ptr-\u003etrimmed_entries * sizeof(unsigned long)))\n+\t\t\t\tcontinue;\n+\t\t\t/* Skip empty entries. */\n+\t\t\tcount = atomic_read(\u0026tmp-\u003ecount);\n+\t\t\tif (!count)\n+\t\t\t\tcontinue;\n+\t\t\t/* Move count from non-first entry to first entry. */\n+\t\t\tatomic_add(count, \u0026ptr-\u003ecount);\n+\t\t\tatomic_sub(count, \u0026tmp-\u003ecount);\n+\t\t}\n+\t\t/* It is safe to call cond_resched() because this function is\n+\t\t * called from schedulable context.\n+\t\t */\n+\t\tcond_resched();\n+\t}\n+\t/* Report all entries for this device. */\n+\tlist_for_each_entry_rcu(ptr, \u0026dev-\u003enetdev_trace_buffer_list, list,\n+\t\t\t\t/* list elements can't go away. */ 1) {\n+\t\t/* Skip empty entries. */\n+\t\tcount = atomic_read(\u0026ptr-\u003ecount);\n+\t\tif (!count)\n+\t\t\tcontinue;\n+\t\t/* Report this entry. It is safe to call cond_resched() because\n+\t\t * this function is called from schedulable context.\n+\t\t */\n+\t\tpos++;\n+\t\tbalance += count;\n+\t\tpr_info(\"Call trace for %s[%d] %+d at\\n\", dev-\u003ename, pos, count);\n+\t\tstack_trace_print(ptr-\u003eentries, ptr-\u003etrimmed_entries, 4);\n+\t\tcond_resched();\n+\t}\n+\tif (!netdev_trace_buffer_exhausted)\n+\t\tpr_info(\"balance as of %s[%d] is %d\\n\", dev-\u003ename, pos, balance);\n+}\n+\n+static void erase_netdev_trace_buffer(const struct net_device *dev)\n+{\n+\tstruct netdev_trace_buffer *ptr;\n+\tunsigned long flags;\n+\n+\t/* This function is called after free_percpu(dev-\u003epcpu_refcnt) was already\n+\t * called, which means that no more __dev_put()/__dev_hold() call can be made.\n+\t * Therefore, no more save_netdev_trace_buffer() call will be made, and we can\n+\t * safely return list elements to netdev_trace_buffer_list.\n+\t */\n+\traw_spin_lock_irqsave(\u0026netdev_trace_buffer_lock, flags);\n+\twhile (!list_empty(\u0026dev-\u003enetdev_trace_buffer_list)) {\n+\t\tptr = list_first_entry(\u0026dev-\u003enetdev_trace_buffer_list, typeof(*ptr), list);\n+\t\tlist_del(\u0026ptr-\u003elist);\n+\t\tlist_add_tail(\u0026ptr-\u003elist, \u0026netdev_trace_buffer_list);\n+\t}\n+\traw_spin_unlock_irqrestore(\u0026netdev_trace_buffer_lock, flags);\n+}\n+\n+void save_netdev_trace_buffer(struct net_device *dev, int delta)\n+{\n+\tstruct netdev_trace_buffer *ptr;\n+\tunsigned long entries[ARRAY_SIZE(ptr-\u003eentries)];\n+\tint nr_entries;\n+\tunsigned long flags;\n+\n+\t/* This function is not NMI-safe. Give up if called from NMI context. */\n+\tif (in_nmi())\n+\t\treturn;\n+\t/* Get stack traces. */\n+\tnr_entries = stack_trace_save(entries, ARRAY_SIZE(ptr-\u003eentries), 1);\n+\t/* Trim traces of process context now if called from softirq context, for\n+\t * we will easily exhaust netdev_trace_buffer_list if we don't trim traces\n+\t * of process context when trying to compare with existing entries.\n+\t *\n+\t * Avoid kallsyms lookup, by using cached address resolved upon boot.\n+\t */\n+\tif (in_softirq()) {\n+\t\tint i;\n+\n+\t\tfor (i = 0; i \u003c nr_entries; i++) {\n+\t\t\tif (entries[i] \u003e= start_of_handle_softirqs \u0026\u0026\n+\t\t\t entries[i] \u003c end_of_handle_softirqs) {\n+\t\t\t\tnr_entries = i + 1;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t}\n+\t/* Compare with existing entries at best-effort basis. Since duplicated entries\n+\t * created by race condition will be merged when reporting, we don't use lock here.\n+\t */\n+\tlist_for_each_entry_rcu(ptr, \u0026dev-\u003enetdev_trace_buffer_list, list,\n+\t\t\t\t/* list elements can't go away. */ 1) {\n+\t\tif (ptr-\u003enr_entries == nr_entries \u0026\u0026\n+\t\t !memcmp(ptr-\u003eentries, entries, nr_entries * sizeof(unsigned long))) {\n+\t\t\tatomic_add(delta, \u0026ptr-\u003ecount);\n+\t\t\treturn;\n+\t\t}\n+\t}\n+\t/* Add a new entry. We don't re-compare with existing entries with lock held, for\n+\t * duplicated entries created by race condition will be merged when reporting.\n+\t * But we use raw spinlock here in case this function is called with some other\n+\t * raw spinlock already held.\n+\t */\n+\traw_spin_lock_irqsave(\u0026netdev_trace_buffer_lock, flags);\n+\tif (!list_empty(\u0026netdev_trace_buffer_list)) {\n+\t\t/* Remove one entry from netdev_trace_buffer_list and initialize it. */\n+\t\tptr = list_first_entry(\u0026netdev_trace_buffer_list, typeof(*ptr), list);\n+\t\tlist_del(\u0026ptr-\u003elist);\n+\t\tatomic_set(\u0026ptr-\u003ecount, delta);\n+\t\tptr-\u003enr_entries = nr_entries;\n+\t\tptr-\u003etrimmed_entries = nr_entries;\n+\t\tmemmove(ptr-\u003eentries, entries, nr_entries * sizeof(unsigned long));\n+\t\t/* Append it in RCU manner, for readers are lockless. */\n+\t\tlist_add_tail_rcu(\u0026ptr-\u003elist, \u0026dev-\u003enetdev_trace_buffer_list);\n+\t} else {\n+\t\tnetdev_trace_buffer_exhausted = true;\n+\t}\n+\traw_spin_unlock_irqrestore(\u0026netdev_trace_buffer_lock, flags);\n+}\n+EXPORT_SYMBOL(save_netdev_trace_buffer);\n+\n+struct timer_completion_struct {\n+\tstruct timer_list timer;\n+\tstruct completion completion;\n+};\n+\n+/* Resolve address of handle_softirqs() and cache it, in order to avoid looking up\n+ * kallsyms every time.\n+ */\n+static void __init netdev_addr_resolve_func(struct timer_list *timer)\n+{\n+\tunsigned long entries[40];\n+\tint nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 1);\n+\tchar buffer[KSYM_SYMBOL_LEN] = { };\n+\tunsigned long offset, size;\n+\tchar *cp;\n+\tint i;\n+\n+\tfor (i = 0; i \u003c nr_entries; i++) {\n+\t\tsprint_symbol(buffer, entries[i]);\n+\t\tif (strncmp(buffer, \"handle_softirqs\", 15))\n+\t\t\tcontinue;\n+\t\tcp = strchr(buffer, '+');\n+\t\tif (!cp || sscanf(cp, \"+%lx/%lx\", \u0026offset, \u0026size) != 2)\n+\t\t\tcontinue;\n+\t\tstart_of_handle_softirqs = entries[i] - offset;\n+\t\tend_of_handle_softirqs = start_of_handle_softirqs + size;\n+\t\tbreak;\n+\t}\n+\tcomplete(\u0026container_of(timer, struct timer_completion_struct, timer)-\u003ecompletion);\n+}\n+\n+static void __init net_dev_refcnt_tracker_init(void)\n+{\n+\tstruct timer_completion_struct tc;\n+\n+\ttimer_setup_on_stack(\u0026tc.timer, netdev_addr_resolve_func, 0);\n+\tinit_completion(\u0026tc.completion);\n+\t/* Schedule a call to netdev_addr_resolve_func(). */\n+\tmod_timer(\u0026tc.timer, jiffies);\n+\t/* Wait for netdev_addr_resolve_func() to be called. */\n+\twait_for_completion(\u0026tc.completion);\n+\t/* Wait for netdev_addr_resolve_func() to complete. */\n+\ttimer_delete_sync(\u0026tc.timer);\n+\ttimer_destroy_on_stack(\u0026tc.timer);\n+}\n+\n+#endif\ndiff --git a/net/socket.c b/net/socket.c\nindex c05d86e63abf7..b3ddcc283cbbc 100644\n--- a/net/socket.c\n+++ b/net/socket.c\n@@ -723,7 +723,11 @@ struct socket *sock_alloc(void)\n }\n EXPORT_SYMBOL(sock_alloc);\n \n-static void __sock_release(struct socket *sock, struct inode *inode)\n+static\n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+noinline\n+#endif\n+void __sock_release(struct socket *sock, struct inode *inode)\n {\n \tconst struct proto_ops *ops = READ_ONCE(sock-\u003eops);\n \n@@ -795,7 +799,13 @@ static noinline void call_trace_sock_send_length(struct sock *sk, int ret,\n \ttrace_sock_send_length(sk, ret, 0);\n }\n \n-static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)\n+static\n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+noinline\n+#else\n+inline\n+#endif\n+int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)\n {\n \tint ret = INDIRECT_CALL_INET(READ_ONCE(sock-\u003eops)-\u003esendmsg, inet6_sendmsg,\n \t\t\t\t inet_sendmsg, sock, msg,\n@@ -1145,8 +1155,13 @@ static noinline void call_trace_sock_recv_length(struct sock *sk, int ret, int f\n \ttrace_sock_recv_length(sk, ret, flags);\n }\n \n-static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,\n-\t\t\t\t int flags)\n+static\n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+noinline\n+#else\n+inline\n+#endif\n+int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg, int flags)\n {\n \tint ret = INDIRECT_CALL_INET(READ_ONCE(sock-\u003eops)-\u003erecvmsg,\n \t\t\t\t inet6_recvmsg,\n@@ -2653,9 +2668,12 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,\n \treturn err \u003c 0 ? err : 0;\n }\n \n-static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,\n-\t\t\t unsigned int flags, struct used_address *used_address,\n-\t\t\t unsigned int allowed_msghdr_flags)\n+static\n+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\n+noinline\n+#endif\n+int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, unsigned int flags,\n+\t\t struct used_address *used_address, unsigned int allowed_msghdr_flags)\n {\n \tunsigned char ctl[sizeof(struct cmsghdr) + 20]\n \t\t\t\t__aligned(sizeof(__kernel_size_t));\n"
} |
| 2/1 | 2026/08/29 15:22 | agent | patch-evaluator |
4mModel:core Args: null Results: {
"EnableConfigs": [
"NET_DEV_REFCNT_TRACKER",
"KALLSYMS",
"DEBUG_KERNEL",
"NET"
],
"FocusSymbols": [
"save_netdev_trace_buffer"
],
"Reasoning": "The patch implements a network device reference count trace buffer tracking mechanism under CONFIG_NET_DEV_REFCNT_TRACKER and CONFIG_KALLSYMS. It saves stack traces on __dev_hold() and __dev_put(), managing an RCU list of trace buffers with a raw spinlock and memory comparisons, which affects core network device lifecycle operations.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 47bb9c9cd4497eff28463ea205f165241c0b158b
Author: syz-cluster <triage@syzkaller.com>
Date: Sat Aug 29 15:22:55 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 87cafc932e9e6..d518338cd0749 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2153,6 +2153,8 @@ enum netdev_reg_state {
*
* FIXME: cleanup struct net_device such that network protocol info
* moves out.
+ *
+ * @netdev_trace_buffer_list: Linked list for debugging refcount leak.
*/
struct net_device {
@@ -2312,6 +2314,9 @@ struct net_device {
#if IS_ENABLED(CONFIG_TLS_DEVICE)
const struct tlsdev_ops *tlsdev_ops;
#endif
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+ struct list_head netdev_trace_buffer_list;
+#endif
unsigned int operstate;
unsigned char link_mode;
@@ -4498,9 +4503,16 @@ static inline bool dev_nit_active(const struct net_device *dev)
void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+void save_netdev_trace_buffer(struct net_device *dev, int delta);
+#else
+static inline void save_netdev_trace_buffer(struct net_device *dev, int delta) { }
+#endif
+
static inline void __dev_put(struct net_device *dev)
{
if (dev) {
+ save_netdev_trace_buffer(dev, -1);
#ifdef CONFIG_PCPU_DEV_REFCNT
this_cpu_dec(*dev->pcpu_refcnt);
#else
@@ -4512,6 +4524,7 @@ static inline void __dev_put(struct net_device *dev)
static inline void __dev_hold(struct net_device *dev)
{
if (dev) {
+ save_netdev_trace_buffer(dev, 1);
#ifdef CONFIG_PCPU_DEV_REFCNT
this_cpu_inc(*dev->pcpu_refcnt);
#else
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 96848fc1f02b8..20c4c92708b8c 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2566,6 +2566,10 @@ static bool rcu_do_batch_check_time(long count, long tlimit,
local_clock() >= tlimit;
}
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static noinline void rcu_do_batch(struct rcu_data *rdp);
+#endif
+
/*
* Invoke any RCU callbacks that have made it to the end of their grace
* period. Throttle as specified by rdp->blimit.
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 7980a4a232f9f..ad98895632880 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -599,6 +599,10 @@ static inline bool lockdep_softirq_start(void) { return false; }
static inline void lockdep_softirq_end(bool in_hardirq) { }
#endif
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static noinline void handle_softirqs(bool ksirqd);
+#endif
+
static void handle_softirqs(bool ksirqd)
{
unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 3c034cbc5bb30..60daae1c6f17f 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3259,6 +3259,10 @@ static bool manage_workers(struct worker *worker)
return true;
}
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static noinline void process_one_work(struct worker *worker, struct work_struct *work);
+#endif
+
/**
* process_one_work - process single work
* @worker: self
diff --git a/net/core/dev.c b/net/core/dev.c
index 38336858c168f..93a7594d586e3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -11639,6 +11639,14 @@ int netdev_refcnt_read(const struct net_device *dev)
}
EXPORT_SYMBOL(netdev_refcnt_read);
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static void dump_netdev_trace_buffer(const struct net_device *dev);
+static void erase_netdev_trace_buffer(const struct net_device *dev);
+#else
+static inline void dump_netdev_trace_buffer(const struct net_device *dev) { }
+static inline void erase_netdev_trace_buffer(const struct net_device *dev) { }
+#endif
+
int netdev_unregister_timeout_secs __read_mostly = 10;
#define WAIT_REFS_MIN_MSECS 1
@@ -11721,6 +11729,7 @@ static struct net_device *netdev_wait_allrefs_any(struct list_head *list)
pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
dev->name, netdev_refcnt_read(dev));
ref_tracker_dir_print(&dev->refcnt_tracker, 10);
+ dump_netdev_trace_buffer(dev);
}
warning_time = jiffies;
@@ -12121,6 +12130,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
dev->priv_len = sizeof_priv;
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+ INIT_LIST_HEAD(&dev->netdev_trace_buffer_list);
+#endif
ref_tracker_dir_init(&dev->refcnt_tracker, 128, "netdev");
#ifdef CONFIG_PCPU_DEV_REFCNT
dev->pcpu_refcnt = alloc_percpu(int);
@@ -12223,6 +12235,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
free_pcpu:
#ifdef CONFIG_PCPU_DEV_REFCNT
free_percpu(dev->pcpu_refcnt);
+ erase_netdev_trace_buffer(dev);
free_dev:
#endif
ref_tracker_dir_exit(&dev->refcnt_tracker);
@@ -12292,6 +12305,7 @@ void free_netdev(struct net_device *dev)
free_percpu(dev->pcpu_refcnt);
dev->pcpu_refcnt = NULL;
#endif
+ erase_netdev_trace_buffer(dev);
free_percpu(dev->core_stats);
dev->core_stats = NULL;
free_percpu(dev->xdp_bulkq);
@@ -13418,6 +13432,12 @@ static struct smp_hotplug_thread backlog_threads = {
.setup = backlog_napi_setup,
};
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static void __init net_dev_refcnt_tracker_init(void);
+#else
+static void __init net_dev_refcnt_tracker_init(void) { };
+#endif
+
/*
* This is called single threaded during boot, so no need
* to take the rtnl semaphore.
@@ -13426,6 +13446,7 @@ static int __init net_dev_init(void)
{
int i, rc = -ENOMEM;
+ net_dev_refcnt_tracker_init();
BUG_ON(!dev_boot_phase);
net_dev_struct_check();
@@ -13529,3 +13550,254 @@ static int __init net_dev_init(void)
}
subsys_initcall(net_dev_init);
+
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+
+#define NETDEV_TRACE_BUFFER_SIZE 32768
+static struct netdev_trace_buffer {
+ struct list_head list;
+ atomic_t count;
+ int trimmed_entries;
+ int nr_entries;
+ unsigned long entries[20];
+} netdev_trace_buffer[NETDEV_TRACE_BUFFER_SIZE];
+static LIST_HEAD(netdev_trace_buffer_list);
+static DEFINE_RAW_SPINLOCK(netdev_trace_buffer_lock);
+static bool netdev_trace_buffer_exhausted;
+static unsigned long start_of_handle_softirqs __ro_after_init;
+static unsigned long end_of_handle_softirqs __ro_after_init;
+
+static int netdev_trace_buffer_init(void)
+{
+ int i;
+
+ for (i = 0; i < NETDEV_TRACE_BUFFER_SIZE; i++)
+ list_add_tail(&netdev_trace_buffer[i].list, &netdev_trace_buffer_list);
+ return 0;
+}
+pure_initcall(netdev_trace_buffer_init);
+
+static int trim_netdev_trace(unsigned long *entries, int nr_entries)
+{
+ char buffer[KSYM_SYMBOL_LEN] = { };
+ char *cp;
+ int i;
+
+ for (i = 0; i < nr_entries; i++) {
+ sprint_symbol_no_offset(buffer, entries[i]);
+ cp = strchr(buffer, ' ');
+ if (cp)
+ *cp = '\0';
+ if (buffer[0] == 'p') {
+ if (!strcmp(buffer, "process_one_work"))
+ return i + 1;
+ } else if (buffer[0] == 'k') {
+ if (!strcmp(buffer, "ksys_unshare"))
+ return i + 1;
+ } else if (buffer[0] == 's') {
+ if (!strcmp(buffer, "sock_sendmsg_nosec") ||
+ !strcmp(buffer, "sock_recvmsg_nosec"))
+ return i + 1;
+ } else if (buffer[0] == 'r') {
+ if (!strcmp(buffer, "rcu_do_batch"))
+ return i + 1;
+ } else if (buffer[0] == '_') {
+ if (!strcmp(buffer, "__sys_bind") ||
+ !strcmp(buffer, "__sock_release") ||
+ !strcmp(buffer, "__sys_bpf"))
+ return i + 1;
+ } else {
+ if (!strcmp(buffer, "do_sock_setsockopt"))
+ return i + 1;
+ }
+ }
+ return nr_entries;
+}
+
+static void dump_netdev_trace_buffer(const struct net_device *dev)
+{
+ struct netdev_trace_buffer *ptr, *tmp;
+ int count, balance = 0, pos = 0;
+
+ /* Update trimmed_entries field. Do not modify nr_entries field
+ * in case save_netdev_trace_buffer() is called again.
+ */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ if (ptr->trimmed_entries == ptr->nr_entries)
+ ptr->trimmed_entries = trim_netdev_trace(ptr->entries, ptr->nr_entries);
+ }
+ /* Merge duplicated entries using trimmed_entries field. */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ /* Skip empty entries. */
+ if (!atomic_read(&ptr->count))
+ continue;
+ tmp = ptr;
+ list_for_each_entry_continue_rcu(tmp, &dev->netdev_trace_buffer_list, list) {
+ if (ptr->trimmed_entries != tmp->trimmed_entries ||
+ memcmp(ptr->entries, tmp->entries,
+ ptr->trimmed_entries * sizeof(unsigned long)))
+ continue;
+ /* Skip empty entries. */
+ count = atomic_read(&tmp->count);
+ if (!count)
+ continue;
+ /* Move count from non-first entry to first entry. */
+ atomic_add(count, &ptr->count);
+ atomic_sub(count, &tmp->count);
+ }
+ /* It is safe to call cond_resched() because this function is
+ * called from schedulable context.
+ */
+ cond_resched();
+ }
+ /* Report all entries for this device. */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ /* Skip empty entries. */
+ count = atomic_read(&ptr->count);
+ if (!count)
+ continue;
+ /* Report this entry. It is safe to call cond_resched() because
+ * this function is called from schedulable context.
+ */
+ pos++;
+ balance += count;
+ pr_info("Call trace for %s[%d] %+d at\n", dev->name, pos, count);
+ stack_trace_print(ptr->entries, ptr->trimmed_entries, 4);
+ cond_resched();
+ }
+ if (!netdev_trace_buffer_exhausted)
+ pr_info("balance as of %s[%d] is %d\n", dev->name, pos, balance);
+}
+
+static void erase_netdev_trace_buffer(const struct net_device *dev)
+{
+ struct netdev_trace_buffer *ptr;
+ unsigned long flags;
+
+ /* This function is called after free_percpu(dev->pcpu_refcnt) was already
+ * called, which means that no more __dev_put()/__dev_hold() call can be made.
+ * Therefore, no more save_netdev_trace_buffer() call will be made, and we can
+ * safely return list elements to netdev_trace_buffer_list.
+ */
+ raw_spin_lock_irqsave(&netdev_trace_buffer_lock, flags);
+ while (!list_empty(&dev->netdev_trace_buffer_list)) {
+ ptr = list_first_entry(&dev->netdev_trace_buffer_list, typeof(*ptr), list);
+ list_del(&ptr->list);
+ list_add_tail(&ptr->list, &netdev_trace_buffer_list);
+ }
+ raw_spin_unlock_irqrestore(&netdev_trace_buffer_lock, flags);
+}
+
+void save_netdev_trace_buffer(struct net_device *dev, int delta)
+{
+ struct netdev_trace_buffer *ptr;
+ unsigned long entries[ARRAY_SIZE(ptr->entries)];
+ int nr_entries;
+ unsigned long flags;
+
+ /* This function is not NMI-safe. Give up if called from NMI context. */
+ if (in_nmi())
+ return;
+ /* Get stack traces. */
+ nr_entries = stack_trace_save(entries, ARRAY_SIZE(ptr->entries), 1);
+ /* Trim traces of process context now if called from softirq context, for
+ * we will easily exhaust netdev_trace_buffer_list if we don't trim traces
+ * of process context when trying to compare with existing entries.
+ *
+ * Avoid kallsyms lookup, by using cached address resolved upon boot.
+ */
+ if (in_softirq()) {
+ int i;
+
+ for (i = 0; i < nr_entries; i++) {
+ if (entries[i] >= start_of_handle_softirqs &&
+ entries[i] < end_of_handle_softirqs) {
+ nr_entries = i + 1;
+ break;
+ }
+ }
+ }
+ /* Compare with existing entries at best-effort basis. Since duplicated entries
+ * created by race condition will be merged when reporting, we don't use lock here.
+ */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ if (ptr->nr_entries == nr_entries &&
+ !memcmp(ptr->entries, entries, nr_entries * sizeof(unsigned long))) {
+ atomic_add(delta, &ptr->count);
+ return;
+ }
+ }
+ /* Add a new entry. We don't re-compare with existing entries with lock held, for
+ * duplicated entries created by race condition will be merged when reporting.
+ * But we use raw spinlock here in case this function is called with some other
+ * raw spinlock already held.
+ */
+ raw_spin_lock_irqsave(&netdev_trace_buffer_lock, flags);
+ if (!list_empty(&netdev_trace_buffer_list)) {
+ /* Remove one entry from netdev_trace_buffer_list and initialize it. */
+ ptr = list_first_entry(&netdev_trace_buffer_list, typeof(*ptr), list);
+ list_del(&ptr->list);
+ atomic_set(&ptr->count, delta);
+ ptr->nr_entries = nr_entries;
+ ptr->trimmed_entries = nr_entries;
+ memmove(ptr->entries, entries, nr_entries * sizeof(unsigned long));
+ /* Append it in RCU manner, for readers are lockless. */
+ list_add_tail_rcu(&ptr->list, &dev->netdev_trace_buffer_list);
+ } else {
+ netdev_trace_buffer_exhausted = true;
+ }
+ raw_spin_unlock_irqrestore(&netdev_trace_buffer_lock, flags);
+}
+EXPORT_SYMBOL(save_netdev_trace_buffer);
+
+struct timer_completion_struct {
+ struct timer_list timer;
+ struct completion completion;
+};
+
+/* Resolve address of handle_softirqs() and cache it, in order to avoid looking up
+ * kallsyms every time.
+ */
+static void __init netdev_addr_resolve_func(struct timer_list *timer)
+{
+ unsigned long entries[40];
+ int nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 1);
+ char buffer[KSYM_SYMBOL_LEN] = { };
+ unsigned long offset, size;
+ char *cp;
+ int i;
+
+ for (i = 0; i < nr_entries; i++) {
+ sprint_symbol(buffer, entries[i]);
+ if (strncmp(buffer, "handle_softirqs", 15))
+ continue;
+ cp = strchr(buffer, '+');
+ if (!cp || sscanf(cp, "+%lx/%lx", &offset, &size) != 2)
+ continue;
+ start_of_handle_softirqs = entries[i] - offset;
+ end_of_handle_softirqs = start_of_handle_softirqs + size;
+ break;
+ }
+ complete(&container_of(timer, struct timer_completion_struct, timer)->completion);
+}
+
+static void __init net_dev_refcnt_tracker_init(void)
+{
+ struct timer_completion_struct tc;
+
+ timer_setup_on_stack(&tc.timer, netdev_addr_resolve_func, 0);
+ init_completion(&tc.completion);
+ /* Schedule a call to netdev_addr_resolve_func(). */
+ mod_timer(&tc.timer, jiffies);
+ /* Wait for netdev_addr_resolve_func() to be called. */
+ wait_for_completion(&tc.completion);
+ /* Wait for netdev_addr_resolve_func() to complete. */
+ timer_delete_sync(&tc.timer);
+ timer_destroy_on_stack(&tc.timer);
+}
+
+#endif
diff --git a/net/socket.c b/net/socket.c
index c05d86e63abf7..b3ddcc283cbbc 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -723,7 +723,11 @@ struct socket *sock_alloc(void)
}
EXPORT_SYMBOL(sock_alloc);
-static void __sock_release(struct socket *sock, struct inode *inode)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#endif
+void __sock_release(struct socket *sock, struct inode *inode)
{
const struct proto_ops *ops = READ_ONCE(sock->ops);
@@ -795,7 +799,13 @@ static noinline void call_trace_sock_send_length(struct sock *sk, int ret,
trace_sock_send_length(sk, ret, 0);
}
-static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#else
+inline
+#endif
+int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
{
int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->sendmsg, inet6_sendmsg,
inet_sendmsg, sock, msg,
@@ -1145,8 +1155,13 @@ static noinline void call_trace_sock_recv_length(struct sock *sk, int ret, int f
trace_sock_recv_length(sk, ret, flags);
}
-static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
- int flags)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#else
+inline
+#endif
+int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg, int flags)
{
int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->recvmsg,
inet6_recvmsg,
@@ -2653,9 +2668,12 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
return err < 0 ? err : 0;
}
-static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
- unsigned int flags, struct used_address *used_address,
- unsigned int allowed_msghdr_flags)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#endif
+int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, unsigned int flags,
+ struct used_address *used_address, unsigned int allowed_msghdr_flags)
{
unsigned char ctl[sizeof(struct cmsghdr) + 20]
__aligned(sizeof(__kernel_size_t));
|
| 3/2 | 2026/08/29 15:22 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 8251 output: 23 thoughts: 854 Thoughts: **Analyzing a Debug Patch for Netdev Refcount Tracking** Okay, let's break this down. My initial impression is that this patch introduces a debug or diagnostic mechanism, specifically aimed at tracking reference counts on network devices. It seems to be a proactive measure to catch memory leaks or other refcount-related issues, potentially for use with tools like syzkaller. My first thought was, is this just "decorative" like logging or tracing that the fuzzing guideline mentions? However, I see that this patch adds two new functions: `netdev_trace_buffer_list` and `save_netdev_trace_buffer`. It appears that these functions are hooked into critical points within the network device lifecycle – specifically, every call to `__dev_put` and `__dev_hold` – provided that certain configurations (`CONFIG_NET_DEV_REFCNT_TRACKER` and `CONFIG_KALLSYMS`) are enabled. That's a strong indicator that this will affect execution and is not decorative. Now, let's dig into the implementation a bit. `save_netdev_trace_buffer` is the key function here. It uses `stack_trace_save` to capture a stack trace, which is a big hint that the goal is to pinpoint the exact locations where a device is being held or released. This trace information is stored in a fixed-size buffer, `netdev_trace_buffer[32768]`. I note the presence of spinlocks (`raw_spin_lock_irqsave`) and RCU traversal, which tells me this is definitely core kernel logic. There are also functions for list manipulation, erasing, and dumping of buffer data. The fact that the stack trace is saved on every `__dev_put` and `__dev_hold` makes this a potentially high-overhead operation if it's running all the time! There are some noinline annotations added to several functions as well. I'll need to look into those to understand what their purpose is in this context. The most important step is to search for `CONFIG_NET_DEV_REFCNT_TRACKER` to see if this is an entirely new configuration option or if it's already part of the kernel. This will determine the scope of this patch. I believe this is going to be marked as worthy of fuzzing! |
| 4/2 | 2026/08/29 15:24 | tool | grepper |
0mArgs:{
"Expression": "NET_DEV_REFCNT_TRACKER"
}Results: {
"Output": "include/linux/netdevice.h=2160=struct net_device {\n--\ninclude/linux/netdevice.h-2316-#endif\ninclude/linux/netdevice.h:2317:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\ninclude/linux/netdevice.h-2318-\tstruct list_head\tnetdev_trace_buffer_list;\n--\ninclude/linux/netdevice.h=4504=void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);\ninclude/linux/netdevice.h-4505-\ninclude/linux/netdevice.h:4506:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\ninclude/linux/netdevice.h-4507-void save_netdev_trace_buffer(struct net_device *dev, int delta);\n--\ninclude/linux/netdevice.h=4536=static inline void __netdev_tracker_alloc(struct net_device *dev,\n--\ninclude/linux/netdevice.h-4539-{\ninclude/linux/netdevice.h:4540:#ifdef CONFIG_NET_DEV_REFCNT_TRACKER\ninclude/linux/netdevice.h-4541-\tref_tracker_alloc(\u0026dev-\u003erefcnt_tracker, tracker, gfp);\n--\ninclude/linux/netdevice.h=4548=static inline void netdev_tracker_alloc(struct net_device *dev,\n--\ninclude/linux/netdevice.h-4550-{\ninclude/linux/netdevice.h:4551:#ifdef CONFIG_NET_DEV_REFCNT_TRACKER\ninclude/linux/netdevice.h-4552-\trefcount_dec(\u0026dev-\u003erefcnt_tracker.no_tracker);\n--\ninclude/linux/netdevice.h=4557=static inline void netdev_tracker_free(struct net_device *dev,\n--\ninclude/linux/netdevice.h-4559-{\ninclude/linux/netdevice.h:4560:#ifdef CONFIG_NET_DEV_REFCNT_TRACKER\ninclude/linux/netdevice.h-4561-\tref_tracker_free(\u0026dev-\u003erefcnt_tracker, tracker);\n--\ninclude/net/net_trackers.h-5-\ninclude/net/net_trackers.h:6:#ifdef CONFIG_NET_DEV_REFCNT_TRACKER\ninclude/net/net_trackers.h-7-typedef struct ref_tracker *netdevice_tracker;\n--\nkernel/configs/debug.config=40=CONFIG_UBSAN_UNREACHABLE=y\n--\nkernel/configs/debug.config-43-#\nkernel/configs/debug.config:44:CONFIG_NET_DEV_REFCNT_TRACKER=y\nkernel/configs/debug.config-45-CONFIG_NET_NS_REFCNT_TRACKER=y\n--\nkernel/rcu/tree.c=2558=static bool rcu_do_batch_check_time(long count, long tlimit,\n--\nkernel/rcu/tree.c-2568-\nkernel/rcu/tree.c:2569:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nkernel/rcu/tree.c-2570-static noinline void rcu_do_batch(struct rcu_data *rdp);\n--\nkernel/softirq.c=599=static inline void lockdep_softirq_end(bool in_hardirq) { }\n--\nkernel/softirq.c-601-\nkernel/softirq.c:602:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nkernel/softirq.c-603-static noinline void handle_softirqs(bool ksirqd);\n--\nkernel/workqueue.c=3244=static bool manage_workers(struct worker *worker)\n--\nkernel/workqueue.c-3261-\nkernel/workqueue.c:3262:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nkernel/workqueue.c-3263-static noinline void process_one_work(struct worker *worker, struct work_struct *work);\n--\nnet/Kconfig.debug-2-\nnet/Kconfig.debug:3:config NET_DEV_REFCNT_TRACKER\nnet/Kconfig.debug-4-\tbool \"Enable net device refcount tracking\"\n--\nnet/core/dev.c=11640=EXPORT_SYMBOL(netdev_refcnt_read);\nnet/core/dev.c-11641-\nnet/core/dev.c:11642:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/core/dev.c-11643-static void dump_netdev_trace_buffer(const struct net_device *dev);\n--\nnet/core/dev.c=12103=struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,\n--\nnet/core/dev.c-12132-\nnet/core/dev.c:12133:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/core/dev.c-12134-\tINIT_LIST_HEAD(\u0026dev-\u003enetdev_trace_buffer_list);\n--\nnet/core/dev.c=13427=static struct smp_hotplug_thread backlog_threads = {\n--\nnet/core/dev.c-13434-\nnet/core/dev.c:13435:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/core/dev.c-13436-static void __init net_dev_refcnt_tracker_init(void);\n--\nnet/core/dev.c=13552=subsys_initcall(net_dev_init);\nnet/core/dev.c-13553-\nnet/core/dev.c:13554:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/core/dev.c-13555-\n--\nnet/socket.c=726=static\nnet/socket.c:727:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/socket.c-728-noinline\n--\nnet/socket.c=802=static\nnet/socket.c:803:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/socket.c-804-noinline\n--\nnet/socket.c=1158=static\nnet/socket.c:1159:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/socket.c-1160-noinline\n--\nnet/socket.c=2671=static\nnet/socket.c:2672:#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) \u0026\u0026 defined(CONFIG_KALLSYMS)\nnet/socket.c-2673-noinline\n"
} |
| 5/2 | 2026/08/29 15:24 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 11499 output: 32 thoughts: 24 Thoughts: Here's a summary of my immediate thought process, focusing on `net/Kconfig.debug` and `NET_DEV_REFCNT_TRACKER`, assuming I'm already quite familiar with the kernel networking stack: **Analyzing Network Device Reference Counting Debugging** Okay, so I need to quickly zero in on how to enable or configure this `NET_DEV_REFCNT_TRACKER` feature. My intuition immediately points to `net/Kconfig.debug`. That's where I'd expect to find debugging options related to network subsystems, especially something like a reference count tracker. It's the standard location in the networking space. I need to refresh my memory on what options are available there. Is it a direct enable/disable, or are there different levels of verbosity or detail? Are there dependencies I need to be aware of? Are there related kernel parameters I should check too, just to be thorough? My immediate goal is to understand how I could potentially use this tracker to debug a tricky network device reference count issue I'm working on. The specifics of the issue might guide me further, but I need a solid baseline understanding of the configuration options first. So, `net/Kconfig.debug` it is. Let's see what's in there. |
| 6/2 | 2026/08/29 15:25 | tool | read-file |
0mArgs:{
"File": "net/Kconfig.debug",
"FirstLine": 1,
"LineCount": 30
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t\n 3:\tconfig NET_DEV_REFCNT_TRACKER\n 4:\t\tbool \"Enable net device refcount tracking\"\n 5:\t\tdepends on DEBUG_KERNEL \u0026\u0026 STACKTRACE_SUPPORT \u0026\u0026 NET\n 6:\t\tselect REF_TRACKER\n 7:\t\tdefault n\n 8:\t\thelp\n 9:\t\t Enable debugging feature to track device references.\n 10:\t\t This adds memory and cpu costs.\n 11:\t\n 12:\tconfig NET_NS_REFCNT_TRACKER\n 13:\t\tbool \"Enable networking namespace refcount tracking\"\n 14:\t\tdepends on DEBUG_KERNEL \u0026\u0026 STACKTRACE_SUPPORT \u0026\u0026 NET\n 15:\t\tselect REF_TRACKER\n 16:\t\tdefault n\n 17:\t\thelp\n 18:\t\t Enable debugging feature to track netns references.\n 19:\t\t This adds memory and cpu costs.\n 20:\t\n 21:\tconfig DEBUG_NET\n 22:\t\tbool \"Add generic networking debug\"\n 23:\t\tdepends on DEBUG_KERNEL \u0026\u0026 NET\n 24:\t\thelp\n 25:\t\t Enable extra sanity checks in networking.\n 26:\t\t This is mostly used by fuzzers, but is safe to select.\n 27:\t\n 28:\tconfig DEBUG_NET_SMALL_RTNL\n 29:\t\tbool \"Add extra per-netns mutex inside RTNL\"\n 30:\t\tdepends on DEBUG_KERNEL \u0026\u0026 NET \u0026\u0026 LOCK_DEBUGGING_SUPPORT\n"
} |
| 7/2 | 2026/08/29 15:25 | llm | patch-evaluator |
2mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12213 output: 19 thoughts: 738 Thoughts: **Fuzzing Decision Time** Okay, so I need to decide if these changes warrant fuzzing. First, I need to remind myself what the guidelines are. It's essentially a check for modifications that are *actually* interesting for fuzzing. If it's just docs, Kconfig, comments, logging, constants, unreachable code in virtualized environments, or vendor-specific stuff, then it's a no-go. But, if it's reachable and modifies core kernel logic, drivers, or architectures, *and* I can verify it's executable, then it's worth the fuzzing effort. Now, let's look at this specific patch. Hold on, what exactly *did* it do again? Ah yes, in `include/linux/netdevice.h`, `__dev_put` and `__dev_hold` are calling `save_netdev_trace_buffer`. And get this, it is called every single time any network device is touched! `save_netdev_trace_buffer` is doing a bunch of interesting things: it is allocating from a global ring/buffer, using raw spinlocks, saving stack traces, comparing stuff using `memcmp`, updating atomic counters, and adding to a linked list `dev->netdev_trace_buffer_list`. When netdevices are freed or dumped (which happens in places like `netdev_wait_allrefs_any`, `alloc_netdev_mqs`, `free_netdev`), `erase_netdev_trace_buffer` or `dump_netdev_trace_buffer` get called. Also, `net_dev_refcnt_tracker_init` is doing timer setup and completion during `net_dev_init`. This is functionally relevant. I see tracing buffer management, linked list manipulation under concurrency, and raw spinlocks in interrupt/softirq/process context. This looks like core networking logic changes! Now, let's see what Kconfig options are required: `CONFIG_NET_DEV_REFCNT_TRACKER` and `CONFIG_KALLSYMS`. Ok, let's check the dependencies to be completely sure. Ah, from `net/Kconfig.debug`, `NET_DEV_REFCNT_TRACKER` depends on `DEBUG_KERNEL`, `STACKTRACE_SUPPORT`, and `NET`, and it also `select`s `REF_TRACKER`. And `CONFIG_KALLSYMS`... I'll need to search the Kconfig files again to see exactly what that depends on. Given this, this *is* definitely worth fuzzing. The changes are core kernel logic. |
| 8/2 | 2026/08/29 15:27 | tool | grepper |
0mArgs:{
"Expression": "config KALLSYMS"
}Results: {
"Output": "init/Kconfig=2086=config CACHESTAT_SYSCALL\n--\ninit/Kconfig-2095-\ninit/Kconfig:2096:config KALLSYMS\ninit/Kconfig-2097-\tbool \"Load all symbols for debugging/ksymoops\" if EXPERT\n--\ninit/Kconfig-2103-\ninit/Kconfig:2104:config KALLSYMS_SELFTEST\ninit/Kconfig-2105-\tbool \"Test the basic functions and performance of kallsyms\"\n--\ninit/Kconfig-2116-\ninit/Kconfig:2117:config KALLSYMS_ALL\ninit/Kconfig-2118-\tbool \"Include all symbols in kallsyms\"\n--\nkernel/ksyms_common.c-3- * ksyms_common.c: A split of kernel/kallsyms.c\nkernel/ksyms_common.c:4: * Contains a few generic function definations independent of config KALLSYMS.\nkernel/ksyms_common.c-5- */\n"
} |
| 9/2 | 2026/08/29 15:27 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13804 output: 33 thoughts: 18 Thoughts: Here's my take on those thoughts: **Analyzing the Kconfig File for Initialization** Okay, let's dive into this initialization process a bit deeper. My focus is on understanding the configuration. I need to zero in on the `init/Kconfig` file. Specifically, I should look around line 2096. That's a reasonable spot to begin exploring the settings that are used during early system startup, and likely some of the core defaults. I'm hoping to get a clearer picture of how specific options are being set or influenced early on. It's time to start parsing those configuration options. |
| 10/2 | 2026/08/29 15:27 | tool | read-file |
0mArgs:{
"File": "init/Kconfig",
"FirstLine": 2090,
"LineCount": 35
}Results: {
"Contents": "2090:\t\t Enable the cachestat system call, which queries the page cache\n2091:\t\t statistics of a file (number of cached pages, dirty pages,\n2092:\t\t pages marked for writeback, (recently) evicted pages).\n2093:\t\n2094:\t\t If unsure say Y here.\n2095:\t\n2096:\tconfig KALLSYMS\n2097:\t\tbool \"Load all symbols for debugging/ksymoops\" if EXPERT\n2098:\t\tdefault y\n2099:\t\thelp\n2100:\t\t Say Y here to let the kernel print out symbolic crash information and\n2101:\t\t symbolic stack backtraces. This increases the size of the kernel\n2102:\t\t somewhat, as all symbols have to be loaded into the kernel image.\n2103:\t\n2104:\tconfig KALLSYMS_SELFTEST\n2105:\t\tbool \"Test the basic functions and performance of kallsyms\"\n2106:\t\tdepends on KALLSYMS\n2107:\t\tdefault n\n2108:\t\thelp\n2109:\t\t Test the basic functions and performance of some interfaces, such as\n2110:\t\t kallsyms_lookup_name. It also calculates the compression rate of the\n2111:\t\t kallsyms compression algorithm for the current symbol set.\n2112:\t\n2113:\t\t Start self-test automatically after system startup. Suggest executing\n2114:\t\t \"dmesg | grep kallsyms_selftest\" to collect test results. \"finish\" is\n2115:\t\t displayed in the last line, indicating that the test is complete.\n2116:\t\n2117:\tconfig KALLSYMS_ALL\n2118:\t\tbool \"Include all symbols in kallsyms\"\n2119:\t\tdepends on DEBUG_KERNEL \u0026\u0026 KALLSYMS\n2120:\t\thelp\n2121:\t\t Normally kallsyms only contains the symbols of functions for nicer\n2122:\t\t OOPS messages and backtraces (i.e., symbols from the text and inittext\n2123:\t\t sections). This is sufficient for most cases. And only if you want to\n2124:\t\t enable kernel live patching, or other less common use cases (e.g.,\n"
} |
| 11/2 | 2026/08/29 15:27 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 14577 output: 142 thoughts: 1352 Thoughts: **Focusing on Key Kernel Functionality for Fuzzing** Alright, let's break this down. First, I need to identify the key kernel functions to prioritize for fuzzing. I'm looking for specific entrypoints, not generic hot-path functions, to avoid skewed test distributions. My priority is non-static, non-inlined API entrypoints – they have distinct symbol addresses, which is key for fuzzing. My initial focus is on the `net/core/dev.c` module, especially considering I found the `save_netdev_trace_buffer` function. I've confirmed that `save_netdev_trace_buffer` is an exported symbol, declared in `include/linux/netdevice.h`, and isn't static, making it an excellent candidate. I've also checked to see what other functions have been modified or added. I went through the entire diff, noting all changed functions and files, including inline functions and static helpers, making sure to consider everything. This includes `rcu_do_batch`, `handle_softirqs`, and others, to get the full picture. I want to be thorough here. I've gone over the code again to verify the relevant functions in the patch, including those in `net/socket.c` and elsewhere. I'm focusing on `save_netdev_trace_buffer` as it stands out as the main non-static, non-inlined entrypoint introduced. It seems perfectly aligned with my criteria. Now, let's verify the configuration requirements. The relevant configs appear to be `NET_DEV_REFCNT_TRACKER`, `KALLSYMS`, and their dependencies: `DEBUG_KERNEL` and `NET`. I made sure to check the ifdefs and confirm that `CONFIG_NET_DEV_REFCNT_TRACKER` and `CONFIG_KALLSYMS` are the primary guards for the new code. I think I've identified the complete set of required configurations. Is this code actually worthy of fuzzing? Based on my review, yes, absolutely. It touches core kernel logic, managing netdevice references with an in-kernel trace buffer, including raw spinlocks, RCU list management, concurrency control, and symbol name processing. This code is reachable and executable in a QEMU environment through standard network operations. It isn't just decorative logging; it introduces new internal data structures and lock protection. This new code has the potential to introduce serious race conditions, lock issues, or memory corruption. This code is definitely worth fuzzing and there are clearly risks worth exploring. Everything is verified, and I'm ready to move on. |
| 12/2 | 2026/08/29 15:27 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"NET_DEV_REFCNT_TRACKER",
"KALLSYMS",
"DEBUG_KERNEL",
"NET"
],
"FocusSymbols": [
"save_netdev_trace_buffer"
],
"Reasoning": "The patch implements a network device reference count trace buffer tracking mechanism under CONFIG_NET_DEV_REFCNT_TRACKER and CONFIG_KALLSYMS. It saves stack traces on __dev_hold() and __dev_put(), managing an RCU list of trace buffers with a raw spinlock and memory comparisons, which affects core network device lifecycle operations.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"NET_DEV_REFCNT_TRACKER",
"KALLSYMS",
"DEBUG_KERNEL",
"NET"
],
"FocusSymbols": [
"save_netdev_trace_buffer"
],
"Reasoning": "The patch implements a network device reference count trace buffer tracking mechanism under CONFIG_NET_DEV_REFCNT_TRACKER and CONFIG_KALLSYMS. It saves stack traces on __dev_hold() and __dev_put(), managing an RCU list of trace buffers with a raw spinlock and memory comparisons, which affects core network device lifecycle operations.",
"WorthFuzzing": true
} |
| 13/1 | 2026/08/29 15:27 | action | If |
2mArgs:{
"WorthFuzzing": true
}Results: null |
| 14/2 | 2026/08/29 15:27 | agent | kmsan-evaluator |
2mModel:core Args: null Results: {
"KMSANReasoning": "The patch introduces an in-kernel net_device reference count tracking/debugging mechanism using a static trace buffer list and stack trace captures. \n\n1. No data is copied to user space (no copy_to_user, put_user, netlink attributes, socket options, etc.); all output is printed to the kernel log via printk/stack_trace_print.\n2. All trace buffers and stack arrays are either zero-initialized (static BSS buffer pool and zeroed stack buffers) or explicitly written up to the count returned by stack_trace_save() before any reads or comparisons.\n3. Length parameters (nr_entries, trimmed_entries) are strictly maintained such that only initialized stack trace entries are ever accessed by memcmp, memmove, and stack_trace_print.\n4. Any potential synchronization, list corruption, or use-after-free issues arising from RCU/raw spinlock usage would be caught by KASAN or LOCKDEP.\n\nTherefore, the changes do not introduce or expose uninitialized memory reads or kernel info-leaks, and a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit 47bb9c9cd4497eff28463ea205f165241c0b158b
Author: syz-cluster <triage@syzkaller.com>
Date: Sat Aug 29 15:22:55 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 87cafc932e9e6..d518338cd0749 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2153,6 +2153,8 @@ enum netdev_reg_state {
*
* FIXME: cleanup struct net_device such that network protocol info
* moves out.
+ *
+ * @netdev_trace_buffer_list: Linked list for debugging refcount leak.
*/
struct net_device {
@@ -2312,6 +2314,9 @@ struct net_device {
#if IS_ENABLED(CONFIG_TLS_DEVICE)
const struct tlsdev_ops *tlsdev_ops;
#endif
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+ struct list_head netdev_trace_buffer_list;
+#endif
unsigned int operstate;
unsigned char link_mode;
@@ -4498,9 +4503,16 @@ static inline bool dev_nit_active(const struct net_device *dev)
void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+void save_netdev_trace_buffer(struct net_device *dev, int delta);
+#else
+static inline void save_netdev_trace_buffer(struct net_device *dev, int delta) { }
+#endif
+
static inline void __dev_put(struct net_device *dev)
{
if (dev) {
+ save_netdev_trace_buffer(dev, -1);
#ifdef CONFIG_PCPU_DEV_REFCNT
this_cpu_dec(*dev->pcpu_refcnt);
#else
@@ -4512,6 +4524,7 @@ static inline void __dev_put(struct net_device *dev)
static inline void __dev_hold(struct net_device *dev)
{
if (dev) {
+ save_netdev_trace_buffer(dev, 1);
#ifdef CONFIG_PCPU_DEV_REFCNT
this_cpu_inc(*dev->pcpu_refcnt);
#else
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 96848fc1f02b8..20c4c92708b8c 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2566,6 +2566,10 @@ static bool rcu_do_batch_check_time(long count, long tlimit,
local_clock() >= tlimit;
}
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static noinline void rcu_do_batch(struct rcu_data *rdp);
+#endif
+
/*
* Invoke any RCU callbacks that have made it to the end of their grace
* period. Throttle as specified by rdp->blimit.
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 7980a4a232f9f..ad98895632880 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -599,6 +599,10 @@ static inline bool lockdep_softirq_start(void) { return false; }
static inline void lockdep_softirq_end(bool in_hardirq) { }
#endif
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static noinline void handle_softirqs(bool ksirqd);
+#endif
+
static void handle_softirqs(bool ksirqd)
{
unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 3c034cbc5bb30..60daae1c6f17f 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3259,6 +3259,10 @@ static bool manage_workers(struct worker *worker)
return true;
}
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static noinline void process_one_work(struct worker *worker, struct work_struct *work);
+#endif
+
/**
* process_one_work - process single work
* @worker: self
diff --git a/net/core/dev.c b/net/core/dev.c
index 38336858c168f..93a7594d586e3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -11639,6 +11639,14 @@ int netdev_refcnt_read(const struct net_device *dev)
}
EXPORT_SYMBOL(netdev_refcnt_read);
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static void dump_netdev_trace_buffer(const struct net_device *dev);
+static void erase_netdev_trace_buffer(const struct net_device *dev);
+#else
+static inline void dump_netdev_trace_buffer(const struct net_device *dev) { }
+static inline void erase_netdev_trace_buffer(const struct net_device *dev) { }
+#endif
+
int netdev_unregister_timeout_secs __read_mostly = 10;
#define WAIT_REFS_MIN_MSECS 1
@@ -11721,6 +11729,7 @@ static struct net_device *netdev_wait_allrefs_any(struct list_head *list)
pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
dev->name, netdev_refcnt_read(dev));
ref_tracker_dir_print(&dev->refcnt_tracker, 10);
+ dump_netdev_trace_buffer(dev);
}
warning_time = jiffies;
@@ -12121,6 +12130,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
dev->priv_len = sizeof_priv;
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+ INIT_LIST_HEAD(&dev->netdev_trace_buffer_list);
+#endif
ref_tracker_dir_init(&dev->refcnt_tracker, 128, "netdev");
#ifdef CONFIG_PCPU_DEV_REFCNT
dev->pcpu_refcnt = alloc_percpu(int);
@@ -12223,6 +12235,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
free_pcpu:
#ifdef CONFIG_PCPU_DEV_REFCNT
free_percpu(dev->pcpu_refcnt);
+ erase_netdev_trace_buffer(dev);
free_dev:
#endif
ref_tracker_dir_exit(&dev->refcnt_tracker);
@@ -12292,6 +12305,7 @@ void free_netdev(struct net_device *dev)
free_percpu(dev->pcpu_refcnt);
dev->pcpu_refcnt = NULL;
#endif
+ erase_netdev_trace_buffer(dev);
free_percpu(dev->core_stats);
dev->core_stats = NULL;
free_percpu(dev->xdp_bulkq);
@@ -13418,6 +13432,12 @@ static struct smp_hotplug_thread backlog_threads = {
.setup = backlog_napi_setup,
};
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+static void __init net_dev_refcnt_tracker_init(void);
+#else
+static void __init net_dev_refcnt_tracker_init(void) { };
+#endif
+
/*
* This is called single threaded during boot, so no need
* to take the rtnl semaphore.
@@ -13426,6 +13446,7 @@ static int __init net_dev_init(void)
{
int i, rc = -ENOMEM;
+ net_dev_refcnt_tracker_init();
BUG_ON(!dev_boot_phase);
net_dev_struct_check();
@@ -13529,3 +13550,254 @@ static int __init net_dev_init(void)
}
subsys_initcall(net_dev_init);
+
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+
+#define NETDEV_TRACE_BUFFER_SIZE 32768
+static struct netdev_trace_buffer {
+ struct list_head list;
+ atomic_t count;
+ int trimmed_entries;
+ int nr_entries;
+ unsigned long entries[20];
+} netdev_trace_buffer[NETDEV_TRACE_BUFFER_SIZE];
+static LIST_HEAD(netdev_trace_buffer_list);
+static DEFINE_RAW_SPINLOCK(netdev_trace_buffer_lock);
+static bool netdev_trace_buffer_exhausted;
+static unsigned long start_of_handle_softirqs __ro_after_init;
+static unsigned long end_of_handle_softirqs __ro_after_init;
+
+static int netdev_trace_buffer_init(void)
+{
+ int i;
+
+ for (i = 0; i < NETDEV_TRACE_BUFFER_SIZE; i++)
+ list_add_tail(&netdev_trace_buffer[i].list, &netdev_trace_buffer_list);
+ return 0;
+}
+pure_initcall(netdev_trace_buffer_init);
+
+static int trim_netdev_trace(unsigned long *entries, int nr_entries)
+{
+ char buffer[KSYM_SYMBOL_LEN] = { };
+ char *cp;
+ int i;
+
+ for (i = 0; i < nr_entries; i++) {
+ sprint_symbol_no_offset(buffer, entries[i]);
+ cp = strchr(buffer, ' ');
+ if (cp)
+ *cp = '\0';
+ if (buffer[0] == 'p') {
+ if (!strcmp(buffer, "process_one_work"))
+ return i + 1;
+ } else if (buffer[0] == 'k') {
+ if (!strcmp(buffer, "ksys_unshare"))
+ return i + 1;
+ } else if (buffer[0] == 's') {
+ if (!strcmp(buffer, "sock_sendmsg_nosec") ||
+ !strcmp(buffer, "sock_recvmsg_nosec"))
+ return i + 1;
+ } else if (buffer[0] == 'r') {
+ if (!strcmp(buffer, "rcu_do_batch"))
+ return i + 1;
+ } else if (buffer[0] == '_') {
+ if (!strcmp(buffer, "__sys_bind") ||
+ !strcmp(buffer, "__sock_release") ||
+ !strcmp(buffer, "__sys_bpf"))
+ return i + 1;
+ } else {
+ if (!strcmp(buffer, "do_sock_setsockopt"))
+ return i + 1;
+ }
+ }
+ return nr_entries;
+}
+
+static void dump_netdev_trace_buffer(const struct net_device *dev)
+{
+ struct netdev_trace_buffer *ptr, *tmp;
+ int count, balance = 0, pos = 0;
+
+ /* Update trimmed_entries field. Do not modify nr_entries field
+ * in case save_netdev_trace_buffer() is called again.
+ */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ if (ptr->trimmed_entries == ptr->nr_entries)
+ ptr->trimmed_entries = trim_netdev_trace(ptr->entries, ptr->nr_entries);
+ }
+ /* Merge duplicated entries using trimmed_entries field. */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ /* Skip empty entries. */
+ if (!atomic_read(&ptr->count))
+ continue;
+ tmp = ptr;
+ list_for_each_entry_continue_rcu(tmp, &dev->netdev_trace_buffer_list, list) {
+ if (ptr->trimmed_entries != tmp->trimmed_entries ||
+ memcmp(ptr->entries, tmp->entries,
+ ptr->trimmed_entries * sizeof(unsigned long)))
+ continue;
+ /* Skip empty entries. */
+ count = atomic_read(&tmp->count);
+ if (!count)
+ continue;
+ /* Move count from non-first entry to first entry. */
+ atomic_add(count, &ptr->count);
+ atomic_sub(count, &tmp->count);
+ }
+ /* It is safe to call cond_resched() because this function is
+ * called from schedulable context.
+ */
+ cond_resched();
+ }
+ /* Report all entries for this device. */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ /* Skip empty entries. */
+ count = atomic_read(&ptr->count);
+ if (!count)
+ continue;
+ /* Report this entry. It is safe to call cond_resched() because
+ * this function is called from schedulable context.
+ */
+ pos++;
+ balance += count;
+ pr_info("Call trace for %s[%d] %+d at\n", dev->name, pos, count);
+ stack_trace_print(ptr->entries, ptr->trimmed_entries, 4);
+ cond_resched();
+ }
+ if (!netdev_trace_buffer_exhausted)
+ pr_info("balance as of %s[%d] is %d\n", dev->name, pos, balance);
+}
+
+static void erase_netdev_trace_buffer(const struct net_device *dev)
+{
+ struct netdev_trace_buffer *ptr;
+ unsigned long flags;
+
+ /* This function is called after free_percpu(dev->pcpu_refcnt) was already
+ * called, which means that no more __dev_put()/__dev_hold() call can be made.
+ * Therefore, no more save_netdev_trace_buffer() call will be made, and we can
+ * safely return list elements to netdev_trace_buffer_list.
+ */
+ raw_spin_lock_irqsave(&netdev_trace_buffer_lock, flags);
+ while (!list_empty(&dev->netdev_trace_buffer_list)) {
+ ptr = list_first_entry(&dev->netdev_trace_buffer_list, typeof(*ptr), list);
+ list_del(&ptr->list);
+ list_add_tail(&ptr->list, &netdev_trace_buffer_list);
+ }
+ raw_spin_unlock_irqrestore(&netdev_trace_buffer_lock, flags);
+}
+
+void save_netdev_trace_buffer(struct net_device *dev, int delta)
+{
+ struct netdev_trace_buffer *ptr;
+ unsigned long entries[ARRAY_SIZE(ptr->entries)];
+ int nr_entries;
+ unsigned long flags;
+
+ /* This function is not NMI-safe. Give up if called from NMI context. */
+ if (in_nmi())
+ return;
+ /* Get stack traces. */
+ nr_entries = stack_trace_save(entries, ARRAY_SIZE(ptr->entries), 1);
+ /* Trim traces of process context now if called from softirq context, for
+ * we will easily exhaust netdev_trace_buffer_list if we don't trim traces
+ * of process context when trying to compare with existing entries.
+ *
+ * Avoid kallsyms lookup, by using cached address resolved upon boot.
+ */
+ if (in_softirq()) {
+ int i;
+
+ for (i = 0; i < nr_entries; i++) {
+ if (entries[i] >= start_of_handle_softirqs &&
+ entries[i] < end_of_handle_softirqs) {
+ nr_entries = i + 1;
+ break;
+ }
+ }
+ }
+ /* Compare with existing entries at best-effort basis. Since duplicated entries
+ * created by race condition will be merged when reporting, we don't use lock here.
+ */
+ list_for_each_entry_rcu(ptr, &dev->netdev_trace_buffer_list, list,
+ /* list elements can't go away. */ 1) {
+ if (ptr->nr_entries == nr_entries &&
+ !memcmp(ptr->entries, entries, nr_entries * sizeof(unsigned long))) {
+ atomic_add(delta, &ptr->count);
+ return;
+ }
+ }
+ /* Add a new entry. We don't re-compare with existing entries with lock held, for
+ * duplicated entries created by race condition will be merged when reporting.
+ * But we use raw spinlock here in case this function is called with some other
+ * raw spinlock already held.
+ */
+ raw_spin_lock_irqsave(&netdev_trace_buffer_lock, flags);
+ if (!list_empty(&netdev_trace_buffer_list)) {
+ /* Remove one entry from netdev_trace_buffer_list and initialize it. */
+ ptr = list_first_entry(&netdev_trace_buffer_list, typeof(*ptr), list);
+ list_del(&ptr->list);
+ atomic_set(&ptr->count, delta);
+ ptr->nr_entries = nr_entries;
+ ptr->trimmed_entries = nr_entries;
+ memmove(ptr->entries, entries, nr_entries * sizeof(unsigned long));
+ /* Append it in RCU manner, for readers are lockless. */
+ list_add_tail_rcu(&ptr->list, &dev->netdev_trace_buffer_list);
+ } else {
+ netdev_trace_buffer_exhausted = true;
+ }
+ raw_spin_unlock_irqrestore(&netdev_trace_buffer_lock, flags);
+}
+EXPORT_SYMBOL(save_netdev_trace_buffer);
+
+struct timer_completion_struct {
+ struct timer_list timer;
+ struct completion completion;
+};
+
+/* Resolve address of handle_softirqs() and cache it, in order to avoid looking up
+ * kallsyms every time.
+ */
+static void __init netdev_addr_resolve_func(struct timer_list *timer)
+{
+ unsigned long entries[40];
+ int nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 1);
+ char buffer[KSYM_SYMBOL_LEN] = { };
+ unsigned long offset, size;
+ char *cp;
+ int i;
+
+ for (i = 0; i < nr_entries; i++) {
+ sprint_symbol(buffer, entries[i]);
+ if (strncmp(buffer, "handle_softirqs", 15))
+ continue;
+ cp = strchr(buffer, '+');
+ if (!cp || sscanf(cp, "+%lx/%lx", &offset, &size) != 2)
+ continue;
+ start_of_handle_softirqs = entries[i] - offset;
+ end_of_handle_softirqs = start_of_handle_softirqs + size;
+ break;
+ }
+ complete(&container_of(timer, struct timer_completion_struct, timer)->completion);
+}
+
+static void __init net_dev_refcnt_tracker_init(void)
+{
+ struct timer_completion_struct tc;
+
+ timer_setup_on_stack(&tc.timer, netdev_addr_resolve_func, 0);
+ init_completion(&tc.completion);
+ /* Schedule a call to netdev_addr_resolve_func(). */
+ mod_timer(&tc.timer, jiffies);
+ /* Wait for netdev_addr_resolve_func() to be called. */
+ wait_for_completion(&tc.completion);
+ /* Wait for netdev_addr_resolve_func() to complete. */
+ timer_delete_sync(&tc.timer);
+ timer_destroy_on_stack(&tc.timer);
+}
+
+#endif
diff --git a/net/socket.c b/net/socket.c
index c05d86e63abf7..b3ddcc283cbbc 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -723,7 +723,11 @@ struct socket *sock_alloc(void)
}
EXPORT_SYMBOL(sock_alloc);
-static void __sock_release(struct socket *sock, struct inode *inode)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#endif
+void __sock_release(struct socket *sock, struct inode *inode)
{
const struct proto_ops *ops = READ_ONCE(sock->ops);
@@ -795,7 +799,13 @@ static noinline void call_trace_sock_send_length(struct sock *sk, int ret,
trace_sock_send_length(sk, ret, 0);
}
-static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#else
+inline
+#endif
+int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
{
int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->sendmsg, inet6_sendmsg,
inet_sendmsg, sock, msg,
@@ -1145,8 +1155,13 @@ static noinline void call_trace_sock_recv_length(struct sock *sk, int ret, int f
trace_sock_recv_length(sk, ret, flags);
}
-static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
- int flags)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#else
+inline
+#endif
+int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg, int flags)
{
int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->recvmsg,
inet6_recvmsg,
@@ -2653,9 +2668,12 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
return err < 0 ? err : 0;
}
-static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
- unsigned int flags, struct used_address *used_address,
- unsigned int allowed_msghdr_flags)
+static
+#if defined(CONFIG_NET_DEV_REFCNT_TRACKER) && defined(CONFIG_KALLSYMS)
+noinline
+#endif
+int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, unsigned int flags,
+ struct used_address *used_address, unsigned int allowed_msghdr_flags)
{
unsigned char ctl[sizeof(struct cmsghdr) + 20]
__aligned(sizeof(__kernel_size_t));
|
| 15/3 | 2026/08/29 15:27 | llm | kmsan-evaluator |
2mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 8248 output: 261 thoughts: 2365 Thoughts: **KMSAN Fuzzing Evaluation** Alright, let's break down this patch and determine if it warrants dedicated KMSAN fuzzing. My initial impression is that this patch, focused on tracing `net_device` reference count operations, doesn't inherently introduce uninitialized memory risks. But let's verify. First, I see the patch adds a debugging mechanism, modifying the `net_device` struct and updating core functions to track reference counts. Key changes involve adding a trace buffer list, modifying `__dev_put` and `__dev_hold`, and annotating functions with `noinline`. The patch also introduces new functions like `netdev_trace_buffer_init`, `dump_netdev_trace_buffer`, `save_netdev_trace_buffer`, etc. The critical area to evaluate for KMSAN is any read of potentially uninitialized memory or information leakage to user space. I need to scrutinize how this new trace buffer is used. My primary focus will be on the variables used for memory. After diving into `save_netdev_trace_buffer`, `dump_netdev_trace_buffer`, `netdev_addr_resolve_func`, and `net_dev_refcnt_tracker_init`, I see no obvious issues. `stack_trace_save` populates the stack trace, and subsequent operations are carefully bounded by the number of returned entries (`nr_entries` and `trimmed_entries`). The static array `netdev_trace_buffer` is properly initialized in BSS. Critically, there are no `copy_to_user` calls or anything else that would expose kernel memory. Even the call to `sprint_symbol_no_offset` uses initialized buffers. I've examined the code for any potential uninitialized reads. `stack_trace_save` correctly sets the entries, and every operation is bounded correctly. The use of RCU with `memcmp` and `memmove` are all constrained by the populated number of entries. I see that the patch avoids exposing kernel data to user-space. Yes, there could be race conditions or potential concurrency issues, but those are in the domain of KASAN/LOCKDEP, not KMSAN. In summary, there's no evidence of uninitialized memory reads or information leaks introduced by this patch. Therefore, a dedicated KMSAN fuzzing effort is not necessary here. I'm going to set `NeedsKMSAN = false` and proceed. I'll sanity check this conclusion with `set-results`. |
| 16/3 | 2026/08/29 15:30 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch introduces an in-kernel net_device reference count tracking/debugging mechanism using a static trace buffer list and stack trace captures. \n\n1. No data is copied to user space (no copy_to_user, put_user, netlink attributes, socket options, etc.); all output is printed to the kernel log via printk/stack_trace_print.\n2. All trace buffers and stack arrays are either zero-initialized (static BSS buffer pool and zeroed stack buffers) or explicitly written up to the count returned by stack_trace_save() before any reads or comparisons.\n3. Length parameters (nr_entries, trimmed_entries) are strictly maintained such that only initialized stack trace entries are ever accessed by memcmp, memmove, and stack_trace_print.\n4. Any potential synchronization, list corruption, or use-after-free issues arising from RCU/raw spinlock usage would be caught by KASAN or LOCKDEP.\n\nTherefore, the changes do not introduce or expose uninitialized memory reads or kernel info-leaks, and a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch introduces an in-kernel net_device reference count tracking/debugging mechanism using a static trace buffer list and stack trace captures. \n\n1. No data is copied to user space (no copy_to_user, put_user, netlink attributes, socket options, etc.); all output is printed to the kernel log via printk/stack_trace_print.\n2. All trace buffers and stack arrays are either zero-initialized (static BSS buffer pool and zeroed stack buffers) or explicitly written up to the count returned by stack_trace_save() before any reads or comparisons.\n3. Length parameters (nr_entries, trimmed_entries) are strictly maintained such that only initialized stack trace entries are ever accessed by memcmp, memmove, and stack_trace_print.\n4. Any potential synchronization, list corruption, or use-after-free issues arising from RCU/raw spinlock usage would be caught by KASAN or LOCKDEP.\n\nTherefore, the changes do not introduce or expose uninitialized memory reads or kernel info-leaks, and a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|