AI Trajectory

null

{
  "EnableConfigs": [
    "INET_DIAG",
    "INET_TCP_DIAG",
    "MPTCP",
    "INET_MPTCP_DIAG"
  ],
  "FocusSymbols": [
    "tcp_diag_dump",
    "mptcp_diag_dump_listeners",
    "inet_diag_dump_clear_cursor"
  ],
  "Reasoning": "The patch introduces a cursor mechanism for dumping TCP and MPTCP sockets via the inet_diag netlink interface. This is a functional change in the core networking stack that affects how sockets are iterated and dumped, preventing duplicates or missed sockets when the hash table changes during the dump. It is reachable from user space via netlink and should be fuzzed.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit b29a31519dcee2bcd59ffe2da4d25d16bae69db7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 30 17:52:50 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h\nindex 704fd415c2b49..4859e77a28c7a 100644\n--- a/include/linux/inet_diag.h\n+++ b/include/linux/inet_diag.h\n@@ -6,6 +6,7 @@\n #include \u003cuapi/linux/inet_diag.h\u003e\n \n struct inet_hashinfo;\n+struct sock;\n \n struct inet_diag_handler {\n \tstruct module\t*owner;\n@@ -32,12 +33,24 @@ struct inet_diag_handler {\n };\n \n struct bpf_sk_storage_diag;\n+\n+enum inet_diag_dump_cursor_type {\n+\tINET_DIAG_DUMP_CURSOR_NONE,\n+\tINET_DIAG_DUMP_CURSOR_TCP_LISTEN,\n+\tINET_DIAG_DUMP_CURSOR_TCP_BIND,\n+\tINET_DIAG_DUMP_CURSOR_TCP_EHASH,\n+\tINET_DIAG_DUMP_CURSOR_MPTCP_LISTEN,\n+};\n+\n struct inet_diag_dump_data {\n \tstruct nlattr *req_nlas[__INET_DIAG_REQ_MAX];\n #define inet_diag_nla_bc req_nlas[INET_DIAG_REQ_BYTECODE]\n #define inet_diag_nla_bpf_stgs req_nlas[INET_DIAG_REQ_SK_BPF_STORAGES]\n \n \tstruct bpf_sk_storage_diag *bpf_stg_diag;\n+\tstruct sock *dump_cursor;\n+\tunsigned int dump_cursor_slot;\n+\tu8 dump_cursor_type;\n \tbool mark_needed;\t/* INET_DIAG_BC_MARK_COND present. */\n #ifdef CONFIG_SOCK_CGROUP_DATA\n \tbool cgroup_needed;\t/* INET_DIAG_BC_CGROUP_COND present. */\n@@ -53,6 +66,8 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,\n \n int inet_diag_bc_sk(const struct inet_diag_dump_data *cb_data, struct sock *sk);\n \n+void inet_diag_dump_clear_cursor(struct inet_diag_dump_data *cb_data);\n+\n void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk);\n \n static inline size_t inet_diag_msg_attrs_size(void)\ndiff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c\nindex 34b77aa87d0a4..41148e8800545 100644\n--- a/net/ipv4/inet_diag.c\n+++ b/net/ipv4/inet_diag.c\n@@ -891,10 +891,23 @@ static int inet_diag_dump_start_compat(struct netlink_callback *cb)\n \treturn __inet_diag_dump_start(cb, sizeof(struct inet_diag_req));\n }\n \n+void inet_diag_dump_clear_cursor(struct inet_diag_dump_data *cb_data)\n+{\n+\tif (!cb_data-\u003edump_cursor)\n+\t\treturn;\n+\n+\tsock_gen_put(cb_data-\u003edump_cursor);\n+\tcb_data-\u003edump_cursor = NULL;\n+\tcb_data-\u003edump_cursor_slot = 0;\n+\tcb_data-\u003edump_cursor_type = INET_DIAG_DUMP_CURSOR_NONE;\n+}\n+EXPORT_SYMBOL_GPL(inet_diag_dump_clear_cursor);\n+\n static int inet_diag_dump_done(struct netlink_callback *cb)\n {\n \tstruct inet_diag_dump_data *cb_data = cb-\u003edata;\n \n+\tinet_diag_dump_clear_cursor(cb_data);\n \tbpf_sk_storage_diag_free(cb_data-\u003ebpf_stg_diag);\n \tkfree(cb-\u003edata);\n \ndiff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c\nindex ba1fdbe9807fd..be0c22cc445b2 100644\n--- a/net/ipv4/tcp_diag.c\n+++ b/net/ipv4/tcp_diag.c\n@@ -285,6 +285,65 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,\n \t\t\t\t net_admin);\n }\n \n+/* Process a maximum of SKARR_SZ sockets at a time when walking hash buckets\n+ * with bh disabled.\n+ */\n+#define SKARR_SZ 16\n+\n+static void tcp_diag_save_cursor(struct inet_diag_dump_data *cb_data, int type,\n+\t\t\t\t unsigned int slot, struct sock *sk)\n+{\n+\tsock_hold(sk);\n+\tinet_diag_dump_clear_cursor(cb_data);\n+\tcb_data-\u003edump_cursor = sk;\n+\tcb_data-\u003edump_cursor_slot = slot;\n+\tcb_data-\u003edump_cursor_type = type;\n+}\n+\n+static bool tcp_diag_bind_collect_sock(struct sock *sk, struct sock **sk_arr,\n+\t\t\t\t       int *num_arr, int *accum, int num)\n+{\n+\tsock_hold(sk);\n+\tnum_arr[*accum] = num;\n+\tsk_arr[*accum] = sk;\n+\n+\treturn ++*accum == SKARR_SZ;\n+}\n+\n+static bool tcp_diag_bind_collect_owners(struct hlist_head *owners,\n+\t\t\t\t\t struct sock **sk_arr, int *num_arr,\n+\t\t\t\t\t int *accum, int *num, int s_num)\n+{\n+\tstruct sock *sk;\n+\n+\tsk_for_each_bound(sk, owners) {\n+\t\tif (*num \u003c s_num) {\n+\t\t\t(*num)++;\n+\t\t\tcontinue;\n+\t\t}\n+\n+\t\tif (tcp_diag_bind_collect_sock(sk, sk_arr, num_arr, accum, *num))\n+\t\t\treturn true;\n+\t\t(*num)++;\n+\t}\n+\n+\treturn false;\n+}\n+\n+static bool tcp_diag_bind_collect_owners_continue(struct sock *sk,\n+\t\t\t\t\t\t  struct sock **sk_arr,\n+\t\t\t\t\t\t  int *num_arr, int *accum,\n+\t\t\t\t\t\t  int *num)\n+{\n+\thlist_for_each_entry_continue(sk, sk_bind_node) {\n+\t\tif (tcp_diag_bind_collect_sock(sk, sk_arr, num_arr, accum, *num))\n+\t\t\treturn true;\n+\t\t(*num)++;\n+\t}\n+\n+\treturn false;\n+}\n+\n static void twsk_build_assert(void)\n {\n \tBUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_family) !=\n@@ -335,8 +394,15 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\tfor (i = s_i; i \u003c= hashinfo-\u003elhash2_mask; i++) {\n \t\t\tstruct inet_listen_hashbucket *ilb;\n \t\t\tstruct hlist_nulls_node *node;\n+\t\t\tstruct sock *sk_arr[SKARR_SZ];\n+\t\t\tstruct sock *cursor;\n+\t\t\tint num_arr[SKARR_SZ];\n+\t\t\tint idx, accum, res;\n+\t\t\tbool use_cursor;\n \n+resume_listen_walk:\n \t\t\tnum = 0;\n+\t\t\taccum = 0;\n \t\t\tilb = \u0026hashinfo-\u003elhash2[i];\n \n \t\t\tif (hlist_nulls_empty(\u0026ilb-\u003enulls_head)) {\n@@ -344,52 +410,80 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\t\t\tcontinue;\n \t\t\t}\n \t\t\tspin_lock(\u0026ilb-\u003elock);\n-\t\t\tsk_nulls_for_each(sk, node, \u0026ilb-\u003enulls_head) {\n-\t\t\t\tstruct inet_sock *inet = inet_sk(sk);\n+\t\t\tcursor = cb_data-\u003edump_cursor;\n+\t\t\tuse_cursor = cursor \u0026\u0026\n+\t\t\t\t     cb_data-\u003edump_cursor_type ==\n+\t\t\t\t     INET_DIAG_DUMP_CURSOR_TCP_LISTEN \u0026\u0026\n+\t\t\t\t     cb_data-\u003edump_cursor_slot == i \u0026\u0026\n+\t\t\t\t     !hlist_nulls_unhashed(\u0026cursor-\u003esk_nulls_node) \u0026\u0026\n+\t\t\t\t     cursor-\u003esk_nulls_node.pprev != LIST_POISON2;\n+\t\t\tnode = use_cursor ? cursor-\u003esk_nulls_node.next :\n+\t\t\t\t\t    ilb-\u003enulls_head.first;\n+\t\t\thlist_nulls_for_each_entry_from(sk, node, sk_nulls_node) {\n+\t\t\t\tif (!use_cursor \u0026\u0026 num \u003c s_num)\n+\t\t\t\t\tgoto next_listen;\n \n-\t\t\t\tif (!net_eq(sock_net(sk), net))\n-\t\t\t\t\tcontinue;\n+\t\t\t\tsock_hold(sk);\n+\t\t\t\tnum_arr[accum] = num;\n+\t\t\t\tsk_arr[accum] = sk;\n+\t\t\t\tif (++accum == SKARR_SZ)\n+\t\t\t\t\tbreak;\n \n-\t\t\t\tif (num \u003c s_num) {\n-\t\t\t\t\tnum++;\n-\t\t\t\t\tcontinue;\n-\t\t\t\t}\n+next_listen:\n+\t\t\t\t++num;\n+\t\t\t}\n+\t\t\tspin_unlock(\u0026ilb-\u003elock);\n \n+\t\t\tres = 0;\n+\t\t\tfor (idx = 0; idx \u003c accum; idx++) {\n+\t\t\t\tstruct inet_sock *inet;\n+\n+\t\t\t\tsk = sk_arr[idx];\n+\t\t\t\tif (!net_eq(sock_net(sk), net))\n+\t\t\t\t\tgoto processed_listen_sk;\n+\n+\t\t\t\tinet = inet_sk(sk);\n \t\t\t\tif (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n \t\t\t\t    sk-\u003esk_family != r-\u003esdiag_family)\n-\t\t\t\t\tgoto next_listen;\n+\t\t\t\t\tgoto processed_listen_sk;\n \n \t\t\t\tif (r-\u003eid.idiag_sport != inet-\u003einet_sport \u0026\u0026\n \t\t\t\t    r-\u003eid.idiag_sport)\n-\t\t\t\t\tgoto next_listen;\n-\n-\t\t\t\tif (!inet_diag_bc_sk(cb_data, sk))\n-\t\t\t\t\tgoto next_listen;\n+\t\t\t\t\tgoto processed_listen_sk;\n \n-\t\t\t\tif (inet_sk_diag_fill(sk, inet_csk(sk), skb,\n-\t\t\t\t\t\t      cb, r, NLM_F_MULTI,\n-\t\t\t\t\t\t      net_admin) \u003c 0) {\n-\t\t\t\t\tspin_unlock(\u0026ilb-\u003elock);\n-\t\t\t\t\tgoto done;\n+\t\t\t\tif (res \u003e= 0 \u0026\u0026 inet_diag_bc_sk(cb_data, sk)) {\n+\t\t\t\t\tres = inet_sk_diag_fill(sk, inet_csk(sk),\n+\t\t\t\t\t\t\t\tskb, cb, r, NLM_F_MULTI,\n+\t\t\t\t\t\t\t\tnet_admin);\n+\t\t\t\t\tif (res \u003c 0)\n+\t\t\t\t\t\tnum = num_arr[idx];\n \t\t\t\t}\n+processed_listen_sk:\n+\t\t\t\tif (res \u003e= 0)\n+\t\t\t\t\ttcp_diag_save_cursor(cb_data,\n+\t\t\t\t\t\t\t     INET_DIAG_DUMP_CURSOR_TCP_LISTEN,\n+\t\t\t\t\t\t\t     i, sk);\n+\t\t\t\tsock_put(sk);\n+\t\t\t}\n+\t\t\tif (res \u003c 0)\n+\t\t\t\tgoto done;\n \n-next_listen:\n-\t\t\t\t++num;\n+\t\t\tcond_resched();\n+\n+\t\t\tif (accum == SKARR_SZ) {\n+\t\t\t\ts_num = 0;\n+\t\t\t\tgoto resume_listen_walk;\n \t\t\t}\n-\t\t\tspin_unlock(\u0026ilb-\u003elock);\n \n+\t\t\tinet_diag_dump_clear_cursor(cb_data);\n \t\t\ts_num = 0;\n \t\t}\n skip_listen_ht:\n+\t\tinet_diag_dump_clear_cursor(cb_data);\n \t\tcb-\u003eargs[0] = 1;\n \t\ts_i = num = s_num = 0;\n \t}\n \n-/* Process a maximum of SKARR_SZ sockets at a time when walking hash buckets\n- * with bh disabled.\n- */\n-#define SKARR_SZ 16\n-\n \t/* Dump bound but inactive (not listening, connecting, etc.) sockets */\n \tif (cb-\u003eargs[0] == 1) {\n \t\tif (!(idiag_states \u0026 TCPF_BOUND_INACTIVE))\n@@ -399,8 +493,10 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\t\tstruct inet_bind_hashbucket *ibb;\n \t\t\tstruct inet_bind2_bucket *tb2;\n \t\t\tstruct sock *sk_arr[SKARR_SZ];\n+\t\t\tstruct sock *cursor;\n \t\t\tint num_arr[SKARR_SZ];\n \t\t\tint idx, accum, res;\n+\t\t\tbool use_cursor;\n \n resume_bind_walk:\n \t\t\tnum = 0;\n@@ -412,34 +508,38 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\t\t\tcontinue;\n \t\t\t}\n \t\t\tspin_lock_bh(\u0026ibb-\u003elock);\n-\t\t\tinet_bind_bucket_for_each(tb2, \u0026ibb-\u003echain) {\n-\t\t\t\tif (!net_eq(ib2_net(tb2), net))\n-\t\t\t\t\tcontinue;\n-\n-\t\t\t\tsk_for_each_bound(sk, \u0026tb2-\u003eowners) {\n-\t\t\t\t\tstruct inet_sock *inet = inet_sk(sk);\n-\n-\t\t\t\t\tif (num \u003c s_num)\n-\t\t\t\t\t\tgoto next_bind;\n-\n-\t\t\t\t\tif (sk-\u003esk_state != TCP_CLOSE ||\n-\t\t\t\t\t    !inet-\u003einet_num)\n-\t\t\t\t\t\tgoto next_bind;\n-\n-\t\t\t\t\tif (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n-\t\t\t\t\t    r-\u003esdiag_family != sk-\u003esk_family)\n-\t\t\t\t\t\tgoto next_bind;\n-\n-\t\t\t\t\tif (!inet_diag_bc_sk(cb_data, sk))\n-\t\t\t\t\t\tgoto next_bind;\n-\n-\t\t\t\t\tsock_hold(sk);\n-\t\t\t\t\tnum_arr[accum] = num;\n-\t\t\t\t\tsk_arr[accum] = sk;\n-\t\t\t\t\tif (++accum == SKARR_SZ)\n+\t\t\tcursor = cb_data-\u003edump_cursor;\n+\t\t\tuse_cursor = cursor \u0026\u0026\n+\t\t\t\t     cb_data-\u003edump_cursor_type ==\n+\t\t\t\t     INET_DIAG_DUMP_CURSOR_TCP_BIND \u0026\u0026\n+\t\t\t\t     cb_data-\u003edump_cursor_slot == i \u0026\u0026\n+\t\t\t\t     !hlist_unhashed(\u0026cursor-\u003esk_bind_node) \u0026\u0026\n+\t\t\t\t     cursor-\u003esk_bind_node.pprev != LIST_POISON2 \u0026\u0026\n+\t\t\t\t     inet_csk(cursor)-\u003eicsk_bind2_hash;\n+\t\t\tif (use_cursor) {\n+\t\t\t\ttb2 = inet_csk(cursor)-\u003eicsk_bind2_hash;\n+\t\t\t\tsk = cursor;\n+\t\t\t\tif (tcp_diag_bind_collect_owners_continue(sk, sk_arr,\n+\t\t\t\t\t\t\t\t\t  num_arr,\n+\t\t\t\t\t\t\t\t\t  \u0026accum,\n+\t\t\t\t\t\t\t\t\t  \u0026num))\n+\t\t\t\t\tgoto pause_bind_walk;\n+\t\t\t\thlist_for_each_entry_continue(tb2, node) {\n+\t\t\t\t\tif (tcp_diag_bind_collect_owners(\u0026tb2-\u003eowners,\n+\t\t\t\t\t\t\t\t\t sk_arr,\n+\t\t\t\t\t\t\t\t\t num_arr,\n+\t\t\t\t\t\t\t\t\t \u0026accum,\n+\t\t\t\t\t\t\t\t\t \u0026num, 0))\n+\t\t\t\t\t\tgoto pause_bind_walk;\n+\t\t\t\t}\n+\t\t\t} else {\n+\t\t\t\tinet_bind_bucket_for_each(tb2, \u0026ibb-\u003echain) {\n+\t\t\t\t\tif (tcp_diag_bind_collect_owners(\u0026tb2-\u003eowners,\n+\t\t\t\t\t\t\t\t\t sk_arr,\n+\t\t\t\t\t\t\t\t\t num_arr,\n+\t\t\t\t\t\t\t\t\t \u0026accum,\n+\t\t\t\t\t\t\t\t\t \u0026num, s_num))\n \t\t\t\t\t\tgoto pause_bind_walk;\n-next_bind:\n-\t\t\t\t\tnum++;\n \t\t\t\t}\n \t\t\t}\n pause_bind_walk:\n@@ -447,15 +547,33 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \n \t\t\tres = 0;\n \t\t\tfor (idx = 0; idx \u003c accum; idx++) {\n-\t\t\t\tif (res \u003e= 0) {\n-\t\t\t\t\tres = inet_sk_diag_fill(sk_arr[idx],\n-\t\t\t\t\t\t\t\tNULL, skb, cb,\n+\t\t\t\tstruct inet_sock *inet;\n+\n+\t\t\t\tsk = sk_arr[idx];\n+\t\t\t\tif (!net_eq(sock_net(sk), net))\n+\t\t\t\t\tgoto put_bind_sk;\n+\n+\t\t\t\tinet = inet_sk(sk);\n+\t\t\t\tif (sk-\u003esk_state != TCP_CLOSE || !inet-\u003einet_num)\n+\t\t\t\t\tgoto put_bind_sk;\n+\n+\t\t\t\tif (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n+\t\t\t\t    r-\u003esdiag_family != sk-\u003esk_family)\n+\t\t\t\t\tgoto put_bind_sk;\n+\n+\t\t\t\tif (res \u003e= 0 \u0026\u0026 inet_diag_bc_sk(cb_data, sk)) {\n+\t\t\t\t\tres = inet_sk_diag_fill(sk, NULL, skb, cb,\n \t\t\t\t\t\t\t\tr, NLM_F_MULTI,\n \t\t\t\t\t\t\t\tnet_admin);\n \t\t\t\t\tif (res \u003c 0)\n \t\t\t\t\t\tnum = num_arr[idx];\n \t\t\t\t}\n-\t\t\t\tsock_put(sk_arr[idx]);\n+\t\t\t\tif (res \u003e= 0)\n+\t\t\t\t\ttcp_diag_save_cursor(cb_data,\n+\t\t\t\t\t\t\t     INET_DIAG_DUMP_CURSOR_TCP_BIND,\n+\t\t\t\t\t\t\t     i, sk);\n+put_bind_sk:\n+\t\t\t\tsock_put(sk);\n \t\t\t}\n \t\t\tif (res \u003c 0)\n \t\t\t\tgoto done;\n@@ -463,13 +581,15 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\t\tcond_resched();\n \n \t\t\tif (accum == SKARR_SZ) {\n-\t\t\t\ts_num = num + 1;\n+\t\t\t\ts_num = 0;\n \t\t\t\tgoto resume_bind_walk;\n \t\t\t}\n \n+\t\t\tinet_diag_dump_clear_cursor(cb_data);\n \t\t\ts_num = 0;\n \t\t}\n skip_bind_ht:\n+\t\tinet_diag_dump_clear_cursor(cb_data);\n \t\tcb-\u003eargs[0] = 2;\n \t\ts_i = num = s_num = 0;\n \t}\n@@ -482,42 +602,33 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\tspinlock_t *lock = inet_ehash_lockp(hashinfo, i);\n \t\tstruct hlist_nulls_node *node;\n \t\tstruct sock *sk_arr[SKARR_SZ];\n+\t\tstruct sock *cursor;\n \t\tint num_arr[SKARR_SZ];\n \t\tint idx, accum, res;\n+\t\tbool use_cursor;\n \n \t\tif (hlist_nulls_empty(\u0026head-\u003echain))\n \t\t\tcontinue;\n \n-\t\tif (i \u003e s_i)\n+\t\tif (i \u003e s_i) {\n+\t\t\tinet_diag_dump_clear_cursor(cb_data);\n \t\t\ts_num = 0;\n+\t\t}\n \n next_chunk:\n \t\tnum = 0;\n \t\taccum = 0;\n \t\tspin_lock_bh(lock);\n-\t\tsk_nulls_for_each(sk, node, \u0026head-\u003echain) {\n-\t\t\tint state;\n-\n-\t\t\tif (!net_eq(sock_net(sk), net))\n-\t\t\t\tcontinue;\n-\t\t\tif (num \u003c s_num)\n-\t\t\t\tgoto next_normal;\n-\t\t\tstate = (sk-\u003esk_state == TCP_TIME_WAIT) ?\n-\t\t\t\tREAD_ONCE(inet_twsk(sk)-\u003etw_substate) : sk-\u003esk_state;\n-\t\t\tif (!(idiag_states \u0026 (1 \u003c\u003c state)))\n-\t\t\t\tgoto next_normal;\n-\t\t\tif (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n-\t\t\t    sk-\u003esk_family != r-\u003esdiag_family)\n-\t\t\t\tgoto next_normal;\n-\t\t\tif (r-\u003eid.idiag_sport != htons(READ_ONCE(sk-\u003esk_num)) \u0026\u0026\n-\t\t\t    r-\u003eid.idiag_sport)\n-\t\t\t\tgoto next_normal;\n-\t\t\tif (r-\u003eid.idiag_dport != sk-\u003esk_dport \u0026\u0026\n-\t\t\t    r-\u003eid.idiag_dport)\n-\t\t\t\tgoto next_normal;\n-\t\t\ttwsk_build_assert();\n-\n-\t\t\tif (!inet_diag_bc_sk(cb_data, sk))\n+\t\tcursor = cb_data-\u003edump_cursor;\n+\t\tuse_cursor = cursor \u0026\u0026\n+\t\t\t     cb_data-\u003edump_cursor_type ==\n+\t\t\t     INET_DIAG_DUMP_CURSOR_TCP_EHASH \u0026\u0026\n+\t\t\t     cb_data-\u003edump_cursor_slot == i \u0026\u0026\n+\t\t\t     !hlist_nulls_unhashed(\u0026cursor-\u003esk_nulls_node) \u0026\u0026\n+\t\t\t     cursor-\u003esk_nulls_node.pprev != LIST_POISON2;\n+\t\tnode = use_cursor ? cursor-\u003esk_nulls_node.next : head-\u003echain.first;\n+\t\thlist_nulls_for_each_entry_from(sk, node, sk_nulls_node) {\n+\t\t\tif (!use_cursor \u0026\u0026 num \u003c s_num)\n \t\t\t\tgoto next_normal;\n \n \t\t\tif (!refcount_inc_not_zero(\u0026sk-\u003esk_refcnt))\n@@ -534,13 +645,42 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \n \t\tres = 0;\n \t\tfor (idx = 0; idx \u003c accum; idx++) {\n-\t\t\tif (res \u003e= 0) {\n-\t\t\t\tres = sk_diag_fill(sk_arr[idx], skb, cb, r,\n-\t\t\t\t\t\t   NLM_F_MULTI, net_admin);\n+\t\t\tint state;\n+\n+\t\t\tsk = sk_arr[idx];\n+\t\t\tif (!net_eq(sock_net(sk), net))\n+\t\t\t\tgoto put_estab_sk;\n+\n+\t\t\tstate = (sk-\u003esk_state == TCP_TIME_WAIT) ?\n+\t\t\t\tREAD_ONCE(inet_twsk(sk)-\u003etw_substate) : sk-\u003esk_state;\n+\t\t\tif (!(idiag_states \u0026 (1 \u003c\u003c state)))\n+\t\t\t\tgoto put_estab_sk;\n+\n+\t\t\tif (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n+\t\t\t    sk-\u003esk_family != r-\u003esdiag_family)\n+\t\t\t\tgoto put_estab_sk;\n+\n+\t\t\tif (r-\u003eid.idiag_sport != htons(READ_ONCE(sk-\u003esk_num)) \u0026\u0026\n+\t\t\t    r-\u003eid.idiag_sport)\n+\t\t\t\tgoto put_estab_sk;\n+\n+\t\t\tif (r-\u003eid.idiag_dport != sk-\u003esk_dport \u0026\u0026\n+\t\t\t    r-\u003eid.idiag_dport)\n+\t\t\t\tgoto put_estab_sk;\n+\n+\t\t\ttwsk_build_assert();\n+\t\t\tif (res \u003e= 0 \u0026\u0026 inet_diag_bc_sk(cb_data, sk)) {\n+\t\t\t\tres = sk_diag_fill(sk, skb, cb, r, NLM_F_MULTI,\n+\t\t\t\t\t\t   net_admin);\n \t\t\t\tif (res \u003c 0)\n \t\t\t\t\tnum = num_arr[idx];\n \t\t\t}\n-\t\t\tsock_gen_put(sk_arr[idx]);\n+\t\t\tif (res \u003e= 0)\n+\t\t\t\ttcp_diag_save_cursor(cb_data,\n+\t\t\t\t\t\t     INET_DIAG_DUMP_CURSOR_TCP_EHASH,\n+\t\t\t\t\t\t     i, sk);\n+put_estab_sk:\n+\t\t\tsock_gen_put(sk);\n \t\t}\n \t\tif (res \u003c 0)\n \t\t\tbreak;\n@@ -548,9 +688,11 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\n \t\tcond_resched();\n \n \t\tif (accum == SKARR_SZ) {\n-\t\t\ts_num = num + 1;\n+\t\t\ts_num = 0;\n \t\t\tgoto next_chunk;\n \t\t}\n+\n+\t\tinet_diag_dump_clear_cursor(cb_data);\n \t}\n \n done:\ndiff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c\nindex 136c2d05c0eeb..981e643430390 100644\n--- a/net/mptcp/mptcp_diag.c\n+++ b/net/mptcp/mptcp_diag.c\n@@ -6,12 +6,25 @@\n  * Author: Paolo Abeni \u003cpabeni@redhat.com\u003e\n  */\n \n+/* Process a bounded number of listeners per bucket lock hold. */\n+#define MPTCP_DIAG_BULK_SZ 16\n+\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/net.h\u003e\n #include \u003clinux/inet_diag.h\u003e\n #include \u003cnet/netlink.h\u003e\n #include \"protocol.h\"\n \n+static void mptcp_diag_save_cursor(struct inet_diag_dump_data *cb_data,\n+\t\t\t\t   unsigned int slot, struct sock *sk)\n+{\n+\tsock_hold(sk);\n+\tinet_diag_dump_clear_cursor(cb_data);\n+\tcb_data-\u003edump_cursor = sk;\n+\tcb_data-\u003edump_cursor_slot = slot;\n+\tcb_data-\u003edump_cursor_type = INET_DIAG_DUMP_CURSOR_MPTCP_LISTEN;\n+}\n+\n static int sk_diag_dump(struct sock *sk, struct sk_buff *skb,\n \t\t\tstruct netlink_callback *cb,\n \t\t\tconst struct inet_diag_req_v2 *req,\n@@ -77,6 +90,7 @@ static void mptcp_diag_dump_listeners(struct sk_buff *skb, struct netlink_callba\n \t\t\t\t      bool net_admin)\n {\n \tstruct mptcp_diag_ctx *diag_ctx = (void *)cb-\u003ectx;\n+\tstruct inet_diag_dump_data *cb_data = cb-\u003edata;\n \tstruct net *net = sock_net(skb-\u003esk);\n \tstruct inet_hashinfo *hinfo;\n \tint i;\n@@ -86,62 +100,98 @@ static void mptcp_diag_dump_listeners(struct sk_buff *skb, struct netlink_callba\n \tfor (i = diag_ctx-\u003el_slot; i \u003c= hinfo-\u003elhash2_mask; i++) {\n \t\tstruct inet_listen_hashbucket *ilb;\n \t\tstruct hlist_nulls_node *node;\n-\t\tstruct sock *sk;\n-\t\tint num = 0;\n-\n+\t\tstruct sock *tmp, *sk, *sk_arr[MPTCP_DIAG_BULK_SZ];\n+\t\tstruct sock *cursor;\n+\t\tint accum, idx, num, ret;\n+\t\tint num_arr[MPTCP_DIAG_BULK_SZ];\n+\t\tbool use_cursor;\n+\n+resume_listen_walk:\n+\t\tnum = 0;\n+\t\taccum = 0;\n \t\tilb = \u0026hinfo-\u003elhash2[i];\n+\t\tret = 0;\n \n \t\trcu_read_lock();\n \t\tspin_lock(\u0026ilb-\u003elock);\n-\t\tsk_nulls_for_each(sk, node, \u0026ilb-\u003enulls_head) {\n-\t\t\tconst struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(sk);\n-\t\t\tstruct inet_sock *inet = inet_sk(sk);\n-\t\t\tint ret;\n-\n-\t\t\tif (num \u003c diag_ctx-\u003el_num)\n-\t\t\t\tgoto next_listen;\n-\n-\t\t\tif (!ctx || strcmp(inet_csk(sk)-\u003eicsk_ulp_ops-\u003ename, \"mptcp\"))\n-\t\t\t\tgoto next_listen;\n-\n-\t\t\tsk = ctx-\u003econn;\n-\t\t\tif (!sk || !net_eq(sock_net(sk), net))\n-\t\t\t\tgoto next_listen;\n-\n-\t\t\tif (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n-\t\t\t    sk-\u003esk_family != r-\u003esdiag_family)\n-\t\t\t\tgoto next_listen;\n-\n-\t\t\tif (r-\u003eid.idiag_sport != inet-\u003einet_sport \u0026\u0026\n-\t\t\t    r-\u003eid.idiag_sport)\n+\t\tcursor = cb_data-\u003edump_cursor;\n+\t\tuse_cursor = cursor \u0026\u0026\n+\t\t\t     cb_data-\u003edump_cursor_type ==\n+\t\t\t     INET_DIAG_DUMP_CURSOR_MPTCP_LISTEN \u0026\u0026\n+\t\t\t     cb_data-\u003edump_cursor_slot == i \u0026\u0026\n+\t\t\t     !hlist_nulls_unhashed(\u0026cursor-\u003esk_nulls_node) \u0026\u0026\n+\t\t\t     cursor-\u003esk_nulls_node.pprev != LIST_POISON2;\n+\t\tnode = use_cursor ? cursor-\u003esk_nulls_node.next :\n+\t\t\t\t    ilb-\u003enulls_head.first;\n+\t\thlist_nulls_for_each_entry_from(sk, node, sk_nulls_node) {\n+\t\t\tif (!use_cursor \u0026\u0026 num \u003c diag_ctx-\u003el_num)\n \t\t\t\tgoto next_listen;\n \n \t\t\tif (!refcount_inc_not_zero(\u0026sk-\u003esk_refcnt))\n \t\t\t\tgoto next_listen;\n \n-\t\t\tret = sk_diag_dump(sk, skb, cb, r, net_admin);\n-\n-\t\t\tsock_put(sk);\n-\n-\t\t\tif (ret \u003c 0) {\n-\t\t\t\tspin_unlock(\u0026ilb-\u003elock);\n-\t\t\t\trcu_read_unlock();\n-\t\t\t\tdiag_ctx-\u003el_slot = i;\n-\t\t\t\tdiag_ctx-\u003el_num = num;\n-\t\t\t\treturn;\n-\t\t\t}\n-\t\t\tdiag_ctx-\u003el_num = num + 1;\n-\t\t\tnum = 0;\n+\t\t\tnum_arr[accum] = num;\n+\t\t\tsk_arr[accum] = sk;\n+\t\t\tif (++accum == MPTCP_DIAG_BULK_SZ)\n+\t\t\t\tbreak;\n next_listen:\n \t\t\t++num;\n \t\t}\n \t\tspin_unlock(\u0026ilb-\u003elock);\n \t\trcu_read_unlock();\n \n+\t\tfor (idx = 0; idx \u003c accum; idx++) {\n+\t\t\tconst struct tcp_ulp_ops *ulp_ops;\n+\t\t\tconst struct mptcp_subflow_context *ctx;\n+\t\t\tstruct inet_sock *inet;\n+\n+\t\t\tsk = sk_arr[idx];\n+\t\t\trcu_read_lock();\n+\t\t\tctx = mptcp_subflow_ctx(sk);\n+\t\t\tulp_ops = READ_ONCE(inet_csk(sk)-\u003eicsk_ulp_ops);\n+\t\t\tinet = inet_sk(sk);\n+\t\t\ttmp = ctx ? ctx-\u003econn : NULL;\n+\t\t\tif (!ctx || !ulp_ops || strcmp(ulp_ops-\u003ename, \"mptcp\") ||\n+\t\t\t    !tmp || !net_eq(sock_net(tmp), net) ||\n+\t\t\t    (r-\u003esdiag_family != AF_UNSPEC \u0026\u0026\n+\t\t\t     tmp-\u003esk_family != r-\u003esdiag_family) ||\n+\t\t\t    (r-\u003eid.idiag_sport != inet-\u003einet_sport \u0026\u0026\n+\t\t\t     r-\u003eid.idiag_sport) ||\n+\t\t\t    !refcount_inc_not_zero(\u0026tmp-\u003esk_refcnt)) {\n+\t\t\t\trcu_read_unlock();\n+\t\t\t\tgoto processed_listener_sk;\n+\t\t\t}\n+\t\t\trcu_read_unlock();\n+\t\t\tif (ret \u003e= 0) {\n+\t\t\t\tret = sk_diag_dump(tmp, skb, cb, r, net_admin);\n+\t\t\t\tif (ret \u003c 0)\n+\t\t\t\t\tnum = num_arr[idx];\n+\t\t\t}\n+\t\t\tsock_put(tmp);\n+processed_listener_sk:\n+\t\t\tif (ret \u003e= 0)\n+\t\t\t\tmptcp_diag_save_cursor(cb_data, i, sk);\n+\t\t\tsock_put(sk);\n+\t\t}\n+\n+\t\tif (ret \u003c 0) {\n+\t\t\tdiag_ctx-\u003el_slot = i;\n+\t\t\tdiag_ctx-\u003el_num = num;\n+\t\t\treturn;\n+\t\t}\n+\n \t\tcond_resched();\n+\n+\t\tif (accum == MPTCP_DIAG_BULK_SZ) {\n+\t\t\tdiag_ctx-\u003el_num = 0;\n+\t\t\tgoto resume_listen_walk;\n+\t\t}\n+\n+\t\tinet_diag_dump_clear_cursor(cb_data);\n \t\tdiag_ctx-\u003el_num = 0;\n \t}\n \n+\tinet_diag_dump_clear_cursor(cb_data);\n \tdiag_ctx-\u003el_num = 0;\n \tdiag_ctx-\u003el_slot = i;\n }\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "INET_DIAG",
    "INET_TCP_DIAG",
    "MPTCP",
    "INET_MPTCP_DIAG"
  ],
  "FocusSymbols": [
    "tcp_diag_dump",
    "mptcp_diag_dump_listeners",
    "inet_diag_dump_clear_cursor"
  ],
  "Reasoning": "The patch introduces a cursor mechanism for dumping TCP and MPTCP sockets via the inet_diag netlink interface. This is a functional change in the core networking stack that affects how sockets are iterated and dumped, preventing duplicates or missed sockets when the hash table changes during the dump. It is reachable from user space via netlink and should be fuzzed.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit b29a31519dcee2bcd59ffe2da4d25d16bae69db7
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 30 17:52:50 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
index 704fd415c2b49..4859e77a28c7a 100644
--- a/include/linux/inet_diag.h
+++ b/include/linux/inet_diag.h
@@ -6,6 +6,7 @@
 #include <uapi/linux/inet_diag.h>
 
 struct inet_hashinfo;
+struct sock;
 
 struct inet_diag_handler {
 	struct module	*owner;
@@ -32,12 +33,24 @@ struct inet_diag_handler {
 };
 
 struct bpf_sk_storage_diag;
+
+enum inet_diag_dump_cursor_type {
+	INET_DIAG_DUMP_CURSOR_NONE,
+	INET_DIAG_DUMP_CURSOR_TCP_LISTEN,
+	INET_DIAG_DUMP_CURSOR_TCP_BIND,
+	INET_DIAG_DUMP_CURSOR_TCP_EHASH,
+	INET_DIAG_DUMP_CURSOR_MPTCP_LISTEN,
+};
+
 struct inet_diag_dump_data {
 	struct nlattr *req_nlas[__INET_DIAG_REQ_MAX];
 #define inet_diag_nla_bc req_nlas[INET_DIAG_REQ_BYTECODE]
 #define inet_diag_nla_bpf_stgs req_nlas[INET_DIAG_REQ_SK_BPF_STORAGES]
 
 	struct bpf_sk_storage_diag *bpf_stg_diag;
+	struct sock *dump_cursor;
+	unsigned int dump_cursor_slot;
+	u8 dump_cursor_type;
 	bool mark_needed;	/* INET_DIAG_BC_MARK_COND present. */
 #ifdef CONFIG_SOCK_CGROUP_DATA
 	bool cgroup_needed;	/* INET_DIAG_BC_CGROUP_COND present. */
@@ -53,6 +66,8 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
 
 int inet_diag_bc_sk(const struct inet_diag_dump_data *cb_data, struct sock *sk);
 
+void inet_diag_dump_clear_cursor(struct inet_diag_dump_data *cb_data);
+
 void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk);
 
 static inline size_t inet_diag_msg_attrs_size(void)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 34b77aa87d0a4..41148e8800545 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -891,10 +891,23 @@ static int inet_diag_dump_start_compat(struct netlink_callback *cb)
 	return __inet_diag_dump_start(cb, sizeof(struct inet_diag_req));
 }
 
+void inet_diag_dump_clear_cursor(struct inet_diag_dump_data *cb_data)
+{
+	if (!cb_data->dump_cursor)
+		return;
+
+	sock_gen_put(cb_data->dump_cursor);
+	cb_data->dump_cursor = NULL;
+	cb_data->dump_cursor_slot = 0;
+	cb_data->dump_cursor_type = INET_DIAG_DUMP_CURSOR_NONE;
+}
+EXPORT_SYMBOL_GPL(inet_diag_dump_clear_cursor);
+
 static int inet_diag_dump_done(struct netlink_callback *cb)
 {
 	struct inet_diag_dump_data *cb_data = cb->data;
 
+	inet_diag_dump_clear_cursor(cb_data);
 	bpf_sk_storage_diag_free(cb_data->bpf_stg_diag);
 	kfree(cb->data);
 
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index ba1fdbe9807fd..be0c22cc445b2 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -285,6 +285,65 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 				 net_admin);
 }
 
+/* Process a maximum of SKARR_SZ sockets at a time when walking hash buckets
+ * with bh disabled.
+ */
+#define SKARR_SZ 16
+
+static void tcp_diag_save_cursor(struct inet_diag_dump_data *cb_data, int type,
+				 unsigned int slot, struct sock *sk)
+{
+	sock_hold(sk);
+	inet_diag_dump_clear_cursor(cb_data);
+	cb_data->dump_cursor = sk;
+	cb_data->dump_cursor_slot = slot;
+	cb_data->dump_cursor_type = type;
+}
+
+static bool tcp_diag_bind_collect_sock(struct sock *sk, struct sock **sk_arr,
+				       int *num_arr, int *accum, int num)
+{
+	sock_hold(sk);
+	num_arr[*accum] = num;
+	sk_arr[*accum] = sk;
+
+	return ++*accum == SKARR_SZ;
+}
+
+static bool tcp_diag_bind_collect_owners(struct hlist_head *owners,
+					 struct sock **sk_arr, int *num_arr,
+					 int *accum, int *num, int s_num)
+{
+	struct sock *sk;
+
+	sk_for_each_bound(sk, owners) {
+		if (*num < s_num) {
+			(*num)++;
+			continue;
+		}
+
+		if (tcp_diag_bind_collect_sock(sk, sk_arr, num_arr, accum, *num))
+			return true;
+		(*num)++;
+	}
+
+	return false;
+}
+
+static bool tcp_diag_bind_collect_owners_continue(struct sock *sk,
+						  struct sock **sk_arr,
+						  int *num_arr, int *accum,
+						  int *num)
+{
+	hlist_for_each_entry_continue(sk, sk_bind_node) {
+		if (tcp_diag_bind_collect_sock(sk, sk_arr, num_arr, accum, *num))
+			return true;
+		(*num)++;
+	}
+
+	return false;
+}
+
 static void twsk_build_assert(void)
 {
 	BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_family) !=
@@ -335,8 +394,15 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 		for (i = s_i; i <= hashinfo->lhash2_mask; i++) {
 			struct inet_listen_hashbucket *ilb;
 			struct hlist_nulls_node *node;
+			struct sock *sk_arr[SKARR_SZ];
+			struct sock *cursor;
+			int num_arr[SKARR_SZ];
+			int idx, accum, res;
+			bool use_cursor;
 
+resume_listen_walk:
 			num = 0;
+			accum = 0;
 			ilb = &hashinfo->lhash2[i];
 
 			if (hlist_nulls_empty(&ilb->nulls_head)) {
@@ -344,52 +410,80 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 				continue;
 			}
 			spin_lock(&ilb->lock);
-			sk_nulls_for_each(sk, node, &ilb->nulls_head) {
-				struct inet_sock *inet = inet_sk(sk);
+			cursor = cb_data->dump_cursor;
+			use_cursor = cursor &&
+				     cb_data->dump_cursor_type ==
+				     INET_DIAG_DUMP_CURSOR_TCP_LISTEN &&
+				     cb_data->dump_cursor_slot == i &&
+				     !hlist_nulls_unhashed(&cursor->sk_nulls_node) &&
+				     cursor->sk_nulls_node.pprev != LIST_POISON2;
+			node = use_cursor ? cursor->sk_nulls_node.next :
+					    ilb->nulls_head.first;
+			hlist_nulls_for_each_entry_from(sk, node, sk_nulls_node) {
+				if (!use_cursor && num < s_num)
+					goto next_listen;
 
-				if (!net_eq(sock_net(sk), net))
-					continue;
+				sock_hold(sk);
+				num_arr[accum] = num;
+				sk_arr[accum] = sk;
+				if (++accum == SKARR_SZ)
+					break;
 
-				if (num < s_num) {
-					num++;
-					continue;
-				}
+next_listen:
+				++num;
+			}
+			spin_unlock(&ilb->lock);
 
+			res = 0;
+			for (idx = 0; idx < accum; idx++) {
+				struct inet_sock *inet;
+
+				sk = sk_arr[idx];
+				if (!net_eq(sock_net(sk), net))
+					goto processed_listen_sk;
+
+				inet = inet_sk(sk);
 				if (r->sdiag_family != AF_UNSPEC &&
 				    sk->sk_family != r->sdiag_family)
-					goto next_listen;
+					goto processed_listen_sk;
 
 				if (r->id.idiag_sport != inet->inet_sport &&
 				    r->id.idiag_sport)
-					goto next_listen;
-
-				if (!inet_diag_bc_sk(cb_data, sk))
-					goto next_listen;
+					goto processed_listen_sk;
 
-				if (inet_sk_diag_fill(sk, inet_csk(sk), skb,
-						      cb, r, NLM_F_MULTI,
-						      net_admin) < 0) {
-					spin_unlock(&ilb->lock);
-					goto done;
+				if (res >= 0 && inet_diag_bc_sk(cb_data, sk)) {
+					res = inet_sk_diag_fill(sk, inet_csk(sk),
+								skb, cb, r, NLM_F_MULTI,
+								net_admin);
+					if (res < 0)
+						num = num_arr[idx];
 				}
+processed_listen_sk:
+				if (res >= 0)
+					tcp_diag_save_cursor(cb_data,
+							     INET_DIAG_DUMP_CURSOR_TCP_LISTEN,
+							     i, sk);
+				sock_put(sk);
+			}
+			if (res < 0)
+				goto done;
 
-next_listen:
-				++num;
+			cond_resched();
+
+			if (accum == SKARR_SZ) {
+				s_num = 0;
+				goto resume_listen_walk;
 			}
-			spin_unlock(&ilb->lock);
 
+			inet_diag_dump_clear_cursor(cb_data);
 			s_num = 0;
 		}
 skip_listen_ht:
+		inet_diag_dump_clear_cursor(cb_data);
 		cb->args[0] = 1;
 		s_i = num = s_num = 0;
 	}
 
-/* Process a maximum of SKARR_SZ sockets at a time when walking hash buckets
- * with bh disabled.
- */
-#define SKARR_SZ 16
-
 	/* Dump bound but inactive (not listening, connecting, etc.) sockets */
 	if (cb->args[0] == 1) {
 		if (!(idiag_states & TCPF_BOUND_INACTIVE))
@@ -399,8 +493,10 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 			struct inet_bind_hashbucket *ibb;
 			struct inet_bind2_bucket *tb2;
 			struct sock *sk_arr[SKARR_SZ];
+			struct sock *cursor;
 			int num_arr[SKARR_SZ];
 			int idx, accum, res;
+			bool use_cursor;
 
 resume_bind_walk:
 			num = 0;
@@ -412,34 +508,38 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 				continue;
 			}
 			spin_lock_bh(&ibb->lock);
-			inet_bind_bucket_for_each(tb2, &ibb->chain) {
-				if (!net_eq(ib2_net(tb2), net))
-					continue;
-
-				sk_for_each_bound(sk, &tb2->owners) {
-					struct inet_sock *inet = inet_sk(sk);
-
-					if (num < s_num)
-						goto next_bind;
-
-					if (sk->sk_state != TCP_CLOSE ||
-					    !inet->inet_num)
-						goto next_bind;
-
-					if (r->sdiag_family != AF_UNSPEC &&
-					    r->sdiag_family != sk->sk_family)
-						goto next_bind;
-
-					if (!inet_diag_bc_sk(cb_data, sk))
-						goto next_bind;
-
-					sock_hold(sk);
-					num_arr[accum] = num;
-					sk_arr[accum] = sk;
-					if (++accum == SKARR_SZ)
+			cursor = cb_data->dump_cursor;
+			use_cursor = cursor &&
+				     cb_data->dump_cursor_type ==
+				     INET_DIAG_DUMP_CURSOR_TCP_BIND &&
+				     cb_data->dump_cursor_slot == i &&
+				     !hlist_unhashed(&cursor->sk_bind_node) &&
+				     cursor->sk_bind_node.pprev != LIST_POISON2 &&
+				     inet_csk(cursor)->icsk_bind2_hash;
+			if (use_cursor) {
+				tb2 = inet_csk(cursor)->icsk_bind2_hash;
+				sk = cursor;
+				if (tcp_diag_bind_collect_owners_continue(sk, sk_arr,
+									  num_arr,
+									  &accum,
+									  &num))
+					goto pause_bind_walk;
+				hlist_for_each_entry_continue(tb2, node) {
+					if (tcp_diag_bind_collect_owners(&tb2->owners,
+									 sk_arr,
+									 num_arr,
+									 &accum,
+									 &num, 0))
+						goto pause_bind_walk;
+				}
+			} else {
+				inet_bind_bucket_for_each(tb2, &ibb->chain) {
+					if (tcp_diag_bind_collect_owners(&tb2->owners,
+									 sk_arr,
+									 num_arr,
+									 &accum,
+									 &num, s_num))
 						goto pause_bind_walk;
-next_bind:
-					num++;
 				}
 			}
 pause_bind_walk:
@@ -447,15 +547,33 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 
 			res = 0;
 			for (idx = 0; idx < accum; idx++) {
-				if (res >= 0) {
-					res = inet_sk_diag_fill(sk_arr[idx],
-								NULL, skb, cb,
+				struct inet_sock *inet;
+
+				sk = sk_arr[idx];
+				if (!net_eq(sock_net(sk), net))
+					goto put_bind_sk;
+
+				inet = inet_sk(sk);
+				if (sk->sk_state != TCP_CLOSE || !inet->inet_num)
+					goto put_bind_sk;
+
+				if (r->sdiag_family != AF_UNSPEC &&
+				    r->sdiag_family != sk->sk_family)
+					goto put_bind_sk;
+
+				if (res >= 0 && inet_diag_bc_sk(cb_data, sk)) {
+					res = inet_sk_diag_fill(sk, NULL, skb, cb,
 								r, NLM_F_MULTI,
 								net_admin);
 					if (res < 0)
 						num = num_arr[idx];
 				}
-				sock_put(sk_arr[idx]);
+				if (res >= 0)
+					tcp_diag_save_cursor(cb_data,
+							     INET_DIAG_DUMP_CURSOR_TCP_BIND,
+							     i, sk);
+put_bind_sk:
+				sock_put(sk);
 			}
 			if (res < 0)
 				goto done;
@@ -463,13 +581,15 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 			cond_resched();
 
 			if (accum == SKARR_SZ) {
-				s_num = num + 1;
+				s_num = 0;
 				goto resume_bind_walk;
 			}
 
+			inet_diag_dump_clear_cursor(cb_data);
 			s_num = 0;
 		}
 skip_bind_ht:
+		inet_diag_dump_clear_cursor(cb_data);
 		cb->args[0] = 2;
 		s_i = num = s_num = 0;
 	}
@@ -482,42 +602,33 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 		spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
 		struct hlist_nulls_node *node;
 		struct sock *sk_arr[SKARR_SZ];
+		struct sock *cursor;
 		int num_arr[SKARR_SZ];
 		int idx, accum, res;
+		bool use_cursor;
 
 		if (hlist_nulls_empty(&head->chain))
 			continue;
 
-		if (i > s_i)
+		if (i > s_i) {
+			inet_diag_dump_clear_cursor(cb_data);
 			s_num = 0;
+		}
 
 next_chunk:
 		num = 0;
 		accum = 0;
 		spin_lock_bh(lock);
-		sk_nulls_for_each(sk, node, &head->chain) {
-			int state;
-
-			if (!net_eq(sock_net(sk), net))
-				continue;
-			if (num < s_num)
-				goto next_normal;
-			state = (sk->sk_state == TCP_TIME_WAIT) ?
-				READ_ONCE(inet_twsk(sk)->tw_substate) : sk->sk_state;
-			if (!(idiag_states & (1 << state)))
-				goto next_normal;
-			if (r->sdiag_family != AF_UNSPEC &&
-			    sk->sk_family != r->sdiag_family)
-				goto next_normal;
-			if (r->id.idiag_sport != htons(READ_ONCE(sk->sk_num)) &&
-			    r->id.idiag_sport)
-				goto next_normal;
-			if (r->id.idiag_dport != sk->sk_dport &&
-			    r->id.idiag_dport)
-				goto next_normal;
-			twsk_build_assert();
-
-			if (!inet_diag_bc_sk(cb_data, sk))
+		cursor = cb_data->dump_cursor;
+		use_cursor = cursor &&
+			     cb_data->dump_cursor_type ==
+			     INET_DIAG_DUMP_CURSOR_TCP_EHASH &&
+			     cb_data->dump_cursor_slot == i &&
+			     !hlist_nulls_unhashed(&cursor->sk_nulls_node) &&
+			     cursor->sk_nulls_node.pprev != LIST_POISON2;
+		node = use_cursor ? cursor->sk_nulls_node.next : head->chain.first;
+		hlist_nulls_for_each_entry_from(sk, node, sk_nulls_node) {
+			if (!use_cursor && num < s_num)
 				goto next_normal;
 
 			if (!refcount_inc_not_zero(&sk->sk_refcnt))
@@ -534,13 +645,42 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 
 		res = 0;
 		for (idx = 0; idx < accum; idx++) {
-			if (res >= 0) {
-				res = sk_diag_fill(sk_arr[idx], skb, cb, r,
-						   NLM_F_MULTI, net_admin);
+			int state;
+
+			sk = sk_arr[idx];
+			if (!net_eq(sock_net(sk), net))
+				goto put_estab_sk;
+
+			state = (sk->sk_state == TCP_TIME_WAIT) ?
+				READ_ONCE(inet_twsk(sk)->tw_substate) : sk->sk_state;
+			if (!(idiag_states & (1 << state)))
+				goto put_estab_sk;
+
+			if (r->sdiag_family != AF_UNSPEC &&
+			    sk->sk_family != r->sdiag_family)
+				goto put_estab_sk;
+
+			if (r->id.idiag_sport != htons(READ_ONCE(sk->sk_num)) &&
+			    r->id.idiag_sport)
+				goto put_estab_sk;
+
+			if (r->id.idiag_dport != sk->sk_dport &&
+			    r->id.idiag_dport)
+				goto put_estab_sk;
+
+			twsk_build_assert();
+			if (res >= 0 && inet_diag_bc_sk(cb_data, sk)) {
+				res = sk_diag_fill(sk, skb, cb, r, NLM_F_MULTI,
+						   net_admin);
 				if (res < 0)
 					num = num_arr[idx];
 			}
-			sock_gen_put(sk_arr[idx]);
+			if (res >= 0)
+				tcp_diag_save_cursor(cb_data,
+						     INET_DIAG_DUMP_CURSOR_TCP_EHASH,
+						     i, sk);
+put_estab_sk:
+			sock_gen_put(sk);
 		}
 		if (res < 0)
 			break;
@@ -548,9 +688,11 @@ static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 		cond_resched();
 
 		if (accum == SKARR_SZ) {
-			s_num = num + 1;
+			s_num = 0;
 			goto next_chunk;
 		}
+
+		inet_diag_dump_clear_cursor(cb_data);
 	}
 
 done:
diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c
index 136c2d05c0eeb..981e643430390 100644
--- a/net/mptcp/mptcp_diag.c
+++ b/net/mptcp/mptcp_diag.c
@@ -6,12 +6,25 @@
  * Author: Paolo Abeni <pabeni@redhat.com>
  */
 
+/* Process a bounded number of listeners per bucket lock hold. */
+#define MPTCP_DIAG_BULK_SZ 16
+
 #include <linux/kernel.h>
 #include <linux/net.h>
 #include <linux/inet_diag.h>
 #include <net/netlink.h>
 #include "protocol.h"
 
+static void mptcp_diag_save_cursor(struct inet_diag_dump_data *cb_data,
+				   unsigned int slot, struct sock *sk)
+{
+	sock_hold(sk);
+	inet_diag_dump_clear_cursor(cb_data);
+	cb_data->dump_cursor = sk;
+	cb_data->dump_cursor_slot = slot;
+	cb_data->dump_cursor_type = INET_DIAG_DUMP_CURSOR_MPTCP_LISTEN;
+}
+
 static int sk_diag_dump(struct sock *sk, struct sk_buff *skb,
 			struct netlink_callback *cb,
 			const struct inet_diag_req_v2 *req,
@@ -77,6 +90,7 @@ static void mptcp_diag_dump_listeners(struct sk_buff *skb, struct netlink_callba
 				      bool net_admin)
 {
 	struct mptcp_diag_ctx *diag_ctx = (void *)cb->ctx;
+	struct inet_diag_dump_data *cb_data = cb->data;
 	struct net *net = sock_net(skb->sk);
 	struct inet_hashinfo *hinfo;
 	int i;
@@ -86,62 +100,98 @@ static void mptcp_diag_dump_listeners(struct sk_buff *skb, struct netlink_callba
 	for (i = diag_ctx->l_slot; i <= hinfo->lhash2_mask; i++) {
 		struct inet_listen_hashbucket *ilb;
 		struct hlist_nulls_node *node;
-		struct sock *sk;
-		int num = 0;
-
+		struct sock *tmp, *sk, *sk_arr[MPTCP_DIAG_BULK_SZ];
+		struct sock *cursor;
+		int accum, idx, num, ret;
+		int num_arr[MPTCP_DIAG_BULK_SZ];
+		bool use_cursor;
+
+resume_listen_walk:
+		num = 0;
+		accum = 0;
 		ilb = &hinfo->lhash2[i];
+		ret = 0;
 
 		rcu_read_lock();
 		spin_lock(&ilb->lock);
-		sk_nulls_for_each(sk, node, &ilb->nulls_head) {
-			const struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(sk);
-			struct inet_sock *inet = inet_sk(sk);
-			int ret;
-
-			if (num < diag_ctx->l_num)
-				goto next_listen;
-
-			if (!ctx || strcmp(inet_csk(sk)->icsk_ulp_ops->name, "mptcp"))
-				goto next_listen;
-
-			sk = ctx->conn;
-			if (!sk || !net_eq(sock_net(sk), net))
-				goto next_listen;
-
-			if (r->sdiag_family != AF_UNSPEC &&
-			    sk->sk_family != r->sdiag_family)
-				goto next_listen;
-
-			if (r->id.idiag_sport != inet->inet_sport &&
-			    r->id.idiag_sport)
+		cursor = cb_data->dump_cursor;
+		use_cursor = cursor &&
+			     cb_data->dump_cursor_type ==
+			     INET_DIAG_DUMP_CURSOR_MPTCP_LISTEN &&
+			     cb_data->dump_cursor_slot == i &&
+			     !hlist_nulls_unhashed(&cursor->sk_nulls_node) &&
+			     cursor->sk_nulls_node.pprev != LIST_POISON2;
+		node = use_cursor ? cursor->sk_nulls_node.next :
+				    ilb->nulls_head.first;
+		hlist_nulls_for_each_entry_from(sk, node, sk_nulls_node) {
+			if (!use_cursor && num < diag_ctx->l_num)
 				goto next_listen;
 
 			if (!refcount_inc_not_zero(&sk->sk_refcnt))
 				goto next_listen;
 
-			ret = sk_diag_dump(sk, skb, cb, r, net_admin);
-
-			sock_put(sk);
-
-			if (ret < 0) {
-				spin_unlock(&ilb->lock);
-				rcu_read_unlock();
-				diag_ctx->l_slot = i;
-				diag_ctx->l_num = num;
-				return;
-			}
-			diag_ctx->l_num = num + 1;
-			num = 0;
+			num_arr[accum] = num;
+			sk_arr[accum] = sk;
+			if (++accum == MPTCP_DIAG_BULK_SZ)
+				break;
 next_listen:
 			++num;
 		}
 		spin_unlock(&ilb->lock);
 		rcu_read_unlock();
 
+		for (idx = 0; idx < accum; idx++) {
+			const struct tcp_ulp_ops *ulp_ops;
+			const struct mptcp_subflow_context *ctx;
+			struct inet_sock *inet;
+
+			sk = sk_arr[idx];
+			rcu_read_lock();
+			ctx = mptcp_subflow_ctx(sk);
+			ulp_ops = READ_ONCE(inet_csk(sk)->icsk_ulp_ops);
+			inet = inet_sk(sk);
+			tmp = ctx ? ctx->conn : NULL;
+			if (!ctx || !ulp_ops || strcmp(ulp_ops->name, "mptcp") ||
+			    !tmp || !net_eq(sock_net(tmp), net) ||
+			    (r->sdiag_family != AF_UNSPEC &&
+			     tmp->sk_family != r->sdiag_family) ||
+			    (r->id.idiag_sport != inet->inet_sport &&
+			     r->id.idiag_sport) ||
+			    !refcount_inc_not_zero(&tmp->sk_refcnt)) {
+				rcu_read_unlock();
+				goto processed_listener_sk;
+			}
+			rcu_read_unlock();
+			if (ret >= 0) {
+				ret = sk_diag_dump(tmp, skb, cb, r, net_admin);
+				if (ret < 0)
+					num = num_arr[idx];
+			}
+			sock_put(tmp);
+processed_listener_sk:
+			if (ret >= 0)
+				mptcp_diag_save_cursor(cb_data, i, sk);
+			sock_put(sk);
+		}
+
+		if (ret < 0) {
+			diag_ctx->l_slot = i;
+			diag_ctx->l_num = num;
+			return;
+		}
+
 		cond_resched();
+
+		if (accum == MPTCP_DIAG_BULK_SZ) {
+			diag_ctx->l_num = 0;
+			goto resume_listen_walk;
+		}
+
+		inet_diag_dump_clear_cursor(cb_data);
 		diag_ctx->l_num = 0;
 	}
 
+	inet_diag_dump_clear_cursor(cb_data);
 	diag_ctx->l_num = 0;
 	diag_ctx->l_slot = i;
 }

gemini-3.1-pro-preview

null

null

							input: 10130
							output: 32
							thoughts: 359
						

**My Assessment of the Networking Stack Patch**

Okay, so I've got this patch here that’s touching some crucial areas of the networking stack: `inet_diag.h`, `inet_diag.c`, `tcp_diag.c`, and `mptcp_diag.c`. The core of the change is this new cursor mechanism, specifically within `tcp_diag` and `mptcp_diag`, for dumping socket information. This is smart; they're adding `dump_cursor`, `dump_cursor_slot`, and `dump_cursor_type` to the `struct inet_diag_dump_data`.  That's the key to making the dumping process robust.

The reason for this change is clear:  the current method was prone to errors. It was skipping sockets based on a count (`s_num`) which is problematic when the hash table structure is dynamic.  This new cursor lets `tcp_diag_dump` pick up *exactly* where it left off, avoiding both duplicated and missed sockets.  Excellent, that's addressing a real issue.  And the same fix is being applied to `mptcp_diag_dump_listeners`, which is the right place to take this.

This is a functional change, a core network component.  Reachability and testability are high; it's definitely something we need to fuzz thoroughly. Let's figure out where the focus should be:

*   In `net/ipv4/tcp_diag.c`, we've got `tcp_diag_dump` which is the function that requires scrutiny.
*   In `net/mptcp/mptcp_diag.c`, we've got `mptcp_diag_dump_listeners`, which is a key one.  And, although `mptcp_diag_dump` isn't directly modified, it calls `mptcp_diag_dump_listeners`, so it's probably worth a look in fuzzing as well, to see how the cursor propagates.

Now, let's make sure we have the correct configuration settings enabled: `CONFIG_INET_DIAG`, `CONFIG_TCP_DIAG`, and `CONFIG_MPTCP` are all going to be required, obviously.  I'll double-check the Kconfig files for MPTCP and INET_DIAG to be absolutely certain we haven’t missed anything. I need to make sure our fuzzing builds are set up correctly. This looks like a solid improvement in the network diagnostic tools.

{
  "Expression": "config MPTCP",
  "PathPrefix": "net/mptcp/Kconfig"
}

{
  "Output": "net/mptcp/Kconfig-1-\nnet/mptcp/Kconfig:2:config MPTCP\nnet/mptcp/Kconfig-3-\tbool \"MPTCP: Multipath TCP\"\n--\nnet/mptcp/Kconfig=16=config INET_MPTCP_DIAG\n--\nnet/mptcp/Kconfig-19-\nnet/mptcp/Kconfig:20:config MPTCP_IPV6\nnet/mptcp/Kconfig-21-\tbool \"MPTCP: IPv6 support for Multipath TCP\"\n--\nnet/mptcp/Kconfig-24-\nnet/mptcp/Kconfig:25:config MPTCP_KUNIT_TEST\nnet/mptcp/Kconfig-26-\ttristate \"This builds the MPTCP KUnit tests\" if !KUNIT_ALL_TESTS\n"
}

gemini-3.1-pro-preview

null

null

							input: 11279
							output: 37
							thoughts: 13
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**INET_MPTCP_DIAG Investigation**

Alright, let's dive in. The first thought is clear: I need to investigate `INET_MPTCP_DIAG`. This is where I'd immediately focus, especially considering the context of whatever problem or performance anomaly is at hand. It's the diagnostic interface for Multipath TCP, so this is where I'd go to get a quick overview of the current status. I'm thinking I'll want to inspect the connection states, subflow statistics, the overall MPTCP configuration, and potentially any error codes or flags that might be present. My mind is already racing through the likely output fields and the corresponding kernel code I might need to refer to if something looks suspicious. I'm expecting some specific fields and a general idea of how to use it, but I always approach these checks with an expectation that I might need to cross-reference with other tools or kernel debugging techniques.

{
  "Expression": "config INET_MPTCP_DIAG",
  "PathPrefix": "net/mptcp/Kconfig"
}

{
  "Output": "net/mptcp/Kconfig=14=if MPTCP\nnet/mptcp/Kconfig-15-\nnet/mptcp/Kconfig:16:config INET_MPTCP_DIAG\nnet/mptcp/Kconfig-17-\tdepends on INET_DIAG\n"
}

gemini-3.1-pro-preview

null

null

							input: 11630
							output: 33
							thoughts: 30
						

Okay, let's dive into this. Here's how I'd approach this task, as if these were my internal thoughts:

**Investigating Network Diagnostics in the Kernel Configuration**

Right, time to get my hands dirty. I need to understand how network diagnostics are configured in the kernel. First things first, I need to check the relevant Kconfig files. Specifically, I'm going to zero in on `net/ipv4/Kconfig`. I'll be looking for configuration options related to internet diagnostics, and especially options concerning TCP diagnostics. My primary targets are `config INET_DIAG` and `config TCP_DIAG`. I need to see how these are defined, what dependencies they have, what their default values are, and whether they are tristate or boolean. This will provide a solid understanding of how I can configure and potentially troubleshoot the kernel's network diagnostics capabilities. This is a good starting point to understand the broader network diagnostic landscape.

{
  "Expression": "config INET_DIAG",
  "PathPrefix": "net/ipv4/Kconfig"
}

{
  "Output": "net/ipv4/Kconfig=419=config INET_TUNNEL\n--\nnet/ipv4/Kconfig-422-\nnet/ipv4/Kconfig:423:config INET_DIAG\nnet/ipv4/Kconfig-424-\ttristate \"INET: socket monitoring interface\"\n--\nnet/ipv4/Kconfig=447=config INET_RAW_DIAG\n--\nnet/ipv4/Kconfig-454-\nnet/ipv4/Kconfig:455:config INET_DIAG_DESTROY\nnet/ipv4/Kconfig-456-\tbool \"INET: allow privileged process to administratively close sockets\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 12069
							output: 35
							thoughts: 12
						

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**Kernel Configuration Query**

Alright, let's see... I'm looking at this code, thinking about TCP diagnostics. Wait a minute... What about `config INET_TCP_DIAG`? This is a critical configuration option, isn't it? I need to quickly recall how that's handled, what implications it has for the diagnostic tools we have at our disposal. Is it enabled? Disabled? What features are tied to that flag, and how does it interface with the various netlink and socket options? Thinking about how various aspects of the networking stack will behave depending on whether this is enabled. Time to quickly refresh my understanding here. I can't proceed without clarifying the status of that config option. It's fundamental to this analysis.

{
  "Expression": "config INET_TCP_DIAG",
  "PathPrefix": "net/ipv4/Kconfig"
}

{
  "Output": "net/ipv4/Kconfig=423=config INET_DIAG\n--\nnet/ipv4/Kconfig-434-\nnet/ipv4/Kconfig:435:config INET_TCP_DIAG\nnet/ipv4/Kconfig-436-\tdepends on INET_DIAG\n"
}

gemini-3.1-pro-preview

null

null

							input: 12385
							output: 40
							thoughts: 108
						

**Analyzing Network Diagnostics Configuration**

Okay, let's break this down. I see we're dealing with network diagnostics, specifically related to TCP and MPTCP. The key configurations I'm considering are `INET_DIAG`, `INET_TCP_DIAG`, `MPTCP`, and `INET_MPTCP_DIAG`. These flags likely control the inclusion or exclusion of certain diagnostic features within the kernel. My primary focus is going to be on the functions that handle the actual data dumping – the heart of the diagnostics.

I need to understand how we're extracting and presenting this information. The functions highlighted are `tcp_diag_dump`, `mptcp_diag_dump_listeners`, and `mptcp_diag_dump`. `mptcp_diag_dump` seems to be the central entry point for all things MPTCP-related.

My immediate next step is to quickly confirm the existence and structure of this `mptcp_diag_dump` function. I want to ensure it’s there and get a handle on its inputs, outputs, and overall purpose. This is the lynchpin I will start with.

{
  "Expression": "mptcp_diag_dump",
  "PathPrefix": "net/mptcp/mptcp_diag.c"
}

{
  "Output": "net/mptcp/mptcp_diag.c=28=static int sk_diag_dump(struct sock *sk, struct sk_buff *skb,\n--\nnet/mptcp/mptcp_diag.c-39-\nnet/mptcp/mptcp_diag.c:40:static int mptcp_diag_dump_one(struct netlink_callback *cb,\nnet/mptcp/mptcp_diag.c-41-\t\t\t       const struct inet_diag_req_v2 *req)\n--\nnet/mptcp/mptcp_diag.c=81=struct mptcp_diag_ctx {\n--\nnet/mptcp/mptcp_diag.c-87-\nnet/mptcp/mptcp_diag.c:88:static void mptcp_diag_dump_listeners(struct sk_buff *skb, struct netlink_callback *cb,\nnet/mptcp/mptcp_diag.c-89-\t\t\t\t      const struct inet_diag_req_v2 *r,\n--\nnet/mptcp/mptcp_diag.c-198-\nnet/mptcp/mptcp_diag.c:199:static void mptcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\nnet/mptcp/mptcp_diag.c-200-\t\t\t    const struct inet_diag_req_v2 *r)\n--\nnet/mptcp/mptcp_diag.c-238-\tif ((r-\u003eidiag_states \u0026 TCPF_LISTEN) \u0026\u0026 r-\u003eid.idiag_dport == 0)\nnet/mptcp/mptcp_diag.c:239:\t\tmptcp_diag_dump_listeners(skb, cb, r, net_admin);\nnet/mptcp/mptcp_diag.c-240-}\n--\nnet/mptcp/mptcp_diag.c=270=static const struct inet_diag_handler mptcp_diag_handler = {\nnet/mptcp/mptcp_diag.c-271-\t.owner\t\t = THIS_MODULE,\nnet/mptcp/mptcp_diag.c:272:\t.dump\t\t = mptcp_diag_dump,\nnet/mptcp/mptcp_diag.c:273:\t.dump_one\t = mptcp_diag_dump_one,\nnet/mptcp/mptcp_diag.c-274-\t.idiag_get_info  = mptcp_diag_get_info,\n"
}

gemini-3.1-pro-preview

null

null

							input: 13427
							output: 35
							thoughts: 53
						

**Analyzing Diagnostic Functions**

Okay, let's break down these diagnostic functions. We have `tcp_diag_dump`, `mptcp_diag_dump`, and `mptcp_diag_dump_listeners`. My first instinct is to investigate the scope of `tcp_diag_dump`. Is it declared `static`? That would influence how and where it can be called. I need to understand its visibility within the module, since this affects how easily it can be integrated with other systems or debugging tools. Knowing its scope is crucial for understanding its intended use case.

{
  "Expression": "tcp_diag_dump",
  "PathPrefix": "net/ipv4/tcp_diag.c"
}

{
  "Output": "net/ipv4/tcp_diag.c=347=static void twsk_build_assert(void)\n--\nnet/ipv4/tcp_diag.c-372-\nnet/ipv4/tcp_diag.c:373:static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,\nnet/ipv4/tcp_diag.c-374-\t\t\t  const struct inet_diag_req_v2 *r)\n--\nnet/ipv4/tcp_diag.c=705=static struct sock *tcp_diag_find_one_icsk(struct net *net,\n--\nnet/ipv4/tcp_diag.c-745-\nnet/ipv4/tcp_diag.c:746:static int tcp_diag_dump_one(struct netlink_callback *cb,\nnet/ipv4/tcp_diag.c-747-\t\t\t     const struct inet_diag_req_v2 *req)\n--\nnet/ipv4/tcp_diag.c=803=static const struct inet_diag_handler tcp_diag_handler = {\nnet/ipv4/tcp_diag.c-804-\t.owner\t\t\t= THIS_MODULE,\nnet/ipv4/tcp_diag.c:805:\t.dump\t\t\t= tcp_diag_dump,\nnet/ipv4/tcp_diag.c:806:\t.dump_one\t\t= tcp_diag_dump_one,\nnet/ipv4/tcp_diag.c-807-\t.idiag_get_info\t\t= tcp_diag_get_info,\n"
}

gemini-3.1-pro-preview

null

null

							input: 14034
							output: 39
							thoughts: 154
						

**Analyzing the Kernel's Diagnostic Function Calls**

Okay, so I'm looking at these diagnostic functions. I initially considered them as static, but then I remembered they are registered within the `inet_diag_handler` structure. That shifts things.

Alright, let me list them anyway. It's good to keep things clear, especially as these are the core functions that have been modified.

Wait a second. The prompt specifically wants me to prioritize non-static, non-inlined API entrypoints. That makes sense, avoiding those potentially problematic inlined helper functions.

Right, `tcp_diag_dump` and `mptcp_diag_dump`. Excellent. They are assigned to function pointers within a struct, meaning they won't be inlined. Their symbol addresses will be distinct. That makes them perfect entry points for the dumping process.

Now let's verify `inet_diag_dump_clear_cursor`. Ah, it's exported! Non-static, confirmed. Good.

{
  "Expression": "inet_diag_dump_clear_cursor",
  "PathPrefix": "net/ipv4/inet_diag.c"
}

{
  "Output": "net/ipv4/inet_diag.c=889=static int inet_diag_dump_start_compat(struct netlink_callback *cb)\n--\nnet/ipv4/inet_diag.c-893-\nnet/ipv4/inet_diag.c:894:void inet_diag_dump_clear_cursor(struct inet_diag_dump_data *cb_data)\nnet/ipv4/inet_diag.c-895-{\n--\nnet/ipv4/inet_diag.c-903-}\nnet/ipv4/inet_diag.c:904:EXPORT_SYMBOL_GPL(inet_diag_dump_clear_cursor);\nnet/ipv4/inet_diag.c-905-\nnet/ipv4/inet_diag.c=906=static int inet_diag_dump_done(struct netlink_callback *cb)\n--\nnet/ipv4/inet_diag.c-909-\nnet/ipv4/inet_diag.c:910:\tinet_diag_dump_clear_cursor(cb_data);\nnet/ipv4/inet_diag.c-911-\tbpf_sk_storage_diag_free(cb_data-\u003ebpf_stg_diag);\n"
}

gemini-3.1-pro-preview

null

null

							input: 14750
							output: 164
							thoughts: 155
						

Okay, let's break this down.

**Diagnostic Dump Considerations**

Right, so I need to focus my attention on these functions: `tcp_diag_dump`, `mptcp_diag_dump_listeners`, and `inet_diag_dump_clear_cursor`. These seem to be the core routines involved in whatever diagnostic functionality we're dealing with. Knowing what they're doing is crucial to understanding the whole picture.

Now, as for the configurations that control all this, I see a clear set: `INET_DIAG`, `INET_TCP_DIAG`, `MPTCP`, and `INET_MPTCP_DIAG`. I need to ensure that the correct configurations are set in order to ensure the diagnostic information is available.

It's always a good practice to double-check that there aren't any other related configs in play. Let's see... looking at the details, `CONFIG_INET_DIAG` and `CONFIG_INET_TCP_DIAG` are tristate, meaning they can be enabled as a module, built-in, or disabled. `CONFIG_MPTCP` is a simple boolean; either it's enabled or disabled. And finally, `CONFIG_INET_MPTCP_DIAG` is another tristate.

I've got the pieces figured out and I'll now set the corresponding configuration settings accordingly.

{
  "EnableConfigs": [
    "INET_DIAG",
    "INET_TCP_DIAG",
    "MPTCP",
    "INET_MPTCP_DIAG"
  ],
  "FocusSymbols": [
    "tcp_diag_dump",
    "mptcp_diag_dump_listeners",
    "inet_diag_dump_clear_cursor"
  ],
  "Reasoning": "The patch introduces a cursor mechanism for dumping TCP and MPTCP sockets via the inet_diag netlink interface. This is a functional change in the core networking stack that affects how sockets are iterated and dumped, preventing duplicates or missed sockets when the hash table changes during the dump. It is reachable from user space via netlink and should be fuzzed.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "INET_DIAG",
    "INET_TCP_DIAG",
    "MPTCP",
    "INET_MPTCP_DIAG"
  ],
  "FocusSymbols": [
    "tcp_diag_dump",
    "mptcp_diag_dump_listeners",
    "inet_diag_dump_clear_cursor"
  ],
  "Reasoning": "The patch introduces a cursor mechanism for dumping TCP and MPTCP sockets via the inet_diag netlink interface. This is a functional change in the core networking stack that affects how sockets are iterated and dumped, preventing duplicates or missed sockets when the hash table changes during the dump. It is reachable from user space via netlink and should be fuzzed.",
  "WorthFuzzing": true
}