| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/10 17:57 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the Intel Ethernet E800 Series driver (ice), specifically TC flower filter offload logic. This driver requires vendor-specific physical PCIe hardware (Intel E810/E800 NICs) that is not emulated in standard QEMU/virtualized fuzzing environments, making the modified code structurally unreachable.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/10 17:57 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 09923750bafc570ac4b3fb561e06135c48a081d5\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Sep 10 17:57:26 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h\nindex db3c7015c56c4..6c596e5a31517 100644\n--- a/drivers/net/ethernet/intel/ice/ice.h\n+++ b/drivers/net/ethernet/intel/ice/ice.h\n@@ -643,6 +643,7 @@ struct ice_pf {\n \t */\n \tu16 num_dmac_chnl_fltrs;\n \tstruct hlist_head tc_flower_fltr_list;\n+\tstruct hlist_head tc_sw_fltr_list;\n \n \tu64 supported_rxdids;\n \ndiff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c\nindex d20357c041273..7cfc8941b7ba5 100644\n--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c\n+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c\n@@ -78,7 +78,8 @@ static int ice_tc_count_lkups(u32 flags, struct ice_tc_flower_fltr *fltr)\n \t\t ICE_TC_FLWR_FIELD_DEST_IPV6 | ICE_TC_FLWR_FIELD_SRC_IPV6))\n \t\tlkups_cnt++;\n \n-\tif (flags \u0026 (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))\n+\tif (flags \u0026 (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |\n+\t\t ICE_TC_FLWR_FIELD_IP_PROTO))\n \t\tlkups_cnt++;\n \n \t/* are L2TPv3 options specified? */\n@@ -552,7 +553,8 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,\n \t}\n \n \tif (headers-\u003el2_key.n_proto == htons(ETH_P_IP) \u0026\u0026\n-\t (flags \u0026 (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))) {\n+\t (flags \u0026 (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |\n+\t\t ICE_TC_FLWR_FIELD_IP_PROTO))) {\n \t\tlist[i].type = ice_proto_type_from_ipv4(inner);\n \n \t\tif (flags \u0026 ICE_TC_FLWR_FIELD_IP_TOS) {\n@@ -567,11 +569,19 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,\n \t\t\t\theaders-\u003el3_mask.ttl;\n \t\t}\n \n+\t\tif (flags \u0026 ICE_TC_FLWR_FIELD_IP_PROTO) {\n+\t\t\tlist[i].h_u.ipv4_hdr.protocol =\n+\t\t\t\theaders-\u003el3_key.ip_proto;\n+\t\t\tlist[i].m_u.ipv4_hdr.protocol =\n+\t\t\t\theaders-\u003el3_mask.ip_proto;\n+\t\t}\n+\n \t\ti++;\n \t}\n \n \tif (headers-\u003el2_key.n_proto == htons(ETH_P_IPV6) \u0026\u0026\n-\t (flags \u0026 (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))) {\n+\t (flags \u0026 (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |\n+\t\t ICE_TC_FLWR_FIELD_IP_PROTO))) {\n \t\tstruct ice_ipv6_hdr *hdr_h, *hdr_m;\n \n \t\thdr_h = \u0026list[i].h_u.ipv6_hdr;\n@@ -592,6 +602,11 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,\n \t\t\thdr_m-\u003ehop_limit = headers-\u003el3_mask.ttl;\n \t\t}\n \n+\t\tif (flags \u0026 ICE_TC_FLWR_FIELD_IP_PROTO) {\n+\t\t\thdr_h-\u003enext_hdr = headers-\u003el3_key.ip_proto;\n+\t\t\thdr_m-\u003enext_hdr = headers-\u003el3_mask.ip_proto;\n+\t\t}\n+\n \t\ti++;\n \t}\n \n@@ -1737,6 +1752,9 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,\n \t\theaders-\u003el2_key.n_proto = cpu_to_be16(n_proto_key);\n \t\theaders-\u003el2_mask.n_proto = cpu_to_be16(n_proto_mask);\n \t\theaders-\u003el3_key.ip_proto = match.key-\u003eip_proto;\n+\t\theaders-\u003el3_mask.ip_proto = match.mask-\u003eip_proto;\n+\t\tif (match.mask-\u003eip_proto)\n+\t\t\tfltr-\u003eflags |= ICE_TC_FLWR_FIELD_IP_PROTO;\n \t}\n \n \tif (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {\n@@ -1910,6 +1928,19 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,\n \t\t}\n \t}\n \n+\tif (fltr-\u003eflags \u0026 (ICE_TC_FLWR_FIELD_DEST_L4_PORT |\n+\t\t\t ICE_TC_FLWR_FIELD_SRC_L4_PORT |\n+\t\t\t ICE_TC_FLWR_FIELD_L2TPV3_SESSID))\n+\t\tfltr-\u003eflags \u0026= ~ICE_TC_FLWR_FIELD_IP_PROTO;\n+\n+\tif ((fltr-\u003eflags \u0026 ICE_TC_FLWR_FIELD_IP_PROTO) \u0026\u0026\n+\t headers-\u003el2_key.n_proto != htons(ETH_P_IP) \u0026\u0026\n+\t headers-\u003el2_key.n_proto != htons(ETH_P_IPV6)) {\n+\t\tNL_SET_ERR_MSG_MOD(fltr-\u003eextack,\n+\t\t\t\t \"IP protocol match is not supported with GTP or PPPoE\");\n+\t\treturn -EOPNOTSUPP;\n+\t}\n+\n \t/* Ingress filter on representor results in an egress filter in HW\n \t * and vice versa\n \t */\n@@ -2238,6 +2269,112 @@ ice_find_tc_flower_fltr(struct ice_pf *pf, unsigned long cookie)\n \treturn NULL;\n }\n \n+/**\n+ * ice_tc_fltr_is_drop - check if a filter carries a drop action\n+ * @cls_flower: offload request describing the filter\n+ *\n+ * Return: true if any action of the filter is a drop, false otherwise.\n+ */\n+static bool ice_tc_fltr_is_drop(struct flow_cls_offload *cls_flower)\n+{\n+\tstruct flow_rule *rule = flow_cls_offload_flow_rule(cls_flower);\n+\tstruct flow_action_entry *act;\n+\tint i;\n+\n+\tif (cls_flower-\u003eclassid)\n+\t\treturn false;\n+\n+\tflow_action_for_each(i, act, \u0026rule-\u003eaction)\n+\t\tif (act-\u003eid == FLOW_ACTION_DROP)\n+\t\t\treturn true;\n+\n+\treturn false;\n+}\n+\n+/**\n+ * ice_tc_untrack_sw_fltr - forget a tracked software-only filter\n+ * @pf: pointer to PF structure\n+ * @cookie: unique filter identifier from the offload request\n+ *\n+ * Return: true if the filter was tracked, false otherwise.\n+ */\n+static bool ice_tc_untrack_sw_fltr(struct ice_pf *pf, unsigned long cookie)\n+{\n+\tstruct ice_tc_sw_fltr *sw_fltr;\n+\n+\thlist_for_each_entry(sw_fltr, \u0026pf-\u003etc_sw_fltr_list, node) {\n+\t\tif (sw_fltr-\u003ecookie != cookie)\n+\t\t\tcontinue;\n+\n+\t\thlist_del(\u0026sw_fltr-\u003enode);\n+\t\tkfree(sw_fltr);\n+\t\treturn true;\n+\t}\n+\n+\treturn false;\n+}\n+\n+/**\n+ * ice_tc_track_sw_fltr - remember a filter that was not offloaded\n+ * @pf: pointer to PF structure\n+ * @filter_dev: device the filter was requested on\n+ * @cls_flower: offload request describing the filter\n+ * @direction: block direction the filter was requested for\n+ */\n+static void ice_tc_track_sw_fltr(struct ice_pf *pf,\n+\t\t\t\t struct net_device *filter_dev,\n+\t\t\t\t struct flow_cls_offload *cls_flower,\n+\t\t\t\t enum ice_eswitch_fltr_direction direction)\n+{\n+\tstruct ice_tc_sw_fltr *sw_fltr;\n+\n+\thlist_for_each_entry(sw_fltr, \u0026pf-\u003etc_sw_fltr_list, node)\n+\t\tif (sw_fltr-\u003ecookie == cls_flower-\u003ecookie)\n+\t\t\treturn;\n+\n+\tsw_fltr = kzalloc_obj(*sw_fltr);\n+\tif (!sw_fltr)\n+\t\treturn;\n+\n+\tsw_fltr-\u003ecookie = cls_flower-\u003ecookie;\n+\tsw_fltr-\u003efilter_dev = filter_dev;\n+\tsw_fltr-\u003eprio = cls_flower-\u003ecommon.prio;\n+\tsw_fltr-\u003edirection = direction;\n+\tsw_fltr-\u003eis_drop = ice_tc_fltr_is_drop(cls_flower);\n+\thlist_add_head(\u0026sw_fltr-\u003enode, \u0026pf-\u003etc_sw_fltr_list);\n+}\n+\n+/**\n+ * ice_tc_drop_bypasses_fltr - check if a drop rule would bypass a filter\n+ * @pf: pointer to PF structure\n+ * @filter_dev: device the drop filter is requested on\n+ * @prio: TC priority of the drop filter\n+ * @direction: block direction of the drop filter\n+ *\n+ * Return: true if such a filter exists, false otherwise.\n+ */\n+static bool\n+ice_tc_drop_bypasses_fltr(struct ice_pf *pf, struct net_device *filter_dev,\n+\t\t\t u32 prio, enum ice_eswitch_fltr_direction direction)\n+{\n+\tstruct ice_tc_flower_fltr *fltr;\n+\tstruct ice_tc_sw_fltr *sw_fltr;\n+\n+\thlist_for_each_entry(sw_fltr, \u0026pf-\u003etc_sw_fltr_list, node)\n+\t\tif (sw_fltr-\u003efilter_dev == filter_dev \u0026\u0026\n+\t\t sw_fltr-\u003edirection == direction \u0026\u0026 sw_fltr-\u003eprio \u003c prio \u0026\u0026\n+\t\t !sw_fltr-\u003eis_drop)\n+\t\t\treturn true;\n+\n+\thlist_for_each_entry(fltr, \u0026pf-\u003etc_flower_fltr_list, tc_flower_node)\n+\t\tif (fltr-\u003efilter_dev == filter_dev \u0026\u0026\n+\t\t fltr-\u003edirection == direction \u0026\u0026 fltr-\u003eprio \u003c prio \u0026\u0026\n+\t\t fltr-\u003eaction.fltr_act != ICE_DROP_PACKET)\n+\t\t\treturn true;\n+\n+\treturn false;\n+}\n+\n /**\n * ice_add_cls_flower - add TC flower filters\n * @netdev: Pointer to filter device\n@@ -2253,14 +2390,24 @@ int ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,\n {\n \tstruct netlink_ext_ack *extack = cls_flower-\u003ecommon.extack;\n \tstruct net_device *vsi_netdev = vsi-\u003enetdev;\n+\tenum ice_eswitch_fltr_direction direction;\n \tstruct ice_tc_flower_fltr *fltr;\n \tstruct ice_pf *pf = vsi-\u003eback;\n+\tbool track_sw_fltrs;\n \tint err;\n \n-\tif (ice_is_reset_in_progress(pf-\u003estate))\n-\t\treturn -EBUSY;\n-\tif (test_bit(ICE_FLAG_FW_LLDP_AGENT, pf-\u003eflags))\n-\t\treturn -EINVAL;\n+\tdirection = ingress ? ICE_ESWITCH_FLTR_INGRESS :\n+\t\t\t ICE_ESWITCH_FLTR_EGRESS;\n+\ttrack_sw_fltrs = !ice_is_eswitch_mode_switchdev(pf);\n+\n+\tif (ice_is_reset_in_progress(pf-\u003estate)) {\n+\t\terr = -EBUSY;\n+\t\tgoto track_sw;\n+\t}\n+\tif (test_bit(ICE_FLAG_FW_LLDP_AGENT, pf-\u003eflags)) {\n+\t\terr = -EINVAL;\n+\t\tgoto track_sw;\n+\t}\n \n \tif (ice_is_port_repr_netdev(netdev))\n \t\tvsi_netdev = netdev;\n@@ -2273,7 +2420,8 @@ int ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,\n \t\t */\n \t\tif (netdev == vsi_netdev)\n \t\t\tNL_SET_ERR_MSG_MOD(extack, \"can't apply TC flower filters, turn ON hw-tc-offload and try again\");\n-\t\treturn -EINVAL;\n+\t\terr = -EINVAL;\n+\t\tgoto track_sw;\n \t}\n \n \t/* avoid duplicate entries, if exists - return error */\n@@ -2283,14 +2431,32 @@ int ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,\n \t\treturn -EEXIST;\n \t}\n \n+\tif (track_sw_fltrs \u0026\u0026 !cls_flower-\u003ecommon.skip_sw \u0026\u0026\n+\t ice_tc_fltr_is_drop(cls_flower) \u0026\u0026\n+\t ice_tc_drop_bypasses_fltr(pf, netdev, cls_flower-\u003ecommon.prio,\n+\t\t\t\t direction)) {\n+\t\tNL_SET_ERR_MSG_MOD(extack,\n+\t\t\t\t \"Drop filter not offloaded because it would bypass a higher priority filter\");\n+\t\terr = -EOPNOTSUPP;\n+\t\tgoto track_sw;\n+\t}\n+\n \t/* prep and add TC-flower filter in HW */\n \terr = ice_add_tc_fltr(netdev, vsi, cls_flower, \u0026fltr, ingress);\n \tif (err)\n-\t\treturn err;\n+\t\tgoto track_sw;\n+\n+\tfltr-\u003efilter_dev = netdev;\n+\tfltr-\u003eprio = cls_flower-\u003ecommon.prio;\n \n \t/* add filter into an ordered list */\n \thlist_add_head(\u0026fltr-\u003etc_flower_node, \u0026pf-\u003etc_flower_fltr_list);\n \treturn 0;\n+\n+track_sw:\n+\tif (track_sw_fltrs \u0026\u0026 !cls_flower-\u003ecommon.skip_sw)\n+\t\tice_tc_track_sw_fltr(pf, netdev, cls_flower, direction);\n+\treturn err;\n }\n \n /**\n@@ -2305,6 +2471,9 @@ ice_del_cls_flower(struct ice_vsi *vsi, struct flow_cls_offload *cls_flower)\n \tstruct ice_pf *pf = vsi-\u003eback;\n \tint err;\n \n+\tif (ice_tc_untrack_sw_fltr(pf, cls_flower-\u003ecookie))\n+\t\treturn 0;\n+\n \t/* find filter */\n \tfltr = ice_find_tc_flower_fltr(pf, cls_flower-\u003ecookie);\n \tif (!fltr) {\ndiff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.h b/drivers/net/ethernet/intel/ice/ice_tc_lib.h\nindex 8a3ab2f22af9b..37d6f4100ecfb 100644\n--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.h\n+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.h\n@@ -38,6 +38,7 @@\n #define ICE_TC_FLWR_FIELD_CVLAN_PRIO\t\tBIT(28)\n #define ICE_TC_FLWR_FIELD_VLAN_TPID\t\tBIT(29)\n #define ICE_TC_FLWR_FIELD_PFCP_OPTS\t\tBIT(30)\n+#define ICE_TC_FLWR_FIELD_IP_PROTO\t\tBIT(31)\n \n #define ICE_TC_FLOWER_MASK_32 0xFFFFFFFF\n \n@@ -138,12 +139,33 @@ enum ice_eswitch_fltr_direction {\n \tICE_ESWITCH_FLTR_EGRESS,\n };\n \n+/**\n+ * struct ice_tc_sw_fltr - filter presented to the driver but not offloaded\n+ * @node: node in the pf-\u003etc_sw_fltr_list\n+ * @cookie: unique filter identifier from the offload request\n+ * @filter_dev: device the filter was requested on\n+ * @prio: TC priority, lower value is evaluated first\n+ * @direction: block direction the filter was requested for\n+ * @is_drop: the filter carries a drop action\n+ */\n+struct ice_tc_sw_fltr {\n+\tstruct hlist_node node;\n+\tunsigned long cookie;\n+\tstruct net_device *filter_dev;\n+\tu32 prio;\n+\tenum ice_eswitch_fltr_direction direction;\n+\tbool is_drop;\n+};\n+\n struct ice_tc_flower_fltr {\n \tstruct hlist_node tc_flower_node;\n \n \t/* cookie becomes filter_rule_id if rule is added successfully */\n \tunsigned long cookie;\n \n+\tstruct net_device *filter_dev;\n+\tu32 prio;\n+\n \t/* add_adv_rule returns information like recipe ID, rule_id. Store\n \t * those values since they are needed to remove advanced rule\n \t */\n"
} |
| 2/1 | 2026/09/10 17:57 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the Intel Ethernet E800 Series driver (ice), specifically TC flower filter offload logic. This driver requires vendor-specific physical PCIe hardware (Intel E810/E800 NICs) that is not emulated in standard QEMU/virtualized fuzzing environments, making the modified code structurally unreachable.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 09923750bafc570ac4b3fb561e06135c48a081d5
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Sep 10 17:57:26 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index db3c7015c56c4..6c596e5a31517 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -643,6 +643,7 @@ struct ice_pf {
*/
u16 num_dmac_chnl_fltrs;
struct hlist_head tc_flower_fltr_list;
+ struct hlist_head tc_sw_fltr_list;
u64 supported_rxdids;
diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
index d20357c041273..7cfc8941b7ba5 100644
--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
@@ -78,7 +78,8 @@ static int ice_tc_count_lkups(u32 flags, struct ice_tc_flower_fltr *fltr)
ICE_TC_FLWR_FIELD_DEST_IPV6 | ICE_TC_FLWR_FIELD_SRC_IPV6))
lkups_cnt++;
- if (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))
+ if (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |
+ ICE_TC_FLWR_FIELD_IP_PROTO))
lkups_cnt++;
/* are L2TPv3 options specified? */
@@ -552,7 +553,8 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,
}
if (headers->l2_key.n_proto == htons(ETH_P_IP) &&
- (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))) {
+ (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |
+ ICE_TC_FLWR_FIELD_IP_PROTO))) {
list[i].type = ice_proto_type_from_ipv4(inner);
if (flags & ICE_TC_FLWR_FIELD_IP_TOS) {
@@ -567,11 +569,19 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,
headers->l3_mask.ttl;
}
+ if (flags & ICE_TC_FLWR_FIELD_IP_PROTO) {
+ list[i].h_u.ipv4_hdr.protocol =
+ headers->l3_key.ip_proto;
+ list[i].m_u.ipv4_hdr.protocol =
+ headers->l3_mask.ip_proto;
+ }
+
i++;
}
if (headers->l2_key.n_proto == htons(ETH_P_IPV6) &&
- (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL))) {
+ (flags & (ICE_TC_FLWR_FIELD_IP_TOS | ICE_TC_FLWR_FIELD_IP_TTL |
+ ICE_TC_FLWR_FIELD_IP_PROTO))) {
struct ice_ipv6_hdr *hdr_h, *hdr_m;
hdr_h = &list[i].h_u.ipv6_hdr;
@@ -592,6 +602,11 @@ ice_tc_fill_rules(struct ice_hw *hw, u32 flags,
hdr_m->hop_limit = headers->l3_mask.ttl;
}
+ if (flags & ICE_TC_FLWR_FIELD_IP_PROTO) {
+ hdr_h->next_hdr = headers->l3_key.ip_proto;
+ hdr_m->next_hdr = headers->l3_mask.ip_proto;
+ }
+
i++;
}
@@ -1737,6 +1752,9 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,
headers->l2_key.n_proto = cpu_to_be16(n_proto_key);
headers->l2_mask.n_proto = cpu_to_be16(n_proto_mask);
headers->l3_key.ip_proto = match.key->ip_proto;
+ headers->l3_mask.ip_proto = match.mask->ip_proto;
+ if (match.mask->ip_proto)
+ fltr->flags |= ICE_TC_FLWR_FIELD_IP_PROTO;
}
if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
@@ -1910,6 +1928,19 @@ ice_parse_cls_flower(struct net_device *filter_dev, struct ice_vsi *vsi,
}
}
+ if (fltr->flags & (ICE_TC_FLWR_FIELD_DEST_L4_PORT |
+ ICE_TC_FLWR_FIELD_SRC_L4_PORT |
+ ICE_TC_FLWR_FIELD_L2TPV3_SESSID))
+ fltr->flags &= ~ICE_TC_FLWR_FIELD_IP_PROTO;
+
+ if ((fltr->flags & ICE_TC_FLWR_FIELD_IP_PROTO) &&
+ headers->l2_key.n_proto != htons(ETH_P_IP) &&
+ headers->l2_key.n_proto != htons(ETH_P_IPV6)) {
+ NL_SET_ERR_MSG_MOD(fltr->extack,
+ "IP protocol match is not supported with GTP or PPPoE");
+ return -EOPNOTSUPP;
+ }
+
/* Ingress filter on representor results in an egress filter in HW
* and vice versa
*/
@@ -2238,6 +2269,112 @@ ice_find_tc_flower_fltr(struct ice_pf *pf, unsigned long cookie)
return NULL;
}
+/**
+ * ice_tc_fltr_is_drop - check if a filter carries a drop action
+ * @cls_flower: offload request describing the filter
+ *
+ * Return: true if any action of the filter is a drop, false otherwise.
+ */
+static bool ice_tc_fltr_is_drop(struct flow_cls_offload *cls_flower)
+{
+ struct flow_rule *rule = flow_cls_offload_flow_rule(cls_flower);
+ struct flow_action_entry *act;
+ int i;
+
+ if (cls_flower->classid)
+ return false;
+
+ flow_action_for_each(i, act, &rule->action)
+ if (act->id == FLOW_ACTION_DROP)
+ return true;
+
+ return false;
+}
+
+/**
+ * ice_tc_untrack_sw_fltr - forget a tracked software-only filter
+ * @pf: pointer to PF structure
+ * @cookie: unique filter identifier from the offload request
+ *
+ * Return: true if the filter was tracked, false otherwise.
+ */
+static bool ice_tc_untrack_sw_fltr(struct ice_pf *pf, unsigned long cookie)
+{
+ struct ice_tc_sw_fltr *sw_fltr;
+
+ hlist_for_each_entry(sw_fltr, &pf->tc_sw_fltr_list, node) {
+ if (sw_fltr->cookie != cookie)
+ continue;
+
+ hlist_del(&sw_fltr->node);
+ kfree(sw_fltr);
+ return true;
+ }
+
+ return false;
+}
+
+/**
+ * ice_tc_track_sw_fltr - remember a filter that was not offloaded
+ * @pf: pointer to PF structure
+ * @filter_dev: device the filter was requested on
+ * @cls_flower: offload request describing the filter
+ * @direction: block direction the filter was requested for
+ */
+static void ice_tc_track_sw_fltr(struct ice_pf *pf,
+ struct net_device *filter_dev,
+ struct flow_cls_offload *cls_flower,
+ enum ice_eswitch_fltr_direction direction)
+{
+ struct ice_tc_sw_fltr *sw_fltr;
+
+ hlist_for_each_entry(sw_fltr, &pf->tc_sw_fltr_list, node)
+ if (sw_fltr->cookie == cls_flower->cookie)
+ return;
+
+ sw_fltr = kzalloc_obj(*sw_fltr);
+ if (!sw_fltr)
+ return;
+
+ sw_fltr->cookie = cls_flower->cookie;
+ sw_fltr->filter_dev = filter_dev;
+ sw_fltr->prio = cls_flower->common.prio;
+ sw_fltr->direction = direction;
+ sw_fltr->is_drop = ice_tc_fltr_is_drop(cls_flower);
+ hlist_add_head(&sw_fltr->node, &pf->tc_sw_fltr_list);
+}
+
+/**
+ * ice_tc_drop_bypasses_fltr - check if a drop rule would bypass a filter
+ * @pf: pointer to PF structure
+ * @filter_dev: device the drop filter is requested on
+ * @prio: TC priority of the drop filter
+ * @direction: block direction of the drop filter
+ *
+ * Return: true if such a filter exists, false otherwise.
+ */
+static bool
+ice_tc_drop_bypasses_fltr(struct ice_pf *pf, struct net_device *filter_dev,
+ u32 prio, enum ice_eswitch_fltr_direction direction)
+{
+ struct ice_tc_flower_fltr *fltr;
+ struct ice_tc_sw_fltr *sw_fltr;
+
+ hlist_for_each_entry(sw_fltr, &pf->tc_sw_fltr_list, node)
+ if (sw_fltr->filter_dev == filter_dev &&
+ sw_fltr->direction == direction && sw_fltr->prio < prio &&
+ !sw_fltr->is_drop)
+ return true;
+
+ hlist_for_each_entry(fltr, &pf->tc_flower_fltr_list, tc_flower_node)
+ if (fltr->filter_dev == filter_dev &&
+ fltr->direction == direction && fltr->prio < prio &&
+ fltr->action.fltr_act != ICE_DROP_PACKET)
+ return true;
+
+ return false;
+}
+
/**
* ice_add_cls_flower - add TC flower filters
* @netdev: Pointer to filter device
@@ -2253,14 +2390,24 @@ int ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,
{
struct netlink_ext_ack *extack = cls_flower->common.extack;
struct net_device *vsi_netdev = vsi->netdev;
+ enum ice_eswitch_fltr_direction direction;
struct ice_tc_flower_fltr *fltr;
struct ice_pf *pf = vsi->back;
+ bool track_sw_fltrs;
int err;
- if (ice_is_reset_in_progress(pf->state))
- return -EBUSY;
- if (test_bit(ICE_FLAG_FW_LLDP_AGENT, pf->flags))
- return -EINVAL;
+ direction = ingress ? ICE_ESWITCH_FLTR_INGRESS :
+ ICE_ESWITCH_FLTR_EGRESS;
+ track_sw_fltrs = !ice_is_eswitch_mode_switchdev(pf);
+
+ if (ice_is_reset_in_progress(pf->state)) {
+ err = -EBUSY;
+ goto track_sw;
+ }
+ if (test_bit(ICE_FLAG_FW_LLDP_AGENT, pf->flags)) {
+ err = -EINVAL;
+ goto track_sw;
+ }
if (ice_is_port_repr_netdev(netdev))
vsi_netdev = netdev;
@@ -2273,7 +2420,8 @@ int ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,
*/
if (netdev == vsi_netdev)
NL_SET_ERR_MSG_MOD(extack, "can't apply TC flower filters, turn ON hw-tc-offload and try again");
- return -EINVAL;
+ err = -EINVAL;
+ goto track_sw;
}
/* avoid duplicate entries, if exists - return error */
@@ -2283,14 +2431,32 @@ int ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,
return -EEXIST;
}
+ if (track_sw_fltrs && !cls_flower->common.skip_sw &&
+ ice_tc_fltr_is_drop(cls_flower) &&
+ ice_tc_drop_bypasses_fltr(pf, netdev, cls_flower->common.prio,
+ direction)) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Drop filter not offloaded because it would bypass a higher priority filter");
+ err = -EOPNOTSUPP;
+ goto track_sw;
+ }
+
/* prep and add TC-flower filter in HW */
err = ice_add_tc_fltr(netdev, vsi, cls_flower, &fltr, ingress);
if (err)
- return err;
+ goto track_sw;
+
+ fltr->filter_dev = netdev;
+ fltr->prio = cls_flower->common.prio;
/* add filter into an ordered list */
hlist_add_head(&fltr->tc_flower_node, &pf->tc_flower_fltr_list);
return 0;
+
+track_sw:
+ if (track_sw_fltrs && !cls_flower->common.skip_sw)
+ ice_tc_track_sw_fltr(pf, netdev, cls_flower, direction);
+ return err;
}
/**
@@ -2305,6 +2471,9 @@ ice_del_cls_flower(struct ice_vsi *vsi, struct flow_cls_offload *cls_flower)
struct ice_pf *pf = vsi->back;
int err;
+ if (ice_tc_untrack_sw_fltr(pf, cls_flower->cookie))
+ return 0;
+
/* find filter */
fltr = ice_find_tc_flower_fltr(pf, cls_flower->cookie);
if (!fltr) {
diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.h b/drivers/net/ethernet/intel/ice/ice_tc_lib.h
index 8a3ab2f22af9b..37d6f4100ecfb 100644
--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.h
+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.h
@@ -38,6 +38,7 @@
#define ICE_TC_FLWR_FIELD_CVLAN_PRIO BIT(28)
#define ICE_TC_FLWR_FIELD_VLAN_TPID BIT(29)
#define ICE_TC_FLWR_FIELD_PFCP_OPTS BIT(30)
+#define ICE_TC_FLWR_FIELD_IP_PROTO BIT(31)
#define ICE_TC_FLOWER_MASK_32 0xFFFFFFFF
@@ -138,12 +139,33 @@ enum ice_eswitch_fltr_direction {
ICE_ESWITCH_FLTR_EGRESS,
};
+/**
+ * struct ice_tc_sw_fltr - filter presented to the driver but not offloaded
+ * @node: node in the pf->tc_sw_fltr_list
+ * @cookie: unique filter identifier from the offload request
+ * @filter_dev: device the filter was requested on
+ * @prio: TC priority, lower value is evaluated first
+ * @direction: block direction the filter was requested for
+ * @is_drop: the filter carries a drop action
+ */
+struct ice_tc_sw_fltr {
+ struct hlist_node node;
+ unsigned long cookie;
+ struct net_device *filter_dev;
+ u32 prio;
+ enum ice_eswitch_fltr_direction direction;
+ bool is_drop;
+};
+
struct ice_tc_flower_fltr {
struct hlist_node tc_flower_node;
/* cookie becomes filter_rule_id if rule is added successfully */
unsigned long cookie;
+ struct net_device *filter_dev;
+ u32 prio;
+
/* add_adv_rule returns information like recipe ID, rule_id. Store
* those values since they are needed to remove advanced rule
*/
|
| 3/2 | 2026/09/10 17:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 7348 output: 31 thoughts: 262 Thoughts: **My Initial Assessment of the ICE Driver Patch** Alright, let's dive into this patch and decide if it's a good candidate for syzkaller fuzzing. My first instinct is to understand the scope of the change. Okay, it looks like this patch touches files within the `drivers/net/ethernet/intel/ice/` directory – `ice.h`, `ice_tc_lib.c`, and `ice_tc_lib.h` specifically. So, we're dealing with the Intel Ethernet Controller E800 series driver, also known as the ICE driver. That narrows our focus. Now, let's bring the triage philosophy into play, specifically Section 2, which deals with structurally unreachable hardware. We need to ascertain if the ICE driver falls into the category of vendor-specific PCIe switches, SmartNICs, or GPU drivers that require specific physical hardware not emulated by standard QEMU or syzkaller. The question then becomes: is the `ice` driver one of those? I need to quickly establish if it requires specialized hardware. The best way forward is to use `grepper` to see how the `ice` driver is configured and used within the kernel. This will quickly give me an overview of its dependencies and whether it's inherently tied to a specific physical setup that makes it an unsuitable candidate for syzkaller. |
| 4/2 | 2026/09/10 17:57 | tool | grepper |
0mArgs:{
"Expression": "config ICE",
"PathPrefix": "drivers/net/ethernet/intel/"
}Results: {
"Output": "drivers/net/ethernet/intel/Kconfig=268=config I40EVF\n--\ndrivers/net/ethernet/intel/Kconfig-290-\ndrivers/net/ethernet/intel/Kconfig:291:config ICE\ndrivers/net/ethernet/intel/Kconfig-292-\ttristate \"Intel(R) Ethernet Connection E800 Series Support\"\n--\ndrivers/net/ethernet/intel/Kconfig-319-\ndrivers/net/ethernet/intel/Kconfig:320:config ICE_HWMON\ndrivers/net/ethernet/intel/Kconfig-321-\tbool \"Intel(R) Ethernet Connection E800 Series Support HWMON support\"\n--\ndrivers/net/ethernet/intel/Kconfig-330-\ndrivers/net/ethernet/intel/Kconfig:331:config ICE_SWITCHDEV\ndrivers/net/ethernet/intel/Kconfig-332-\tbool \"Switchdev Support\"\n--\ndrivers/net/ethernet/intel/Kconfig-344-\ndrivers/net/ethernet/intel/Kconfig:345:config ICE_HWTS\ndrivers/net/ethernet/intel/Kconfig-346-\tbool \"Support HW cross-timestamp on platforms with PTM support\"\n"
} |
| 5/2 | 2026/09/10 17:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 8252 output: 36 thoughts: 32 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: **Investigating the Intel E800 NIC Driver Probe** Alright, time to get to the bottom of this. Let's start with the basics. I need to quickly confirm that the `ice` driver is, in fact, the correct PCI device driver for the Intel E800 series NICs. This means I'm going to quickly check the driver's probe routine, specifically looking at how it identifies the device based on its PCI IDs. A quick check of the PCI IDs will confirm that we are indeed looking at the correct driver. Nothing like a methodical start to a potentially complex investigation. |
| 6/2 | 2026/09/10 17:57 | tool | grepper |
0mArgs:{
"Expression": "ice_pci_tbl",
"PathPrefix": "drivers/net/ethernet/intel/ice"
}Results: {
"Output": "drivers/net/ethernet/intel/ice/ice_main.c=5117=static int ice_probe_recovery_mode(struct ice_pf *pf)\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5149- * @pdev: PCI device information struct\ndrivers/net/ethernet/intel/ice/ice_main.c:5150: * @ent: entry in ice_pci_tbl\ndrivers/net/ethernet/intel/ice/ice_main.c-5151- *\n--\ndrivers/net/ethernet/intel/ice/ice_main.c=5771=static void ice_pci_err_reset_done(struct pci_dev *pdev)\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5775-\ndrivers/net/ethernet/intel/ice/ice_main.c:5776:/* ice_pci_tbl - PCI Device ID Table\ndrivers/net/ethernet/intel/ice/ice_main.c-5777- *\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5783- */\ndrivers/net/ethernet/intel/ice/ice_main.c:5784:static const struct pci_device_id ice_pci_tbl[] = {\ndrivers/net/ethernet/intel/ice/ice_main.c-5785-\t{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_BACKPLANE) },\n--\ndrivers/net/ethernet/intel/ice/ice_main.c-5836-};\ndrivers/net/ethernet/intel/ice/ice_main.c:5837:MODULE_DEVICE_TABLE(pci, ice_pci_tbl);\ndrivers/net/ethernet/intel/ice/ice_main.c-5838-\n--\ndrivers/net/ethernet/intel/ice/ice_main.c=5849=static struct pci_driver ice_driver = {\ndrivers/net/ethernet/intel/ice/ice_main.c-5850-\t.name = KBUILD_MODNAME,\ndrivers/net/ethernet/intel/ice/ice_main.c:5851:\t.id_table = ice_pci_tbl,\ndrivers/net/ethernet/intel/ice/ice_main.c-5852-\t.probe = ice_probe,\n"
} |
| 7/2 | 2026/09/10 17:57 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 9083 output: 101 thoughts: 505 Thoughts: **Analyzing the Feasibility of Fuzzing the `ice` Driver** Okay, so I'm digging into whether we can actually fuzz the `ice` driver, specifically without requiring a physical Intel E800 series PCIe card. My initial thought is that since it's an enterprise-grade NIC, my gut says it probably needs the physical hardware. QEMU definitely doesn't emulate the `ice` hardware, it focuses on the more common stuff like `e1000`, `vmxnet3`, and `virtio-net`. The text I'm looking at confirms this: `ice` requires a real ASIC/PCIe card, like the Intel E810 or E800 series. That "Structurally unreachable hardware" section in the docs immediately clicks. We're talking about drivers that are tied to specific hardware and aren't going to run without it, just like `mlxsw`, `pds_core`, etc. The `ice` driver *definitely* fits this description. Since we're missing the physical card or proper emulation, functions like `ice_probe` won't ever be called, and therefore we'll never see things like `ice_pf`, or `ice_add_cls_flower`. I'm now checking if there's any clever mock or virtual driver mode buried in the code, or if some obscure configuration flags can bring it to life. A quick look at the patch diff confirms that the changes are isolated within the `drivers/net/ethernet/intel/ice/` directory, specifically in `ice.h`, `ice_tc_lib.c`, and `ice_tc_lib.h`. Given all this, I'm pretty confident in my conclusion. Because the patch directly involves a driver that only works with physical hardware unavailable in standard virtualized environments, fuzzing is essentially a no-go for this patch. The relevant fields are: * `WorthFuzzing`: false * `EnableConfigs`: \[ ] * `FocusSymbols`: \[ ] * `Reasoning`: Concise explanation that the patch is for the Intel Ethernet Connection E800 Series driver (`ice`), which requires physical PCIe hardware not emulated in virtualized environments, making the code structurally unreachable. Now I'll prep the `set-results` tool call. |
| 8/2 | 2026/09/10 17:57 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the Intel Ethernet E800 Series driver (ice), specifically TC flower filter offload logic. This driver requires vendor-specific physical PCIe hardware (Intel E810/E800 NICs) that is not emulated in standard QEMU/virtualized fuzzing environments, making the modified code structurally unreachable.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the Intel Ethernet E800 Series driver (ice), specifically TC flower filter offload logic. This driver requires vendor-specific physical PCIe hardware (Intel E810/E800 NICs) that is not emulated in standard QEMU/virtualized fuzzing environments, making the modified code structurally unreachable.",
"WorthFuzzing": false
} |
| 9/1 | 2026/09/10 17:57 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|