| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/10 11:52 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch adds a Netlink multicast event for DRM RAS and implements it in the Intel Xe GPU driver. The new code is only reachable via the `xe` driver, which requires physical PCIe hardware not emulated in standard QEMU. Therefore, it cannot be fuzzed in a virtualized environment.",
"WorthFuzzing": false
} |
| 1/1 | 2026/08/10 11:52 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 3c656258fc9703edff240bf0732866ae2dac6d98\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Aug 10 11:52:57 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst\nindex 83c21853b74b6..406e4c49bac1f 100644\n--- a/Documentation/gpu/drm-ras.rst\n+++ b/Documentation/gpu/drm-ras.rst\n@@ -56,6 +56,7 @@ User space tools can:\n ``node-id`` and ``error-id`` as parameters.\n * Clear specific error counters with the ``clear-error-counter`` command, using both\n ``node-id`` and ``error-id`` as parameters.\n+* Subscribe to the ``error-report`` multicast group to receive ``error-event``.\n \n YAML-based Interface\n --------------------\n@@ -111,3 +112,23 @@ Example: Clear an error counter for a given node\n \n sudo ynl --family drm_ras --do clear-error-counter --json '{\"node-id\":0, \"error-id\":1}'\n None\n+\n+Example: Subscribe to ``error-report`` multicast group\n+\n+.. code-block:: bash\n+\n+ sudo ynl --family drm_ras --output-json --subscribe error-report\n+\n+.. code-block:: json\n+\n+ {\n+ \"name\": \"error-event\",\n+ \"msg\": {\n+ \"device-name\": \"0000:03:00.0\",\n+ \"node-id\": 1,\n+ \"node-name\": \"uncorrectable-errors\",\n+ \"error-id\": 1,\n+ \"error-name\": \"error_name1\",\n+ \"error-value\": 1\n+ }\n+ }\ndiff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml\nindex e113056f8c016..8aed3d4515e5a 100644\n--- a/Documentation/netlink/specs/drm_ras.yaml\n+++ b/Documentation/netlink/specs/drm_ras.yaml\n@@ -69,6 +69,33 @@ attribute-sets:\n name: error-value\n type: u32\n doc: Current value of the requested error counter.\n+ -\n+ name: error-event-attrs\n+ attributes:\n+ -\n+ name: device-name\n+ type: string\n+ doc: Device (PCI BDF, UUID) that reported the error.\n+ -\n+ name: node-id\n+ type: u32\n+ doc: ID of the node that reported the error.\n+ -\n+ name: node-name\n+ type: string\n+ doc: Name of the node that reported the error.\n+ -\n+ name: error-id\n+ type: u32\n+ doc: ID of the error counter.\n+ -\n+ name: error-name\n+ type: string\n+ doc: Name of the error.\n+ -\n+ name: error-value\n+ type: u32\n+ doc: Current value of the error counter.\n \n operations:\n list:\n@@ -124,3 +151,24 @@ operations:\n do:\n request:\n attributes: *id-attrs\n+ -\n+ name: error-event\n+ doc: \u003e-\n+ Report an error event to userspace.\n+ The event includes the device, node and error information\n+ of the error that triggered the event.\n+ attribute-set: error-event-attrs\n+ mcgrp: error-report\n+ event:\n+ attributes:\n+ - device-name\n+ - node-id\n+ - node-name\n+ - error-id\n+ - error-name\n+ - error-value\n+\n+mcast-groups:\n+ list:\n+ -\n+ name: error-report\ndiff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c\nindex d6eab29a1394c..39155fb514de3 100644\n--- a/drivers/gpu/drm/drm_ras.c\n+++ b/drivers/gpu/drm/drm_ras.c\n@@ -41,6 +41,11 @@\n * Userspace must provide Node ID, Error ID.\n * Clears specific error counter of a node if supported.\n *\n+ * 4. ERROR_REPORT: Subscribe to this multicast group to receive error events\n+ *\n+ * 5. ERROR_EVENT: Report an error event to userspace. The event contains device, node\n+ * and error information that triggered the event.\n+ *\n * Node registration:\n *\n * - drm_ras_node_register(): Registers a new node and assigns\n@@ -186,6 +191,34 @@ static int msg_reply_value(struct sk_buff *msg, u32 error_id,\n \t\t\t value);\n }\n \n+static int msg_put_error_event_attrs(struct sk_buff *msg, struct drm_ras_node *node,\n+\t\t\t\t u32 error_id, const char *error_name, u32 value)\n+{\n+\tint ret;\n+\n+\tret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME, node-\u003edevice_name);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID, node-\u003eid);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME, node-\u003enode_name);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID, error_id);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME, error_name);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\treturn nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE, value);\n+}\n+\n static int doit_reply_value(struct genl_info *info, u32 node_id,\n \t\t\t u32 error_id)\n {\n@@ -222,6 +255,74 @@ static int doit_reply_value(struct genl_info *info, u32 node_id,\n \treturn genlmsg_reply(msg, info);\n }\n \n+/**\n+ * drm_ras_nl_error_event() - Report an error event\n+ * @node: Node structure\n+ * @error_id: ID of the error\n+ * @error_name: Name of the error\n+ * @value: Value of the error counter\n+ *\n+ * Report an error-event to userspace using the error-report multicast group.\n+ *\n+ * Context: Process context only. Uses %GFP_KERNEL and multicasts to all\n+ * netns, which is unbounded work; callers in interrupt handlers\n+ * or other atomic context must defer event.\n+ *\n+ * Return: 0 on success, or negative errno on failure.\n+ */\n+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,\n+\t\t\t u32 value)\n+{\n+\tstruct genl_info info;\n+\tstruct sk_buff *msg;\n+\tstruct nlattr *hdr;\n+\tint ret;\n+\n+\tif (!node || !error_name)\n+\t\treturn -EINVAL;\n+\n+\t/* Check the node is currently registered */\n+\tif (xa_load(\u0026drm_ras_xa, node-\u003eid) != node)\n+\t\treturn -ENOENT;\n+\n+\t/* Currently only Error Counter events are supported */\n+\tif (node-\u003etype != DRM_RAS_NODE_TYPE_ERROR_COUNTER)\n+\t\treturn -EOPNOTSUPP;\n+\n+\t/* Check the error ID is within the valid range */\n+\tif (error_id \u003c node-\u003eerror_counter_range.first ||\n+\t error_id \u003e node-\u003eerror_counter_range.last)\n+\t\treturn -EINVAL;\n+\n+\tgenl_info_init_ntf(\u0026info, \u0026drm_ras_nl_family, DRM_RAS_CMD_ERROR_EVENT);\n+\n+\tmsg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);\n+\tif (!msg)\n+\t\treturn -ENOMEM;\n+\n+\thdr = genlmsg_iput(msg, \u0026info);\n+\tif (!hdr) {\n+\t\tret = -EMSGSIZE;\n+\t\tgoto free_msg;\n+\t}\n+\n+\tret = msg_put_error_event_attrs(msg, node, error_id, error_name, value);\n+\tif (ret)\n+\t\tgoto cancel_msg;\n+\n+\tgenlmsg_end(msg, hdr);\n+\tgenlmsg_multicast_allns(\u0026drm_ras_nl_family, msg, 0, DRM_RAS_NLGRP_ERROR_REPORT);\n+\n+\treturn 0;\n+\n+cancel_msg:\n+\tgenlmsg_cancel(msg, hdr);\n+free_msg:\n+\tnlmsg_free(msg);\n+\treturn ret;\n+}\n+EXPORT_SYMBOL(drm_ras_nl_error_event);\n+\n /**\n * drm_ras_nl_get_error_counter_dumpit() - Dump all Error Counters\n * @skb: Netlink message buffer\ndiff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c\nindex dea1c1b2494e8..9d3123cc9f9ca 100644\n--- a/drivers/gpu/drm/drm_ras_nl.c\n+++ b/drivers/gpu/drm/drm_ras_nl.c\n@@ -58,6 +58,10 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {\n \t},\n };\n \n+static const struct genl_multicast_group drm_ras_nl_mcgrps[] = {\n+\t[DRM_RAS_NLGRP_ERROR_REPORT] = { \"error-report\", },\n+};\n+\n struct genl_family drm_ras_nl_family __ro_after_init = {\n \t.name\t\t= DRM_RAS_FAMILY_NAME,\n \t.version\t= DRM_RAS_FAMILY_VERSION,\n@@ -66,4 +70,6 @@ struct genl_family drm_ras_nl_family __ro_after_init = {\n \t.module\t\t= THIS_MODULE,\n \t.split_ops\t= drm_ras_nl_ops,\n \t.n_split_ops\t= ARRAY_SIZE(drm_ras_nl_ops),\n+\t.mcgrps\t\t= drm_ras_nl_mcgrps,\n+\t.n_mcgrps\t= ARRAY_SIZE(drm_ras_nl_mcgrps),\n };\ndiff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h\nindex a398643572a5a..03ec275aca929 100644\n--- a/drivers/gpu/drm/drm_ras_nl.h\n+++ b/drivers/gpu/drm/drm_ras_nl.h\n@@ -21,6 +21,10 @@ int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,\n int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,\n \t\t\t\t\tstruct genl_info *info);\n \n+enum {\n+\tDRM_RAS_NLGRP_ERROR_REPORT,\n+};\n+\n extern struct genl_family drm_ras_nl_family;\n \n #endif /* _LINUX_DRM_RAS_GEN_H */\ndiff --git a/drivers/gpu/drm/xe/xe_drm_ras.c b/drivers/gpu/drm/xe/xe_drm_ras.c\nindex 7937d8ba0ed9c..bf1b921f4183f 100644\n--- a/drivers/gpu/drm/xe/xe_drm_ras.c\n+++ b/drivers/gpu/drm/xe/xe_drm_ras.c\n@@ -185,6 +185,37 @@ static int register_nodes(struct xe_device *xe)\n \treturn ret;\n }\n \n+/**\n+ * xe_drm_ras_event() - Report drm-ras error event to userspace\n+ * @xe: xe device structure\n+ * @component: error component (see \u0026enum drm_xe_ras_error_component)\n+ * @severity: error severity (see \u0026enum drm_xe_ras_error_severity)\n+ * @value: value of error counter\n+ *\n+ * Report an error-event to userspace.\n+ */\n+void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value)\n+{\n+\tstruct xe_drm_ras *ras = \u0026xe-\u003eras;\n+\tstruct xe_drm_ras_counter *info = ras-\u003einfo[severity];\n+\tstruct drm_ras_node *node;\n+\tint ret;\n+\n+\t/* Event is supported only if drm-ras is enabled */\n+\tif (!xe-\u003einfo.has_drm_ras)\n+\t\treturn;\n+\n+\tnode = \u0026ras-\u003enode[severity];\n+\n+\tif (!info || !info[component].name)\n+\t\treturn;\n+\n+\tret = drm_ras_nl_error_event(node, component, info[component].name, value);\n+\tif (ret)\n+\t\tdrm_err_ratelimited(\u0026xe-\u003edrm, \"drm-ras error-event failed: %d for %s %s\\n\", ret,\n+\t\t\t\t info[component].name, error_severity[severity]);\n+}\n+\n /**\n * xe_drm_ras_init() - Initialize DRM RAS\n * @xe: xe device instance\ndiff --git a/drivers/gpu/drm/xe/xe_drm_ras.h b/drivers/gpu/drm/xe/xe_drm_ras.h\nindex 365c70e93e82f..723229b2cffb6 100644\n--- a/drivers/gpu/drm/xe/xe_drm_ras.h\n+++ b/drivers/gpu/drm/xe/xe_drm_ras.h\n@@ -5,11 +5,14 @@\n #ifndef _XE_DRM_RAS_H_\n #define _XE_DRM_RAS_H_\n \n+#include \u003clinux/types.h\u003e\n+\n struct xe_device;\n \n #define for_each_error_severity(i)\t\\\n \tfor (i = 0; i \u003c DRM_XE_RAS_ERR_SEV_MAX; i++)\n \n int xe_drm_ras_init(struct xe_device *xe);\n+void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value);\n \n #endif\ndiff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c\nindex 352f056fd9ef4..48532447e1d8c 100644\n--- a/drivers/gpu/drm/xe/xe_ras.c\n+++ b/drivers/gpu/drm/xe/xe_ras.c\n@@ -90,6 +90,8 @@ static const char * const gpu_health_states[] = {\n };\n static_assert(ARRAY_SIZE(gpu_health_states) == XE_RAS_HEALTH_MAX);\n \n+static int get_counter(struct xe_device *xe, struct xe_ras_error_class *counter, u32 *value);\n+\n static u8 drm_to_xe_ras_severity(u8 severity)\n {\n \tswitch (severity) {\n@@ -102,6 +104,18 @@ static u8 drm_to_xe_ras_severity(u8 severity)\n \t}\n }\n \n+static u8 xe_to_drm_ras_severity(u8 severity)\n+{\n+\tswitch (severity) {\n+\tcase XE_RAS_SEV_CORRECTABLE:\n+\t\treturn DRM_XE_RAS_ERR_SEV_CORRECTABLE;\n+\tcase XE_RAS_SEV_UNCORRECTABLE:\n+\t\treturn DRM_XE_RAS_ERR_SEV_UNCORRECTABLE;\n+\tdefault:\n+\t\treturn DRM_XE_RAS_ERR_SEV_MAX;\n+\t}\n+}\n+\n static u8 drm_to_xe_ras_component(u8 component)\n {\n \tswitch (component) {\n@@ -120,6 +134,24 @@ static u8 drm_to_xe_ras_component(u8 component)\n \t}\n }\n \n+static u8 xe_to_drm_ras_component(u8 component)\n+{\n+\tswitch (component) {\n+\tcase XE_RAS_COMP_DEVICE_MEMORY:\n+\t\treturn DRM_XE_RAS_ERR_COMP_DEVICE_MEMORY;\n+\tcase XE_RAS_COMP_CORE_COMPUTE:\n+\t\treturn DRM_XE_RAS_ERR_COMP_CORE_COMPUTE;\n+\tcase XE_RAS_COMP_PCIE:\n+\t\treturn DRM_XE_RAS_ERR_COMP_PCIE;\n+\tcase XE_RAS_COMP_FABRIC:\n+\t\treturn DRM_XE_RAS_ERR_COMP_FABRIC;\n+\tcase XE_RAS_COMP_SOC_INTERNAL:\n+\t\treturn DRM_XE_RAS_ERR_COMP_SOC_INTERNAL;\n+\tdefault:\n+\t\treturn DRM_XE_RAS_ERR_COMP_MAX;\n+\t}\n+}\n+\n static int ras_status_to_errno(u32 status)\n {\n \tswitch (status) {\n@@ -236,6 +268,26 @@ static void ras_usp_aer_init(struct xe_device *xe)\n \tdev_dbg(\u0026usp-\u003edev, \"Uncorrectable Internal Errors downgraded and unmasked\\n\");\n }\n \n+static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)\n+{\n+\tstruct xe_ras_error_class counter = {0};\n+\tu8 drm_severity, drm_component;\n+\tu32 value;\n+\tint ret;\n+\n+\tcounter.common.severity = severity;\n+\tcounter.common.component = component;\n+\n+\tret = get_counter(xe, \u0026counter, \u0026value);\n+\tif (ret)\n+\t\treturn;\n+\n+\tdrm_severity = xe_to_drm_ras_severity(severity);\n+\tdrm_component = xe_to_drm_ras_component(component);\n+\n+\txe_drm_ras_event(xe, drm_component, drm_severity, value);\n+}\n+\n static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)\n {\n \tstruct xe_ras_compute_error *error_info = (void *)arr-\u003edetails;\n@@ -330,8 +382,10 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,\n \tstruct xe_ras_threshold_crossed *pending = (void *)\u0026response-\u003edata;\n \tstruct xe_ras_error_class *errors = pending-\u003ecounters;\n \tu32 id, ncounters = pending-\u003encounters;\n+\tu8 sent = 0;\n \n \tBUILD_BUG_ON(sizeof(response-\u003edata) \u003c sizeof(*pending));\n+\tBUILD_BUG_ON(BITS_PER_TYPE(sent) \u003c XE_RAS_COMP_MAX);\n \txe_device_assert_mem_access(xe);\n \n \tif (!ncounters || ncounters \u003e XE_RAS_NUM_COUNTERS)\n@@ -350,6 +404,13 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,\n \n \t\txe_warn(xe, \"[RAS]: %s %s detected\\n\",\n \t\t\tcomp_to_str(component), sev_to_str(severity));\n+\n+\t\t/* Send event once per component */\n+\t\tif (sent \u0026 BIT(component))\n+\t\t\tcontinue;\n+\t\tsent |= BIT(component);\n+\n+\t\tras_send_error_event(xe, severity, component);\n \t}\n }\n \n@@ -406,12 +467,14 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)\n \tenum xe_ras_recovery_action final_action;\n \tu32 remaining = XE_SYSCTRL_FLOOD_LIMIT;\n \tstruct xe_ras_get_soc_error response;\n+\tu8 sent = 0;\n \tsize_t rlen;\n \tint ret;\n \n \tif (!xe-\u003einfo.has_sysctrl)\n \t\treturn XE_RAS_RECOVERY_ACTION_RESET;\n \n+\tBUILD_BUG_ON(BITS_PER_TYPE(sent) \u003c XE_RAS_COMP_MAX);\n \t/* Default action */\n \tfinal_action = XE_RAS_RECOVERY_ACTION_RECOVERED;\n \n@@ -452,6 +515,12 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)\n \t\t\txe_info(xe, \"[RAS]: %s %s detected\\n\", comp_to_str(component),\n \t\t\t\tsev_to_str(severity));\n \n+\t\t\t/* Send event once per component */\n+\t\t\tif (!(sent \u0026 BIT(component))) {\n+\t\t\t\tsent |= BIT(component);\n+\t\t\t\tras_send_error_event(xe, severity, component);\n+\t\t\t}\n+\n \t\t\tswitch (component) {\n \t\t\tcase XE_RAS_COMP_CORE_COMPUTE:\n \t\t\t\taction = handle_core_compute_errors(arr);\ndiff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h\nindex 0beede3ddc4e4..ee2caa0edc6f9 100644\n--- a/include/drm/drm_ras.h\n+++ b/include/drm/drm_ras.h\n@@ -80,9 +80,14 @@ struct drm_device;\n #if IS_ENABLED(CONFIG_DRM_RAS)\n int drm_ras_node_register(struct drm_ras_node *node);\n void drm_ras_node_unregister(struct drm_ras_node *node);\n+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,\n+\t\t\t u32 value);\n #else\n static inline int drm_ras_node_register(struct drm_ras_node *node) { return 0; }\n static inline void drm_ras_node_unregister(struct drm_ras_node *node) { }\n+static inline int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id,\n+\t\t\t\t\t const char *error_name, u32 value)\n+{ return 0; }\n #endif\n \n #endif\ndiff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h\nindex 218a3ee868052..eab8231aa87cb 100644\n--- a/include/uapi/drm/drm_ras.h\n+++ b/include/uapi/drm/drm_ras.h\n@@ -38,13 +38,28 @@ enum {\n \tDRM_RAS_A_ERROR_COUNTER_ATTRS_MAX = (__DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX - 1)\n };\n \n+enum {\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME = 1,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE,\n+\n+\t__DRM_RAS_A_ERROR_EVENT_ATTRS_MAX,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_MAX = (__DRM_RAS_A_ERROR_EVENT_ATTRS_MAX - 1)\n+};\n+\n enum {\n \tDRM_RAS_CMD_LIST_NODES = 1,\n \tDRM_RAS_CMD_GET_ERROR_COUNTER,\n \tDRM_RAS_CMD_CLEAR_ERROR_COUNTER,\n+\tDRM_RAS_CMD_ERROR_EVENT,\n \n \t__DRM_RAS_CMD_MAX,\n \tDRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)\n };\n \n+#define DRM_RAS_MCGRP_ERROR_REPORT\t\"error-report\"\n+\n #endif /* _UAPI_LINUX_DRM_RAS_H */\n"
} |
| 2/1 | 2026/08/10 11:52 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch adds a Netlink multicast event for DRM RAS and implements it in the Intel Xe GPU driver. The new code is only reachable via the `xe` driver, which requires physical PCIe hardware not emulated in standard QEMU. Therefore, it cannot be fuzzed in a virtualized environment.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 3c656258fc9703edff240bf0732866ae2dac6d98
Author: syz-cluster <triage@syzkaller.com>
Date: Mon Aug 10 11:52:57 2026 +0000
syz-cluster: applied patch under review
diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst
index 83c21853b74b6..406e4c49bac1f 100644
--- a/Documentation/gpu/drm-ras.rst
+++ b/Documentation/gpu/drm-ras.rst
@@ -56,6 +56,7 @@ User space tools can:
``node-id`` and ``error-id`` as parameters.
* Clear specific error counters with the ``clear-error-counter`` command, using both
``node-id`` and ``error-id`` as parameters.
+* Subscribe to the ``error-report`` multicast group to receive ``error-event``.
YAML-based Interface
--------------------
@@ -111,3 +112,23 @@ Example: Clear an error counter for a given node
sudo ynl --family drm_ras --do clear-error-counter --json '{"node-id":0, "error-id":1}'
None
+
+Example: Subscribe to ``error-report`` multicast group
+
+.. code-block:: bash
+
+ sudo ynl --family drm_ras --output-json --subscribe error-report
+
+.. code-block:: json
+
+ {
+ "name": "error-event",
+ "msg": {
+ "device-name": "0000:03:00.0",
+ "node-id": 1,
+ "node-name": "uncorrectable-errors",
+ "error-id": 1,
+ "error-name": "error_name1",
+ "error-value": 1
+ }
+ }
diff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml
index e113056f8c016..8aed3d4515e5a 100644
--- a/Documentation/netlink/specs/drm_ras.yaml
+++ b/Documentation/netlink/specs/drm_ras.yaml
@@ -69,6 +69,33 @@ attribute-sets:
name: error-value
type: u32
doc: Current value of the requested error counter.
+ -
+ name: error-event-attrs
+ attributes:
+ -
+ name: device-name
+ type: string
+ doc: Device (PCI BDF, UUID) that reported the error.
+ -
+ name: node-id
+ type: u32
+ doc: ID of the node that reported the error.
+ -
+ name: node-name
+ type: string
+ doc: Name of the node that reported the error.
+ -
+ name: error-id
+ type: u32
+ doc: ID of the error counter.
+ -
+ name: error-name
+ type: string
+ doc: Name of the error.
+ -
+ name: error-value
+ type: u32
+ doc: Current value of the error counter.
operations:
list:
@@ -124,3 +151,24 @@ operations:
do:
request:
attributes: *id-attrs
+ -
+ name: error-event
+ doc: >-
+ Report an error event to userspace.
+ The event includes the device, node and error information
+ of the error that triggered the event.
+ attribute-set: error-event-attrs
+ mcgrp: error-report
+ event:
+ attributes:
+ - device-name
+ - node-id
+ - node-name
+ - error-id
+ - error-name
+ - error-value
+
+mcast-groups:
+ list:
+ -
+ name: error-report
diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
index d6eab29a1394c..39155fb514de3 100644
--- a/drivers/gpu/drm/drm_ras.c
+++ b/drivers/gpu/drm/drm_ras.c
@@ -41,6 +41,11 @@
* Userspace must provide Node ID, Error ID.
* Clears specific error counter of a node if supported.
*
+ * 4. ERROR_REPORT: Subscribe to this multicast group to receive error events
+ *
+ * 5. ERROR_EVENT: Report an error event to userspace. The event contains device, node
+ * and error information that triggered the event.
+ *
* Node registration:
*
* - drm_ras_node_register(): Registers a new node and assigns
@@ -186,6 +191,34 @@ static int msg_reply_value(struct sk_buff *msg, u32 error_id,
value);
}
+static int msg_put_error_event_attrs(struct sk_buff *msg, struct drm_ras_node *node,
+ u32 error_id, const char *error_name, u32 value)
+{
+ int ret;
+
+ ret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME, node->device_name);
+ if (ret)
+ return ret;
+
+ ret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID, node->id);
+ if (ret)
+ return ret;
+
+ ret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME, node->node_name);
+ if (ret)
+ return ret;
+
+ ret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID, error_id);
+ if (ret)
+ return ret;
+
+ ret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME, error_name);
+ if (ret)
+ return ret;
+
+ return nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE, value);
+}
+
static int doit_reply_value(struct genl_info *info, u32 node_id,
u32 error_id)
{
@@ -222,6 +255,74 @@ static int doit_reply_value(struct genl_info *info, u32 node_id,
return genlmsg_reply(msg, info);
}
+/**
+ * drm_ras_nl_error_event() - Report an error event
+ * @node: Node structure
+ * @error_id: ID of the error
+ * @error_name: Name of the error
+ * @value: Value of the error counter
+ *
+ * Report an error-event to userspace using the error-report multicast group.
+ *
+ * Context: Process context only. Uses %GFP_KERNEL and multicasts to all
+ * netns, which is unbounded work; callers in interrupt handlers
+ * or other atomic context must defer event.
+ *
+ * Return: 0 on success, or negative errno on failure.
+ */
+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,
+ u32 value)
+{
+ struct genl_info info;
+ struct sk_buff *msg;
+ struct nlattr *hdr;
+ int ret;
+
+ if (!node || !error_name)
+ return -EINVAL;
+
+ /* Check the node is currently registered */
+ if (xa_load(&drm_ras_xa, node->id) != node)
+ return -ENOENT;
+
+ /* Currently only Error Counter events are supported */
+ if (node->type != DRM_RAS_NODE_TYPE_ERROR_COUNTER)
+ return -EOPNOTSUPP;
+
+ /* Check the error ID is within the valid range */
+ if (error_id < node->error_counter_range.first ||
+ error_id > node->error_counter_range.last)
+ return -EINVAL;
+
+ genl_info_init_ntf(&info, &drm_ras_nl_family, DRM_RAS_CMD_ERROR_EVENT);
+
+ msg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+ if (!msg)
+ return -ENOMEM;
+
+ hdr = genlmsg_iput(msg, &info);
+ if (!hdr) {
+ ret = -EMSGSIZE;
+ goto free_msg;
+ }
+
+ ret = msg_put_error_event_attrs(msg, node, error_id, error_name, value);
+ if (ret)
+ goto cancel_msg;
+
+ genlmsg_end(msg, hdr);
+ genlmsg_multicast_allns(&drm_ras_nl_family, msg, 0, DRM_RAS_NLGRP_ERROR_REPORT);
+
+ return 0;
+
+cancel_msg:
+ genlmsg_cancel(msg, hdr);
+free_msg:
+ nlmsg_free(msg);
+ return ret;
+}
+EXPORT_SYMBOL(drm_ras_nl_error_event);
+
/**
* drm_ras_nl_get_error_counter_dumpit() - Dump all Error Counters
* @skb: Netlink message buffer
diff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c
index dea1c1b2494e8..9d3123cc9f9ca 100644
--- a/drivers/gpu/drm/drm_ras_nl.c
+++ b/drivers/gpu/drm/drm_ras_nl.c
@@ -58,6 +58,10 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {
},
};
+static const struct genl_multicast_group drm_ras_nl_mcgrps[] = {
+ [DRM_RAS_NLGRP_ERROR_REPORT] = { "error-report", },
+};
+
struct genl_family drm_ras_nl_family __ro_after_init = {
.name = DRM_RAS_FAMILY_NAME,
.version = DRM_RAS_FAMILY_VERSION,
@@ -66,4 +70,6 @@ struct genl_family drm_ras_nl_family __ro_after_init = {
.module = THIS_MODULE,
.split_ops = drm_ras_nl_ops,
.n_split_ops = ARRAY_SIZE(drm_ras_nl_ops),
+ .mcgrps = drm_ras_nl_mcgrps,
+ .n_mcgrps = ARRAY_SIZE(drm_ras_nl_mcgrps),
};
diff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h
index a398643572a5a..03ec275aca929 100644
--- a/drivers/gpu/drm/drm_ras_nl.h
+++ b/drivers/gpu/drm/drm_ras_nl.h
@@ -21,6 +21,10 @@ int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
struct genl_info *info);
+enum {
+ DRM_RAS_NLGRP_ERROR_REPORT,
+};
+
extern struct genl_family drm_ras_nl_family;
#endif /* _LINUX_DRM_RAS_GEN_H */
diff --git a/drivers/gpu/drm/xe/xe_drm_ras.c b/drivers/gpu/drm/xe/xe_drm_ras.c
index 7937d8ba0ed9c..bf1b921f4183f 100644
--- a/drivers/gpu/drm/xe/xe_drm_ras.c
+++ b/drivers/gpu/drm/xe/xe_drm_ras.c
@@ -185,6 +185,37 @@ static int register_nodes(struct xe_device *xe)
return ret;
}
+/**
+ * xe_drm_ras_event() - Report drm-ras error event to userspace
+ * @xe: xe device structure
+ * @component: error component (see &enum drm_xe_ras_error_component)
+ * @severity: error severity (see &enum drm_xe_ras_error_severity)
+ * @value: value of error counter
+ *
+ * Report an error-event to userspace.
+ */
+void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value)
+{
+ struct xe_drm_ras *ras = &xe->ras;
+ struct xe_drm_ras_counter *info = ras->info[severity];
+ struct drm_ras_node *node;
+ int ret;
+
+ /* Event is supported only if drm-ras is enabled */
+ if (!xe->info.has_drm_ras)
+ return;
+
+ node = &ras->node[severity];
+
+ if (!info || !info[component].name)
+ return;
+
+ ret = drm_ras_nl_error_event(node, component, info[component].name, value);
+ if (ret)
+ drm_err_ratelimited(&xe->drm, "drm-ras error-event failed: %d for %s %s\n", ret,
+ info[component].name, error_severity[severity]);
+}
+
/**
* xe_drm_ras_init() - Initialize DRM RAS
* @xe: xe device instance
diff --git a/drivers/gpu/drm/xe/xe_drm_ras.h b/drivers/gpu/drm/xe/xe_drm_ras.h
index 365c70e93e82f..723229b2cffb6 100644
--- a/drivers/gpu/drm/xe/xe_drm_ras.h
+++ b/drivers/gpu/drm/xe/xe_drm_ras.h
@@ -5,11 +5,14 @@
#ifndef _XE_DRM_RAS_H_
#define _XE_DRM_RAS_H_
+#include <linux/types.h>
+
struct xe_device;
#define for_each_error_severity(i) \
for (i = 0; i < DRM_XE_RAS_ERR_SEV_MAX; i++)
int xe_drm_ras_init(struct xe_device *xe);
+void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value);
#endif
diff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c
index 352f056fd9ef4..48532447e1d8c 100644
--- a/drivers/gpu/drm/xe/xe_ras.c
+++ b/drivers/gpu/drm/xe/xe_ras.c
@@ -90,6 +90,8 @@ static const char * const gpu_health_states[] = {
};
static_assert(ARRAY_SIZE(gpu_health_states) == XE_RAS_HEALTH_MAX);
+static int get_counter(struct xe_device *xe, struct xe_ras_error_class *counter, u32 *value);
+
static u8 drm_to_xe_ras_severity(u8 severity)
{
switch (severity) {
@@ -102,6 +104,18 @@ static u8 drm_to_xe_ras_severity(u8 severity)
}
}
+static u8 xe_to_drm_ras_severity(u8 severity)
+{
+ switch (severity) {
+ case XE_RAS_SEV_CORRECTABLE:
+ return DRM_XE_RAS_ERR_SEV_CORRECTABLE;
+ case XE_RAS_SEV_UNCORRECTABLE:
+ return DRM_XE_RAS_ERR_SEV_UNCORRECTABLE;
+ default:
+ return DRM_XE_RAS_ERR_SEV_MAX;
+ }
+}
+
static u8 drm_to_xe_ras_component(u8 component)
{
switch (component) {
@@ -120,6 +134,24 @@ static u8 drm_to_xe_ras_component(u8 component)
}
}
+static u8 xe_to_drm_ras_component(u8 component)
+{
+ switch (component) {
+ case XE_RAS_COMP_DEVICE_MEMORY:
+ return DRM_XE_RAS_ERR_COMP_DEVICE_MEMORY;
+ case XE_RAS_COMP_CORE_COMPUTE:
+ return DRM_XE_RAS_ERR_COMP_CORE_COMPUTE;
+ case XE_RAS_COMP_PCIE:
+ return DRM_XE_RAS_ERR_COMP_PCIE;
+ case XE_RAS_COMP_FABRIC:
+ return DRM_XE_RAS_ERR_COMP_FABRIC;
+ case XE_RAS_COMP_SOC_INTERNAL:
+ return DRM_XE_RAS_ERR_COMP_SOC_INTERNAL;
+ default:
+ return DRM_XE_RAS_ERR_COMP_MAX;
+ }
+}
+
static int ras_status_to_errno(u32 status)
{
switch (status) {
@@ -236,6 +268,26 @@ static void ras_usp_aer_init(struct xe_device *xe)
dev_dbg(&usp->dev, "Uncorrectable Internal Errors downgraded and unmasked\n");
}
+static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)
+{
+ struct xe_ras_error_class counter = {0};
+ u8 drm_severity, drm_component;
+ u32 value;
+ int ret;
+
+ counter.common.severity = severity;
+ counter.common.component = component;
+
+ ret = get_counter(xe, &counter, &value);
+ if (ret)
+ return;
+
+ drm_severity = xe_to_drm_ras_severity(severity);
+ drm_component = xe_to_drm_ras_component(component);
+
+ xe_drm_ras_event(xe, drm_component, drm_severity, value);
+}
+
static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)
{
struct xe_ras_compute_error *error_info = (void *)arr->details;
@@ -330,8 +382,10 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
struct xe_ras_threshold_crossed *pending = (void *)&response->data;
struct xe_ras_error_class *errors = pending->counters;
u32 id, ncounters = pending->ncounters;
+ u8 sent = 0;
BUILD_BUG_ON(sizeof(response->data) < sizeof(*pending));
+ BUILD_BUG_ON(BITS_PER_TYPE(sent) < XE_RAS_COMP_MAX);
xe_device_assert_mem_access(xe);
if (!ncounters || ncounters > XE_RAS_NUM_COUNTERS)
@@ -350,6 +404,13 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
xe_warn(xe, "[RAS]: %s %s detected\n",
comp_to_str(component), sev_to_str(severity));
+
+ /* Send event once per component */
+ if (sent & BIT(component))
+ continue;
+ sent |= BIT(component);
+
+ ras_send_error_event(xe, severity, component);
}
}
@@ -406,12 +467,14 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)
enum xe_ras_recovery_action final_action;
u32 remaining = XE_SYSCTRL_FLOOD_LIMIT;
struct xe_ras_get_soc_error response;
+ u8 sent = 0;
size_t rlen;
int ret;
if (!xe->info.has_sysctrl)
return XE_RAS_RECOVERY_ACTION_RESET;
+ BUILD_BUG_ON(BITS_PER_TYPE(sent) < XE_RAS_COMP_MAX);
/* Default action */
final_action = XE_RAS_RECOVERY_ACTION_RECOVERED;
@@ -452,6 +515,12 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)
xe_info(xe, "[RAS]: %s %s detected\n", comp_to_str(component),
sev_to_str(severity));
+ /* Send event once per component */
+ if (!(sent & BIT(component))) {
+ sent |= BIT(component);
+ ras_send_error_event(xe, severity, component);
+ }
+
switch (component) {
case XE_RAS_COMP_CORE_COMPUTE:
action = handle_core_compute_errors(arr);
diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
index 0beede3ddc4e4..ee2caa0edc6f9 100644
--- a/include/drm/drm_ras.h
+++ b/include/drm/drm_ras.h
@@ -80,9 +80,14 @@ struct drm_device;
#if IS_ENABLED(CONFIG_DRM_RAS)
int drm_ras_node_register(struct drm_ras_node *node);
void drm_ras_node_unregister(struct drm_ras_node *node);
+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,
+ u32 value);
#else
static inline int drm_ras_node_register(struct drm_ras_node *node) { return 0; }
static inline void drm_ras_node_unregister(struct drm_ras_node *node) { }
+static inline int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id,
+ const char *error_name, u32 value)
+{ return 0; }
#endif
#endif
diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
index 218a3ee868052..eab8231aa87cb 100644
--- a/include/uapi/drm/drm_ras.h
+++ b/include/uapi/drm/drm_ras.h
@@ -38,13 +38,28 @@ enum {
DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX = (__DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX - 1)
};
+enum {
+ DRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME = 1,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE,
+
+ __DRM_RAS_A_ERROR_EVENT_ATTRS_MAX,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_MAX = (__DRM_RAS_A_ERROR_EVENT_ATTRS_MAX - 1)
+};
+
enum {
DRM_RAS_CMD_LIST_NODES = 1,
DRM_RAS_CMD_GET_ERROR_COUNTER,
DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
+ DRM_RAS_CMD_ERROR_EVENT,
__DRM_RAS_CMD_MAX,
DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
};
+#define DRM_RAS_MCGRP_ERROR_REPORT "error-report"
+
#endif /* _UAPI_LINUX_DRM_RAS_H */
|
| 3/2 | 2026/08/10 11:52 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8157 output: 23 thoughts: 691 Thoughts: **Analyzing the DRM RAS Netlink Event Patch** Okay, so I'm looking at this patch and it seems to introduce a Netlink multicast event specifically for DRM RAS (Reliability, Availability, Serviceability). The changes are spread across quite a few files: documentation, the core DRM RAS code, and, notably, within the Intel Xe graphics driver (`xe`). The core of the functionality appears to be the addition of `drm_ras_nl_error_event()` which sends the Netlink multicast message. This is triggered by `xe_drm_ras_event()` which calls `ras_send_error_event()` in `xe_ras.c`. A key question pops up immediately – is the Intel Xe driver a vendor-specific GPU driver? Yes, it is, given its location in `drivers/gpu/drm/xe`. And, I need to check the criteria... Ah, the prompt says to return WorthFuzzing=false if the changes are limited to vendor-specific drivers that need physical PCIe hardware, which isn't emulated in standard QEMU. That's a red flag for Fuzzing. My initial thought is that the *entire* patch might fall into this category because the Xe driver is invoking the Netlink event. However, I have to ensure that all parts are considered. Let's see... Is `drm_ras_nl_error_event` callable from other locations? That's the critical question here. Okay, checking the code, it looks like `drm_ras_nl_error_event` is exported with `EXPORT_SYMBOL()`. So, other modules *could* call it, which is the concern. However, currently it's only called from the `xe_drm_ras_event` function within the Xe driver. Now, the main question is: can userspace directly trigger this event? Looking at the Netlink spec, the `error-event` is defined as an event, not a command. There are `event:` entries, but no `do:` or `dump:` entries. This means it is a kernel-to-userspace notification. Userspace would *subscribe* to the multicast group and receive the event, but it can't directly *cause* the event. It can *only* be triggered by the kernel. This is important to determine if this can be exploited. So, userspace can *receive* the event, but it cannot send it. The only direct caller of the function is indeed `xe_drm_ras_event`. Ok, to be *absolutely* certain, let's verify there are *no* other callers of `drm_ras_nl_error_event` that could potentially be triggered by some other means. |
| 4/2 | 2026/08/10 11:53 | tool | grepper |
0mArgs:{
"Expression": "drm_ras_nl_error_event"
}Results: {
"Output": "drivers/gpu/drm/drm_ras.c=222=static int doit_reply_value(struct genl_info *info, u32 node_id,\n--\ndrivers/gpu/drm/drm_ras.c-258-/**\ndrivers/gpu/drm/drm_ras.c:259: * drm_ras_nl_error_event() - Report an error event\ndrivers/gpu/drm/drm_ras.c-260- * @node: Node structure\n--\ndrivers/gpu/drm/drm_ras.c-272- */\ndrivers/gpu/drm/drm_ras.c:273:int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,\ndrivers/gpu/drm/drm_ras.c-274-\t\t\t u32 value)\n--\ndrivers/gpu/drm/drm_ras.c-323-}\ndrivers/gpu/drm/drm_ras.c:324:EXPORT_SYMBOL(drm_ras_nl_error_event);\ndrivers/gpu/drm/drm_ras.c-325-\n--\ndrivers/gpu/drm/xe/xe_drm_ras.c=197=void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value)\n--\ndrivers/gpu/drm/xe/xe_drm_ras.c-212-\ndrivers/gpu/drm/xe/xe_drm_ras.c:213:\tret = drm_ras_nl_error_event(node, component, info[component].name, value);\ndrivers/gpu/drm/xe/xe_drm_ras.c-214-\tif (ret)\n--\ninclude/drm/drm_ras.h=82=void drm_ras_node_unregister(struct drm_ras_node *node);\ninclude/drm/drm_ras.h:83:int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,\ninclude/drm/drm_ras.h-84-\t\t\t u32 value);\n--\ninclude/drm/drm_ras.h=87=static inline void drm_ras_node_unregister(struct drm_ras_node *node) { }\ninclude/drm/drm_ras.h:88:static inline int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id,\ninclude/drm/drm_ras.h-89-\t\t\t\t\t const char *error_name, u32 value)\n"
} |
| 5/2 | 2026/08/10 11:53 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10095 output: 21 thoughts: 235 Thoughts: **WorthFuzzing Decision: Xe Driver Code** Okay, so I'm looking at this patch and trying to figure out if it's worth fuzzing. The key function here is `xe_drm_ras_event`, and I've traced it down – it's the *only* caller of this function. Now, my understanding is that the `xe` driver is Intel's Xe GPU driver, and a vendor-specific one at that. The prompt specifically flags these drivers as problematic for fuzzing: they need physical PCIe hardware to function correctly and are not going to run within a QEMU environment. This is a common issue with these types of drivers. Since `xe_drm_ras_event` is *only* called by the `xe` driver, and the `xe` driver needs physical hardware, it's clear: there's no way this new code can be reached in a standard, virtualized QEMU setup. I've double-checked my assumptions, there's no other path to `drm_ras_nl_error_event`. The fact that it's only called within the `xe` driver reinforces my conclusion. This code path is unreachable for fuzzing purposes. Therefore, based on the prompt's criteria, this code is not worth fuzzing. |
| 6/2 | 2026/08/10 11:53 | tool | grepper |
0mArgs:{
"Expression": "xe_drm_ras_event"
}Results: {
"Output": "drivers/gpu/drm/xe/xe_drm_ras.c=157=static int register_nodes(struct xe_device *xe)\n--\ndrivers/gpu/drm/xe/xe_drm_ras.c-188-/**\ndrivers/gpu/drm/xe/xe_drm_ras.c:189: * xe_drm_ras_event() - Report drm-ras error event to userspace\ndrivers/gpu/drm/xe/xe_drm_ras.c-190- * @xe: xe device structure\n--\ndrivers/gpu/drm/xe/xe_drm_ras.c-196- */\ndrivers/gpu/drm/xe/xe_drm_ras.c:197:void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value)\ndrivers/gpu/drm/xe/xe_drm_ras.c-198-{\n--\ndrivers/gpu/drm/xe/xe_drm_ras.h=15=int xe_drm_ras_init(struct xe_device *xe);\ndrivers/gpu/drm/xe/xe_drm_ras.h:16:void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value);\ndrivers/gpu/drm/xe/xe_drm_ras.h-17-\n--\ndrivers/gpu/drm/xe/xe_ras.c=271=static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)\n--\ndrivers/gpu/drm/xe/xe_ras.c-287-\ndrivers/gpu/drm/xe/xe_ras.c:288:\txe_drm_ras_event(xe, drm_component, drm_severity, value);\ndrivers/gpu/drm/xe/xe_ras.c-289-}\n"
} |
| 7/2 | 2026/08/10 11:53 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11096 output: 93 thoughts: 106 Thoughts: **My Assessment: This Code is Unsuitable for Fuzzing** Alright, let's break this down. Yep, the critical code change is exclusively within `xe_ras.c`. Given that this specifically targets a vendor-specific GPU driver – in this case, Intel's Xe – it immediately triggers my exclusion criteria. I need to make a judgment call: is this something I can effectively fuzz? My reasoning is straightforward: The patch introduces a Netlink multicast event related to DRM RAS, and the implementation is entirely contained within the Intel Xe GPU driver. The kicker is that this new functionality is *only* accessible through the `xe` driver. Now, I know the limitations of my current setup. The xe driver requires actual, physical PCIe hardware, something not emulated in standard QEMU environments. Since I'm working within a virtualized setting, I can't effectively reach and exercise this new code. Consequently, I will confidently set WorthFuzzing to false. It's simply not feasible to test this code thoroughly with my current resources. |
| 8/2 | 2026/08/10 11:53 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch adds a Netlink multicast event for DRM RAS and implements it in the Intel Xe GPU driver. The new code is only reachable via the `xe` driver, which requires physical PCIe hardware not emulated in standard QEMU. Therefore, it cannot be fuzzed in a virtualized environment.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch adds a Netlink multicast event for DRM RAS and implements it in the Intel Xe GPU driver. The new code is only reachable via the `xe` driver, which requires physical PCIe hardware not emulated in standard QEMU. Therefore, it cannot be fuzzed in a virtualized environment.",
"WorthFuzzing": false
} |
| 9/1 | 2026/08/10 11:53 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|