AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/10/09 21:51	flow	patch-triage	0m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.", "WorthFuzzing": false }
1/1	2026/10/09 21:51	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 0594d4fd21630d3da95b5622b872d3c05cfb9a30\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Oct 9 21:51:29 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c\nindex abebdb1fc2628..fc90ee6663c36 100644\n--- a/drivers/net/ethernet/ibm/ibmveth.c\n+++ b/drivers/net/ethernet/ibm/ibmveth.c\n@@ -135,6 +135,13 @@ static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter adapter)\n \treturn be32_to_cpu(adapter-\u003erx_queue.queue_addr[adapter-\u003erx_queue.index].length);\n }\n \n+static u64 ibmveth_rxq_correlator(struct ibmveth_adapter adapter)\n+{\n+\tunsigned int idx = adapter-\u003erx_queue.index;\n+\n+\treturn READ_ONCE(adapter-\u003erx_queue.queue_addr[idx].correlator);\n+}\n+\n static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter adapter)\n {\n \treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_CSUM_GOOD;\n@@ -443,6 +450,37 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter adapter,\n \t}\n }\n \n+/* The correlator comes back from PHYP; a bad one schedules a reset. /\n+static bool ibmveth_rxq_correlator_valid(struct ibmveth_adapter adapter,\n+\t\t\t\t\t u64 correlator)\n+{\n+\tunsigned int index = correlator \u0026 0xffffffffUL;\n+\tunsigned int pool = correlator \u003e\u003e 32;\n+\n+\t/* An inactive pool keeps its size but has no skbuff array. /\n+\tif (pool \u003c IBMVETH_NUM_BUFF_POOLS \u0026\u0026\n+\t index \u003c adapter-\u003erx_buff_pool[pool].size \u0026\u0026\n+\t adapter-\u003erx_buff_pool[pool].skbuff)\n+\t\treturn true;\n+\n+\tif (net_ratelimit())\n+\t\tnetdev_err(adapter-\u003enetdev,\n+\t\t\t \"invalid RX correlator %llx, resetting\\n\",\n+\t\t\t correlator);\n+\tschedule_work(\u0026adapter-\u003ework);\n+\treturn false;\n+}\n+\n+static void ibmveth_rxq_no_skb(struct ibmveth_adapter adapter,\n+\t\t\t u64 correlator)\n+{\n+\tif (net_ratelimit())\n+\t\tnetdev_err(adapter-\u003enetdev,\n+\t\t\t \"no buffer for RX correlator %llx, resetting\\n\",\n+\t\t\t correlator);\n+\tschedule_work(\u0026adapter-\u003ework);\n+}\n+\n /*\n ibmveth_remove_buffer_from_pool - remove a buffer from a pool\n * @adapter: adapter instance\n@@ -451,7 +489,8 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter adapter,\n \n * Return:\n * * %0 - success\n- * * %-EINVAL - correlator maps to pool or index out of range\n+ * * %-EINVAL - correlator maps to pool or index out of range, or to an\n+ * inactive pool\n * * %-EFAULT - pool and index map to null skb\n /\n static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter adapter,\n@@ -462,15 +501,12 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter adapter,\n \tunsigned int free_index;\n \tstruct sk_buff skb;\n \n-\tif (WARN_ON(pool \u003e= IBMVETH_NUM_BUFF_POOLS) \|\|\n-\t WARN_ON(index \u003e= adapter-\u003erx_buff_pool[pool].size)) {\n-\t\tschedule_work(\u0026adapter-\u003ework);\n+\tif (!ibmveth_rxq_correlator_valid(adapter, correlator))\n \t\treturn -EINVAL;\n-\t}\n \n \tskb = adapter-\u003erx_buff_pool[pool].skbuff[index];\n-\tif (WARN_ON(!skb)) {\n-\t\tschedule_work(\u0026adapter-\u003ework);\n+\tif (!skb) {\n+\t\tibmveth_rxq_no_skb(adapter, correlator);\n \t\treturn -EFAULT;\n \t}\n \n@@ -504,20 +540,29 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter adapter,\n \treturn 0;\n }\n \n-/ get the current buffer on the rx queue /\n-static inline struct sk_buff ibmveth_rxq_get_buffer(struct ibmveth_adapter adapter)\n+/ get the buffer for @correlator, read once from the current rx queue entry /\n+static struct sk_buff ibmveth_rxq_get_buffer(struct ibmveth_adapter adapter,\n+\t\t\t\t\t u64 correlator)\n {\n-\tu64 correlator = adapter-\u003erx_queue.queue_addr[adapter-\u003erx_queue.index].correlator;\n \tunsigned int pool = correlator \u003e\u003e 32;\n \tunsigned int index = correlator \u0026 0xffffffffUL;\n+\tstruct sk_buff skb;\n \n-\tif (WARN_ON(pool \u003e= IBMVETH_NUM_BUFF_POOLS) \|\|\n-\t WARN_ON(index \u003e= adapter-\u003erx_buff_pool[pool].size)) {\n-\t\tschedule_work(\u0026adapter-\u003ework);\n+\tif (!ibmveth_rxq_correlator_valid(adapter, correlator))\n \t\treturn NULL;\n-\t}\n \n-\treturn adapter-\u003erx_buff_pool[pool].skbuff[index];\n+\tskb = adapter-\u003erx_buff_pool[pool].skbuff[index];\n+\tif (!skb)\n+\t\tibmveth_rxq_no_skb(adapter, correlator);\n+\treturn skb;\n+}\n+\n+static void ibmveth_rxq_advance(struct ibmveth_adapter adapter)\n+{\n+\tif (++adapter-\u003erx_queue.index == adapter-\u003erx_queue.num_slots) {\n+\t\tadapter-\u003erx_queue.index = 0;\n+\t\tadapter-\u003erx_queue.toggle = !adapter-\u003erx_queue.toggle;\n+\t}\n }\n \n /\n@@ -528,6 +573,9 @@ static inline struct sk_buff ibmveth_rxq_get_buffer(struct ibmveth_adapter ada\n \n * Context: called from ibmveth_poll\n \n+ The ring advances even on error, so poll does not return to a bad\n+ * slot before the scheduled reset can run.\n+ \n Return:\n * * %0 - success\n * * other - non-zero return from ibmveth_remove_buffer_from_pool\n@@ -540,15 +588,9 @@ static int ibmveth_rxq_harvest_buffer(struct ibmveth_adapter adapter,\n \n \tcor = adapter-\u003erx_queue.queue_addr[adapter-\u003erx_queue.index].correlator;\n \trc = ibmveth_remove_buffer_from_pool(adapter, cor, reuse);\n-\tif (unlikely(rc))\n-\t\treturn rc;\n-\n-\tif (++adapter-\u003erx_queue.index == adapter-\u003erx_queue.num_slots) {\n-\t\tadapter-\u003erx_queue.index = 0;\n-\t\tadapter-\u003erx_queue.toggle = !adapter-\u003erx_queue.toggle;\n-\t}\n+\tibmveth_rxq_advance(adapter);\n \n-\treturn 0;\n+\treturn rc;\n }\n \n static void ibmveth_free_tx_ltb(struct ibmveth_adapter adapter, int idx)\n@@ -628,8 +670,6 @@ static int ibmveth_open(struct net_device netdev)\n \n \tnetdev_dbg(netdev, \"open starting\\n\");\n \n-\tnapi_enable(\u0026adapter-\u003enapi);\n-\n \tfor(i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n \t\trxq_entries += adapter-\u003erx_buff_pool[i].size;\n \n@@ -717,10 +757,19 @@ static int ibmveth_open(struct net_device netdev)\n \t\t}\n \t}\n \n+\t/* NAPI can run as soon as it is enabled, from netpoll during the\n+\t * direct close()/open() pairs or from a direct ibmveth_interrupt()\n+\t * call, so enable it only once everything ibmveth_poll() touches\n+\t * exists.\n+\t /\n+\tnapi_enable(\u0026adapter-\u003enapi);\n+\n \tnetdev_dbg(netdev, \"registering irq 0x%x\\n\", netdev-\u003eirq);\n \trc = request_irq(netdev-\u003eirq, ibmveth_interrupt, 0, netdev-\u003ename,\n \t\t\t netdev);\n \tif (rc != 0) {\n+\t\tnapi_disable(\u0026adapter-\u003enapi);\n+\t\tsynchronize_net();\n \t\tnetdev_err(netdev, \"unable to request irq 0x%x, rc %d\\n\",\n \t\t\t netdev-\u003eirq, rc);\n \t\tgoto out_free_buffer_pools;\n@@ -733,6 +782,7 @@ static int ibmveth_open(struct net_device netdev)\n \n \tnetif_tx_start_all_queues(netdev);\n \n+\tadapter-\u003eopened = true;\n \tnetdev_dbg(netdev, \"open complete\\n\");\n \n \treturn 0;\n@@ -765,7 +815,6 @@ static int ibmveth_open(struct net_device netdev)\n out_free_buffer_list:\n \tfree_page((unsigned long)adapter-\u003ebuffer_list_addr);\n out:\n-\tnapi_disable(\u0026adapter-\u003enapi);\n \treturn rc;\n }\n \n@@ -776,11 +825,24 @@ static int ibmveth_close(struct net_device netdev)\n \tlong lpar_rc;\n \tint i;\n \n+\t/* change_mtu, pool sysfs, set_csum and set_tso call close() and\n+\t * open() directly. If that open() fails, IFF_UP stays set and\n+\t * NAPI is disabled; a second close() would hang in napi_disable().\n+\t /\n+\tif (!adapter-\u003eopened)\n+\t\treturn 0;\n+\tadapter-\u003eopened = false;\n+\n \tnetdev_dbg(netdev, \"close starting\\n\");\n \n \tnapi_disable(\u0026adapter-\u003enapi);\n+\t/ napi_disable() returns once ibmveth_poll() has called\n+\t * napi_complete_done(), but the poll still re-enables the\n+\t * interrupt and reads the RX queue after that.\n+\t /\n+\tsynchronize_net();\n \n-\tnetif_tx_stop_all_queues(netdev);\n+\tnetif_tx_disable(netdev);\n \n \th_vio_signal(adapter-\u003evdev-\u003eunit_address, VIO_IRQ_DISABLE);\n \n@@ -827,10 +889,10 @@ static int ibmveth_close(struct net_device netdev)\n \n @w: pointer to work_struct embedded in adapter structure\n \n- Context: This routine acquires rtnl_mutex and disables its NAPI through\n- * ibmveth_close. It can't be called directly in a context that has\n- * already acquired rtnl_mutex or disabled its NAPI, or directly from\n- * a poll routine.\n+ * Context: This routine acquires rtnl_mutex and, if the device is open,\n+ * disables its NAPI through ibmveth_close. It can't be called\n+ * directly in a context that has already acquired rtnl_mutex or\n+ * disabled its NAPI, or directly from a poll routine.\n \n Return: void\n /\n@@ -1122,12 +1184,13 @@ static int ibmveth_set_channels(struct net_device netdev,\n \tstruct ibmveth_adapter adapter = netdev_priv(netdev);\n \tunsigned int old = netdev-\u003ereal_num_tx_queues,\n \t\t goal = channels-\u003etx_count;\n-\tint rc, i;\n+\tint rc, i, alloc_rc = 0;\n \n-\t/ If ndo_open has not been called yet then don't allocate, just set\n-\t * desired netdev_queue's and return\n+\t/* If the device is not open (including a failed close/open with\n+\t * IFF_UP still set) then don't allocate, just set desired\n+\t * netdev_queue's and return\n \t /\n-\tif (!(netdev-\u003eflags \u0026 IFF_UP))\n+\tif (!adapter-\u003eopened)\n \t\treturn netif_set_real_num_tx_queues(netdev, goal);\n \n \t/ We have IBMVETH_MAX_QUEUES netdev_queue's allocated\n@@ -1147,6 +1210,7 @@ static int ibmveth_set_channels(struct net_device netdev,\n \t\t/ if something goes wrong, free everything we just allocated /\n \t\tnetdev_err(netdev, \"Failed to allocate more tx queues, returning to %d queues\\n\",\n \t\t\t old);\n+\t\talloc_rc = rc;\n \t\tgoal = old;\n \t\told = i;\n \t\tbreak;\n@@ -1157,6 +1221,8 @@ static int ibmveth_set_channels(struct net_device netdev,\n \t\t\t old);\n \t\tgoal = old;\n \t\told = i;\n+\t} else if (alloc_rc) {\n+\t\trc = alloc_rc;\n \t}\n \t/* Free any that are no longer needed /\n \tfor (i = old; i \u003e goal; i--) {\n@@ -1454,7 +1520,9 @@ static int ibmveth_poll(struct napi_struct napi, int budget)\n \tstruct net_device netdev = adapter-\u003enetdev;\n \tint frames_processed = 0;\n \tunsigned long lpar_rc;\n+\tint rescheduled = 0;\n \tu16 mss = 0;\n+\tint rc;\n \n restart_poll:\n \twhile (frames_processed \u003c budget) {\n@@ -1466,19 +1534,46 @@ static int ibmveth_poll(struct napi_struct napi, int budget)\n \t\t\twmb(); /* suggested by larson1 /\n \t\t\tadapter-\u003erx_invalid_buffer++;\n \t\t\tnetdev_dbg(netdev, \"recycling invalid buffer\\n\");\n-\t\t\tif (unlikely(ibmveth_rxq_harvest_buffer(adapter, true)))\n-\t\t\t\tbreak;\n+\t\t\trc = ibmveth_rxq_harvest_buffer(adapter, true);\n+\t\t\tif (unlikely(rc)) {\n+\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\tframes_processed++;\n+\t\t\t\tcontinue;\n+\t\t\t}\n \t\t} else {\n \t\t\tstruct sk_buff skb, new_skb;\n \t\t\tint length = ibmveth_rxq_frame_length(adapter);\n \t\t\tint offset = ibmveth_rxq_frame_offset(adapter);\n \t\t\tint csum_good = ibmveth_rxq_csum_good(adapter);\n \t\t\tint lrg_pkt = ibmveth_rxq_large_packet(adapter);\n+\t\t\tu64 correlator = ibmveth_rxq_correlator(adapter);\n+\t\t\tunsigned int pool, room, off, len;\n \t\t\t__sum16 iph_check = 0;\n \n-\t\t\tskb = ibmveth_rxq_get_buffer(adapter);\n-\t\t\tif (unlikely(!skb))\n-\t\t\t\tbreak;\n+\t\t\tskb = ibmveth_rxq_get_buffer(adapter, correlator);\n+\t\t\tif (unlikely(!skb)) {\n+\t\t\t\tibmveth_rxq_advance(adapter);\n+\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\tframes_processed++;\n+\t\t\t\tcontinue;\n+\t\t\t}\n+\n+\t\t\tpool = correlator \u003e\u003e 32;\n+\t\t\troom = min_t(unsigned int, skb_tailroom(skb),\n+\t\t\t\t adapter-\u003erx_buff_pool[pool].buff_size);\n+\t\t\toff = offset;\n+\t\t\tlen = length;\n+\t\t\tif (unlikely(len \u003c ETH_HLEN \|\| off \u003e= room \|\|\n+\t\t\t\t len \u003e room - off)) {\n+\t\t\t\tif (net_ratelimit())\n+\t\t\t\t\tnetdev_err(netdev,\n+\t\t\t\t\t\t \"bad RX frame offset %u length %u (buffer %u), dropping\\n\",\n+\t\t\t\t\t\t off, len, room);\n+\t\t\t\tibmveth_rxq_harvest_buffer(adapter, true);\n+\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\tframes_processed++;\n+\t\t\t\tcontinue;\n+\t\t\t}\n \n \t\t\t/ if the large packet bit is set in the rx queue\n \t\t\t * descriptor, the mss will be written by PHYP eight\n@@ -1502,12 +1597,21 @@ static int ibmveth_poll(struct napi_struct napi, int budget)\n \t\t\t\tif (rx_flush)\n \t\t\t\t\tibmveth_flush_buffer(skb-\u003edata,\n \t\t\t\t\t\tlength + offset);\n-\t\t\t\tif (unlikely(ibmveth_rxq_harvest_buffer(adapter, true)))\n-\t\t\t\t\tbreak;\n+\t\t\t\trc = ibmveth_rxq_harvest_buffer(adapter, true);\n+\t\t\t\tif (unlikely(rc)) {\n+\t\t\t\t\tdev_kfree_skb_any(new_skb);\n+\t\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\t\tframes_processed++;\n+\t\t\t\t\tcontinue;\n+\t\t\t\t}\n \t\t\t\tskb = new_skb;\n \t\t\t} else {\n-\t\t\t\tif (unlikely(ibmveth_rxq_harvest_buffer(adapter, false)))\n-\t\t\t\t\tbreak;\n+\t\t\t\trc = ibmveth_rxq_harvest_buffer(adapter, false);\n+\t\t\t\tif (unlikely(rc)) {\n+\t\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\t\tframes_processed++;\n+\t\t\t\t\tcontinue;\n+\t\t\t\t}\n \t\t\t\tskb_reserve(skb, offset);\n \t\t\t}\n \n@@ -1542,7 +1646,11 @@ static int ibmveth_poll(struct napi_struct napi, int budget)\n \t\t}\n \t}\n \n-\tibmveth_replenish_task(adapter);\n+\t/* netpoll polls with budget 0 for TX only, and is not serialized\n+\t * with a NAPI poll that was already running when it was set up\n+\t /\n+\tif (budget)\n+\t\tibmveth_replenish_task(adapter);\n \n \tif (frames_processed == budget)\n \t\tgoto out;\n@@ -1562,10 +1670,16 @@ static int ibmveth_poll(struct napi_struct napi, int budget)\n \tif (ibmveth_rxq_pending_buffer(adapter) \u0026\u0026 napi_schedule(napi)) {\n \t\tlpar_rc = h_vio_signal(adapter-\u003evdev-\u003eunit_address,\n \t\t\t\t VIO_IRQ_DISABLE);\n+\t\trescheduled = 1;\n \t\tgoto restart_poll;\n \t}\n \n out:\n+\t/* napi_schedule() already queued us. Returning budget would\n+\t * make busy_poll_stop() queue the napi a second time.\n+\t /\n+\tif (rescheduled \u0026\u0026 budget \u0026\u0026 frames_processed \u003e= budget)\n+\t\treturn budget - 1;\n \treturn frames_processed;\n }\n \n@@ -1682,14 +1796,6 @@ static int ibmveth_change_mtu(struct net_device dev, int new_mtu)\n \treturn -EINVAL;\n }\n \n-#ifdef CONFIG_NET_POLL_CONTROLLER\n-static void ibmveth_poll_controller(struct net_device dev)\n-{\n-\tibmveth_replenish_task(netdev_priv(dev));\n-\tibmveth_interrupt(dev-\u003eirq, dev);\n-}\n-#endif\n-\n /\n ibmveth_get_desired_dma - Calculate IO memory desired by the driver\n \n@@ -1791,11 +1897,42 @@ static const struct net_device_ops ibmveth_netdev_ops = {\n \t.ndo_validate_addr\t= eth_validate_addr,\n \t.ndo_set_mac_address = ibmveth_set_mac_addr,\n \t.ndo_features_check\t= ibmveth_features_check,\n-#ifdef CONFIG_NET_POLL_CONTROLLER\n-\t.ndo_poll_controller\t= ibmveth_poll_controller,\n-#endif\n };\n \n+/\n+ ibmveth_pool_kobj_release - Mark a pool kobject finished\n+ * @kobj: kobject embedded in the pool\n+ \n+ The pool kobjects live in netdev_priv(), so the last put must wait\n+ * for this before free_netdev().\n+ /\n+static void ibmveth_pool_kobj_release(struct kobject kobj)\n+{\n+\tstruct ibmveth_buff_pool pool = container_of(kobj,\n+\t\t\t\t\t\t struct ibmveth_buff_pool,\n+\t\t\t\t\t\t kobj);\n+\n+\tcomplete(\u0026pool-\u003ereleased);\n+}\n+\n+/\n+ ibmveth_put_pool_kobjs - Drop the pool kobjects and wait for release\n+ * @adapter: ibmveth adapter\n+ \n+ With CONFIG_DEBUG_KOBJECT_RELEASE the cleanup, including removing the\n+ * sysfs files, runs later from a work item in the kobject; wait for it\n+ * so free_netdev() cannot free the pools first.\n+ /\n+static void ibmveth_put_pool_kobjs(struct ibmveth_adapter adapter)\n+{\n+\tint i;\n+\n+\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n+\t\tkobject_put(\u0026adapter-\u003erx_buff_pool[i].kobj);\n+\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n+\t\twait_for_completion(\u0026adapter-\u003erx_buff_pool[i].released);\n+}\n+\n static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id)\n {\n \tint rc, i, mac_len;\n@@ -1906,6 +2043,7 @@ static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id)\n \t\tibmveth_init_buffer_pool(\u0026adapter-\u003erx_buff_pool[i], i,\n \t\t\t\t\t pool_count[i], pool_size[i],\n \t\t\t\t\t pool_active[i]);\n+\t\tinit_completion(\u0026adapter-\u003erx_buff_pool[i].released);\n \t\terror = kobject_init_and_add(kobj, \u0026ktype_veth_pool,\n \t\t\t\t\t \u0026dev-\u003edev.kobj, \"pool%d\", i);\n \t\tif (!error)\n@@ -1917,8 +2055,7 @@ static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id)\n \tif (rc) {\n \t\tnetdev_dbg(netdev, \"failed to set number of tx queues rc=%d\\n\",\n \t\t\t rc);\n-\t\tfree_netdev(netdev);\n-\t\treturn rc;\n+\t\tgoto err_put_pools;\n \t}\n \tadapter-\u003etx_ltb_size = PAGE_ALIGN(IBMVETH_MAX_TX_BUF_SIZE);\n \tfor (i = 0; i \u003c IBMVETH_MAX_QUEUES; i++)\n@@ -1933,25 +2070,27 @@ static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id)\n \n \tif (rc) {\n \t\tnetdev_dbg(netdev, \"failed to register netdev rc=%d\\n\", rc);\n-\t\tfree_netdev(netdev);\n-\t\treturn rc;\n+\t\tgoto err_put_pools;\n \t}\n \n \tnetdev_dbg(netdev, \"registered\\n\");\n \n \treturn 0;\n+\n+err_put_pools:\n+\tibmveth_put_pool_kobjs(adapter);\n+\tfree_netdev(netdev);\n+\treturn rc;\n }\n \n static void ibmveth_remove(struct vio_dev dev)\n {\n \tstruct net_device netdev = dev_get_drvdata(\u0026dev-\u003edev);\n \tstruct ibmveth_adapter adapter = netdev_priv(netdev);\n-\tint i;\n \n-\tcancel_work_sync(\u0026adapter-\u003ework);\n+\tdisable_work_sync(\u0026adapter-\u003ework);\n \n-\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n-\t\tkobject_put(\u0026adapter-\u003erx_buff_pool[i].kobj);\n+\tibmveth_put_pool_kobjs(adapter);\n \n \tunregister_netdev(netdev);\n \n@@ -2127,7 +2266,7 @@ static const struct sysfs_ops veth_pool_ops = {\n };\n \n static struct kobj_type ktype_veth_pool = {\n-\t.release = NULL,\n+\t.release = ibmveth_pool_kobj_release,\n \t.sysfs_ops = \u0026veth_pool_ops,\n \t.default_groups = veth_pool_groups,\n };\n@@ -2198,8 +2337,7 @@ static void ibmveth_reset_kunit(struct work_struct w)\n * @test: pointer to kunit structure\n \n Tests the error returns from ibmveth_remove_buffer_from_pool.\n- * ibmveth_remove_buffer_from_pool also calls WARN_ON, so dmesg should be\n- * checked to see that these warnings happened.\n+ * Each error also logs a ratelimited netdev_err.\n \n Return: void\n /\n@@ -2208,6 +2346,7 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit test)\n \tstruct ibmveth_adapter adapter = kunit_kzalloc(test, sizeof(adapter), GFP_KERNEL);\n \tstruct ibmveth_buff_pool pool;\n \tu64 correlator;\n+\tint ret;\n \n \tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter);\n \n@@ -2231,6 +2370,13 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit test)\n \tKUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, false));\n \tKUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, true));\n \n+\t/* Pool 2 is in range but has no skbuff array, like an inactive pool. /\n+\tcorrelator = ((u64)2 \u003c\u003c 32) \| 0;\n+\tret = ibmveth_remove_buffer_from_pool(adapter, correlator, false);\n+\tKUNIT_EXPECT_EQ(test, -EINVAL, ret);\n+\tret = ibmveth_remove_buffer_from_pool(adapter, correlator, true);\n+\tKUNIT_EXPECT_EQ(test, -EINVAL, ret);\n+\n \tcorrelator = (u64)0 \| 0;\n \tpool-\u003eskbuff[0] = NULL;\n \tKUNIT_EXPECT_EQ(test, -EFAULT, ibmveth_remove_buffer_from_pool(adapter, correlator, false));\n@@ -2243,9 +2389,8 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit test)\n * ibmveth_rxq_get_buffer_test - unit test for ibmveth_rxq_get_buffer\n * @test: pointer to kunit structure\n \n- Tests ibmveth_rxq_get_buffer. ibmveth_rxq_get_buffer also calls WARN_ON for\n- * the NULL returns, so dmesg should be checked to see that these warnings\n- * happened.\n+ * Tests ibmveth_rxq_get_buffer. Each NULL return also logs a ratelimited\n+ * netdev_err.\n \n Return: void\n /\n@@ -2276,15 +2421,87 @@ static void ibmveth_rxq_get_buffer_test(struct kunit test)\n \tpool-\u003eskbuff = kunit_kcalloc(test, pool-\u003esize, sizeof(void ), GFP_KERNEL);\n \tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool-\u003eskbuff);\n \n+\tu64 cor;\n+\n \tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)IBMVETH_NUM_BUFF_POOLS \u003c\u003c 32 \| 0;\n-\tKUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter));\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, NULL,\n+\t\t\t ibmveth_rxq_get_buffer(adapter, cor));\n \n \tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)0 \u003c\u003c 32 \| adapter-\u003erx_buff_pool[0].size;\n-\tKUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter));\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, NULL,\n+\t\t\t ibmveth_rxq_get_buffer(adapter, cor));\n+\n+\t/ Pool 2 is in range but has no skbuff array, like an inactive pool. /\n+\tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)2 \u003c\u003c 32 \| 0;\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, NULL,\n+\t\t\t ibmveth_rxq_get_buffer(adapter, cor));\n \n \tpool-\u003eskbuff[0] = skb;\n \tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)0 \u003c\u003c 32 \| 0;\n-\tKUNIT_EXPECT_PTR_EQ(test, skb, ibmveth_rxq_get_buffer(adapter));\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, skb,\n+\t\t\t ibmveth_rxq_get_buffer(adapter, cor));\n+\n+\tflush_work(\u0026adapter-\u003ework);\n+}\n+\n+/\n+ ibmveth_rxq_harvest_buffer_test - unit test for ibmveth_rxq_harvest_buffer\n+ * @test: pointer to kunit structure\n+ \n+ A bad correlator must still advance the RX ring, wrapping and flipping\n+ * the toggle at the end. This covers the harvest path; the advance after\n+ * ibmveth_rxq_get_buffer() fails in ibmveth_poll() is not tested here.\n+ \n+ Return: void\n+ /\n+static void ibmveth_rxq_harvest_buffer_test(struct kunit test)\n+{\n+\tstruct ibmveth_adapter adapter;\n+\tstruct ibmveth_buff_pool pool;\n+\tint ret;\n+\n+\tadapter = kunit_kzalloc(test, sizeof(adapter), GFP_KERNEL);\n+\tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter);\n+\n+\tINIT_WORK(\u0026adapter-\u003ework, ibmveth_reset_kunit);\n+\n+\tadapter-\u003erx_queue.num_slots = 2;\n+\tadapter-\u003erx_queue.index = 0;\n+\tadapter-\u003erx_queue.toggle = 1;\n+\tadapter-\u003erx_queue.queue_addr =\n+\t\tkunit_kcalloc(test, 2, sizeof(struct ibmveth_rx_q_entry),\n+\t\t\t GFP_KERNEL);\n+\tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter-\u003erx_queue.queue_addr);\n+\n+\t/ Set sane values for buffer pools /\n+\tfor (int i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n+\t\tibmveth_init_buffer_pool(\u0026adapter-\u003erx_buff_pool[i], i,\n+\t\t\t\t\t pool_count[i], pool_size[i],\n+\t\t\t\t\t pool_active[i]);\n+\n+\tpool = \u0026adapter-\u003erx_buff_pool[0];\n+\tpool-\u003eskbuff = kunit_kcalloc(test, pool-\u003esize, sizeof(void ),\n+\t\t\t\t GFP_KERNEL);\n+\tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool-\u003eskbuff);\n+\n+\t/* Slot 0: pool out of range. Slot 1: valid, but no skb. /\n+\tadapter-\u003erx_queue.queue_addr[0].correlator =\n+\t\t(u64)IBMVETH_NUM_BUFF_POOLS \u003c\u003c 32 \| 0;\n+\tadapter-\u003erx_queue.queue_addr[1].correlator = (u64)0 \u003c\u003c 32 \| 0;\n+\n+\tret = ibmveth_rxq_harvest_buffer(adapter, true);\n+\tKUNIT_EXPECT_EQ(test, -EINVAL, ret);\n+\tKUNIT_EXPECT_EQ(test, 1ULL, adapter-\u003erx_queue.index);\n+\tKUNIT_EXPECT_EQ(test, 1ULL, adapter-\u003erx_queue.toggle);\n+\n+\tret = ibmveth_rxq_harvest_buffer(adapter, true);\n+\tKUNIT_EXPECT_EQ(test, -EFAULT, ret);\n+\tKUNIT_EXPECT_EQ(test, 0ULL, adapter-\u003erx_queue.index);\n+\tKUNIT_EXPECT_EQ(test, 0ULL, adapter-\u003erx_queue.toggle);\n \n \tflush_work(\u0026adapter-\u003ework);\n }\n@@ -2292,6 +2509,7 @@ static void ibmveth_rxq_get_buffer_test(struct kunit test)\n static struct kunit_case ibmveth_test_cases[] = {\n \tKUNIT_CASE(ibmveth_remove_buffer_from_pool_test),\n \tKUNIT_CASE(ibmveth_rxq_get_buffer_test),\n+\tKUNIT_CASE(ibmveth_rxq_harvest_buffer_test),\n \t{}\n };\n \ndiff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h\nindex d87713668ed30..be0939caa328e 100644\n--- a/drivers/net/ethernet/ibm/ibmveth.h\n+++ b/drivers/net/ethernet/ibm/ibmveth.h\n@@ -14,6 +14,8 @@\n #ifndef _IBMVETH_H\n #define _IBMVETH_H\n \n+#include \u003clinux/completion.h\u003e\n+\n /* constants for H_MULTICAST_CTRL /\n #define IbmVethMcastReceptionModifyBit 0x80000UL\n #define IbmVethMcastReceptionEnableBit 0x20000UL\n@@ -143,6 +145,7 @@ struct ibmveth_buff_pool {\n struct sk_buff skbuff;\n int active;\n struct kobject kobj;\n+\tstruct completion released;\n };\n \n struct ibmveth_rx_q {\n@@ -172,6 +175,8 @@ struct ibmveth_adapter {\n \tint rx_csum;\n \tint large_send;\n \tbool is_active_trunk;\n+\t/ Set by a successful ibmveth_open(), cleared by ibmveth_close(). */\n+\tbool opened;\n \tunsigned int rx_buffers_per_hcall;\n \n \tu64 fw_ipv6_csum_support;\n" }
2/1	2026/10/09 21:51	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 0594d4fd21630d3da95b5622b872d3c05cfb9a30 Author: syz-cluster <triage@syzkaller.com> Date: Fri Oct 9 21:51:29 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c index abebdb1fc2628..fc90ee6663c36 100644 --- a/drivers/net/ethernet/ibm/ibmveth.c +++ b/drivers/net/ethernet/ibm/ibmveth.c @@ -135,6 +135,13 @@ static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter adapter) return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].length); } +static u64 ibmveth_rxq_correlator(struct ibmveth_adapter adapter) +{ + unsigned int idx = adapter->rx_queue.index; + + return READ_ONCE(adapter->rx_queue.queue_addr[idx].correlator); +} + static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter adapter) { return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_CSUM_GOOD; @@ -443,6 +450,37 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter adapter, } } +/* The correlator comes back from PHYP; a bad one schedules a reset. / +static bool ibmveth_rxq_correlator_valid(struct ibmveth_adapter adapter, + u64 correlator) +{ + unsigned int index = correlator & 0xffffffffUL; + unsigned int pool = correlator >> 32; + + /* An inactive pool keeps its size but has no skbuff array. / + if (pool < IBMVETH_NUM_BUFF_POOLS && + index < adapter->rx_buff_pool[pool].size && + adapter->rx_buff_pool[pool].skbuff) + return true; + + if (net_ratelimit()) + netdev_err(adapter->netdev, + "invalid RX correlator %llx, resetting\n", + correlator); + schedule_work(&adapter->work); + return false; +} + +static void ibmveth_rxq_no_skb(struct ibmveth_adapter adapter, + u64 correlator) +{ + if (net_ratelimit()) + netdev_err(adapter->netdev, + "no buffer for RX correlator %llx, resetting\n", + correlator); + schedule_work(&adapter->work); +} + /** * ibmveth_remove_buffer_from_pool - remove a buffer from a pool * @adapter: adapter instance @@ -451,7 +489,8 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter adapter, * Return: * * %0 - success - * * %-EINVAL - correlator maps to pool or index out of range + * * %-EINVAL - correlator maps to pool or index out of range, or to an + * inactive pool * * %-EFAULT - pool and index map to null skb / static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter adapter, @@ -462,15 +501,12 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter adapter, unsigned int free_index; struct sk_buff skb; - if (WARN_ON(pool >= IBMVETH_NUM_BUFF_POOLS) \|\| - WARN_ON(index >= adapter->rx_buff_pool[pool].size)) { - schedule_work(&adapter->work); + if (!ibmveth_rxq_correlator_valid(adapter, correlator)) return -EINVAL; - } skb = adapter->rx_buff_pool[pool].skbuff[index]; - if (WARN_ON(!skb)) { - schedule_work(&adapter->work); + if (!skb) { + ibmveth_rxq_no_skb(adapter, correlator); return -EFAULT; } @@ -504,20 +540,29 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter adapter, return 0; } -/ get the current buffer on the rx queue / -static inline struct sk_buff ibmveth_rxq_get_buffer(struct ibmveth_adapter adapter) +/ get the buffer for @correlator, read once from the current rx queue entry / +static struct sk_buff ibmveth_rxq_get_buffer(struct ibmveth_adapter adapter, + u64 correlator) { - u64 correlator = adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator; unsigned int pool = correlator >> 32; unsigned int index = correlator & 0xffffffffUL; + struct sk_buff skb; - if (WARN_ON(pool >= IBMVETH_NUM_BUFF_POOLS) \|\| - WARN_ON(index >= adapter->rx_buff_pool[pool].size)) { - schedule_work(&adapter->work); + if (!ibmveth_rxq_correlator_valid(adapter, correlator)) return NULL; - } - return adapter->rx_buff_pool[pool].skbuff[index]; + skb = adapter->rx_buff_pool[pool].skbuff[index]; + if (!skb) + ibmveth_rxq_no_skb(adapter, correlator); + return skb; +} + +static void ibmveth_rxq_advance(struct ibmveth_adapter adapter) +{ + if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) { + adapter->rx_queue.index = 0; + adapter->rx_queue.toggle = !adapter->rx_queue.toggle; + } } /* @@ -528,6 +573,9 @@ static inline struct sk_buff ibmveth_rxq_get_buffer(struct ibmveth_adapter ada * * Context: called from ibmveth_poll * + * The ring advances even on error, so poll does not return to a bad + * slot before the scheduled reset can run. + * * Return: * * %0 - success * * other - non-zero return from ibmveth_remove_buffer_from_pool @@ -540,15 +588,9 @@ static int ibmveth_rxq_harvest_buffer(struct ibmveth_adapter adapter, cor = adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator; rc = ibmveth_remove_buffer_from_pool(adapter, cor, reuse); - if (unlikely(rc)) - return rc; - - if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) { - adapter->rx_queue.index = 0; - adapter->rx_queue.toggle = !adapter->rx_queue.toggle; - } + ibmveth_rxq_advance(adapter); - return 0; + return rc; } static void ibmveth_free_tx_ltb(struct ibmveth_adapter adapter, int idx) @@ -628,8 +670,6 @@ static int ibmveth_open(struct net_device netdev) netdev_dbg(netdev, "open starting\n"); - napi_enable(&adapter->napi); - for(i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) rxq_entries += adapter->rx_buff_pool[i].size; @@ -717,10 +757,19 @@ static int ibmveth_open(struct net_device netdev) } } + /* NAPI can run as soon as it is enabled, from netpoll during the + * direct close()/open() pairs or from a direct ibmveth_interrupt() + * call, so enable it only once everything ibmveth_poll() touches + * exists. + / + napi_enable(&adapter->napi); + netdev_dbg(netdev, "registering irq 0x%x\n", netdev->irq); rc = request_irq(netdev->irq, ibmveth_interrupt, 0, netdev->name, netdev); if (rc != 0) { + napi_disable(&adapter->napi); + synchronize_net(); netdev_err(netdev, "unable to request irq 0x%x, rc %d\n", netdev->irq, rc); goto out_free_buffer_pools; @@ -733,6 +782,7 @@ static int ibmveth_open(struct net_device netdev) netif_tx_start_all_queues(netdev); + adapter->opened = true; netdev_dbg(netdev, "open complete\n"); return 0; @@ -765,7 +815,6 @@ static int ibmveth_open(struct net_device netdev) out_free_buffer_list: free_page((unsigned long)adapter->buffer_list_addr); out: - napi_disable(&adapter->napi); return rc; } @@ -776,11 +825,24 @@ static int ibmveth_close(struct net_device netdev) long lpar_rc; int i; + /* change_mtu, pool sysfs, set_csum and set_tso call close() and + * open() directly. If that open() fails, IFF_UP stays set and + * NAPI is disabled; a second close() would hang in napi_disable(). + / + if (!adapter->opened) + return 0; + adapter->opened = false; + netdev_dbg(netdev, "close starting\n"); napi_disable(&adapter->napi); + / napi_disable() returns once ibmveth_poll() has called + * napi_complete_done(), but the poll still re-enables the + * interrupt and reads the RX queue after that. + / + synchronize_net(); - netif_tx_stop_all_queues(netdev); + netif_tx_disable(netdev); h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE); @@ -827,10 +889,10 @@ static int ibmveth_close(struct net_device netdev) * * @w: pointer to work_struct embedded in adapter structure * - * Context: This routine acquires rtnl_mutex and disables its NAPI through - * ibmveth_close. It can't be called directly in a context that has - * already acquired rtnl_mutex or disabled its NAPI, or directly from - * a poll routine. + * Context: This routine acquires rtnl_mutex and, if the device is open, + * disables its NAPI through ibmveth_close. It can't be called + * directly in a context that has already acquired rtnl_mutex or + * disabled its NAPI, or directly from a poll routine. * * Return: void / @@ -1122,12 +1184,13 @@ static int ibmveth_set_channels(struct net_device netdev, struct ibmveth_adapter adapter = netdev_priv(netdev); unsigned int old = netdev->real_num_tx_queues, goal = channels->tx_count; - int rc, i; + int rc, i, alloc_rc = 0; - / If ndo_open has not been called yet then don't allocate, just set - * desired netdev_queue's and return + /* If the device is not open (including a failed close/open with + * IFF_UP still set) then don't allocate, just set desired + * netdev_queue's and return / - if (!(netdev->flags & IFF_UP)) + if (!adapter->opened) return netif_set_real_num_tx_queues(netdev, goal); / We have IBMVETH_MAX_QUEUES netdev_queue's allocated @@ -1147,6 +1210,7 @@ static int ibmveth_set_channels(struct net_device netdev, / if something goes wrong, free everything we just allocated / netdev_err(netdev, "Failed to allocate more tx queues, returning to %d queues\n", old); + alloc_rc = rc; goal = old; old = i; break; @@ -1157,6 +1221,8 @@ static int ibmveth_set_channels(struct net_device netdev, old); goal = old; old = i; + } else if (alloc_rc) { + rc = alloc_rc; } /* Free any that are no longer needed / for (i = old; i > goal; i--) { @@ -1454,7 +1520,9 @@ static int ibmveth_poll(struct napi_struct napi, int budget) struct net_device netdev = adapter->netdev; int frames_processed = 0; unsigned long lpar_rc; + int rescheduled = 0; u16 mss = 0; + int rc; restart_poll: while (frames_processed < budget) { @@ -1466,19 +1534,46 @@ static int ibmveth_poll(struct napi_struct napi, int budget) wmb(); /* suggested by larson1 / adapter->rx_invalid_buffer++; netdev_dbg(netdev, "recycling invalid buffer\n"); - if (unlikely(ibmveth_rxq_harvest_buffer(adapter, true))) - break; + rc = ibmveth_rxq_harvest_buffer(adapter, true); + if (unlikely(rc)) { + netdev->stats.rx_dropped++; + frames_processed++; + continue; + } } else { struct sk_buff skb, new_skb; int length = ibmveth_rxq_frame_length(adapter); int offset = ibmveth_rxq_frame_offset(adapter); int csum_good = ibmveth_rxq_csum_good(adapter); int lrg_pkt = ibmveth_rxq_large_packet(adapter); + u64 correlator = ibmveth_rxq_correlator(adapter); + unsigned int pool, room, off, len; __sum16 iph_check = 0; - skb = ibmveth_rxq_get_buffer(adapter); - if (unlikely(!skb)) - break; + skb = ibmveth_rxq_get_buffer(adapter, correlator); + if (unlikely(!skb)) { + ibmveth_rxq_advance(adapter); + netdev->stats.rx_dropped++; + frames_processed++; + continue; + } + + pool = correlator >> 32; + room = min_t(unsigned int, skb_tailroom(skb), + adapter->rx_buff_pool[pool].buff_size); + off = offset; + len = length; + if (unlikely(len < ETH_HLEN \|\| off >= room \|\| + len > room - off)) { + if (net_ratelimit()) + netdev_err(netdev, + "bad RX frame offset %u length %u (buffer %u), dropping\n", + off, len, room); + ibmveth_rxq_harvest_buffer(adapter, true); + netdev->stats.rx_dropped++; + frames_processed++; + continue; + } / if the large packet bit is set in the rx queue * descriptor, the mss will be written by PHYP eight @@ -1502,12 +1597,21 @@ static int ibmveth_poll(struct napi_struct napi, int budget) if (rx_flush) ibmveth_flush_buffer(skb->data, length + offset); - if (unlikely(ibmveth_rxq_harvest_buffer(adapter, true))) - break; + rc = ibmveth_rxq_harvest_buffer(adapter, true); + if (unlikely(rc)) { + dev_kfree_skb_any(new_skb); + netdev->stats.rx_dropped++; + frames_processed++; + continue; + } skb = new_skb; } else { - if (unlikely(ibmveth_rxq_harvest_buffer(adapter, false))) - break; + rc = ibmveth_rxq_harvest_buffer(adapter, false); + if (unlikely(rc)) { + netdev->stats.rx_dropped++; + frames_processed++; + continue; + } skb_reserve(skb, offset); } @@ -1542,7 +1646,11 @@ static int ibmveth_poll(struct napi_struct napi, int budget) } } - ibmveth_replenish_task(adapter); + /* netpoll polls with budget 0 for TX only, and is not serialized + * with a NAPI poll that was already running when it was set up + / + if (budget) + ibmveth_replenish_task(adapter); if (frames_processed == budget) goto out; @@ -1562,10 +1670,16 @@ static int ibmveth_poll(struct napi_struct napi, int budget) if (ibmveth_rxq_pending_buffer(adapter) && napi_schedule(napi)) { lpar_rc = h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE); + rescheduled = 1; goto restart_poll; } out: + /* napi_schedule() already queued us. Returning budget would + * make busy_poll_stop() queue the napi a second time. + / + if (rescheduled && budget && frames_processed >= budget) + return budget - 1; return frames_processed; } @@ -1682,14 +1796,6 @@ static int ibmveth_change_mtu(struct net_device dev, int new_mtu) return -EINVAL; } -#ifdef CONFIG_NET_POLL_CONTROLLER -static void ibmveth_poll_controller(struct net_device dev) -{ - ibmveth_replenish_task(netdev_priv(dev)); - ibmveth_interrupt(dev->irq, dev); -} -#endif - /* * ibmveth_get_desired_dma - Calculate IO memory desired by the driver * @@ -1791,11 +1897,42 @@ static const struct net_device_ops ibmveth_netdev_ops = { .ndo_validate_addr = eth_validate_addr, .ndo_set_mac_address = ibmveth_set_mac_addr, .ndo_features_check = ibmveth_features_check, -#ifdef CONFIG_NET_POLL_CONTROLLER - .ndo_poll_controller = ibmveth_poll_controller, -#endif }; +/** + * ibmveth_pool_kobj_release - Mark a pool kobject finished + * @kobj: kobject embedded in the pool + * + * The pool kobjects live in netdev_priv(), so the last put must wait + * for this before free_netdev(). + / +static void ibmveth_pool_kobj_release(struct kobject kobj) +{ + struct ibmveth_buff_pool pool = container_of(kobj, + struct ibmveth_buff_pool, + kobj); + + complete(&pool->released); +} + +/* + * ibmveth_put_pool_kobjs - Drop the pool kobjects and wait for release + * @adapter: ibmveth adapter + * + * With CONFIG_DEBUG_KOBJECT_RELEASE the cleanup, including removing the + * sysfs files, runs later from a work item in the kobject; wait for it + * so free_netdev() cannot free the pools first. + / +static void ibmveth_put_pool_kobjs(struct ibmveth_adapter adapter) +{ + int i; + + for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) + kobject_put(&adapter->rx_buff_pool[i].kobj); + for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) + wait_for_completion(&adapter->rx_buff_pool[i].released); +} + static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id) { int rc, i, mac_len; @@ -1906,6 +2043,7 @@ static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id) ibmveth_init_buffer_pool(&adapter->rx_buff_pool[i], i, pool_count[i], pool_size[i], pool_active[i]); + init_completion(&adapter->rx_buff_pool[i].released); error = kobject_init_and_add(kobj, &ktype_veth_pool, &dev->dev.kobj, "pool%d", i); if (!error) @@ -1917,8 +2055,7 @@ static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id) if (rc) { netdev_dbg(netdev, "failed to set number of tx queues rc=%d\n", rc); - free_netdev(netdev); - return rc; + goto err_put_pools; } adapter->tx_ltb_size = PAGE_ALIGN(IBMVETH_MAX_TX_BUF_SIZE); for (i = 0; i < IBMVETH_MAX_QUEUES; i++) @@ -1933,25 +2070,27 @@ static int ibmveth_probe(struct vio_dev dev, const struct vio_device_id id) if (rc) { netdev_dbg(netdev, "failed to register netdev rc=%d\n", rc); - free_netdev(netdev); - return rc; + goto err_put_pools; } netdev_dbg(netdev, "registered\n"); return 0; + +err_put_pools: + ibmveth_put_pool_kobjs(adapter); + free_netdev(netdev); + return rc; } static void ibmveth_remove(struct vio_dev dev) { struct net_device netdev = dev_get_drvdata(&dev->dev); struct ibmveth_adapter adapter = netdev_priv(netdev); - int i; - cancel_work_sync(&adapter->work); + disable_work_sync(&adapter->work); - for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) - kobject_put(&adapter->rx_buff_pool[i].kobj); + ibmveth_put_pool_kobjs(adapter); unregister_netdev(netdev); @@ -2127,7 +2266,7 @@ static const struct sysfs_ops veth_pool_ops = { }; static struct kobj_type ktype_veth_pool = { - .release = NULL, + .release = ibmveth_pool_kobj_release, .sysfs_ops = &veth_pool_ops, .default_groups = veth_pool_groups, }; @@ -2198,8 +2337,7 @@ static void ibmveth_reset_kunit(struct work_struct w) * @test: pointer to kunit structure * * Tests the error returns from ibmveth_remove_buffer_from_pool. - * ibmveth_remove_buffer_from_pool also calls WARN_ON, so dmesg should be - * checked to see that these warnings happened. + * Each error also logs a ratelimited netdev_err. * * Return: void / @@ -2208,6 +2346,7 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit test) struct ibmveth_adapter adapter = kunit_kzalloc(test, sizeof(adapter), GFP_KERNEL); struct ibmveth_buff_pool pool; u64 correlator; + int ret; KUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter); @@ -2231,6 +2370,13 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit test) KUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, false)); KUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, true)); + /* Pool 2 is in range but has no skbuff array, like an inactive pool. / + correlator = ((u64)2 << 32) \| 0; + ret = ibmveth_remove_buffer_from_pool(adapter, correlator, false); + KUNIT_EXPECT_EQ(test, -EINVAL, ret); + ret = ibmveth_remove_buffer_from_pool(adapter, correlator, true); + KUNIT_EXPECT_EQ(test, -EINVAL, ret); + correlator = (u64)0 \| 0; pool->skbuff[0] = NULL; KUNIT_EXPECT_EQ(test, -EFAULT, ibmveth_remove_buffer_from_pool(adapter, correlator, false)); @@ -2243,9 +2389,8 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit test) * ibmveth_rxq_get_buffer_test - unit test for ibmveth_rxq_get_buffer * @test: pointer to kunit structure * - * Tests ibmveth_rxq_get_buffer. ibmveth_rxq_get_buffer also calls WARN_ON for - * the NULL returns, so dmesg should be checked to see that these warnings - * happened. + * Tests ibmveth_rxq_get_buffer. Each NULL return also logs a ratelimited + * netdev_err. * * Return: void / @@ -2276,15 +2421,87 @@ static void ibmveth_rxq_get_buffer_test(struct kunit test) pool->skbuff = kunit_kcalloc(test, pool->size, sizeof(void ), GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool->skbuff); + u64 cor; + adapter->rx_queue.queue_addr[0].correlator = (u64)IBMVETH_NUM_BUFF_POOLS << 32 \| 0; - KUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter)); + cor = ibmveth_rxq_correlator(adapter); + KUNIT_EXPECT_PTR_EQ(test, NULL, + ibmveth_rxq_get_buffer(adapter, cor)); adapter->rx_queue.queue_addr[0].correlator = (u64)0 << 32 \| adapter->rx_buff_pool[0].size; - KUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter)); + cor = ibmveth_rxq_correlator(adapter); + KUNIT_EXPECT_PTR_EQ(test, NULL, + ibmveth_rxq_get_buffer(adapter, cor)); + + / Pool 2 is in range but has no skbuff array, like an inactive pool. / + adapter->rx_queue.queue_addr[0].correlator = (u64)2 << 32 \| 0; + cor = ibmveth_rxq_correlator(adapter); + KUNIT_EXPECT_PTR_EQ(test, NULL, + ibmveth_rxq_get_buffer(adapter, cor)); pool->skbuff[0] = skb; adapter->rx_queue.queue_addr[0].correlator = (u64)0 << 32 \| 0; - KUNIT_EXPECT_PTR_EQ(test, skb, ibmveth_rxq_get_buffer(adapter)); + cor = ibmveth_rxq_correlator(adapter); + KUNIT_EXPECT_PTR_EQ(test, skb, + ibmveth_rxq_get_buffer(adapter, cor)); + + flush_work(&adapter->work); +} + +/* + * ibmveth_rxq_harvest_buffer_test - unit test for ibmveth_rxq_harvest_buffer + * @test: pointer to kunit structure + * + * A bad correlator must still advance the RX ring, wrapping and flipping + * the toggle at the end. This covers the harvest path; the advance after + * ibmveth_rxq_get_buffer() fails in ibmveth_poll() is not tested here. + * + * Return: void + / +static void ibmveth_rxq_harvest_buffer_test(struct kunit test) +{ + struct ibmveth_adapter adapter; + struct ibmveth_buff_pool pool; + int ret; + + adapter = kunit_kzalloc(test, sizeof(adapter), GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter); + + INIT_WORK(&adapter->work, ibmveth_reset_kunit); + + adapter->rx_queue.num_slots = 2; + adapter->rx_queue.index = 0; + adapter->rx_queue.toggle = 1; + adapter->rx_queue.queue_addr = + kunit_kcalloc(test, 2, sizeof(struct ibmveth_rx_q_entry), + GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter->rx_queue.queue_addr); + + / Set sane values for buffer pools / + for (int i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) + ibmveth_init_buffer_pool(&adapter->rx_buff_pool[i], i, + pool_count[i], pool_size[i], + pool_active[i]); + + pool = &adapter->rx_buff_pool[0]; + pool->skbuff = kunit_kcalloc(test, pool->size, sizeof(void ), + GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool->skbuff); + + /* Slot 0: pool out of range. Slot 1: valid, but no skb. / + adapter->rx_queue.queue_addr[0].correlator = + (u64)IBMVETH_NUM_BUFF_POOLS << 32 \| 0; + adapter->rx_queue.queue_addr[1].correlator = (u64)0 << 32 \| 0; + + ret = ibmveth_rxq_harvest_buffer(adapter, true); + KUNIT_EXPECT_EQ(test, -EINVAL, ret); + KUNIT_EXPECT_EQ(test, 1ULL, adapter->rx_queue.index); + KUNIT_EXPECT_EQ(test, 1ULL, adapter->rx_queue.toggle); + + ret = ibmveth_rxq_harvest_buffer(adapter, true); + KUNIT_EXPECT_EQ(test, -EFAULT, ret); + KUNIT_EXPECT_EQ(test, 0ULL, adapter->rx_queue.index); + KUNIT_EXPECT_EQ(test, 0ULL, adapter->rx_queue.toggle); flush_work(&adapter->work); } @@ -2292,6 +2509,7 @@ static void ibmveth_rxq_get_buffer_test(struct kunit test) static struct kunit_case ibmveth_test_cases[] = { KUNIT_CASE(ibmveth_remove_buffer_from_pool_test), KUNIT_CASE(ibmveth_rxq_get_buffer_test), + KUNIT_CASE(ibmveth_rxq_harvest_buffer_test), {} }; diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h index d87713668ed30..be0939caa328e 100644 --- a/drivers/net/ethernet/ibm/ibmveth.h +++ b/drivers/net/ethernet/ibm/ibmveth.h @@ -14,6 +14,8 @@ #ifndef _IBMVETH_H #define _IBMVETH_H +#include <linux/completion.h> + /* constants for H_MULTICAST_CTRL / #define IbmVethMcastReceptionModifyBit 0x80000UL #define IbmVethMcastReceptionEnableBit 0x20000UL @@ -143,6 +145,7 @@ struct ibmveth_buff_pool { struct sk_buff skbuff; int active; struct kobject kobj; + struct completion released; }; struct ibmveth_rx_q { @@ -172,6 +175,8 @@ struct ibmveth_adapter { int rx_csum; int large_send; bool is_active_trunk; + / Set by a successful ibmveth_open(), cleared by ibmveth_close(). */ + bool opened; unsigned int rx_buffers_per_hcall; u64 fw_ipv6_csum_support;
3/2	2026/10/09 21:51	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 11952 output: 32 thoughts: 167 Thoughts: Evaluating the Fuzzing Potential of This Patch Series Okay, so the goal is to figure out if this patch series is even worth the effort of throwing syzkaller at it, specifically on amd64. First, let's carefully dissect the instructions and the patches themselves. I need to understand the scope and target. The key here, it seems, is `ibmveth`. My initial thought is to ascertain if `ibmveth` is even reachable on amd64. I see the file paths, `drivers/net/ethernet/ibm/ibmveth.c` and `ibmveth.h`. Classic. Wait a second… `ibmveth`… that rings a bell. IBM virtual ethernet. That screams IBM Power, right? Like pSeries, vio_bus, PHYP, that whole ecosystem. But does it ever touch amd64? This is the crucial point. Does this code have the potential to be compiled for x86? Is it guarded by any architecture-specific or platform-specific configs that would prevent it from even being built on amd64? My intuition says unlikely, but I need to be certain. I need to quickly check the Kconfig. I can either use grepper or just dive into `drivers/net/ethernet/ibm/Kconfig`. This is going to tell me if things like `PPC_PSERIES`, `PPC_VIOPATH`, or even a generic `CONFIG_PPC` gate the visibility of `ibmveth`. That's the deciding factor here – can syzkaller even reach this code on amd64?
4/2	2026/10/09 21:51	tool	grepper	0m Args: { "Expression": "IBMVETH", "PathPrefixes": [ "drivers/net/ethernet/ibm" ] } Results: { "Output": "\nFull output is too long, showing 200 out of 383 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (4 files in total):\ndrivers/net/ethernet/ibm/Kconfig:3\ndrivers/net/ethernet/ibm/Makefile:1\ndrivers/net/ethernet/ibm/ibmveth.c:79\ndrivers/net/ethernet/ibm/ibmveth.h:40\n\ndrivers/net/ethernet/ibm/Kconfig=18=if NET_VENDOR_IBM\ndrivers/net/ethernet/ibm/Kconfig-19-\ndrivers/net/ethernet/ibm/Kconfig:20:config IBMVETH\ndrivers/net/ethernet/ibm/Kconfig-21-\ttristate \"IBM LAN Virtual Ethernet support\"\n--\ndrivers/net/ethernet/ibm/Kconfig-29-\ndrivers/net/ethernet/ibm/Kconfig:30:config IBMVETH_KUNIT_TEST\ndrivers/net/ethernet/ibm/Kconfig-31-\tbool \"KUnit test for IBM LAN Virtual Ethernet support\" if !KUNIT_ALL_TESTS\ndrivers/net/ethernet/ibm/Kconfig-32-\tdepends on KUNIT\ndrivers/net/ethernet/ibm/Kconfig:33:\tdepends on KUNIT=y \u0026\u0026 IBMVETH=y\ndrivers/net/ethernet/ibm/Kconfig-34-\tdefault KUNIT_ALL_TESTS\n--\ndrivers/net/ethernet/ibm/Makefile-5-\ndrivers/net/ethernet/ibm/Makefile:6:obj-$(CONFIG_IBMVETH) += ibmveth.o\ndrivers/net/ethernet/ibm/Makefile-7-obj-$(CONFIG_IBMVNIC) += ibmvnic.o\n--\ndrivers/net/ethernet/ibm/ibmveth.c=75=struct ibmveth_stat {\n--\ndrivers/net/ethernet/ibm/ibmveth.c-79-\ndrivers/net/ethernet/ibm/ibmveth.c:80:#define IBMVETH_STAT_OFF(stat) offsetof(struct ibmveth_adapter, stat)\ndrivers/net/ethernet/ibm/ibmveth.c:81:#define IBMVETH_GET_STAT(a, off) ((u64 )(((unsigned long)(a)) + off))\ndrivers/net/ethernet/ibm/ibmveth.c-82-\ndrivers/net/ethernet/ibm/ibmveth.c=83=static struct ibmveth_stat ibmveth_stats[] = {\ndrivers/net/ethernet/ibm/ibmveth.c:84:\t{ \"replenish_task_cycles\", IBMVETH_STAT_OFF(replenish_task_cycles) },\ndrivers/net/ethernet/ibm/ibmveth.c:85:\t{ \"replenish_no_mem\", IBMVETH_STAT_OFF(replenish_no_mem) },\ndrivers/net/ethernet/ibm/ibmveth.c-86-\t{ \"replenish_add_buff_failure\",\ndrivers/net/ethernet/ibm/ibmveth.c:87:\t\t\tIBMVETH_STAT_OFF(replenish_add_buff_failure) },\ndrivers/net/ethernet/ibm/ibmveth.c-88-\t{ \"replenish_add_buff_success\",\ndrivers/net/ethernet/ibm/ibmveth.c:89:\t\t\tIBMVETH_STAT_OFF(replenish_add_buff_success) },\ndrivers/net/ethernet/ibm/ibmveth.c:90:\t{ \"rx_invalid_buffer\", IBMVETH_STAT_OFF(rx_invalid_buffer) },\ndrivers/net/ethernet/ibm/ibmveth.c:91:\t{ \"rx_no_buffer\", IBMVETH_STAT_OFF(rx_no_buffer) },\ndrivers/net/ethernet/ibm/ibmveth.c:92:\t{ \"tx_map_failed\", IBMVETH_STAT_OFF(tx_map_failed) },\ndrivers/net/ethernet/ibm/ibmveth.c:93:\t{ \"tx_send_failed\", IBMVETH_STAT_OFF(tx_send_failed) },\ndrivers/net/ethernet/ibm/ibmveth.c:94:\t{ \"fw_enabled_ipv4_csum\", IBMVETH_STAT_OFF(fw_ipv4_csum_support) },\ndrivers/net/ethernet/ibm/ibmveth.c:95:\t{ \"fw_enabled_ipv6_csum\", IBMVETH_STAT_OFF(fw_ipv6_csum_support) },\ndrivers/net/ethernet/ibm/ibmveth.c:96:\t{ \"tx_large_packets\", IBMVETH_STAT_OFF(tx_large_packets) },\ndrivers/net/ethernet/ibm/ibmveth.c:97:\t{ \"rx_large_packets\", IBMVETH_STAT_OFF(rx_large_packets) },\ndrivers/net/ethernet/ibm/ibmveth.c:98:\t{ \"fw_enabled_large_send\", IBMVETH_STAT_OFF(fw_large_send_support) }\ndrivers/net/ethernet/ibm/ibmveth.c-99-};\n--\ndrivers/net/ethernet/ibm/ibmveth.c=107=static inline int ibmveth_rxq_toggle(struct ibmveth_adapter adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-108-{\ndrivers/net/ethernet/ibm/ibmveth.c:109:\treturn (ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_TOGGLE) \u003e\u003e\ndrivers/net/ethernet/ibm/ibmveth.c:110:\t\t\tIBMVETH_RXQ_TOGGLE_SHIFT;\ndrivers/net/ethernet/ibm/ibmveth.c-111-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=118=static inline int ibmveth_rxq_buffer_valid(struct ibmveth_adapter adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-119-{\ndrivers/net/ethernet/ibm/ibmveth.c:120:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_VALID;\ndrivers/net/ethernet/ibm/ibmveth.c-121-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=123=static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-124-{\ndrivers/net/ethernet/ibm/ibmveth.c:125:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_OFF_MASK;\ndrivers/net/ethernet/ibm/ibmveth.c-126-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=128=static inline int ibmveth_rxq_large_packet(struct ibmveth_adapter adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-129-{\ndrivers/net/ethernet/ibm/ibmveth.c:130:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_LRG_PKT;\ndrivers/net/ethernet/ibm/ibmveth.c-131-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=145=static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-146-{\ndrivers/net/ethernet/ibm/ibmveth.c:147:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_CSUM_GOOD;\ndrivers/net/ethernet/ibm/ibmveth.c-148-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=150=static unsigned int ibmveth_real_max_tx_queues(void)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-153-\ndrivers/net/ethernet/ibm/ibmveth.c:154:\treturn min(n_cpu, IBMVETH_MAX_QUEUES);\ndrivers/net/ethernet/ibm/ibmveth.c-155-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=218=static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter adapter,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-220-{\ndrivers/net/ethernet/ibm/ibmveth.c:221:\tunion ibmveth_buf_desc descs[IBMVETH_MAX_RX_PER_HCALL] = {0};\ndrivers/net/ethernet/ibm/ibmveth.c-222-\tu32 remaining = pool-\u003esize - atomic_read(\u0026pool-\u003eavailable);\ndrivers/net/ethernet/ibm/ibmveth.c:223:\tu64 correlators[IBMVETH_MAX_RX_PER_HCALL] = {0};\ndrivers/net/ethernet/ibm/ibmveth.c-224-\tunsigned long lpar_rc;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-283-\ndrivers/net/ethernet/ibm/ibmveth.c:284:\t\t\t\tlen = adapter-\u003enetdev-\u003emtu + IBMVETH_BUFF_OH;\ndrivers/net/ethernet/ibm/ibmveth.c-285-\t\t\t\tlen = min(pool-\u003ebuff_size, len);\n--\ndrivers/net/ethernet/ibm/ibmveth.c-289-\ndrivers/net/ethernet/ibm/ibmveth.c:290:\t\t\tdescs[filled].fields.flags_len = IBMVETH_BUF_VALID \|\ndrivers/net/ethernet/ibm/ibmveth.c-291-\t\t\t\t\t\t\t pool-\u003ebuff_size;\n--\ndrivers/net/ethernet/ibm/ibmveth.c=402=static void ibmveth_replenish_task(struct ibmveth_adapter adapter)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-407-\ndrivers/net/ethernet/ibm/ibmveth.c:408:\tfor (i = (IBMVETH_NUM_BUFF_POOLS - 1); i \u003e= 0; i--) {\ndrivers/net/ethernet/ibm/ibmveth.c-409-\t\tstruct ibmveth_buff_pool pool = \u0026adapter-\u003erx_buff_pool[i];\n--\ndrivers/net/ethernet/ibm/ibmveth.c=454=static bool ibmveth_rxq_correlator_valid(struct ibmveth_adapter adapter,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-460-\t/ An inactive pool keeps its size but has no skbuff array. /\ndrivers/net/ethernet/ibm/ibmveth.c:461:\tif (pool \u003c IBMVETH_NUM_BUFF_POOLS \u0026\u0026\ndrivers/net/ethernet/ibm/ibmveth.c-462-\t index \u003c adapter-\u003erx_buff_pool[pool].size \u0026\u0026\n--\ndrivers/net/ethernet/ibm/ibmveth.c=660=static int ibmveth_open(struct net_device netdev)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-672-\ndrivers/net/ethernet/ibm/ibmveth.c:673:\tfor(i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\ndrivers/net/ethernet/ibm/ibmveth.c-674-\t\trxq_entries += adapter-\u003erx_buff_pool[i].size;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-723-\ndrivers/net/ethernet/ibm/ibmveth.c:724:\trxq_desc.fields.flags_len = IBMVETH_BUF_VALID \|\ndrivers/net/ethernet/ibm/ibmveth.c-725-\t\t\t\t\tadapter-\u003erx_queue.queue_len;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-748-\ndrivers/net/ethernet/ibm/ibmveth.c:749:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++) {\ndrivers/net/ethernet/ibm/ibmveth.c-750-\t\tif (!adapter-\u003erx_buff_pool[i].active)\n--\ndrivers/net/ethernet/ibm/ibmveth.c=821=static int ibmveth_close(struct net_device netdev)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-873-\ndrivers/net/ethernet/ibm/ibmveth.c:874:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\ndrivers/net/ethernet/ibm/ibmveth.c-875-\t\tif (adapter-\u003erx_buff_pool[i].active)\n--\ndrivers/net/ethernet/ibm/ibmveth.c=971=static int ibmveth_set_csum_offload(struct net_device dev, u32 data)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-990-\tif (data) {\ndrivers/net/ethernet/ibm/ibmveth.c:991:\t\tset_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c:992:\t\tset_attr6 = IBMVETH_ILLAN_IPV6_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c-993-\t} else {\ndrivers/net/ethernet/ibm/ibmveth.c:994:\t\tclr_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c:995:\t\tclr_attr6 = IBMVETH_ILLAN_IPV6_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c-996-\t}\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1000-\tif (ret == H_SUCCESS \u0026\u0026\ndrivers/net/ethernet/ibm/ibmveth.c:1001:\t (ret_attr \u0026 IBMVETH_ILLAN_PADDED_PKT_CSUM)) {\ndrivers/net/ethernet/ibm/ibmveth.c-1002-\t\tret4 = h_illan_attributes(adapter-\u003evdev-\u003eunit_address, clr_attr,\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1054=static int ibmveth_set_tso(struct net_device dev, u32 data)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1070-\tif (data)\ndrivers/net/ethernet/ibm/ibmveth.c:1071:\t\tset_attr = IBMVETH_ILLAN_LRG_SR_ENABLED;\ndrivers/net/ethernet/ibm/ibmveth.c-1072-\telse\ndrivers/net/ethernet/ibm/ibmveth.c:1073:\t\tclr_attr = IBMVETH_ILLAN_LRG_SR_ENABLED;\ndrivers/net/ethernet/ibm/ibmveth.c-1074-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1076-\ndrivers/net/ethernet/ibm/ibmveth.c:1077:\tif (ret1 == H_SUCCESS \u0026\u0026 (ret_attr \u0026 IBMVETH_ILLAN_LRG_SND_SUPPORT) \u0026\u0026\ndrivers/net/ethernet/ibm/ibmveth.c-1078-\t !old_large_send) {\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1161=static void ibmveth_get_ethtool_stats(struct net_device dev,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1167-\tfor (i = 0; i \u003c ARRAY_SIZE(ibmveth_stats); i++)\ndrivers/net/ethernet/ibm/ibmveth.c:1168:\t\tdata[i] = IBMVETH_GET_STAT(adapter, ibmveth_stats[i].offset);\ndrivers/net/ethernet/ibm/ibmveth.c-1169-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1181=static int ibmveth_set_channels(struct net_device netdev,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1195-\ndrivers/net/ethernet/ibm/ibmveth.c:1196:\t/ We have IBMVETH_MAX_QUEUES netdev_queue's allocated\ndrivers/net/ethernet/ibm/ibmveth.c-1197-\t * but we may need to alloc/free the ltb's.\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1300=static netdev_tx_t ibmveth_start_xmit(struct sk_buff skb,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1323-\ndrivers/net/ethernet/ibm/ibmveth.c:1324:\tdesc_flags = IBMVETH_BUF_VALID;\ndrivers/net/ethernet/ibm/ibmveth.c-1325-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1329-\ndrivers/net/ethernet/ibm/ibmveth.c:1330:\t\tdesc_flags \|= (IBMVETH_BUF_NO_CSUM \| IBMVETH_BUF_CSUM_GOOD);\ndrivers/net/ethernet/ibm/ibmveth.c-1331-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1336-\t\tif (skb_is_gso(skb) \u0026\u0026 adapter-\u003efw_large_send_support)\ndrivers/net/ethernet/ibm/ibmveth.c:1337:\t\t\tdesc_flags \|= IBMVETH_BUF_LRG_SND;\ndrivers/net/ethernet/ibm/ibmveth.c-1338-\t}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1755=static int ibmveth_change_mtu(struct net_device dev, int new_mtu)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1758-\tstruct vio_dev viodev = adapter-\u003evdev;\ndrivers/net/ethernet/ibm/ibmveth.c:1759:\tint new_mtu_oh = new_mtu + IBMVETH_BUFF_OH;\ndrivers/net/ethernet/ibm/ibmveth.c-1760-\tint i, rc;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1762-\ndrivers/net/ethernet/ibm/ibmveth.c:1763:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\ndrivers/net/ethernet/ibm/ibmveth.c-1764-\t\tif (new_mtu_oh \u003c= adapter-\u003erx_buff_pool[i].buff_size)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1766-\ndrivers/net/ethernet/ibm/ibmveth.c:1767:\tif (i == IBMVETH_NUM_BUFF_POOLS)\ndrivers/net/ethernet/ibm/ibmveth.c-1768-\t\treturn -EINVAL;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1777-\t/ Look for an active buffer pool that can hold the new MTU /\ndrivers/net/ethernet/ibm/ibmveth.c:1778:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++) {\ndrivers/net/ethernet/ibm/ibmveth.c-1779-\t\tadapter-\u003erx_buff_pool[i].active = 1;\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1807=static unsigned long ibmveth_get_desired_dma(struct vio_dev vdev)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1819-\tif (netdev == NULL)\ndrivers/net/ethernet/ibm/ibmveth.c:1820:\t\treturn IOMMU_PAGE_ALIGN(IBMVETH_IO_ENTITLEMENT_DEFAULT, tbl);\ndrivers/net/ethernet/ibm/ibmveth.c-1821-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1823-\ndrivers/net/ethernet/ibm/ibmveth.c:1824:\tret = IBMVETH_BUFF_LIST_SIZE + IBMVETH_FILT_LIST_SIZE;\ndrivers/net/ethernet/ibm/ibmveth.c-1825-\tret += IOMMU_PAGE_ALIGN(netdev-\u003emtu, tbl);\ndrivers/net/ethernet/ibm/ibmveth.c-1826-\t/* add size of mapped tx buffers */\n\n" }
5/2	2026/10/09 21:51	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 17877 output: 37 thoughts: 29 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Analyzing the Dependency Landscape of CONFIG_IBMVETH Alright, let's dive right in. My first thought is to zero in on the dependencies of `CONFIG_IBMVETH`. I'll immediately head over to `drivers/net/ethernet/ibm/Kconfig`. This is standard operating procedure, of course, but it's important to be methodical. Kconfig files are the heart of configuration in the kernel, and that's where I'll find the precise information I need regarding what other components, features, or drivers need to be enabled or are in conflict with this one. I anticipate finding conditionals, relationships to other `CONFIG_` options, and potentially information on any hardware requirements or constraints. This quick check will give me a clear picture of how `CONFIG_IBMVETH` fits within the larger network stack and potentially identify any areas where I'll need to pay extra attention to avoid conflicts or ensure proper functionality. From there, I can begin to draw more complex conclusions based on the resulting dependency tree.
6/2	2026/10/09 21:51	tool	read-file	0m Args: { "File": "drivers/net/ethernet/ibm/Kconfig", "FirstLine": 1, "LineCount": 45 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t#\n 3:\t# IBM device configuration.\n 4:\t#\n 5:\t\n 6:\tconfig NET_VENDOR_IBM\n 7:\t\tbool \"IBM devices\"\n 8:\t\tdefault y\n 9:\t\tdepends on PPC_PSERIES \|\| PPC_DCR \|\| (IBMEBUS \u0026\u0026 SPARSEMEM)\n 10:\t\thelp\n 11:\t\t If you have a network (Ethernet) card belonging to this class, say Y.\n 12:\t\n 13:\t\t Note that the answer to this question doesn't directly affect the\n 14:\t\t kernel: saying N will just cause the configurator to skip all\n 15:\t\t the questions about IBM devices. If you say Y, you will be asked for\n 16:\t\t your specific card in the following questions.\n 17:\t\n 18:\tif NET_VENDOR_IBM\n 19:\t\n 20:\tconfig IBMVETH\n 21:\t\ttristate \"IBM LAN Virtual Ethernet support\"\n 22:\t\tdepends on PPC_PSERIES\n 23:\t\thelp\n 24:\t\t This driver supports virtual ethernet adapters on newer IBM iSeries\n 25:\t\t and pSeries systems.\n 26:\t\n 27:\t\t To compile this driver as a module, choose M here. The module will\n 28:\t\t be called ibmveth.\n 29:\t\n 30:\tconfig IBMVETH_KUNIT_TEST\n 31:\t\tbool \"KUnit test for IBM LAN Virtual Ethernet support\" if !KUNIT_ALL_TESTS\n 32:\t\tdepends on KUNIT\n 33:\t\tdepends on KUNIT=y \u0026\u0026 IBMVETH=y\n 34:\t\tdefault KUNIT_ALL_TESTS\n 35:\t\thelp\n 36:\t\t This builds unit tests for the IBM LAN Virtual Ethernet driver.\n 37:\t\n 38:\t\t For more information on KUnit and unit tests in general, please refer\n 39:\t\t to the KUnit documentation in Documentation/dev-tools/kunit/.\n 40:\t\n 41:\t\t If unsure, say N.\n 42:\t\n 43:\tsource \"drivers/net/ethernet/ibm/emac/Kconfig\"\n 44:\t\n 45:\tconfig IBMVNIC\n" }
7/2	2026/10/09 21:51	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 18775 output: 20 thoughts: 130 Thoughts: Investigating IBM LAN Virtual Ethernet Support Okay, let's dive into this Kconfig snippet. Lines 20-22 highlight the `IBMVETH` configuration. Interesting, it's a tristate option for IBM LAN Virtual Ethernet, and it depends on `PPC_PSERIES`. My immediate thought is, "Right, Power Systems, makes sense." But then I see that `NET_VENDOR_IBM` also has a dependency of `PPC_PSERIES` (among other things). Now, that gives me pause. I know PPC_PSERIES usually relates to PowerPC architecture and System p servers. But… can `PPC_PSERIES` actually be enabled on an amd64 system? That doesn't seem right. I need to clarify this. I should go and check the definition of `PPC_PSERIES` within the Kconfig files and review if this dependency can be extended to other architectures, or if there's a problem here. I suspect there's a missing or inaccurate constraint. Let's see...
8/2	2026/10/09 21:51	tool	grepper	0m Args: { "Expression": "config PPC_PSERIES" } Results: { "Output": "arch/powerpc/platforms/pseries/Kconfig-1-# SPDX-License-Identifier: GPL-2.0\narch/powerpc/platforms/pseries/Kconfig:2:config PPC_PSERIES\narch/powerpc/platforms/pseries/Kconfig-3-\tdepends on PPC64 \u0026\u0026 PPC_BOOK3S\n--\narch/powerpc/platforms/pseries/Kconfig=92=config LPARCFG\n--\narch/powerpc/platforms/pseries/Kconfig-98-\narch/powerpc/platforms/pseries/Kconfig:99:config PPC_PSERIES_DEBUG\narch/powerpc/platforms/pseries/Kconfig-100-\tdepends on PPC_PSERIES \u0026\u0026 PPC_EARLY_DEBUG\n" }
9/2	2026/10/09 21:51	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 19344 output: 40 thoughts: 122 Thoughts: Investigating the IBMVETH Compatibility Okay, so I'm looking at `PPC_PSERIES`, and it's clear that the driver `IBMVETH` relies heavily on `PPC64` and `PPC_BOOK3S`. But I need to get to the bottom of this. The bigger question is, can `IBMVETH` even compile on an AMD64 system, or is it completely unreachable? Let's see if a `COMPILE_TEST` configuration option can somehow enable it. My initial thought is to check the configuration itself: I'll start by examining the `config IBMVETH` block. Right, here's what I see: `depends on PPC_PSERIES`. No `\|\| COMPILE_TEST` clause to broaden its availability. That's a strong indicator. Now I need to confirm this from the implementation side. Since `ibmveth.c` is the key file, let me quickly search for instances of `#include <asm/vio.h>` or a similar include that would imply a dependency on PowerPC-specific virtual I/O hardware. That's usually the telltale sign.
10/2	2026/10/09 21:52	tool	read-file	0m Args: { "File": "drivers/net/ethernet/ibm/ibmveth.c", "FirstLine": 1, "LineCount": 50 } Results: { "Contents": " 1:\t// SPDX-License-Identifier: GPL-2.0-or-later\n 2:\t/\n 3:\t IBM Power Virtual Ethernet Device Driver\n 4:\t \n 5:\t Copyright (C) IBM Corporation, 2003, 2010\n 6:\t \n 7:\t Authors: Dave Larson \u003clarson1@us.ibm.com\u003e\n 8:\t \t Santiago Leon \u003csantil@linux.vnet.ibm.com\u003e\n 9:\t \t Brian King \u003cbrking@linux.vnet.ibm.com\u003e\n 10:\t \t Robert Jennings \u003crcj@linux.vnet.ibm.com\u003e\n 11:\t \t Anton Blanchard \u003canton@au.ibm.com\u003e\n 12:\t /\n 13:\t\n 14:\t#include \u003clinux/module.h\u003e\n 15:\t#include \u003clinux/types.h\u003e\n 16:\t#include \u003clinux/errno.h\u003e\n 17:\t#include \u003clinux/dma-mapping.h\u003e\n 18:\t#include \u003clinux/kernel.h\u003e\n 19:\t#include \u003clinux/netdevice.h\u003e\n 20:\t#include \u003clinux/etherdevice.h\u003e\n 21:\t#include \u003clinux/skbuff.h\u003e\n 22:\t#include \u003clinux/init.h\u003e\n 23:\t#include \u003clinux/interrupt.h\u003e\n 24:\t#include \u003clinux/mm.h\u003e\n 25:\t#include \u003clinux/pm.h\u003e\n 26:\t#include \u003clinux/ethtool.h\u003e\n 27:\t#include \u003clinux/in.h\u003e\n 28:\t#include \u003clinux/ip.h\u003e\n 29:\t#include \u003clinux/ipv6.h\u003e\n 30:\t#include \u003clinux/slab.h\u003e\n 31:\t#include \u003casm/hvcall.h\u003e\n 32:\t#include \u003clinux/atomic.h\u003e\n 33:\t#include \u003casm/vio.h\u003e\n 34:\t#include \u003casm/iommu.h\u003e\n 35:\t#include \u003casm/firmware.h\u003e\n 36:\t#include \u003cnet/tcp.h\u003e\n 37:\t#include \u003cnet/ip6_checksum.h\u003e\n 38:\t\n 39:\t#include \"ibmveth.h\"\n 40:\t\n 41:\tstatic irqreturn_t ibmveth_interrupt(int irq, void dev_instance);\n 42:\tstatic unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev);\n 43:\t\n 44:\tstatic struct kobj_type ktype_veth_pool;\n 45:\t\n 46:\t\n 47:\tstatic const char ibmveth_driver_name[] = \"ibmveth\";\n 48:\tstatic const char ibmveth_driver_string[] = \"IBM Power Virtual Ethernet Driver\";\n 49:\t#define ibmveth_driver_version \"1.06\"\n 50:\t\n" }
11/2	2026/10/09 21:52	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 20543 output: 152 thoughts: 818 Thoughts: Fuzzing Verdict: Not Worthy Okay, let's break this down systematically. I see the code modification involves `ibmveth.c` and `ibmveth.h`, which immediately rings alarm bells – that's IBM Power Virtual Ethernet, definitely a PowerPC thing. Looking at the includes, specifically `<asm/hvcall.h>` and `<asm/vio.h>`, confirms my suspicions; those are PowerPC specific headers. I need to make sure this isn't relevant to my target architecture, amd64. Section 2 of the instructions provides negative criteria, and one of them is "Code paths exclusive to architectures other than the target architecture." Perfect. My gut feeling is right on this. To be completely sure, I'll go through the details methodically. First, I need to see the dependencies. I see that `CONFIG_IBMVETH` depends on `CONFIG_PPC_PSERIES`, which in turn depends on `PPC64 && PPC_BOOK3S`. That confirms it – this isn't even compilable on amd64. It’s PowerPC-only. And the included headers cement it: hypervisor calls and VIO bus code are all PPC-specific. Even without checking the source itself, I know there is no way this could be relevant on amd64. It's a dead end. I've confirmed the files touched are only in `ibmveth.c` and `ibmveth.h`, which are definitely IBM Power / PPC architecture. All of my previous findings apply. Therefore, given all of this information, this is not relevant to my target architecture. It's an unreachable execution path on amd64. I need to make sure this fits my "set-results" requirements. `WorthFuzzing` should be `false`, `EnableConfigs` and `FocusSymbols` should be an empty list, and I'll need a clear `Reasoning`. I'll formulate that concisely: "The patch modifies the IBM Power Virtual Ethernet (`ibmveth`) driver and its KUnit tests. The `CONFIG_IBMVETH` driver depends on `CONFIG_PPC_PSERIES` (PowerPC architecture) and includes architecture-specific headers (`<asm/hvcall.h>`, `<asm/vio.h>`). It cannot be compiled or executed on the target architecture (`amd64`). Because the changes are exclusive to an architecture other than the target architecture, they are unreachable and do not warrant fuzzing." Now that I've double-checked everything, I'm confident in my assessment. I can call `set-results` with the appropriate parameters.
12/2	2026/10/09 21:52	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.", "WorthFuzzing": false }
13/1	2026/10/09 21:52	action	If	0m Args: { "WorthFuzzing": false } Results: null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "PatchDiff": "commit 0594d4fd21630d3da95b5622b872d3c05cfb9a30\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Oct 9 21:51:29 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c\nindex abebdb1fc2628..fc90ee6663c36 100644\n--- a/drivers/net/ethernet/ibm/ibmveth.c\n+++ b/drivers/net/ethernet/ibm/ibmveth.c\n@@ -135,6 +135,13 @@ static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter)\n \treturn be32_to_cpu(adapter-\u003erx_queue.queue_addr[adapter-\u003erx_queue.index].length);\n }\n \n+static u64 ibmveth_rxq_correlator(struct ibmveth_adapter *adapter)\n+{\n+\tunsigned int idx = adapter-\u003erx_queue.index;\n+\n+\treturn READ_ONCE(adapter-\u003erx_queue.queue_addr[idx].correlator);\n+}\n+\n static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter *adapter)\n {\n \treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_CSUM_GOOD;\n@@ -443,6 +450,37 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter,\n \t}\n }\n \n+/* The correlator comes back from PHYP; a bad one schedules a reset. */\n+static bool ibmveth_rxq_correlator_valid(struct ibmveth_adapter *adapter,\n+\t\t\t\t\t u64 correlator)\n+{\n+\tunsigned int index = correlator \u0026 0xffffffffUL;\n+\tunsigned int pool = correlator \u003e\u003e 32;\n+\n+\t/* An inactive pool keeps its size but has no skbuff array. */\n+\tif (pool \u003c IBMVETH_NUM_BUFF_POOLS \u0026\u0026\n+\t    index \u003c adapter-\u003erx_buff_pool[pool].size \u0026\u0026\n+\t    adapter-\u003erx_buff_pool[pool].skbuff)\n+\t\treturn true;\n+\n+\tif (net_ratelimit())\n+\t\tnetdev_err(adapter-\u003enetdev,\n+\t\t\t   \"invalid RX correlator %llx, resetting\\n\",\n+\t\t\t   correlator);\n+\tschedule_work(\u0026adapter-\u003ework);\n+\treturn false;\n+}\n+\n+static void ibmveth_rxq_no_skb(struct ibmveth_adapter *adapter,\n+\t\t\t       u64 correlator)\n+{\n+\tif (net_ratelimit())\n+\t\tnetdev_err(adapter-\u003enetdev,\n+\t\t\t   \"no buffer for RX correlator %llx, resetting\\n\",\n+\t\t\t   correlator);\n+\tschedule_work(\u0026adapter-\u003ework);\n+}\n+\n /**\n  * ibmveth_remove_buffer_from_pool - remove a buffer from a pool\n  * @adapter: adapter instance\n@@ -451,7 +489,8 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter,\n  *\n  * Return:\n  * * %0       - success\n- * * %-EINVAL - correlator maps to pool or index out of range\n+ * * %-EINVAL - correlator maps to pool or index out of range, or to an\n+ *              inactive pool\n  * * %-EFAULT - pool and index map to null skb\n  */\n static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,\n@@ -462,15 +501,12 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,\n \tunsigned int free_index;\n \tstruct sk_buff *skb;\n \n-\tif (WARN_ON(pool \u003e= IBMVETH_NUM_BUFF_POOLS) ||\n-\t    WARN_ON(index \u003e= adapter-\u003erx_buff_pool[pool].size)) {\n-\t\tschedule_work(\u0026adapter-\u003ework);\n+\tif (!ibmveth_rxq_correlator_valid(adapter, correlator))\n \t\treturn -EINVAL;\n-\t}\n \n \tskb = adapter-\u003erx_buff_pool[pool].skbuff[index];\n-\tif (WARN_ON(!skb)) {\n-\t\tschedule_work(\u0026adapter-\u003ework);\n+\tif (!skb) {\n+\t\tibmveth_rxq_no_skb(adapter, correlator);\n \t\treturn -EFAULT;\n \t}\n \n@@ -504,20 +540,29 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,\n \treturn 0;\n }\n \n-/* get the current buffer on the rx queue */\n-static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *adapter)\n+/* get the buffer for @correlator, read once from the current rx queue entry */\n+static struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *adapter,\n+\t\t\t\t\t      u64 correlator)\n {\n-\tu64 correlator = adapter-\u003erx_queue.queue_addr[adapter-\u003erx_queue.index].correlator;\n \tunsigned int pool = correlator \u003e\u003e 32;\n \tunsigned int index = correlator \u0026 0xffffffffUL;\n+\tstruct sk_buff *skb;\n \n-\tif (WARN_ON(pool \u003e= IBMVETH_NUM_BUFF_POOLS) ||\n-\t    WARN_ON(index \u003e= adapter-\u003erx_buff_pool[pool].size)) {\n-\t\tschedule_work(\u0026adapter-\u003ework);\n+\tif (!ibmveth_rxq_correlator_valid(adapter, correlator))\n \t\treturn NULL;\n-\t}\n \n-\treturn adapter-\u003erx_buff_pool[pool].skbuff[index];\n+\tskb = adapter-\u003erx_buff_pool[pool].skbuff[index];\n+\tif (!skb)\n+\t\tibmveth_rxq_no_skb(adapter, correlator);\n+\treturn skb;\n+}\n+\n+static void ibmveth_rxq_advance(struct ibmveth_adapter *adapter)\n+{\n+\tif (++adapter-\u003erx_queue.index == adapter-\u003erx_queue.num_slots) {\n+\t\tadapter-\u003erx_queue.index = 0;\n+\t\tadapter-\u003erx_queue.toggle = !adapter-\u003erx_queue.toggle;\n+\t}\n }\n \n /**\n@@ -528,6 +573,9 @@ static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *ada\n  *\n  * Context: called from ibmveth_poll\n  *\n+ * The ring advances even on error, so poll does not return to a bad\n+ * slot before the scheduled reset can run.\n+ *\n  * Return:\n  * * %0    - success\n  * * other - non-zero return from ibmveth_remove_buffer_from_pool\n@@ -540,15 +588,9 @@ static int ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter,\n \n \tcor = adapter-\u003erx_queue.queue_addr[adapter-\u003erx_queue.index].correlator;\n \trc = ibmveth_remove_buffer_from_pool(adapter, cor, reuse);\n-\tif (unlikely(rc))\n-\t\treturn rc;\n-\n-\tif (++adapter-\u003erx_queue.index == adapter-\u003erx_queue.num_slots) {\n-\t\tadapter-\u003erx_queue.index = 0;\n-\t\tadapter-\u003erx_queue.toggle = !adapter-\u003erx_queue.toggle;\n-\t}\n+\tibmveth_rxq_advance(adapter);\n \n-\treturn 0;\n+\treturn rc;\n }\n \n static void ibmveth_free_tx_ltb(struct ibmveth_adapter *adapter, int idx)\n@@ -628,8 +670,6 @@ static int ibmveth_open(struct net_device *netdev)\n \n \tnetdev_dbg(netdev, \"open starting\\n\");\n \n-\tnapi_enable(\u0026adapter-\u003enapi);\n-\n \tfor(i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n \t\trxq_entries += adapter-\u003erx_buff_pool[i].size;\n \n@@ -717,10 +757,19 @@ static int ibmveth_open(struct net_device *netdev)\n \t\t}\n \t}\n \n+\t/* NAPI can run as soon as it is enabled, from netpoll during the\n+\t * direct close()/open() pairs or from a direct ibmveth_interrupt()\n+\t * call, so enable it only once everything ibmveth_poll() touches\n+\t * exists.\n+\t */\n+\tnapi_enable(\u0026adapter-\u003enapi);\n+\n \tnetdev_dbg(netdev, \"registering irq 0x%x\\n\", netdev-\u003eirq);\n \trc = request_irq(netdev-\u003eirq, ibmveth_interrupt, 0, netdev-\u003ename,\n \t\t\t netdev);\n \tif (rc != 0) {\n+\t\tnapi_disable(\u0026adapter-\u003enapi);\n+\t\tsynchronize_net();\n \t\tnetdev_err(netdev, \"unable to request irq 0x%x, rc %d\\n\",\n \t\t\t   netdev-\u003eirq, rc);\n \t\tgoto out_free_buffer_pools;\n@@ -733,6 +782,7 @@ static int ibmveth_open(struct net_device *netdev)\n \n \tnetif_tx_start_all_queues(netdev);\n \n+\tadapter-\u003eopened = true;\n \tnetdev_dbg(netdev, \"open complete\\n\");\n \n \treturn 0;\n@@ -765,7 +815,6 @@ static int ibmveth_open(struct net_device *netdev)\n out_free_buffer_list:\n \tfree_page((unsigned long)adapter-\u003ebuffer_list_addr);\n out:\n-\tnapi_disable(\u0026adapter-\u003enapi);\n \treturn rc;\n }\n \n@@ -776,11 +825,24 @@ static int ibmveth_close(struct net_device *netdev)\n \tlong lpar_rc;\n \tint i;\n \n+\t/* change_mtu, pool sysfs, set_csum and set_tso call close() and\n+\t * open() directly. If that open() fails, IFF_UP stays set and\n+\t * NAPI is disabled; a second close() would hang in napi_disable().\n+\t */\n+\tif (!adapter-\u003eopened)\n+\t\treturn 0;\n+\tadapter-\u003eopened = false;\n+\n \tnetdev_dbg(netdev, \"close starting\\n\");\n \n \tnapi_disable(\u0026adapter-\u003enapi);\n+\t/* napi_disable() returns once ibmveth_poll() has called\n+\t * napi_complete_done(), but the poll still re-enables the\n+\t * interrupt and reads the RX queue after that.\n+\t */\n+\tsynchronize_net();\n \n-\tnetif_tx_stop_all_queues(netdev);\n+\tnetif_tx_disable(netdev);\n \n \th_vio_signal(adapter-\u003evdev-\u003eunit_address, VIO_IRQ_DISABLE);\n \n@@ -827,10 +889,10 @@ static int ibmveth_close(struct net_device *netdev)\n  *\n  * @w: pointer to work_struct embedded in adapter structure\n  *\n- * Context: This routine acquires rtnl_mutex and disables its NAPI through\n- *          ibmveth_close. It can't be called directly in a context that has\n- *          already acquired rtnl_mutex or disabled its NAPI, or directly from\n- *          a poll routine.\n+ * Context: This routine acquires rtnl_mutex and, if the device is open,\n+ *          disables its NAPI through ibmveth_close. It can't be called\n+ *          directly in a context that has already acquired rtnl_mutex or\n+ *          disabled its NAPI, or directly from a poll routine.\n  *\n  * Return: void\n  */\n@@ -1122,12 +1184,13 @@ static int ibmveth_set_channels(struct net_device *netdev,\n \tstruct ibmveth_adapter *adapter = netdev_priv(netdev);\n \tunsigned int old = netdev-\u003ereal_num_tx_queues,\n \t\t     goal = channels-\u003etx_count;\n-\tint rc, i;\n+\tint rc, i, alloc_rc = 0;\n \n-\t/* If ndo_open has not been called yet then don't allocate, just set\n-\t * desired netdev_queue's and return\n+\t/* If the device is not open (including a failed close/open with\n+\t * IFF_UP still set) then don't allocate, just set desired\n+\t * netdev_queue's and return\n \t */\n-\tif (!(netdev-\u003eflags \u0026 IFF_UP))\n+\tif (!adapter-\u003eopened)\n \t\treturn netif_set_real_num_tx_queues(netdev, goal);\n \n \t/* We have IBMVETH_MAX_QUEUES netdev_queue's allocated\n@@ -1147,6 +1210,7 @@ static int ibmveth_set_channels(struct net_device *netdev,\n \t\t/* if something goes wrong, free everything we just allocated */\n \t\tnetdev_err(netdev, \"Failed to allocate more tx queues, returning to %d queues\\n\",\n \t\t\t   old);\n+\t\talloc_rc = rc;\n \t\tgoal = old;\n \t\told = i;\n \t\tbreak;\n@@ -1157,6 +1221,8 @@ static int ibmveth_set_channels(struct net_device *netdev,\n \t\t\t   old);\n \t\tgoal = old;\n \t\told = i;\n+\t} else if (alloc_rc) {\n+\t\trc = alloc_rc;\n \t}\n \t/* Free any that are no longer needed */\n \tfor (i = old; i \u003e goal; i--) {\n@@ -1454,7 +1520,9 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)\n \tstruct net_device *netdev = adapter-\u003enetdev;\n \tint frames_processed = 0;\n \tunsigned long lpar_rc;\n+\tint rescheduled = 0;\n \tu16 mss = 0;\n+\tint rc;\n \n restart_poll:\n \twhile (frames_processed \u003c budget) {\n@@ -1466,19 +1534,46 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)\n \t\t\twmb(); /* suggested by larson1 */\n \t\t\tadapter-\u003erx_invalid_buffer++;\n \t\t\tnetdev_dbg(netdev, \"recycling invalid buffer\\n\");\n-\t\t\tif (unlikely(ibmveth_rxq_harvest_buffer(adapter, true)))\n-\t\t\t\tbreak;\n+\t\t\trc = ibmveth_rxq_harvest_buffer(adapter, true);\n+\t\t\tif (unlikely(rc)) {\n+\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\tframes_processed++;\n+\t\t\t\tcontinue;\n+\t\t\t}\n \t\t} else {\n \t\t\tstruct sk_buff *skb, *new_skb;\n \t\t\tint length = ibmveth_rxq_frame_length(adapter);\n \t\t\tint offset = ibmveth_rxq_frame_offset(adapter);\n \t\t\tint csum_good = ibmveth_rxq_csum_good(adapter);\n \t\t\tint lrg_pkt = ibmveth_rxq_large_packet(adapter);\n+\t\t\tu64 correlator = ibmveth_rxq_correlator(adapter);\n+\t\t\tunsigned int pool, room, off, len;\n \t\t\t__sum16 iph_check = 0;\n \n-\t\t\tskb = ibmveth_rxq_get_buffer(adapter);\n-\t\t\tif (unlikely(!skb))\n-\t\t\t\tbreak;\n+\t\t\tskb = ibmveth_rxq_get_buffer(adapter, correlator);\n+\t\t\tif (unlikely(!skb)) {\n+\t\t\t\tibmveth_rxq_advance(adapter);\n+\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\tframes_processed++;\n+\t\t\t\tcontinue;\n+\t\t\t}\n+\n+\t\t\tpool = correlator \u003e\u003e 32;\n+\t\t\troom = min_t(unsigned int, skb_tailroom(skb),\n+\t\t\t\t     adapter-\u003erx_buff_pool[pool].buff_size);\n+\t\t\toff = offset;\n+\t\t\tlen = length;\n+\t\t\tif (unlikely(len \u003c ETH_HLEN || off \u003e= room ||\n+\t\t\t\t     len \u003e room - off)) {\n+\t\t\t\tif (net_ratelimit())\n+\t\t\t\t\tnetdev_err(netdev,\n+\t\t\t\t\t\t   \"bad RX frame offset %u length %u (buffer %u), dropping\\n\",\n+\t\t\t\t\t\t   off, len, room);\n+\t\t\t\tibmveth_rxq_harvest_buffer(adapter, true);\n+\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\tframes_processed++;\n+\t\t\t\tcontinue;\n+\t\t\t}\n \n \t\t\t/* if the large packet bit is set in the rx queue\n \t\t\t * descriptor, the mss will be written by PHYP eight\n@@ -1502,12 +1597,21 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)\n \t\t\t\tif (rx_flush)\n \t\t\t\t\tibmveth_flush_buffer(skb-\u003edata,\n \t\t\t\t\t\tlength + offset);\n-\t\t\t\tif (unlikely(ibmveth_rxq_harvest_buffer(adapter, true)))\n-\t\t\t\t\tbreak;\n+\t\t\t\trc = ibmveth_rxq_harvest_buffer(adapter, true);\n+\t\t\t\tif (unlikely(rc)) {\n+\t\t\t\t\tdev_kfree_skb_any(new_skb);\n+\t\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\t\tframes_processed++;\n+\t\t\t\t\tcontinue;\n+\t\t\t\t}\n \t\t\t\tskb = new_skb;\n \t\t\t} else {\n-\t\t\t\tif (unlikely(ibmveth_rxq_harvest_buffer(adapter, false)))\n-\t\t\t\t\tbreak;\n+\t\t\t\trc = ibmveth_rxq_harvest_buffer(adapter, false);\n+\t\t\t\tif (unlikely(rc)) {\n+\t\t\t\t\tnetdev-\u003estats.rx_dropped++;\n+\t\t\t\t\tframes_processed++;\n+\t\t\t\t\tcontinue;\n+\t\t\t\t}\n \t\t\t\tskb_reserve(skb, offset);\n \t\t\t}\n \n@@ -1542,7 +1646,11 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)\n \t\t}\n \t}\n \n-\tibmveth_replenish_task(adapter);\n+\t/* netpoll polls with budget 0 for TX only, and is not serialized\n+\t * with a NAPI poll that was already running when it was set up\n+\t */\n+\tif (budget)\n+\t\tibmveth_replenish_task(adapter);\n \n \tif (frames_processed == budget)\n \t\tgoto out;\n@@ -1562,10 +1670,16 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)\n \tif (ibmveth_rxq_pending_buffer(adapter) \u0026\u0026 napi_schedule(napi)) {\n \t\tlpar_rc = h_vio_signal(adapter-\u003evdev-\u003eunit_address,\n \t\t\t\t       VIO_IRQ_DISABLE);\n+\t\trescheduled = 1;\n \t\tgoto restart_poll;\n \t}\n \n out:\n+\t/* napi_schedule() already queued us. Returning budget would\n+\t * make busy_poll_stop() queue the napi a second time.\n+\t */\n+\tif (rescheduled \u0026\u0026 budget \u0026\u0026 frames_processed \u003e= budget)\n+\t\treturn budget - 1;\n \treturn frames_processed;\n }\n \n@@ -1682,14 +1796,6 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)\n \treturn -EINVAL;\n }\n \n-#ifdef CONFIG_NET_POLL_CONTROLLER\n-static void ibmveth_poll_controller(struct net_device *dev)\n-{\n-\tibmveth_replenish_task(netdev_priv(dev));\n-\tibmveth_interrupt(dev-\u003eirq, dev);\n-}\n-#endif\n-\n /**\n  * ibmveth_get_desired_dma - Calculate IO memory desired by the driver\n  *\n@@ -1791,11 +1897,42 @@ static const struct net_device_ops ibmveth_netdev_ops = {\n \t.ndo_validate_addr\t= eth_validate_addr,\n \t.ndo_set_mac_address    = ibmveth_set_mac_addr,\n \t.ndo_features_check\t= ibmveth_features_check,\n-#ifdef CONFIG_NET_POLL_CONTROLLER\n-\t.ndo_poll_controller\t= ibmveth_poll_controller,\n-#endif\n };\n \n+/**\n+ * ibmveth_pool_kobj_release - Mark a pool kobject finished\n+ * @kobj: kobject embedded in the pool\n+ *\n+ * The pool kobjects live in netdev_priv(), so the last put must wait\n+ * for this before free_netdev().\n+ */\n+static void ibmveth_pool_kobj_release(struct kobject *kobj)\n+{\n+\tstruct ibmveth_buff_pool *pool = container_of(kobj,\n+\t\t\t\t\t\t      struct ibmveth_buff_pool,\n+\t\t\t\t\t\t      kobj);\n+\n+\tcomplete(\u0026pool-\u003ereleased);\n+}\n+\n+/**\n+ * ibmveth_put_pool_kobjs - Drop the pool kobjects and wait for release\n+ * @adapter: ibmveth adapter\n+ *\n+ * With CONFIG_DEBUG_KOBJECT_RELEASE the cleanup, including removing the\n+ * sysfs files, runs later from a work item in the kobject; wait for it\n+ * so free_netdev() cannot free the pools first.\n+ */\n+static void ibmveth_put_pool_kobjs(struct ibmveth_adapter *adapter)\n+{\n+\tint i;\n+\n+\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n+\t\tkobject_put(\u0026adapter-\u003erx_buff_pool[i].kobj);\n+\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n+\t\twait_for_completion(\u0026adapter-\u003erx_buff_pool[i].released);\n+}\n+\n static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)\n {\n \tint rc, i, mac_len;\n@@ -1906,6 +2043,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)\n \t\tibmveth_init_buffer_pool(\u0026adapter-\u003erx_buff_pool[i], i,\n \t\t\t\t\t pool_count[i], pool_size[i],\n \t\t\t\t\t pool_active[i]);\n+\t\tinit_completion(\u0026adapter-\u003erx_buff_pool[i].released);\n \t\terror = kobject_init_and_add(kobj, \u0026ktype_veth_pool,\n \t\t\t\t\t     \u0026dev-\u003edev.kobj, \"pool%d\", i);\n \t\tif (!error)\n@@ -1917,8 +2055,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)\n \tif (rc) {\n \t\tnetdev_dbg(netdev, \"failed to set number of tx queues rc=%d\\n\",\n \t\t\t   rc);\n-\t\tfree_netdev(netdev);\n-\t\treturn rc;\n+\t\tgoto err_put_pools;\n \t}\n \tadapter-\u003etx_ltb_size = PAGE_ALIGN(IBMVETH_MAX_TX_BUF_SIZE);\n \tfor (i = 0; i \u003c IBMVETH_MAX_QUEUES; i++)\n@@ -1933,25 +2070,27 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)\n \n \tif (rc) {\n \t\tnetdev_dbg(netdev, \"failed to register netdev rc=%d\\n\", rc);\n-\t\tfree_netdev(netdev);\n-\t\treturn rc;\n+\t\tgoto err_put_pools;\n \t}\n \n \tnetdev_dbg(netdev, \"registered\\n\");\n \n \treturn 0;\n+\n+err_put_pools:\n+\tibmveth_put_pool_kobjs(adapter);\n+\tfree_netdev(netdev);\n+\treturn rc;\n }\n \n static void ibmveth_remove(struct vio_dev *dev)\n {\n \tstruct net_device *netdev = dev_get_drvdata(\u0026dev-\u003edev);\n \tstruct ibmveth_adapter *adapter = netdev_priv(netdev);\n-\tint i;\n \n-\tcancel_work_sync(\u0026adapter-\u003ework);\n+\tdisable_work_sync(\u0026adapter-\u003ework);\n \n-\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n-\t\tkobject_put(\u0026adapter-\u003erx_buff_pool[i].kobj);\n+\tibmveth_put_pool_kobjs(adapter);\n \n \tunregister_netdev(netdev);\n \n@@ -2127,7 +2266,7 @@ static const struct sysfs_ops veth_pool_ops = {\n };\n \n static struct kobj_type ktype_veth_pool = {\n-\t.release        = NULL,\n+\t.release        = ibmveth_pool_kobj_release,\n \t.sysfs_ops      = \u0026veth_pool_ops,\n \t.default_groups = veth_pool_groups,\n };\n@@ -2198,8 +2337,7 @@ static void ibmveth_reset_kunit(struct work_struct *w)\n  * @test: pointer to kunit structure\n  *\n  * Tests the error returns from ibmveth_remove_buffer_from_pool.\n- * ibmveth_remove_buffer_from_pool also calls WARN_ON, so dmesg should be\n- * checked to see that these warnings happened.\n+ * Each error also logs a ratelimited netdev_err.\n  *\n  * Return: void\n  */\n@@ -2208,6 +2346,7 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit *test)\n \tstruct ibmveth_adapter *adapter = kunit_kzalloc(test, sizeof(*adapter), GFP_KERNEL);\n \tstruct ibmveth_buff_pool *pool;\n \tu64 correlator;\n+\tint ret;\n \n \tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter);\n \n@@ -2231,6 +2370,13 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit *test)\n \tKUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, false));\n \tKUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, true));\n \n+\t/* Pool 2 is in range but has no skbuff array, like an inactive pool. */\n+\tcorrelator = ((u64)2 \u003c\u003c 32) | 0;\n+\tret = ibmveth_remove_buffer_from_pool(adapter, correlator, false);\n+\tKUNIT_EXPECT_EQ(test, -EINVAL, ret);\n+\tret = ibmveth_remove_buffer_from_pool(adapter, correlator, true);\n+\tKUNIT_EXPECT_EQ(test, -EINVAL, ret);\n+\n \tcorrelator = (u64)0 | 0;\n \tpool-\u003eskbuff[0] = NULL;\n \tKUNIT_EXPECT_EQ(test, -EFAULT, ibmveth_remove_buffer_from_pool(adapter, correlator, false));\n@@ -2243,9 +2389,8 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit *test)\n  * ibmveth_rxq_get_buffer_test - unit test for ibmveth_rxq_get_buffer\n  * @test: pointer to kunit structure\n  *\n- * Tests ibmveth_rxq_get_buffer. ibmveth_rxq_get_buffer also calls WARN_ON for\n- * the NULL returns, so dmesg should be checked to see that these warnings\n- * happened.\n+ * Tests ibmveth_rxq_get_buffer. Each NULL return also logs a ratelimited\n+ * netdev_err.\n  *\n  * Return: void\n  */\n@@ -2276,15 +2421,87 @@ static void ibmveth_rxq_get_buffer_test(struct kunit *test)\n \tpool-\u003eskbuff = kunit_kcalloc(test, pool-\u003esize, sizeof(void *), GFP_KERNEL);\n \tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool-\u003eskbuff);\n \n+\tu64 cor;\n+\n \tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)IBMVETH_NUM_BUFF_POOLS \u003c\u003c 32 | 0;\n-\tKUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter));\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, NULL,\n+\t\t\t    ibmveth_rxq_get_buffer(adapter, cor));\n \n \tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)0 \u003c\u003c 32 | adapter-\u003erx_buff_pool[0].size;\n-\tKUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter));\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, NULL,\n+\t\t\t    ibmveth_rxq_get_buffer(adapter, cor));\n+\n+\t/* Pool 2 is in range but has no skbuff array, like an inactive pool. */\n+\tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)2 \u003c\u003c 32 | 0;\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, NULL,\n+\t\t\t    ibmveth_rxq_get_buffer(adapter, cor));\n \n \tpool-\u003eskbuff[0] = skb;\n \tadapter-\u003erx_queue.queue_addr[0].correlator = (u64)0 \u003c\u003c 32 | 0;\n-\tKUNIT_EXPECT_PTR_EQ(test, skb, ibmveth_rxq_get_buffer(adapter));\n+\tcor = ibmveth_rxq_correlator(adapter);\n+\tKUNIT_EXPECT_PTR_EQ(test, skb,\n+\t\t\t    ibmveth_rxq_get_buffer(adapter, cor));\n+\n+\tflush_work(\u0026adapter-\u003ework);\n+}\n+\n+/**\n+ * ibmveth_rxq_harvest_buffer_test - unit test for ibmveth_rxq_harvest_buffer\n+ * @test: pointer to kunit structure\n+ *\n+ * A bad correlator must still advance the RX ring, wrapping and flipping\n+ * the toggle at the end. This covers the harvest path; the advance after\n+ * ibmveth_rxq_get_buffer() fails in ibmveth_poll() is not tested here.\n+ *\n+ * Return: void\n+ */\n+static void ibmveth_rxq_harvest_buffer_test(struct kunit *test)\n+{\n+\tstruct ibmveth_adapter *adapter;\n+\tstruct ibmveth_buff_pool *pool;\n+\tint ret;\n+\n+\tadapter = kunit_kzalloc(test, sizeof(*adapter), GFP_KERNEL);\n+\tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter);\n+\n+\tINIT_WORK(\u0026adapter-\u003ework, ibmveth_reset_kunit);\n+\n+\tadapter-\u003erx_queue.num_slots = 2;\n+\tadapter-\u003erx_queue.index = 0;\n+\tadapter-\u003erx_queue.toggle = 1;\n+\tadapter-\u003erx_queue.queue_addr =\n+\t\tkunit_kcalloc(test, 2, sizeof(struct ibmveth_rx_q_entry),\n+\t\t\t      GFP_KERNEL);\n+\tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter-\u003erx_queue.queue_addr);\n+\n+\t/* Set sane values for buffer pools */\n+\tfor (int i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\n+\t\tibmveth_init_buffer_pool(\u0026adapter-\u003erx_buff_pool[i], i,\n+\t\t\t\t\t pool_count[i], pool_size[i],\n+\t\t\t\t\t pool_active[i]);\n+\n+\tpool = \u0026adapter-\u003erx_buff_pool[0];\n+\tpool-\u003eskbuff = kunit_kcalloc(test, pool-\u003esize, sizeof(void *),\n+\t\t\t\t     GFP_KERNEL);\n+\tKUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool-\u003eskbuff);\n+\n+\t/* Slot 0: pool out of range. Slot 1: valid, but no skb. */\n+\tadapter-\u003erx_queue.queue_addr[0].correlator =\n+\t\t(u64)IBMVETH_NUM_BUFF_POOLS \u003c\u003c 32 | 0;\n+\tadapter-\u003erx_queue.queue_addr[1].correlator = (u64)0 \u003c\u003c 32 | 0;\n+\n+\tret = ibmveth_rxq_harvest_buffer(adapter, true);\n+\tKUNIT_EXPECT_EQ(test, -EINVAL, ret);\n+\tKUNIT_EXPECT_EQ(test, 1ULL, adapter-\u003erx_queue.index);\n+\tKUNIT_EXPECT_EQ(test, 1ULL, adapter-\u003erx_queue.toggle);\n+\n+\tret = ibmveth_rxq_harvest_buffer(adapter, true);\n+\tKUNIT_EXPECT_EQ(test, -EFAULT, ret);\n+\tKUNIT_EXPECT_EQ(test, 0ULL, adapter-\u003erx_queue.index);\n+\tKUNIT_EXPECT_EQ(test, 0ULL, adapter-\u003erx_queue.toggle);\n \n \tflush_work(\u0026adapter-\u003ework);\n }\n@@ -2292,6 +2509,7 @@ static void ibmveth_rxq_get_buffer_test(struct kunit *test)\n static struct kunit_case ibmveth_test_cases[] = {\n \tKUNIT_CASE(ibmveth_remove_buffer_from_pool_test),\n \tKUNIT_CASE(ibmveth_rxq_get_buffer_test),\n+\tKUNIT_CASE(ibmveth_rxq_harvest_buffer_test),\n \t{}\n };\n \ndiff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h\nindex d87713668ed30..be0939caa328e 100644\n--- a/drivers/net/ethernet/ibm/ibmveth.h\n+++ b/drivers/net/ethernet/ibm/ibmveth.h\n@@ -14,6 +14,8 @@\n #ifndef _IBMVETH_H\n #define _IBMVETH_H\n \n+#include \u003clinux/completion.h\u003e\n+\n /* constants for H_MULTICAST_CTRL */\n #define IbmVethMcastReceptionModifyBit     0x80000UL\n #define IbmVethMcastReceptionEnableBit     0x20000UL\n@@ -143,6 +145,7 @@ struct ibmveth_buff_pool {\n     struct sk_buff **skbuff;\n     int active;\n     struct kobject kobj;\n+\tstruct completion released;\n };\n \n struct ibmveth_rx_q {\n@@ -172,6 +175,8 @@ struct ibmveth_adapter {\n \tint rx_csum;\n \tint large_send;\n \tbool is_active_trunk;\n+\t/* Set by a successful ibmveth_open(), cleared by ibmveth_close(). */\n+\tbool opened;\n \tunsigned int rx_buffers_per_hcall;\n \n \tu64 fw_ipv6_csum_support;\n"
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 0594d4fd21630d3da95b5622b872d3c05cfb9a30
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Oct 9 21:51:29 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index abebdb1fc2628..fc90ee6663c36 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -135,6 +135,13 @@ static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter)
 	return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].length);
 }
 
+static u64 ibmveth_rxq_correlator(struct ibmveth_adapter *adapter)
+{
+	unsigned int idx = adapter->rx_queue.index;
+
+	return READ_ONCE(adapter->rx_queue.queue_addr[idx].correlator);
+}
+
 static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter *adapter)
 {
 	return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_CSUM_GOOD;
@@ -443,6 +450,37 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter,
 	}
 }
 
+/* The correlator comes back from PHYP; a bad one schedules a reset. */
+static bool ibmveth_rxq_correlator_valid(struct ibmveth_adapter *adapter,
+					 u64 correlator)
+{
+	unsigned int index = correlator & 0xffffffffUL;
+	unsigned int pool = correlator >> 32;
+
+	/* An inactive pool keeps its size but has no skbuff array. */
+	if (pool < IBMVETH_NUM_BUFF_POOLS &&
+	    index < adapter->rx_buff_pool[pool].size &&
+	    adapter->rx_buff_pool[pool].skbuff)
+		return true;
+
+	if (net_ratelimit())
+		netdev_err(adapter->netdev,
+			   "invalid RX correlator %llx, resetting\n",
+			   correlator);
+	schedule_work(&adapter->work);
+	return false;
+}
+
+static void ibmveth_rxq_no_skb(struct ibmveth_adapter *adapter,
+			       u64 correlator)
+{
+	if (net_ratelimit())
+		netdev_err(adapter->netdev,
+			   "no buffer for RX correlator %llx, resetting\n",
+			   correlator);
+	schedule_work(&adapter->work);
+}
+
 /**
  * ibmveth_remove_buffer_from_pool - remove a buffer from a pool
  * @adapter: adapter instance
@@ -451,7 +489,8 @@ static void ibmveth_free_buffer_pool(struct ibmveth_adapter *adapter,
  *
  * Return:
  * * %0       - success
- * * %-EINVAL - correlator maps to pool or index out of range
+ * * %-EINVAL - correlator maps to pool or index out of range, or to an
+ *              inactive pool
  * * %-EFAULT - pool and index map to null skb
  */
 static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,
@@ -462,15 +501,12 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,
 	unsigned int free_index;
 	struct sk_buff *skb;
 
-	if (WARN_ON(pool >= IBMVETH_NUM_BUFF_POOLS) ||
-	    WARN_ON(index >= adapter->rx_buff_pool[pool].size)) {
-		schedule_work(&adapter->work);
+	if (!ibmveth_rxq_correlator_valid(adapter, correlator))
 		return -EINVAL;
-	}
 
 	skb = adapter->rx_buff_pool[pool].skbuff[index];
-	if (WARN_ON(!skb)) {
-		schedule_work(&adapter->work);
+	if (!skb) {
+		ibmveth_rxq_no_skb(adapter, correlator);
 		return -EFAULT;
 	}
 
@@ -504,20 +540,29 @@ static int ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter,
 	return 0;
 }
 
-/* get the current buffer on the rx queue */
-static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *adapter)
+/* get the buffer for @correlator, read once from the current rx queue entry */
+static struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *adapter,
+					      u64 correlator)
 {
-	u64 correlator = adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator;
 	unsigned int pool = correlator >> 32;
 	unsigned int index = correlator & 0xffffffffUL;
+	struct sk_buff *skb;
 
-	if (WARN_ON(pool >= IBMVETH_NUM_BUFF_POOLS) ||
-	    WARN_ON(index >= adapter->rx_buff_pool[pool].size)) {
-		schedule_work(&adapter->work);
+	if (!ibmveth_rxq_correlator_valid(adapter, correlator))
 		return NULL;
-	}
 
-	return adapter->rx_buff_pool[pool].skbuff[index];
+	skb = adapter->rx_buff_pool[pool].skbuff[index];
+	if (!skb)
+		ibmveth_rxq_no_skb(adapter, correlator);
+	return skb;
+}
+
+static void ibmveth_rxq_advance(struct ibmveth_adapter *adapter)
+{
+	if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
+		adapter->rx_queue.index = 0;
+		adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
+	}
 }
 
 /**
@@ -528,6 +573,9 @@ static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *ada
  *
  * Context: called from ibmveth_poll
  *
+ * The ring advances even on error, so poll does not return to a bad
+ * slot before the scheduled reset can run.
+ *
  * Return:
  * * %0    - success
  * * other - non-zero return from ibmveth_remove_buffer_from_pool
@@ -540,15 +588,9 @@ static int ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter,
 
 	cor = adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator;
 	rc = ibmveth_remove_buffer_from_pool(adapter, cor, reuse);
-	if (unlikely(rc))
-		return rc;
-
-	if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
-		adapter->rx_queue.index = 0;
-		adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
-	}
+	ibmveth_rxq_advance(adapter);
 
-	return 0;
+	return rc;
 }
 
 static void ibmveth_free_tx_ltb(struct ibmveth_adapter *adapter, int idx)
@@ -628,8 +670,6 @@ static int ibmveth_open(struct net_device *netdev)
 
 	netdev_dbg(netdev, "open starting\n");
 
-	napi_enable(&adapter->napi);
-
 	for(i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
 		rxq_entries += adapter->rx_buff_pool[i].size;
 
@@ -717,10 +757,19 @@ static int ibmveth_open(struct net_device *netdev)
 		}
 	}
 
+	/* NAPI can run as soon as it is enabled, from netpoll during the
+	 * direct close()/open() pairs or from a direct ibmveth_interrupt()
+	 * call, so enable it only once everything ibmveth_poll() touches
+	 * exists.
+	 */
+	napi_enable(&adapter->napi);
+
 	netdev_dbg(netdev, "registering irq 0x%x\n", netdev->irq);
 	rc = request_irq(netdev->irq, ibmveth_interrupt, 0, netdev->name,
 			 netdev);
 	if (rc != 0) {
+		napi_disable(&adapter->napi);
+		synchronize_net();
 		netdev_err(netdev, "unable to request irq 0x%x, rc %d\n",
 			   netdev->irq, rc);
 		goto out_free_buffer_pools;
@@ -733,6 +782,7 @@ static int ibmveth_open(struct net_device *netdev)
 
 	netif_tx_start_all_queues(netdev);
 
+	adapter->opened = true;
 	netdev_dbg(netdev, "open complete\n");
 
 	return 0;
@@ -765,7 +815,6 @@ static int ibmveth_open(struct net_device *netdev)
 out_free_buffer_list:
 	free_page((unsigned long)adapter->buffer_list_addr);
 out:
-	napi_disable(&adapter->napi);
 	return rc;
 }
 
@@ -776,11 +825,24 @@ static int ibmveth_close(struct net_device *netdev)
 	long lpar_rc;
 	int i;
 
+	/* change_mtu, pool sysfs, set_csum and set_tso call close() and
+	 * open() directly. If that open() fails, IFF_UP stays set and
+	 * NAPI is disabled; a second close() would hang in napi_disable().
+	 */
+	if (!adapter->opened)
+		return 0;
+	adapter->opened = false;
+
 	netdev_dbg(netdev, "close starting\n");
 
 	napi_disable(&adapter->napi);
+	/* napi_disable() returns once ibmveth_poll() has called
+	 * napi_complete_done(), but the poll still re-enables the
+	 * interrupt and reads the RX queue after that.
+	 */
+	synchronize_net();
 
-	netif_tx_stop_all_queues(netdev);
+	netif_tx_disable(netdev);
 
 	h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
 
@@ -827,10 +889,10 @@ static int ibmveth_close(struct net_device *netdev)
  *
  * @w: pointer to work_struct embedded in adapter structure
  *
- * Context: This routine acquires rtnl_mutex and disables its NAPI through
- *          ibmveth_close. It can't be called directly in a context that has
- *          already acquired rtnl_mutex or disabled its NAPI, or directly from
- *          a poll routine.
+ * Context: This routine acquires rtnl_mutex and, if the device is open,
+ *          disables its NAPI through ibmveth_close. It can't be called
+ *          directly in a context that has already acquired rtnl_mutex or
+ *          disabled its NAPI, or directly from a poll routine.
  *
  * Return: void
  */
@@ -1122,12 +1184,13 @@ static int ibmveth_set_channels(struct net_device *netdev,
 	struct ibmveth_adapter *adapter = netdev_priv(netdev);
 	unsigned int old = netdev->real_num_tx_queues,
 		     goal = channels->tx_count;
-	int rc, i;
+	int rc, i, alloc_rc = 0;
 
-	/* If ndo_open has not been called yet then don't allocate, just set
-	 * desired netdev_queue's and return
+	/* If the device is not open (including a failed close/open with
+	 * IFF_UP still set) then don't allocate, just set desired
+	 * netdev_queue's and return
 	 */
-	if (!(netdev->flags & IFF_UP))
+	if (!adapter->opened)
 		return netif_set_real_num_tx_queues(netdev, goal);
 
 	/* We have IBMVETH_MAX_QUEUES netdev_queue's allocated
@@ -1147,6 +1210,7 @@ static int ibmveth_set_channels(struct net_device *netdev,
 		/* if something goes wrong, free everything we just allocated */
 		netdev_err(netdev, "Failed to allocate more tx queues, returning to %d queues\n",
 			   old);
+		alloc_rc = rc;
 		goal = old;
 		old = i;
 		break;
@@ -1157,6 +1221,8 @@ static int ibmveth_set_channels(struct net_device *netdev,
 			   old);
 		goal = old;
 		old = i;
+	} else if (alloc_rc) {
+		rc = alloc_rc;
 	}
 	/* Free any that are no longer needed */
 	for (i = old; i > goal; i--) {
@@ -1454,7 +1520,9 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 	struct net_device *netdev = adapter->netdev;
 	int frames_processed = 0;
 	unsigned long lpar_rc;
+	int rescheduled = 0;
 	u16 mss = 0;
+	int rc;
 
 restart_poll:
 	while (frames_processed < budget) {
@@ -1466,19 +1534,46 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 			wmb(); /* suggested by larson1 */
 			adapter->rx_invalid_buffer++;
 			netdev_dbg(netdev, "recycling invalid buffer\n");
-			if (unlikely(ibmveth_rxq_harvest_buffer(adapter, true)))
-				break;
+			rc = ibmveth_rxq_harvest_buffer(adapter, true);
+			if (unlikely(rc)) {
+				netdev->stats.rx_dropped++;
+				frames_processed++;
+				continue;
+			}
 		} else {
 			struct sk_buff *skb, *new_skb;
 			int length = ibmveth_rxq_frame_length(adapter);
 			int offset = ibmveth_rxq_frame_offset(adapter);
 			int csum_good = ibmveth_rxq_csum_good(adapter);
 			int lrg_pkt = ibmveth_rxq_large_packet(adapter);
+			u64 correlator = ibmveth_rxq_correlator(adapter);
+			unsigned int pool, room, off, len;
 			__sum16 iph_check = 0;
 
-			skb = ibmveth_rxq_get_buffer(adapter);
-			if (unlikely(!skb))
-				break;
+			skb = ibmveth_rxq_get_buffer(adapter, correlator);
+			if (unlikely(!skb)) {
+				ibmveth_rxq_advance(adapter);
+				netdev->stats.rx_dropped++;
+				frames_processed++;
+				continue;
+			}
+
+			pool = correlator >> 32;
+			room = min_t(unsigned int, skb_tailroom(skb),
+				     adapter->rx_buff_pool[pool].buff_size);
+			off = offset;
+			len = length;
+			if (unlikely(len < ETH_HLEN || off >= room ||
+				     len > room - off)) {
+				if (net_ratelimit())
+					netdev_err(netdev,
+						   "bad RX frame offset %u length %u (buffer %u), dropping\n",
+						   off, len, room);
+				ibmveth_rxq_harvest_buffer(adapter, true);
+				netdev->stats.rx_dropped++;
+				frames_processed++;
+				continue;
+			}
 
 			/* if the large packet bit is set in the rx queue
 			 * descriptor, the mss will be written by PHYP eight
@@ -1502,12 +1597,21 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 				if (rx_flush)
 					ibmveth_flush_buffer(skb->data,
 						length + offset);
-				if (unlikely(ibmveth_rxq_harvest_buffer(adapter, true)))
-					break;
+				rc = ibmveth_rxq_harvest_buffer(adapter, true);
+				if (unlikely(rc)) {
+					dev_kfree_skb_any(new_skb);
+					netdev->stats.rx_dropped++;
+					frames_processed++;
+					continue;
+				}
 				skb = new_skb;
 			} else {
-				if (unlikely(ibmveth_rxq_harvest_buffer(adapter, false)))
-					break;
+				rc = ibmveth_rxq_harvest_buffer(adapter, false);
+				if (unlikely(rc)) {
+					netdev->stats.rx_dropped++;
+					frames_processed++;
+					continue;
+				}
 				skb_reserve(skb, offset);
 			}
 
@@ -1542,7 +1646,11 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 		}
 	}
 
-	ibmveth_replenish_task(adapter);
+	/* netpoll polls with budget 0 for TX only, and is not serialized
+	 * with a NAPI poll that was already running when it was set up
+	 */
+	if (budget)
+		ibmveth_replenish_task(adapter);
 
 	if (frames_processed == budget)
 		goto out;
@@ -1562,10 +1670,16 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 	if (ibmveth_rxq_pending_buffer(adapter) && napi_schedule(napi)) {
 		lpar_rc = h_vio_signal(adapter->vdev->unit_address,
 				       VIO_IRQ_DISABLE);
+		rescheduled = 1;
 		goto restart_poll;
 	}
 
 out:
+	/* napi_schedule() already queued us. Returning budget would
+	 * make busy_poll_stop() queue the napi a second time.
+	 */
+	if (rescheduled && budget && frames_processed >= budget)
+		return budget - 1;
 	return frames_processed;
 }
 
@@ -1682,14 +1796,6 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
 	return -EINVAL;
 }
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void ibmveth_poll_controller(struct net_device *dev)
-{
-	ibmveth_replenish_task(netdev_priv(dev));
-	ibmveth_interrupt(dev->irq, dev);
-}
-#endif
-
 /**
  * ibmveth_get_desired_dma - Calculate IO memory desired by the driver
  *
@@ -1791,11 +1897,42 @@ static const struct net_device_ops ibmveth_netdev_ops = {
 	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_set_mac_address    = ibmveth_set_mac_addr,
 	.ndo_features_check	= ibmveth_features_check,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-	.ndo_poll_controller	= ibmveth_poll_controller,
-#endif
 };
 
+/**
+ * ibmveth_pool_kobj_release - Mark a pool kobject finished
+ * @kobj: kobject embedded in the pool
+ *
+ * The pool kobjects live in netdev_priv(), so the last put must wait
+ * for this before free_netdev().
+ */
+static void ibmveth_pool_kobj_release(struct kobject *kobj)
+{
+	struct ibmveth_buff_pool *pool = container_of(kobj,
+						      struct ibmveth_buff_pool,
+						      kobj);
+
+	complete(&pool->released);
+}
+
+/**
+ * ibmveth_put_pool_kobjs - Drop the pool kobjects and wait for release
+ * @adapter: ibmveth adapter
+ *
+ * With CONFIG_DEBUG_KOBJECT_RELEASE the cleanup, including removing the
+ * sysfs files, runs later from a work item in the kobject; wait for it
+ * so free_netdev() cannot free the pools first.
+ */
+static void ibmveth_put_pool_kobjs(struct ibmveth_adapter *adapter)
+{
+	int i;
+
+	for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
+		kobject_put(&adapter->rx_buff_pool[i].kobj);
+	for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
+		wait_for_completion(&adapter->rx_buff_pool[i].released);
+}
+
 static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 {
 	int rc, i, mac_len;
@@ -1906,6 +2043,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 		ibmveth_init_buffer_pool(&adapter->rx_buff_pool[i], i,
 					 pool_count[i], pool_size[i],
 					 pool_active[i]);
+		init_completion(&adapter->rx_buff_pool[i].released);
 		error = kobject_init_and_add(kobj, &ktype_veth_pool,
 					     &dev->dev.kobj, "pool%d", i);
 		if (!error)
@@ -1917,8 +2055,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 	if (rc) {
 		netdev_dbg(netdev, "failed to set number of tx queues rc=%d\n",
 			   rc);
-		free_netdev(netdev);
-		return rc;
+		goto err_put_pools;
 	}
 	adapter->tx_ltb_size = PAGE_ALIGN(IBMVETH_MAX_TX_BUF_SIZE);
 	for (i = 0; i < IBMVETH_MAX_QUEUES; i++)
@@ -1933,25 +2070,27 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
 	if (rc) {
 		netdev_dbg(netdev, "failed to register netdev rc=%d\n", rc);
-		free_netdev(netdev);
-		return rc;
+		goto err_put_pools;
 	}
 
 	netdev_dbg(netdev, "registered\n");
 
 	return 0;
+
+err_put_pools:
+	ibmveth_put_pool_kobjs(adapter);
+	free_netdev(netdev);
+	return rc;
 }
 
 static void ibmveth_remove(struct vio_dev *dev)
 {
 	struct net_device *netdev = dev_get_drvdata(&dev->dev);
 	struct ibmveth_adapter *adapter = netdev_priv(netdev);
-	int i;
 
-	cancel_work_sync(&adapter->work);
+	disable_work_sync(&adapter->work);
 
-	for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
-		kobject_put(&adapter->rx_buff_pool[i].kobj);
+	ibmveth_put_pool_kobjs(adapter);
 
 	unregister_netdev(netdev);
 
@@ -2127,7 +2266,7 @@ static const struct sysfs_ops veth_pool_ops = {
 };
 
 static struct kobj_type ktype_veth_pool = {
-	.release        = NULL,
+	.release        = ibmveth_pool_kobj_release,
 	.sysfs_ops      = &veth_pool_ops,
 	.default_groups = veth_pool_groups,
 };
@@ -2198,8 +2337,7 @@ static void ibmveth_reset_kunit(struct work_struct *w)
  * @test: pointer to kunit structure
  *
  * Tests the error returns from ibmveth_remove_buffer_from_pool.
- * ibmveth_remove_buffer_from_pool also calls WARN_ON, so dmesg should be
- * checked to see that these warnings happened.
+ * Each error also logs a ratelimited netdev_err.
  *
  * Return: void
  */
@@ -2208,6 +2346,7 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit *test)
 	struct ibmveth_adapter *adapter = kunit_kzalloc(test, sizeof(*adapter), GFP_KERNEL);
 	struct ibmveth_buff_pool *pool;
 	u64 correlator;
+	int ret;
 
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter);
 
@@ -2231,6 +2370,13 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, false));
 	KUNIT_EXPECT_EQ(test, -EINVAL, ibmveth_remove_buffer_from_pool(adapter, correlator, true));
 
+	/* Pool 2 is in range but has no skbuff array, like an inactive pool. */
+	correlator = ((u64)2 << 32) | 0;
+	ret = ibmveth_remove_buffer_from_pool(adapter, correlator, false);
+	KUNIT_EXPECT_EQ(test, -EINVAL, ret);
+	ret = ibmveth_remove_buffer_from_pool(adapter, correlator, true);
+	KUNIT_EXPECT_EQ(test, -EINVAL, ret);
+
 	correlator = (u64)0 | 0;
 	pool->skbuff[0] = NULL;
 	KUNIT_EXPECT_EQ(test, -EFAULT, ibmveth_remove_buffer_from_pool(adapter, correlator, false));
@@ -2243,9 +2389,8 @@ static void ibmveth_remove_buffer_from_pool_test(struct kunit *test)
  * ibmveth_rxq_get_buffer_test - unit test for ibmveth_rxq_get_buffer
  * @test: pointer to kunit structure
  *
- * Tests ibmveth_rxq_get_buffer. ibmveth_rxq_get_buffer also calls WARN_ON for
- * the NULL returns, so dmesg should be checked to see that these warnings
- * happened.
+ * Tests ibmveth_rxq_get_buffer. Each NULL return also logs a ratelimited
+ * netdev_err.
  *
  * Return: void
  */
@@ -2276,15 +2421,87 @@ static void ibmveth_rxq_get_buffer_test(struct kunit *test)
 	pool->skbuff = kunit_kcalloc(test, pool->size, sizeof(void *), GFP_KERNEL);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool->skbuff);
 
+	u64 cor;
+
 	adapter->rx_queue.queue_addr[0].correlator = (u64)IBMVETH_NUM_BUFF_POOLS << 32 | 0;
-	KUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter));
+	cor = ibmveth_rxq_correlator(adapter);
+	KUNIT_EXPECT_PTR_EQ(test, NULL,
+			    ibmveth_rxq_get_buffer(adapter, cor));
 
 	adapter->rx_queue.queue_addr[0].correlator = (u64)0 << 32 | adapter->rx_buff_pool[0].size;
-	KUNIT_EXPECT_PTR_EQ(test, NULL, ibmveth_rxq_get_buffer(adapter));
+	cor = ibmveth_rxq_correlator(adapter);
+	KUNIT_EXPECT_PTR_EQ(test, NULL,
+			    ibmveth_rxq_get_buffer(adapter, cor));
+
+	/* Pool 2 is in range but has no skbuff array, like an inactive pool. */
+	adapter->rx_queue.queue_addr[0].correlator = (u64)2 << 32 | 0;
+	cor = ibmveth_rxq_correlator(adapter);
+	KUNIT_EXPECT_PTR_EQ(test, NULL,
+			    ibmveth_rxq_get_buffer(adapter, cor));
 
 	pool->skbuff[0] = skb;
 	adapter->rx_queue.queue_addr[0].correlator = (u64)0 << 32 | 0;
-	KUNIT_EXPECT_PTR_EQ(test, skb, ibmveth_rxq_get_buffer(adapter));
+	cor = ibmveth_rxq_correlator(adapter);
+	KUNIT_EXPECT_PTR_EQ(test, skb,
+			    ibmveth_rxq_get_buffer(adapter, cor));
+
+	flush_work(&adapter->work);
+}
+
+/**
+ * ibmveth_rxq_harvest_buffer_test - unit test for ibmveth_rxq_harvest_buffer
+ * @test: pointer to kunit structure
+ *
+ * A bad correlator must still advance the RX ring, wrapping and flipping
+ * the toggle at the end. This covers the harvest path; the advance after
+ * ibmveth_rxq_get_buffer() fails in ibmveth_poll() is not tested here.
+ *
+ * Return: void
+ */
+static void ibmveth_rxq_harvest_buffer_test(struct kunit *test)
+{
+	struct ibmveth_adapter *adapter;
+	struct ibmveth_buff_pool *pool;
+	int ret;
+
+	adapter = kunit_kzalloc(test, sizeof(*adapter), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter);
+
+	INIT_WORK(&adapter->work, ibmveth_reset_kunit);
+
+	adapter->rx_queue.num_slots = 2;
+	adapter->rx_queue.index = 0;
+	adapter->rx_queue.toggle = 1;
+	adapter->rx_queue.queue_addr =
+		kunit_kcalloc(test, 2, sizeof(struct ibmveth_rx_q_entry),
+			      GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, adapter->rx_queue.queue_addr);
+
+	/* Set sane values for buffer pools */
+	for (int i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++)
+		ibmveth_init_buffer_pool(&adapter->rx_buff_pool[i], i,
+					 pool_count[i], pool_size[i],
+					 pool_active[i]);
+
+	pool = &adapter->rx_buff_pool[0];
+	pool->skbuff = kunit_kcalloc(test, pool->size, sizeof(void *),
+				     GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, pool->skbuff);
+
+	/* Slot 0: pool out of range. Slot 1: valid, but no skb. */
+	adapter->rx_queue.queue_addr[0].correlator =
+		(u64)IBMVETH_NUM_BUFF_POOLS << 32 | 0;
+	adapter->rx_queue.queue_addr[1].correlator = (u64)0 << 32 | 0;
+
+	ret = ibmveth_rxq_harvest_buffer(adapter, true);
+	KUNIT_EXPECT_EQ(test, -EINVAL, ret);
+	KUNIT_EXPECT_EQ(test, 1ULL, adapter->rx_queue.index);
+	KUNIT_EXPECT_EQ(test, 1ULL, adapter->rx_queue.toggle);
+
+	ret = ibmveth_rxq_harvest_buffer(adapter, true);
+	KUNIT_EXPECT_EQ(test, -EFAULT, ret);
+	KUNIT_EXPECT_EQ(test, 0ULL, adapter->rx_queue.index);
+	KUNIT_EXPECT_EQ(test, 0ULL, adapter->rx_queue.toggle);
 
 	flush_work(&adapter->work);
 }
@@ -2292,6 +2509,7 @@ static void ibmveth_rxq_get_buffer_test(struct kunit *test)
 static struct kunit_case ibmveth_test_cases[] = {
 	KUNIT_CASE(ibmveth_remove_buffer_from_pool_test),
 	KUNIT_CASE(ibmveth_rxq_get_buffer_test),
+	KUNIT_CASE(ibmveth_rxq_harvest_buffer_test),
 	{}
 };
 
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index d87713668ed30..be0939caa328e 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -14,6 +14,8 @@
 #ifndef _IBMVETH_H
 #define _IBMVETH_H
 
+#include <linux/completion.h>
+
 /* constants for H_MULTICAST_CTRL */
 #define IbmVethMcastReceptionModifyBit     0x80000UL
 #define IbmVethMcastReceptionEnableBit     0x20000UL
@@ -143,6 +145,7 @@ struct ibmveth_buff_pool {
     struct sk_buff **skbuff;
     int active;
     struct kobject kobj;
+	struct completion released;
 };
 
 struct ibmveth_rx_q {
@@ -172,6 +175,8 @@ struct ibmveth_adapter {
 	int rx_csum;
 	int large_send;
 	bool is_active_trunk;
+	/* Set by a successful ibmveth_open(), cleared by ibmveth_close(). */
+	bool opened;
 	unsigned int rx_buffers_per_hcall;
 
 	u64 fw_ipv6_csum_support;

							input: 11952
							output: 32
							thoughts: 167

**Evaluating the Fuzzing Potential of This Patch Series**

Okay, so the goal is to figure out if this patch series is even worth the effort of throwing syzkaller at it, specifically on amd64. First, let's carefully dissect the instructions and the patches themselves. I need to understand the scope and target. The key here, it seems, is `ibmveth`.

My initial thought is to ascertain if `ibmveth` is even *reachable* on amd64. I see the file paths, `drivers/net/ethernet/ibm/ibmveth.c` and `ibmveth.h`. Classic.

Wait a second… `ibmveth`… that rings a bell. IBM virtual ethernet. That screams IBM Power, right? Like pSeries, vio_bus, PHYP, that whole ecosystem. But does it *ever* touch amd64? This is the crucial point. Does this code have the potential to be compiled for x86? Is it guarded by any architecture-specific or platform-specific configs that would prevent it from even being built on amd64? My intuition says unlikely, but I need to be certain.

I need to quickly check the Kconfig. I can either use grepper or just dive into `drivers/net/ethernet/ibm/Kconfig`. This is going to tell me if things like `PPC_PSERIES`, `PPC_VIOPATH`, or even a generic `CONFIG_PPC` gate the visibility of `ibmveth`. That's the deciding factor here – can syzkaller even *reach* this code on amd64?

{
  "Expression": "IBMVETH",
  "PathPrefixes": [
    "drivers/net/ethernet/ibm"
  ]
}

{
  "Output": "\nFull output is too long, showing 200 out of 383 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (4 files in total):\ndrivers/net/ethernet/ibm/Kconfig:3\ndrivers/net/ethernet/ibm/Makefile:1\ndrivers/net/ethernet/ibm/ibmveth.c:79\ndrivers/net/ethernet/ibm/ibmveth.h:40\n\ndrivers/net/ethernet/ibm/Kconfig=18=if NET_VENDOR_IBM\ndrivers/net/ethernet/ibm/Kconfig-19-\ndrivers/net/ethernet/ibm/Kconfig:20:config IBMVETH\ndrivers/net/ethernet/ibm/Kconfig-21-\ttristate \"IBM LAN Virtual Ethernet support\"\n--\ndrivers/net/ethernet/ibm/Kconfig-29-\ndrivers/net/ethernet/ibm/Kconfig:30:config IBMVETH_KUNIT_TEST\ndrivers/net/ethernet/ibm/Kconfig-31-\tbool \"KUnit test for IBM LAN Virtual Ethernet support\" if !KUNIT_ALL_TESTS\ndrivers/net/ethernet/ibm/Kconfig-32-\tdepends on KUNIT\ndrivers/net/ethernet/ibm/Kconfig:33:\tdepends on KUNIT=y \u0026\u0026 IBMVETH=y\ndrivers/net/ethernet/ibm/Kconfig-34-\tdefault KUNIT_ALL_TESTS\n--\ndrivers/net/ethernet/ibm/Makefile-5-\ndrivers/net/ethernet/ibm/Makefile:6:obj-$(CONFIG_IBMVETH) += ibmveth.o\ndrivers/net/ethernet/ibm/Makefile-7-obj-$(CONFIG_IBMVNIC) += ibmvnic.o\n--\ndrivers/net/ethernet/ibm/ibmveth.c=75=struct ibmveth_stat {\n--\ndrivers/net/ethernet/ibm/ibmveth.c-79-\ndrivers/net/ethernet/ibm/ibmveth.c:80:#define IBMVETH_STAT_OFF(stat) offsetof(struct ibmveth_adapter, stat)\ndrivers/net/ethernet/ibm/ibmveth.c:81:#define IBMVETH_GET_STAT(a, off) *((u64 *)(((unsigned long)(a)) + off))\ndrivers/net/ethernet/ibm/ibmveth.c-82-\ndrivers/net/ethernet/ibm/ibmveth.c=83=static struct ibmveth_stat ibmveth_stats[] = {\ndrivers/net/ethernet/ibm/ibmveth.c:84:\t{ \"replenish_task_cycles\", IBMVETH_STAT_OFF(replenish_task_cycles) },\ndrivers/net/ethernet/ibm/ibmveth.c:85:\t{ \"replenish_no_mem\", IBMVETH_STAT_OFF(replenish_no_mem) },\ndrivers/net/ethernet/ibm/ibmveth.c-86-\t{ \"replenish_add_buff_failure\",\ndrivers/net/ethernet/ibm/ibmveth.c:87:\t\t\tIBMVETH_STAT_OFF(replenish_add_buff_failure) },\ndrivers/net/ethernet/ibm/ibmveth.c-88-\t{ \"replenish_add_buff_success\",\ndrivers/net/ethernet/ibm/ibmveth.c:89:\t\t\tIBMVETH_STAT_OFF(replenish_add_buff_success) },\ndrivers/net/ethernet/ibm/ibmveth.c:90:\t{ \"rx_invalid_buffer\", IBMVETH_STAT_OFF(rx_invalid_buffer) },\ndrivers/net/ethernet/ibm/ibmveth.c:91:\t{ \"rx_no_buffer\", IBMVETH_STAT_OFF(rx_no_buffer) },\ndrivers/net/ethernet/ibm/ibmveth.c:92:\t{ \"tx_map_failed\", IBMVETH_STAT_OFF(tx_map_failed) },\ndrivers/net/ethernet/ibm/ibmveth.c:93:\t{ \"tx_send_failed\", IBMVETH_STAT_OFF(tx_send_failed) },\ndrivers/net/ethernet/ibm/ibmveth.c:94:\t{ \"fw_enabled_ipv4_csum\", IBMVETH_STAT_OFF(fw_ipv4_csum_support) },\ndrivers/net/ethernet/ibm/ibmveth.c:95:\t{ \"fw_enabled_ipv6_csum\", IBMVETH_STAT_OFF(fw_ipv6_csum_support) },\ndrivers/net/ethernet/ibm/ibmveth.c:96:\t{ \"tx_large_packets\", IBMVETH_STAT_OFF(tx_large_packets) },\ndrivers/net/ethernet/ibm/ibmveth.c:97:\t{ \"rx_large_packets\", IBMVETH_STAT_OFF(rx_large_packets) },\ndrivers/net/ethernet/ibm/ibmveth.c:98:\t{ \"fw_enabled_large_send\", IBMVETH_STAT_OFF(fw_large_send_support) }\ndrivers/net/ethernet/ibm/ibmveth.c-99-};\n--\ndrivers/net/ethernet/ibm/ibmveth.c=107=static inline int ibmveth_rxq_toggle(struct ibmveth_adapter *adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-108-{\ndrivers/net/ethernet/ibm/ibmveth.c:109:\treturn (ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_TOGGLE) \u003e\u003e\ndrivers/net/ethernet/ibm/ibmveth.c:110:\t\t\tIBMVETH_RXQ_TOGGLE_SHIFT;\ndrivers/net/ethernet/ibm/ibmveth.c-111-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=118=static inline int ibmveth_rxq_buffer_valid(struct ibmveth_adapter *adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-119-{\ndrivers/net/ethernet/ibm/ibmveth.c:120:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_VALID;\ndrivers/net/ethernet/ibm/ibmveth.c-121-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=123=static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter *adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-124-{\ndrivers/net/ethernet/ibm/ibmveth.c:125:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_OFF_MASK;\ndrivers/net/ethernet/ibm/ibmveth.c-126-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=128=static inline int ibmveth_rxq_large_packet(struct ibmveth_adapter *adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-129-{\ndrivers/net/ethernet/ibm/ibmveth.c:130:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_LRG_PKT;\ndrivers/net/ethernet/ibm/ibmveth.c-131-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=145=static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter *adapter)\ndrivers/net/ethernet/ibm/ibmveth.c-146-{\ndrivers/net/ethernet/ibm/ibmveth.c:147:\treturn ibmveth_rxq_flags(adapter) \u0026 IBMVETH_RXQ_CSUM_GOOD;\ndrivers/net/ethernet/ibm/ibmveth.c-148-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=150=static unsigned int ibmveth_real_max_tx_queues(void)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-153-\ndrivers/net/ethernet/ibm/ibmveth.c:154:\treturn min(n_cpu, IBMVETH_MAX_QUEUES);\ndrivers/net/ethernet/ibm/ibmveth.c-155-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=218=static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-220-{\ndrivers/net/ethernet/ibm/ibmveth.c:221:\tunion ibmveth_buf_desc descs[IBMVETH_MAX_RX_PER_HCALL] = {0};\ndrivers/net/ethernet/ibm/ibmveth.c-222-\tu32 remaining = pool-\u003esize - atomic_read(\u0026pool-\u003eavailable);\ndrivers/net/ethernet/ibm/ibmveth.c:223:\tu64 correlators[IBMVETH_MAX_RX_PER_HCALL] = {0};\ndrivers/net/ethernet/ibm/ibmveth.c-224-\tunsigned long lpar_rc;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-283-\ndrivers/net/ethernet/ibm/ibmveth.c:284:\t\t\t\tlen = adapter-\u003enetdev-\u003emtu + IBMVETH_BUFF_OH;\ndrivers/net/ethernet/ibm/ibmveth.c-285-\t\t\t\tlen = min(pool-\u003ebuff_size, len);\n--\ndrivers/net/ethernet/ibm/ibmveth.c-289-\ndrivers/net/ethernet/ibm/ibmveth.c:290:\t\t\tdescs[filled].fields.flags_len = IBMVETH_BUF_VALID |\ndrivers/net/ethernet/ibm/ibmveth.c-291-\t\t\t\t\t\t\t  pool-\u003ebuff_size;\n--\ndrivers/net/ethernet/ibm/ibmveth.c=402=static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-407-\ndrivers/net/ethernet/ibm/ibmveth.c:408:\tfor (i = (IBMVETH_NUM_BUFF_POOLS - 1); i \u003e= 0; i--) {\ndrivers/net/ethernet/ibm/ibmveth.c-409-\t\tstruct ibmveth_buff_pool *pool = \u0026adapter-\u003erx_buff_pool[i];\n--\ndrivers/net/ethernet/ibm/ibmveth.c=454=static bool ibmveth_rxq_correlator_valid(struct ibmveth_adapter *adapter,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-460-\t/* An inactive pool keeps its size but has no skbuff array. */\ndrivers/net/ethernet/ibm/ibmveth.c:461:\tif (pool \u003c IBMVETH_NUM_BUFF_POOLS \u0026\u0026\ndrivers/net/ethernet/ibm/ibmveth.c-462-\t    index \u003c adapter-\u003erx_buff_pool[pool].size \u0026\u0026\n--\ndrivers/net/ethernet/ibm/ibmveth.c=660=static int ibmveth_open(struct net_device *netdev)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-672-\ndrivers/net/ethernet/ibm/ibmveth.c:673:\tfor(i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\ndrivers/net/ethernet/ibm/ibmveth.c-674-\t\trxq_entries += adapter-\u003erx_buff_pool[i].size;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-723-\ndrivers/net/ethernet/ibm/ibmveth.c:724:\trxq_desc.fields.flags_len = IBMVETH_BUF_VALID |\ndrivers/net/ethernet/ibm/ibmveth.c-725-\t\t\t\t\tadapter-\u003erx_queue.queue_len;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-748-\ndrivers/net/ethernet/ibm/ibmveth.c:749:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++) {\ndrivers/net/ethernet/ibm/ibmveth.c-750-\t\tif (!adapter-\u003erx_buff_pool[i].active)\n--\ndrivers/net/ethernet/ibm/ibmveth.c=821=static int ibmveth_close(struct net_device *netdev)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-873-\ndrivers/net/ethernet/ibm/ibmveth.c:874:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\ndrivers/net/ethernet/ibm/ibmveth.c-875-\t\tif (adapter-\u003erx_buff_pool[i].active)\n--\ndrivers/net/ethernet/ibm/ibmveth.c=971=static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-990-\tif (data) {\ndrivers/net/ethernet/ibm/ibmveth.c:991:\t\tset_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c:992:\t\tset_attr6 = IBMVETH_ILLAN_IPV6_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c-993-\t} else {\ndrivers/net/ethernet/ibm/ibmveth.c:994:\t\tclr_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c:995:\t\tclr_attr6 = IBMVETH_ILLAN_IPV6_TCP_CSUM;\ndrivers/net/ethernet/ibm/ibmveth.c-996-\t}\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1000-\tif (ret == H_SUCCESS \u0026\u0026\ndrivers/net/ethernet/ibm/ibmveth.c:1001:\t    (ret_attr \u0026 IBMVETH_ILLAN_PADDED_PKT_CSUM)) {\ndrivers/net/ethernet/ibm/ibmveth.c-1002-\t\tret4 = h_illan_attributes(adapter-\u003evdev-\u003eunit_address, clr_attr,\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1054=static int ibmveth_set_tso(struct net_device *dev, u32 data)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1070-\tif (data)\ndrivers/net/ethernet/ibm/ibmveth.c:1071:\t\tset_attr = IBMVETH_ILLAN_LRG_SR_ENABLED;\ndrivers/net/ethernet/ibm/ibmveth.c-1072-\telse\ndrivers/net/ethernet/ibm/ibmveth.c:1073:\t\tclr_attr = IBMVETH_ILLAN_LRG_SR_ENABLED;\ndrivers/net/ethernet/ibm/ibmveth.c-1074-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1076-\ndrivers/net/ethernet/ibm/ibmveth.c:1077:\tif (ret1 == H_SUCCESS \u0026\u0026 (ret_attr \u0026 IBMVETH_ILLAN_LRG_SND_SUPPORT) \u0026\u0026\ndrivers/net/ethernet/ibm/ibmveth.c-1078-\t    !old_large_send) {\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1161=static void ibmveth_get_ethtool_stats(struct net_device *dev,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1167-\tfor (i = 0; i \u003c ARRAY_SIZE(ibmveth_stats); i++)\ndrivers/net/ethernet/ibm/ibmveth.c:1168:\t\tdata[i] = IBMVETH_GET_STAT(adapter, ibmveth_stats[i].offset);\ndrivers/net/ethernet/ibm/ibmveth.c-1169-}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1181=static int ibmveth_set_channels(struct net_device *netdev,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1195-\ndrivers/net/ethernet/ibm/ibmveth.c:1196:\t/* We have IBMVETH_MAX_QUEUES netdev_queue's allocated\ndrivers/net/ethernet/ibm/ibmveth.c-1197-\t * but we may need to alloc/free the ltb's.\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1300=static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1323-\ndrivers/net/ethernet/ibm/ibmveth.c:1324:\tdesc_flags = IBMVETH_BUF_VALID;\ndrivers/net/ethernet/ibm/ibmveth.c-1325-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1329-\ndrivers/net/ethernet/ibm/ibmveth.c:1330:\t\tdesc_flags |= (IBMVETH_BUF_NO_CSUM | IBMVETH_BUF_CSUM_GOOD);\ndrivers/net/ethernet/ibm/ibmveth.c-1331-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1336-\t\tif (skb_is_gso(skb) \u0026\u0026 adapter-\u003efw_large_send_support)\ndrivers/net/ethernet/ibm/ibmveth.c:1337:\t\t\tdesc_flags |= IBMVETH_BUF_LRG_SND;\ndrivers/net/ethernet/ibm/ibmveth.c-1338-\t}\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1755=static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1758-\tstruct vio_dev *viodev = adapter-\u003evdev;\ndrivers/net/ethernet/ibm/ibmveth.c:1759:\tint new_mtu_oh = new_mtu + IBMVETH_BUFF_OH;\ndrivers/net/ethernet/ibm/ibmveth.c-1760-\tint i, rc;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1762-\ndrivers/net/ethernet/ibm/ibmveth.c:1763:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++)\ndrivers/net/ethernet/ibm/ibmveth.c-1764-\t\tif (new_mtu_oh \u003c= adapter-\u003erx_buff_pool[i].buff_size)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1766-\ndrivers/net/ethernet/ibm/ibmveth.c:1767:\tif (i == IBMVETH_NUM_BUFF_POOLS)\ndrivers/net/ethernet/ibm/ibmveth.c-1768-\t\treturn -EINVAL;\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1777-\t/* Look for an active buffer pool that can hold the new MTU */\ndrivers/net/ethernet/ibm/ibmveth.c:1778:\tfor (i = 0; i \u003c IBMVETH_NUM_BUFF_POOLS; i++) {\ndrivers/net/ethernet/ibm/ibmveth.c-1779-\t\tadapter-\u003erx_buff_pool[i].active = 1;\n--\ndrivers/net/ethernet/ibm/ibmveth.c=1807=static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev)\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1819-\tif (netdev == NULL)\ndrivers/net/ethernet/ibm/ibmveth.c:1820:\t\treturn IOMMU_PAGE_ALIGN(IBMVETH_IO_ENTITLEMENT_DEFAULT, tbl);\ndrivers/net/ethernet/ibm/ibmveth.c-1821-\n--\ndrivers/net/ethernet/ibm/ibmveth.c-1823-\ndrivers/net/ethernet/ibm/ibmveth.c:1824:\tret = IBMVETH_BUFF_LIST_SIZE + IBMVETH_FILT_LIST_SIZE;\ndrivers/net/ethernet/ibm/ibmveth.c-1825-\tret += IOMMU_PAGE_ALIGN(netdev-\u003emtu, tbl);\ndrivers/net/ethernet/ibm/ibmveth.c-1826-\t/* add size of mapped tx buffers */\n\n"
}

							input: 17877
							output: 37
							thoughts: 29

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the Dependency Landscape of CONFIG_IBMVETH**

Alright, let's dive right in. My first thought is to zero in on the dependencies of `CONFIG_IBMVETH`. I'll immediately head over to `drivers/net/ethernet/ibm/Kconfig`. This is standard operating procedure, of course, but it's important to be methodical. Kconfig files are the heart of configuration in the kernel, and that's where I'll find the precise information I need regarding what other components, features, or drivers need to be enabled or are in conflict with this one. I anticipate finding conditionals, relationships to other `CONFIG_` options, and potentially information on any hardware requirements or constraints. This quick check will give me a clear picture of how `CONFIG_IBMVETH` fits within the larger network stack and potentially identify any areas where I'll need to pay extra attention to avoid conflicts or ensure proper functionality. From there, I can begin to draw more complex conclusions based on the resulting dependency tree.

{
  "File": "drivers/net/ethernet/ibm/Kconfig",
  "FirstLine": 1,
  "LineCount": 45
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# IBM device configuration.\n   4:\t#\n   5:\t\n   6:\tconfig NET_VENDOR_IBM\n   7:\t\tbool \"IBM devices\"\n   8:\t\tdefault y\n   9:\t\tdepends on PPC_PSERIES || PPC_DCR || (IBMEBUS \u0026\u0026 SPARSEMEM)\n  10:\t\thelp\n  11:\t\t  If you have a network (Ethernet) card belonging to this class, say Y.\n  12:\t\n  13:\t\t  Note that the answer to this question doesn't directly affect the\n  14:\t\t  kernel: saying N will just cause the configurator to skip all\n  15:\t\t  the questions about IBM devices. If you say Y, you will be asked for\n  16:\t\t  your specific card in the following questions.\n  17:\t\n  18:\tif NET_VENDOR_IBM\n  19:\t\n  20:\tconfig IBMVETH\n  21:\t\ttristate \"IBM LAN Virtual Ethernet support\"\n  22:\t\tdepends on PPC_PSERIES\n  23:\t\thelp\n  24:\t\t  This driver supports virtual ethernet adapters on newer IBM iSeries\n  25:\t\t  and pSeries systems.\n  26:\t\n  27:\t\t  To compile this driver as a module, choose M here. The module will\n  28:\t\t  be called ibmveth.\n  29:\t\n  30:\tconfig IBMVETH_KUNIT_TEST\n  31:\t\tbool \"KUnit test for IBM LAN Virtual Ethernet support\" if !KUNIT_ALL_TESTS\n  32:\t\tdepends on KUNIT\n  33:\t\tdepends on KUNIT=y \u0026\u0026 IBMVETH=y\n  34:\t\tdefault KUNIT_ALL_TESTS\n  35:\t\thelp\n  36:\t\t  This builds unit tests for the IBM LAN Virtual Ethernet driver.\n  37:\t\n  38:\t\t  For more information on KUnit and unit tests in general, please refer\n  39:\t\t  to the KUnit documentation in Documentation/dev-tools/kunit/.\n  40:\t\n  41:\t\t  If unsure, say N.\n  42:\t\n  43:\tsource \"drivers/net/ethernet/ibm/emac/Kconfig\"\n  44:\t\n  45:\tconfig IBMVNIC\n"
}

							input: 18775
							output: 20
							thoughts: 130

**Investigating IBM LAN Virtual Ethernet Support**

Okay, let's dive into this Kconfig snippet. Lines 20-22 highlight the `IBMVETH` configuration. Interesting, it's a tristate option for IBM LAN Virtual Ethernet, and it depends on `PPC_PSERIES`. My immediate thought is, "Right, Power Systems, makes sense." But then I see that `NET_VENDOR_IBM` also has a dependency of `PPC_PSERIES` (among other things). Now, that gives me pause. I know PPC_PSERIES usually relates to PowerPC architecture and System p servers. But… can `PPC_PSERIES` *actually* be enabled on an amd64 system? That doesn't seem right. I need to clarify this. I should go and check the definition of `PPC_PSERIES` within the Kconfig files and review if this dependency can be extended to other architectures, or if there's a problem here. I suspect there's a missing or inaccurate constraint. Let's see...

{
  "Expression": "config PPC_PSERIES"
}

{
  "Output": "arch/powerpc/platforms/pseries/Kconfig-1-# SPDX-License-Identifier: GPL-2.0\narch/powerpc/platforms/pseries/Kconfig:2:config PPC_PSERIES\narch/powerpc/platforms/pseries/Kconfig-3-\tdepends on PPC64 \u0026\u0026 PPC_BOOK3S\n--\narch/powerpc/platforms/pseries/Kconfig=92=config LPARCFG\n--\narch/powerpc/platforms/pseries/Kconfig-98-\narch/powerpc/platforms/pseries/Kconfig:99:config PPC_PSERIES_DEBUG\narch/powerpc/platforms/pseries/Kconfig-100-\tdepends on PPC_PSERIES \u0026\u0026 PPC_EARLY_DEBUG\n"
}

							input: 19344
							output: 40
							thoughts: 122

**Investigating the IBMVETH Compatibility**

Okay, so I'm looking at `PPC_PSERIES`, and it's clear that the driver `IBMVETH` relies heavily on `PPC64` and `PPC_BOOK3S`.  But I need to get to the bottom of this. The bigger question is, can `IBMVETH` even *compile* on an AMD64 system, or is it completely unreachable?

Let's see if a `COMPILE_TEST` configuration option can somehow enable it. My initial thought is to check the configuration itself: I'll start by examining the `config IBMVETH` block. 

Right, here's what I see: `depends on PPC_PSERIES`. No `|| COMPILE_TEST` clause to broaden its availability. That's a strong indicator.

Now I need to confirm this from the implementation side. Since `ibmveth.c` is the key file, let me quickly search for instances of `#include <asm/vio.h>` or a similar include that would imply a dependency on PowerPC-specific virtual I/O hardware. That's usually the telltale sign.

{
  "File": "drivers/net/ethernet/ibm/ibmveth.c",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: GPL-2.0-or-later\n   2:\t/*\n   3:\t * IBM Power Virtual Ethernet Device Driver\n   4:\t *\n   5:\t * Copyright (C) IBM Corporation, 2003, 2010\n   6:\t *\n   7:\t * Authors: Dave Larson \u003clarson1@us.ibm.com\u003e\n   8:\t *\t    Santiago Leon \u003csantil@linux.vnet.ibm.com\u003e\n   9:\t *\t    Brian King \u003cbrking@linux.vnet.ibm.com\u003e\n  10:\t *\t    Robert Jennings \u003crcj@linux.vnet.ibm.com\u003e\n  11:\t *\t    Anton Blanchard \u003canton@au.ibm.com\u003e\n  12:\t */\n  13:\t\n  14:\t#include \u003clinux/module.h\u003e\n  15:\t#include \u003clinux/types.h\u003e\n  16:\t#include \u003clinux/errno.h\u003e\n  17:\t#include \u003clinux/dma-mapping.h\u003e\n  18:\t#include \u003clinux/kernel.h\u003e\n  19:\t#include \u003clinux/netdevice.h\u003e\n  20:\t#include \u003clinux/etherdevice.h\u003e\n  21:\t#include \u003clinux/skbuff.h\u003e\n  22:\t#include \u003clinux/init.h\u003e\n  23:\t#include \u003clinux/interrupt.h\u003e\n  24:\t#include \u003clinux/mm.h\u003e\n  25:\t#include \u003clinux/pm.h\u003e\n  26:\t#include \u003clinux/ethtool.h\u003e\n  27:\t#include \u003clinux/in.h\u003e\n  28:\t#include \u003clinux/ip.h\u003e\n  29:\t#include \u003clinux/ipv6.h\u003e\n  30:\t#include \u003clinux/slab.h\u003e\n  31:\t#include \u003casm/hvcall.h\u003e\n  32:\t#include \u003clinux/atomic.h\u003e\n  33:\t#include \u003casm/vio.h\u003e\n  34:\t#include \u003casm/iommu.h\u003e\n  35:\t#include \u003casm/firmware.h\u003e\n  36:\t#include \u003cnet/tcp.h\u003e\n  37:\t#include \u003cnet/ip6_checksum.h\u003e\n  38:\t\n  39:\t#include \"ibmveth.h\"\n  40:\t\n  41:\tstatic irqreturn_t ibmveth_interrupt(int irq, void *dev_instance);\n  42:\tstatic unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev);\n  43:\t\n  44:\tstatic struct kobj_type ktype_veth_pool;\n  45:\t\n  46:\t\n  47:\tstatic const char ibmveth_driver_name[] = \"ibmveth\";\n  48:\tstatic const char ibmveth_driver_string[] = \"IBM Power Virtual Ethernet Driver\";\n  49:\t#define ibmveth_driver_version \"1.06\"\n  50:\t\n"
}

							input: 20543
							output: 152
							thoughts: 818

**Fuzzing Verdict: Not Worthy**

Okay, let's break this down systematically. I see the code modification involves `ibmveth.c` and `ibmveth.h`, which immediately rings alarm bells – that's IBM Power Virtual Ethernet, definitely a PowerPC thing. Looking at the includes, specifically `<asm/hvcall.h>` and `<asm/vio.h>`, confirms my suspicions; those are PowerPC specific headers. I need to make sure this isn't relevant to my target architecture, amd64.

Section 2 of the instructions provides negative criteria, and one of them is "Code paths exclusive to architectures other than the target architecture." Perfect. My gut feeling is right on this. To be completely sure, I'll go through the details methodically.

First, I need to see the dependencies. I see that `CONFIG_IBMVETH` depends on `CONFIG_PPC_PSERIES`, which in turn depends on `PPC64 && PPC_BOOK3S`. That confirms it – this isn't even *compilable* on amd64. It’s PowerPC-only. And the included headers cement it: hypervisor calls and VIO bus code are all PPC-specific. Even without checking the source itself, I know there is no way this could be relevant on amd64. It's a dead end.

I've confirmed the files touched are only in `ibmveth.c` and `ibmveth.h`, which are definitely IBM Power / PPC architecture. All of my previous findings apply. Therefore, given all of this information, this is not relevant to my target architecture. It's an unreachable execution path on amd64.

I need to make sure this fits my "set-results" requirements. `WorthFuzzing` should be `false`, `EnableConfigs` and `FocusSymbols` should be an empty list, and I'll need a clear `Reasoning`. I'll formulate that concisely: "The patch modifies the IBM Power Virtual Ethernet (`ibmveth`) driver and its KUnit tests. The `CONFIG_IBMVETH` driver depends on `CONFIG_PPC_PSERIES` (PowerPC architecture) and includes architecture-specific headers (`<asm/hvcall.h>`, `<asm/vio.h>`). It cannot be compiled or executed on the target architecture (`amd64`). Because the changes are exclusive to an architecture other than the target architecture, they are unreachable and do not warrant fuzzing."

Now that I've double-checked everything, I'm confident in my assessment. I can call `set-results` with the appropriate parameters.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the IBM Power Virtual Ethernet (ibmveth) driver (drivers/net/ethernet/ibm/ibmveth.c and ibmveth.h). The driver depends on CONFIG_PPC_PSERIES (PPC64/PowerPC) and utilizes architecture-specific headers (\u003casm/hvcall.h\u003e, \u003casm/vio.h\u003e) and hypervisor calls. It cannot be compiled or executed on the target architecture (amd64). Because the modified code is exclusive to an architecture other than the target architecture, it is structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)