| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/23 07:08 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only adds a netlink multicast event sent from the kernel to userspace to report hardware RAS errors. It does not introduce any new userspace-controllable inputs, ioctls, or netlink commands that can be fuzzed.",
"WorthFuzzing": false
} |
| 1/1 | 2026/07/23 07:08 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 501617c40b15cc25c2eaed0a7cddee2abf340bc4\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jul 23 07:08:18 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst\nindex 83c21853b74b60..406e4c49bac1fd 100644\n--- a/Documentation/gpu/drm-ras.rst\n+++ b/Documentation/gpu/drm-ras.rst\n@@ -56,6 +56,7 @@ User space tools can:\n ``node-id`` and ``error-id`` as parameters.\n * Clear specific error counters with the ``clear-error-counter`` command, using both\n ``node-id`` and ``error-id`` as parameters.\n+* Subscribe to the ``error-report`` multicast group to receive ``error-event``.\n \n YAML-based Interface\n --------------------\n@@ -111,3 +112,23 @@ Example: Clear an error counter for a given node\n \n sudo ynl --family drm_ras --do clear-error-counter --json '{\"node-id\":0, \"error-id\":1}'\n None\n+\n+Example: Subscribe to ``error-report`` multicast group\n+\n+.. code-block:: bash\n+\n+ sudo ynl --family drm_ras --output-json --subscribe error-report\n+\n+.. code-block:: json\n+\n+ {\n+ \"name\": \"error-event\",\n+ \"msg\": {\n+ \"device-name\": \"0000:03:00.0\",\n+ \"node-id\": 1,\n+ \"node-name\": \"uncorrectable-errors\",\n+ \"error-id\": 1,\n+ \"error-name\": \"error_name1\",\n+ \"error-value\": 1\n+ }\n+ }\ndiff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml\nindex e113056f8c016c..8aed3d4515e5af 100644\n--- a/Documentation/netlink/specs/drm_ras.yaml\n+++ b/Documentation/netlink/specs/drm_ras.yaml\n@@ -69,6 +69,33 @@ attribute-sets:\n name: error-value\n type: u32\n doc: Current value of the requested error counter.\n+ -\n+ name: error-event-attrs\n+ attributes:\n+ -\n+ name: device-name\n+ type: string\n+ doc: Device (PCI BDF, UUID) that reported the error.\n+ -\n+ name: node-id\n+ type: u32\n+ doc: ID of the node that reported the error.\n+ -\n+ name: node-name\n+ type: string\n+ doc: Name of the node that reported the error.\n+ -\n+ name: error-id\n+ type: u32\n+ doc: ID of the error counter.\n+ -\n+ name: error-name\n+ type: string\n+ doc: Name of the error.\n+ -\n+ name: error-value\n+ type: u32\n+ doc: Current value of the error counter.\n \n operations:\n list:\n@@ -124,3 +151,24 @@ operations:\n do:\n request:\n attributes: *id-attrs\n+ -\n+ name: error-event\n+ doc: \u003e-\n+ Report an error event to userspace.\n+ The event includes the device, node and error information\n+ of the error that triggered the event.\n+ attribute-set: error-event-attrs\n+ mcgrp: error-report\n+ event:\n+ attributes:\n+ - device-name\n+ - node-id\n+ - node-name\n+ - error-id\n+ - error-name\n+ - error-value\n+\n+mcast-groups:\n+ list:\n+ -\n+ name: error-report\ndiff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c\nindex d6eab29a1394ca..39155fb514de3a 100644\n--- a/drivers/gpu/drm/drm_ras.c\n+++ b/drivers/gpu/drm/drm_ras.c\n@@ -41,6 +41,11 @@\n * Userspace must provide Node ID, Error ID.\n * Clears specific error counter of a node if supported.\n *\n+ * 4. ERROR_REPORT: Subscribe to this multicast group to receive error events\n+ *\n+ * 5. ERROR_EVENT: Report an error event to userspace. The event contains device, node\n+ * and error information that triggered the event.\n+ *\n * Node registration:\n *\n * - drm_ras_node_register(): Registers a new node and assigns\n@@ -186,6 +191,34 @@ static int msg_reply_value(struct sk_buff *msg, u32 error_id,\n \t\t\t value);\n }\n \n+static int msg_put_error_event_attrs(struct sk_buff *msg, struct drm_ras_node *node,\n+\t\t\t\t u32 error_id, const char *error_name, u32 value)\n+{\n+\tint ret;\n+\n+\tret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME, node-\u003edevice_name);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID, node-\u003eid);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME, node-\u003enode_name);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID, error_id);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME, error_name);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\treturn nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE, value);\n+}\n+\n static int doit_reply_value(struct genl_info *info, u32 node_id,\n \t\t\t u32 error_id)\n {\n@@ -222,6 +255,74 @@ static int doit_reply_value(struct genl_info *info, u32 node_id,\n \treturn genlmsg_reply(msg, info);\n }\n \n+/**\n+ * drm_ras_nl_error_event() - Report an error event\n+ * @node: Node structure\n+ * @error_id: ID of the error\n+ * @error_name: Name of the error\n+ * @value: Value of the error counter\n+ *\n+ * Report an error-event to userspace using the error-report multicast group.\n+ *\n+ * Context: Process context only. Uses %GFP_KERNEL and multicasts to all\n+ * netns, which is unbounded work; callers in interrupt handlers\n+ * or other atomic context must defer event.\n+ *\n+ * Return: 0 on success, or negative errno on failure.\n+ */\n+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,\n+\t\t\t u32 value)\n+{\n+\tstruct genl_info info;\n+\tstruct sk_buff *msg;\n+\tstruct nlattr *hdr;\n+\tint ret;\n+\n+\tif (!node || !error_name)\n+\t\treturn -EINVAL;\n+\n+\t/* Check the node is currently registered */\n+\tif (xa_load(\u0026drm_ras_xa, node-\u003eid) != node)\n+\t\treturn -ENOENT;\n+\n+\t/* Currently only Error Counter events are supported */\n+\tif (node-\u003etype != DRM_RAS_NODE_TYPE_ERROR_COUNTER)\n+\t\treturn -EOPNOTSUPP;\n+\n+\t/* Check the error ID is within the valid range */\n+\tif (error_id \u003c node-\u003eerror_counter_range.first ||\n+\t error_id \u003e node-\u003eerror_counter_range.last)\n+\t\treturn -EINVAL;\n+\n+\tgenl_info_init_ntf(\u0026info, \u0026drm_ras_nl_family, DRM_RAS_CMD_ERROR_EVENT);\n+\n+\tmsg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);\n+\tif (!msg)\n+\t\treturn -ENOMEM;\n+\n+\thdr = genlmsg_iput(msg, \u0026info);\n+\tif (!hdr) {\n+\t\tret = -EMSGSIZE;\n+\t\tgoto free_msg;\n+\t}\n+\n+\tret = msg_put_error_event_attrs(msg, node, error_id, error_name, value);\n+\tif (ret)\n+\t\tgoto cancel_msg;\n+\n+\tgenlmsg_end(msg, hdr);\n+\tgenlmsg_multicast_allns(\u0026drm_ras_nl_family, msg, 0, DRM_RAS_NLGRP_ERROR_REPORT);\n+\n+\treturn 0;\n+\n+cancel_msg:\n+\tgenlmsg_cancel(msg, hdr);\n+free_msg:\n+\tnlmsg_free(msg);\n+\treturn ret;\n+}\n+EXPORT_SYMBOL(drm_ras_nl_error_event);\n+\n /**\n * drm_ras_nl_get_error_counter_dumpit() - Dump all Error Counters\n * @skb: Netlink message buffer\ndiff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c\nindex dea1c1b2494e81..9d3123cc9f9caa 100644\n--- a/drivers/gpu/drm/drm_ras_nl.c\n+++ b/drivers/gpu/drm/drm_ras_nl.c\n@@ -58,6 +58,10 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {\n \t},\n };\n \n+static const struct genl_multicast_group drm_ras_nl_mcgrps[] = {\n+\t[DRM_RAS_NLGRP_ERROR_REPORT] = { \"error-report\", },\n+};\n+\n struct genl_family drm_ras_nl_family __ro_after_init = {\n \t.name\t\t= DRM_RAS_FAMILY_NAME,\n \t.version\t= DRM_RAS_FAMILY_VERSION,\n@@ -66,4 +70,6 @@ struct genl_family drm_ras_nl_family __ro_after_init = {\n \t.module\t\t= THIS_MODULE,\n \t.split_ops\t= drm_ras_nl_ops,\n \t.n_split_ops\t= ARRAY_SIZE(drm_ras_nl_ops),\n+\t.mcgrps\t\t= drm_ras_nl_mcgrps,\n+\t.n_mcgrps\t= ARRAY_SIZE(drm_ras_nl_mcgrps),\n };\ndiff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h\nindex a398643572a5a0..03ec275aca9292 100644\n--- a/drivers/gpu/drm/drm_ras_nl.h\n+++ b/drivers/gpu/drm/drm_ras_nl.h\n@@ -21,6 +21,10 @@ int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,\n int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,\n \t\t\t\t\tstruct genl_info *info);\n \n+enum {\n+\tDRM_RAS_NLGRP_ERROR_REPORT,\n+};\n+\n extern struct genl_family drm_ras_nl_family;\n \n #endif /* _LINUX_DRM_RAS_GEN_H */\ndiff --git a/drivers/gpu/drm/xe/xe_drm_ras.c b/drivers/gpu/drm/xe/xe_drm_ras.c\nindex 7937d8ba0ed9ce..5cbfd12d61f4b0 100644\n--- a/drivers/gpu/drm/xe/xe_drm_ras.c\n+++ b/drivers/gpu/drm/xe/xe_drm_ras.c\n@@ -185,6 +185,37 @@ static int register_nodes(struct xe_device *xe)\n \treturn ret;\n }\n \n+/**\n+ * xe_drm_ras_event() - Report drm-ras error event to userspace\n+ * @xe: xe device structure\n+ * @component: error component (see \u0026enum drm_xe_ras_error_component)\n+ * @severity: error severity (see \u0026enum drm_xe_ras_error_severity)\n+ * @value: value of error counter\n+ *\n+ * Report an error-event to userspace.\n+ */\n+void xe_drm_ras_event(struct xe_device *xe, u8 component, u8 severity, u32 value)\n+{\n+\tstruct xe_drm_ras *ras = \u0026xe-\u003eras;\n+\tstruct xe_drm_ras_counter *info = ras-\u003einfo[severity];\n+\tstruct drm_ras_node *node;\n+\tint ret;\n+\n+\t/* Event is supported only if drm-ras is enabled */\n+\tif (!xe-\u003einfo.has_drm_ras)\n+\t\treturn;\n+\n+\tnode = \u0026ras-\u003enode[severity];\n+\n+\tif (!info || !info[component].name)\n+\t\treturn;\n+\n+\tret = drm_ras_nl_error_event(node, component, info[component].name, value);\n+\tif (ret)\n+\t\tdrm_err_ratelimited(\u0026xe-\u003edrm, \"drm-ras error-event failed: %d for %s %s\\n\", ret,\n+\t\t\t\t info[component].name, error_severity[severity]);\n+}\n+\n /**\n * xe_drm_ras_init() - Initialize DRM RAS\n * @xe: xe device instance\ndiff --git a/drivers/gpu/drm/xe/xe_drm_ras.h b/drivers/gpu/drm/xe/xe_drm_ras.h\nindex 365c70e93e82fd..add96bf1a7abd6 100644\n--- a/drivers/gpu/drm/xe/xe_drm_ras.h\n+++ b/drivers/gpu/drm/xe/xe_drm_ras.h\n@@ -5,11 +5,14 @@\n #ifndef _XE_DRM_RAS_H_\n #define _XE_DRM_RAS_H_\n \n+#include \u003clinux/types.h\u003e\n+\n struct xe_device;\n \n #define for_each_error_severity(i)\t\\\n \tfor (i = 0; i \u003c DRM_XE_RAS_ERR_SEV_MAX; i++)\n \n int xe_drm_ras_init(struct xe_device *xe);\n+void xe_drm_ras_event(struct xe_device *xe, u8 component, u8 severity, u32 value);\n \n #endif\ndiff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c\nindex a31e06b8aa67ac..d43f614de72370 100644\n--- a/drivers/gpu/drm/xe/xe_ras.c\n+++ b/drivers/gpu/drm/xe/xe_ras.c\n@@ -90,6 +90,8 @@ static const char * const gpu_health_states[] = {\n };\n static_assert(ARRAY_SIZE(gpu_health_states) == XE_RAS_HEALTH_MAX);\n \n+static int get_counter(struct xe_device *xe, struct xe_ras_error_class *counter, u32 *value);\n+\n static u8 drm_to_xe_ras_severity(u8 severity)\n {\n \tswitch (severity) {\n@@ -102,6 +104,18 @@ static u8 drm_to_xe_ras_severity(u8 severity)\n \t}\n }\n \n+static u8 xe_to_drm_ras_severity(u8 severity)\n+{\n+\tswitch (severity) {\n+\tcase XE_RAS_SEV_CORRECTABLE:\n+\t\treturn DRM_XE_RAS_ERR_SEV_CORRECTABLE;\n+\tcase XE_RAS_SEV_UNCORRECTABLE:\n+\t\treturn DRM_XE_RAS_ERR_SEV_UNCORRECTABLE;\n+\tdefault:\n+\t\treturn DRM_XE_RAS_ERR_SEV_MAX;\n+\t}\n+}\n+\n static u8 drm_to_xe_ras_component(u8 component)\n {\n \tswitch (component) {\n@@ -120,6 +134,24 @@ static u8 drm_to_xe_ras_component(u8 component)\n \t}\n }\n \n+static u8 xe_to_drm_ras_component(u8 component)\n+{\n+\tswitch (component) {\n+\tcase XE_RAS_COMP_DEVICE_MEMORY:\n+\t\treturn DRM_XE_RAS_ERR_COMP_DEVICE_MEMORY;\n+\tcase XE_RAS_COMP_CORE_COMPUTE:\n+\t\treturn DRM_XE_RAS_ERR_COMP_CORE_COMPUTE;\n+\tcase XE_RAS_COMP_PCIE:\n+\t\treturn DRM_XE_RAS_ERR_COMP_PCIE;\n+\tcase XE_RAS_COMP_FABRIC:\n+\t\treturn DRM_XE_RAS_ERR_COMP_FABRIC;\n+\tcase XE_RAS_COMP_SOC_INTERNAL:\n+\t\treturn DRM_XE_RAS_ERR_COMP_SOC_INTERNAL;\n+\tdefault:\n+\t\treturn DRM_XE_RAS_ERR_COMP_MAX;\n+\t}\n+}\n+\n static int ras_status_to_errno(u32 status)\n {\n \tswitch (status) {\n@@ -218,6 +250,26 @@ static void ras_usp_aer_init(struct xe_device *xe)\n \tdev_dbg(\u0026usp-\u003edev, \"Uncorrectable Internal Errors downgraded and unmasked\\n\");\n }\n \n+static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)\n+{\n+\tstruct xe_ras_error_class counter = {0};\n+\tu8 drm_severity, drm_component;\n+\tu32 value;\n+\tint ret;\n+\n+\tcounter.common.severity = severity;\n+\tcounter.common.component = component;\n+\n+\tret = get_counter(xe, \u0026counter, \u0026value);\n+\tif (ret)\n+\t\treturn;\n+\n+\tdrm_severity = xe_to_drm_ras_severity(severity);\n+\tdrm_component = xe_to_drm_ras_component(component);\n+\n+\txe_drm_ras_event(xe, drm_component, drm_severity, value);\n+}\n+\n static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)\n {\n \tstruct xe_ras_compute_error *error_info = (void *)arr-\u003edetails;\n@@ -312,8 +364,10 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,\n \tstruct xe_ras_threshold_crossed *pending = (void *)\u0026response-\u003edata;\n \tstruct xe_ras_error_class *errors = pending-\u003ecounters;\n \tu32 id, ncounters = pending-\u003encounters;\n+\tu8 sent = 0;\n \n \tBUILD_BUG_ON(sizeof(response-\u003edata) \u003c sizeof(*pending));\n+\tBUILD_BUG_ON(BITS_PER_TYPE(sent) \u003c XE_RAS_COMP_MAX);\n \txe_device_assert_mem_access(xe);\n \n \tif (!ncounters || ncounters \u003e XE_RAS_NUM_COUNTERS)\n@@ -329,6 +383,13 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,\n \n \t\txe_warn(xe, \"[RAS]: %s %s detected\\n\",\n \t\t\tcomp_to_str(component), sev_to_str(severity));\n+\n+\t\t/* Send event once per component */\n+\t\tif (sent \u0026 BIT(component))\n+\t\t\tcontinue;\n+\t\tsent |= BIT(component);\n+\n+\t\tras_send_error_event(xe, severity, component);\n \t}\n }\n \n@@ -382,6 +443,7 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)\n \tenum xe_ras_recovery_action final_action;\n \tu32 remaining = XE_SYSCTRL_FLOOD_LIMIT;\n \tstruct xe_ras_get_soc_error response;\n+\tu8 sent = 0;\n \tsize_t rlen;\n \tint ret;\n \n@@ -425,6 +487,12 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)\n \t\t\txe_info(xe, \"[RAS]: %s %s detected\\n\", comp_to_str(component),\n \t\t\t\tsev_to_str(severity));\n \n+\t\t\t/* Send event once per component */\n+\t\t\tif (!(sent \u0026 BIT(component))) {\n+\t\t\t\tsent |= BIT(component);\n+\t\t\t\tras_send_error_event(xe, severity, component);\n+\t\t\t}\n+\n \t\t\tswitch (component) {\n \t\t\tcase XE_RAS_COMP_CORE_COMPUTE:\n \t\t\t\taction = handle_core_compute_errors(arr);\ndiff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h\nindex 0beede3ddc4e4b..ee2caa0edc6f92 100644\n--- a/include/drm/drm_ras.h\n+++ b/include/drm/drm_ras.h\n@@ -80,9 +80,14 @@ struct drm_device;\n #if IS_ENABLED(CONFIG_DRM_RAS)\n int drm_ras_node_register(struct drm_ras_node *node);\n void drm_ras_node_unregister(struct drm_ras_node *node);\n+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,\n+\t\t\t u32 value);\n #else\n static inline int drm_ras_node_register(struct drm_ras_node *node) { return 0; }\n static inline void drm_ras_node_unregister(struct drm_ras_node *node) { }\n+static inline int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id,\n+\t\t\t\t\t const char *error_name, u32 value)\n+{ return 0; }\n #endif\n \n #endif\ndiff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h\nindex 218a3ee8680527..eab8231aa87cbf 100644\n--- a/include/uapi/drm/drm_ras.h\n+++ b/include/uapi/drm/drm_ras.h\n@@ -38,13 +38,28 @@ enum {\n \tDRM_RAS_A_ERROR_COUNTER_ATTRS_MAX = (__DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX - 1)\n };\n \n+enum {\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME = 1,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE,\n+\n+\t__DRM_RAS_A_ERROR_EVENT_ATTRS_MAX,\n+\tDRM_RAS_A_ERROR_EVENT_ATTRS_MAX = (__DRM_RAS_A_ERROR_EVENT_ATTRS_MAX - 1)\n+};\n+\n enum {\n \tDRM_RAS_CMD_LIST_NODES = 1,\n \tDRM_RAS_CMD_GET_ERROR_COUNTER,\n \tDRM_RAS_CMD_CLEAR_ERROR_COUNTER,\n+\tDRM_RAS_CMD_ERROR_EVENT,\n \n \t__DRM_RAS_CMD_MAX,\n \tDRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)\n };\n \n+#define DRM_RAS_MCGRP_ERROR_REPORT\t\"error-report\"\n+\n #endif /* _UAPI_LINUX_DRM_RAS_H */\n"
} |
| 2/1 | 2026/07/23 07:08 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only adds a netlink multicast event sent from the kernel to userspace to report hardware RAS errors. It does not introduce any new userspace-controllable inputs, ioctls, or netlink commands that can be fuzzed.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 501617c40b15cc25c2eaed0a7cddee2abf340bc4
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Jul 23 07:08:18 2026 +0000
syz-cluster: applied patch under review
diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst
index 83c21853b74b60..406e4c49bac1fd 100644
--- a/Documentation/gpu/drm-ras.rst
+++ b/Documentation/gpu/drm-ras.rst
@@ -56,6 +56,7 @@ User space tools can:
``node-id`` and ``error-id`` as parameters.
* Clear specific error counters with the ``clear-error-counter`` command, using both
``node-id`` and ``error-id`` as parameters.
+* Subscribe to the ``error-report`` multicast group to receive ``error-event``.
YAML-based Interface
--------------------
@@ -111,3 +112,23 @@ Example: Clear an error counter for a given node
sudo ynl --family drm_ras --do clear-error-counter --json '{"node-id":0, "error-id":1}'
None
+
+Example: Subscribe to ``error-report`` multicast group
+
+.. code-block:: bash
+
+ sudo ynl --family drm_ras --output-json --subscribe error-report
+
+.. code-block:: json
+
+ {
+ "name": "error-event",
+ "msg": {
+ "device-name": "0000:03:00.0",
+ "node-id": 1,
+ "node-name": "uncorrectable-errors",
+ "error-id": 1,
+ "error-name": "error_name1",
+ "error-value": 1
+ }
+ }
diff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml
index e113056f8c016c..8aed3d4515e5af 100644
--- a/Documentation/netlink/specs/drm_ras.yaml
+++ b/Documentation/netlink/specs/drm_ras.yaml
@@ -69,6 +69,33 @@ attribute-sets:
name: error-value
type: u32
doc: Current value of the requested error counter.
+ -
+ name: error-event-attrs
+ attributes:
+ -
+ name: device-name
+ type: string
+ doc: Device (PCI BDF, UUID) that reported the error.
+ -
+ name: node-id
+ type: u32
+ doc: ID of the node that reported the error.
+ -
+ name: node-name
+ type: string
+ doc: Name of the node that reported the error.
+ -
+ name: error-id
+ type: u32
+ doc: ID of the error counter.
+ -
+ name: error-name
+ type: string
+ doc: Name of the error.
+ -
+ name: error-value
+ type: u32
+ doc: Current value of the error counter.
operations:
list:
@@ -124,3 +151,24 @@ operations:
do:
request:
attributes: *id-attrs
+ -
+ name: error-event
+ doc: >-
+ Report an error event to userspace.
+ The event includes the device, node and error information
+ of the error that triggered the event.
+ attribute-set: error-event-attrs
+ mcgrp: error-report
+ event:
+ attributes:
+ - device-name
+ - node-id
+ - node-name
+ - error-id
+ - error-name
+ - error-value
+
+mcast-groups:
+ list:
+ -
+ name: error-report
diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
index d6eab29a1394ca..39155fb514de3a 100644
--- a/drivers/gpu/drm/drm_ras.c
+++ b/drivers/gpu/drm/drm_ras.c
@@ -41,6 +41,11 @@
* Userspace must provide Node ID, Error ID.
* Clears specific error counter of a node if supported.
*
+ * 4. ERROR_REPORT: Subscribe to this multicast group to receive error events
+ *
+ * 5. ERROR_EVENT: Report an error event to userspace. The event contains device, node
+ * and error information that triggered the event.
+ *
* Node registration:
*
* - drm_ras_node_register(): Registers a new node and assigns
@@ -186,6 +191,34 @@ static int msg_reply_value(struct sk_buff *msg, u32 error_id,
value);
}
+static int msg_put_error_event_attrs(struct sk_buff *msg, struct drm_ras_node *node,
+ u32 error_id, const char *error_name, u32 value)
+{
+ int ret;
+
+ ret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME, node->device_name);
+ if (ret)
+ return ret;
+
+ ret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID, node->id);
+ if (ret)
+ return ret;
+
+ ret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME, node->node_name);
+ if (ret)
+ return ret;
+
+ ret = nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID, error_id);
+ if (ret)
+ return ret;
+
+ ret = nla_put_string(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME, error_name);
+ if (ret)
+ return ret;
+
+ return nla_put_u32(msg, DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE, value);
+}
+
static int doit_reply_value(struct genl_info *info, u32 node_id,
u32 error_id)
{
@@ -222,6 +255,74 @@ static int doit_reply_value(struct genl_info *info, u32 node_id,
return genlmsg_reply(msg, info);
}
+/**
+ * drm_ras_nl_error_event() - Report an error event
+ * @node: Node structure
+ * @error_id: ID of the error
+ * @error_name: Name of the error
+ * @value: Value of the error counter
+ *
+ * Report an error-event to userspace using the error-report multicast group.
+ *
+ * Context: Process context only. Uses %GFP_KERNEL and multicasts to all
+ * netns, which is unbounded work; callers in interrupt handlers
+ * or other atomic context must defer event.
+ *
+ * Return: 0 on success, or negative errno on failure.
+ */
+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,
+ u32 value)
+{
+ struct genl_info info;
+ struct sk_buff *msg;
+ struct nlattr *hdr;
+ int ret;
+
+ if (!node || !error_name)
+ return -EINVAL;
+
+ /* Check the node is currently registered */
+ if (xa_load(&drm_ras_xa, node->id) != node)
+ return -ENOENT;
+
+ /* Currently only Error Counter events are supported */
+ if (node->type != DRM_RAS_NODE_TYPE_ERROR_COUNTER)
+ return -EOPNOTSUPP;
+
+ /* Check the error ID is within the valid range */
+ if (error_id < node->error_counter_range.first ||
+ error_id > node->error_counter_range.last)
+ return -EINVAL;
+
+ genl_info_init_ntf(&info, &drm_ras_nl_family, DRM_RAS_CMD_ERROR_EVENT);
+
+ msg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+ if (!msg)
+ return -ENOMEM;
+
+ hdr = genlmsg_iput(msg, &info);
+ if (!hdr) {
+ ret = -EMSGSIZE;
+ goto free_msg;
+ }
+
+ ret = msg_put_error_event_attrs(msg, node, error_id, error_name, value);
+ if (ret)
+ goto cancel_msg;
+
+ genlmsg_end(msg, hdr);
+ genlmsg_multicast_allns(&drm_ras_nl_family, msg, 0, DRM_RAS_NLGRP_ERROR_REPORT);
+
+ return 0;
+
+cancel_msg:
+ genlmsg_cancel(msg, hdr);
+free_msg:
+ nlmsg_free(msg);
+ return ret;
+}
+EXPORT_SYMBOL(drm_ras_nl_error_event);
+
/**
* drm_ras_nl_get_error_counter_dumpit() - Dump all Error Counters
* @skb: Netlink message buffer
diff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c
index dea1c1b2494e81..9d3123cc9f9caa 100644
--- a/drivers/gpu/drm/drm_ras_nl.c
+++ b/drivers/gpu/drm/drm_ras_nl.c
@@ -58,6 +58,10 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {
},
};
+static const struct genl_multicast_group drm_ras_nl_mcgrps[] = {
+ [DRM_RAS_NLGRP_ERROR_REPORT] = { "error-report", },
+};
+
struct genl_family drm_ras_nl_family __ro_after_init = {
.name = DRM_RAS_FAMILY_NAME,
.version = DRM_RAS_FAMILY_VERSION,
@@ -66,4 +70,6 @@ struct genl_family drm_ras_nl_family __ro_after_init = {
.module = THIS_MODULE,
.split_ops = drm_ras_nl_ops,
.n_split_ops = ARRAY_SIZE(drm_ras_nl_ops),
+ .mcgrps = drm_ras_nl_mcgrps,
+ .n_mcgrps = ARRAY_SIZE(drm_ras_nl_mcgrps),
};
diff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h
index a398643572a5a0..03ec275aca9292 100644
--- a/drivers/gpu/drm/drm_ras_nl.h
+++ b/drivers/gpu/drm/drm_ras_nl.h
@@ -21,6 +21,10 @@ int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
struct genl_info *info);
+enum {
+ DRM_RAS_NLGRP_ERROR_REPORT,
+};
+
extern struct genl_family drm_ras_nl_family;
#endif /* _LINUX_DRM_RAS_GEN_H */
diff --git a/drivers/gpu/drm/xe/xe_drm_ras.c b/drivers/gpu/drm/xe/xe_drm_ras.c
index 7937d8ba0ed9ce..5cbfd12d61f4b0 100644
--- a/drivers/gpu/drm/xe/xe_drm_ras.c
+++ b/drivers/gpu/drm/xe/xe_drm_ras.c
@@ -185,6 +185,37 @@ static int register_nodes(struct xe_device *xe)
return ret;
}
+/**
+ * xe_drm_ras_event() - Report drm-ras error event to userspace
+ * @xe: xe device structure
+ * @component: error component (see &enum drm_xe_ras_error_component)
+ * @severity: error severity (see &enum drm_xe_ras_error_severity)
+ * @value: value of error counter
+ *
+ * Report an error-event to userspace.
+ */
+void xe_drm_ras_event(struct xe_device *xe, u8 component, u8 severity, u32 value)
+{
+ struct xe_drm_ras *ras = &xe->ras;
+ struct xe_drm_ras_counter *info = ras->info[severity];
+ struct drm_ras_node *node;
+ int ret;
+
+ /* Event is supported only if drm-ras is enabled */
+ if (!xe->info.has_drm_ras)
+ return;
+
+ node = &ras->node[severity];
+
+ if (!info || !info[component].name)
+ return;
+
+ ret = drm_ras_nl_error_event(node, component, info[component].name, value);
+ if (ret)
+ drm_err_ratelimited(&xe->drm, "drm-ras error-event failed: %d for %s %s\n", ret,
+ info[component].name, error_severity[severity]);
+}
+
/**
* xe_drm_ras_init() - Initialize DRM RAS
* @xe: xe device instance
diff --git a/drivers/gpu/drm/xe/xe_drm_ras.h b/drivers/gpu/drm/xe/xe_drm_ras.h
index 365c70e93e82fd..add96bf1a7abd6 100644
--- a/drivers/gpu/drm/xe/xe_drm_ras.h
+++ b/drivers/gpu/drm/xe/xe_drm_ras.h
@@ -5,11 +5,14 @@
#ifndef _XE_DRM_RAS_H_
#define _XE_DRM_RAS_H_
+#include <linux/types.h>
+
struct xe_device;
#define for_each_error_severity(i) \
for (i = 0; i < DRM_XE_RAS_ERR_SEV_MAX; i++)
int xe_drm_ras_init(struct xe_device *xe);
+void xe_drm_ras_event(struct xe_device *xe, u8 component, u8 severity, u32 value);
#endif
diff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c
index a31e06b8aa67ac..d43f614de72370 100644
--- a/drivers/gpu/drm/xe/xe_ras.c
+++ b/drivers/gpu/drm/xe/xe_ras.c
@@ -90,6 +90,8 @@ static const char * const gpu_health_states[] = {
};
static_assert(ARRAY_SIZE(gpu_health_states) == XE_RAS_HEALTH_MAX);
+static int get_counter(struct xe_device *xe, struct xe_ras_error_class *counter, u32 *value);
+
static u8 drm_to_xe_ras_severity(u8 severity)
{
switch (severity) {
@@ -102,6 +104,18 @@ static u8 drm_to_xe_ras_severity(u8 severity)
}
}
+static u8 xe_to_drm_ras_severity(u8 severity)
+{
+ switch (severity) {
+ case XE_RAS_SEV_CORRECTABLE:
+ return DRM_XE_RAS_ERR_SEV_CORRECTABLE;
+ case XE_RAS_SEV_UNCORRECTABLE:
+ return DRM_XE_RAS_ERR_SEV_UNCORRECTABLE;
+ default:
+ return DRM_XE_RAS_ERR_SEV_MAX;
+ }
+}
+
static u8 drm_to_xe_ras_component(u8 component)
{
switch (component) {
@@ -120,6 +134,24 @@ static u8 drm_to_xe_ras_component(u8 component)
}
}
+static u8 xe_to_drm_ras_component(u8 component)
+{
+ switch (component) {
+ case XE_RAS_COMP_DEVICE_MEMORY:
+ return DRM_XE_RAS_ERR_COMP_DEVICE_MEMORY;
+ case XE_RAS_COMP_CORE_COMPUTE:
+ return DRM_XE_RAS_ERR_COMP_CORE_COMPUTE;
+ case XE_RAS_COMP_PCIE:
+ return DRM_XE_RAS_ERR_COMP_PCIE;
+ case XE_RAS_COMP_FABRIC:
+ return DRM_XE_RAS_ERR_COMP_FABRIC;
+ case XE_RAS_COMP_SOC_INTERNAL:
+ return DRM_XE_RAS_ERR_COMP_SOC_INTERNAL;
+ default:
+ return DRM_XE_RAS_ERR_COMP_MAX;
+ }
+}
+
static int ras_status_to_errno(u32 status)
{
switch (status) {
@@ -218,6 +250,26 @@ static void ras_usp_aer_init(struct xe_device *xe)
dev_dbg(&usp->dev, "Uncorrectable Internal Errors downgraded and unmasked\n");
}
+static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)
+{
+ struct xe_ras_error_class counter = {0};
+ u8 drm_severity, drm_component;
+ u32 value;
+ int ret;
+
+ counter.common.severity = severity;
+ counter.common.component = component;
+
+ ret = get_counter(xe, &counter, &value);
+ if (ret)
+ return;
+
+ drm_severity = xe_to_drm_ras_severity(severity);
+ drm_component = xe_to_drm_ras_component(component);
+
+ xe_drm_ras_event(xe, drm_component, drm_severity, value);
+}
+
static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)
{
struct xe_ras_compute_error *error_info = (void *)arr->details;
@@ -312,8 +364,10 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
struct xe_ras_threshold_crossed *pending = (void *)&response->data;
struct xe_ras_error_class *errors = pending->counters;
u32 id, ncounters = pending->ncounters;
+ u8 sent = 0;
BUILD_BUG_ON(sizeof(response->data) < sizeof(*pending));
+ BUILD_BUG_ON(BITS_PER_TYPE(sent) < XE_RAS_COMP_MAX);
xe_device_assert_mem_access(xe);
if (!ncounters || ncounters > XE_RAS_NUM_COUNTERS)
@@ -329,6 +383,13 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
xe_warn(xe, "[RAS]: %s %s detected\n",
comp_to_str(component), sev_to_str(severity));
+
+ /* Send event once per component */
+ if (sent & BIT(component))
+ continue;
+ sent |= BIT(component);
+
+ ras_send_error_event(xe, severity, component);
}
}
@@ -382,6 +443,7 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)
enum xe_ras_recovery_action final_action;
u32 remaining = XE_SYSCTRL_FLOOD_LIMIT;
struct xe_ras_get_soc_error response;
+ u8 sent = 0;
size_t rlen;
int ret;
@@ -425,6 +487,12 @@ enum xe_ras_recovery_action xe_ras_process_errors(struct xe_device *xe)
xe_info(xe, "[RAS]: %s %s detected\n", comp_to_str(component),
sev_to_str(severity));
+ /* Send event once per component */
+ if (!(sent & BIT(component))) {
+ sent |= BIT(component);
+ ras_send_error_event(xe, severity, component);
+ }
+
switch (component) {
case XE_RAS_COMP_CORE_COMPUTE:
action = handle_core_compute_errors(arr);
diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
index 0beede3ddc4e4b..ee2caa0edc6f92 100644
--- a/include/drm/drm_ras.h
+++ b/include/drm/drm_ras.h
@@ -80,9 +80,14 @@ struct drm_device;
#if IS_ENABLED(CONFIG_DRM_RAS)
int drm_ras_node_register(struct drm_ras_node *node);
void drm_ras_node_unregister(struct drm_ras_node *node);
+int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id, const char *error_name,
+ u32 value);
#else
static inline int drm_ras_node_register(struct drm_ras_node *node) { return 0; }
static inline void drm_ras_node_unregister(struct drm_ras_node *node) { }
+static inline int drm_ras_nl_error_event(struct drm_ras_node *node, u32 error_id,
+ const char *error_name, u32 value)
+{ return 0; }
#endif
#endif
diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
index 218a3ee8680527..eab8231aa87cbf 100644
--- a/include/uapi/drm/drm_ras.h
+++ b/include/uapi/drm/drm_ras.h
@@ -38,13 +38,28 @@ enum {
DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX = (__DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX - 1)
};
+enum {
+ DRM_RAS_A_ERROR_EVENT_ATTRS_DEVICE_NAME = 1,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_ID,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_NODE_NAME,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_ID,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_NAME,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_ERROR_VALUE,
+
+ __DRM_RAS_A_ERROR_EVENT_ATTRS_MAX,
+ DRM_RAS_A_ERROR_EVENT_ATTRS_MAX = (__DRM_RAS_A_ERROR_EVENT_ATTRS_MAX - 1)
+};
+
enum {
DRM_RAS_CMD_LIST_NODES = 1,
DRM_RAS_CMD_GET_ERROR_COUNTER,
DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
+ DRM_RAS_CMD_ERROR_EVENT,
__DRM_RAS_CMD_MAX,
DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
};
+#define DRM_RAS_MCGRP_ERROR_REPORT "error-report"
+
#endif /* _UAPI_LINUX_DRM_RAS_H */
|
| 3/2 | 2026/07/23 07:08 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7979 output: 82 thoughts: 1119 Thoughts: **Assessing the Fuzzing Potential of the Netlink Error Event Patch** Okay, let's break this down. We have a patch that introduces a new netlink multicast event, `error-event`, within the `drm_ras` family. The goal is to inform userspace about hardware errors detected in the kernel, specifically within the `xe` driver. We're adding a function `drm_ras_nl_error_event` to send this event. The `xe` driver is set up to call `ras_send_error_event` whenever a RAS error, or a threshold being crossed, is detected. My initial thought is to determine if this requires fuzzing. The key here is to understand the direction of data flow. This is an event *to* userspace, not a command *from* userspace. The patch modifies `drivers/gpu/drm/drm_ras.c` to include the `drm_ras_nl_error_event` function which is responsible for sending the netlink multicast message. Also, `drivers/gpu/drm/xe/xe_ras.c` is being altered to call this new function whenever a hardware error is detected. The important question is if there are any new *inputs* from userspace being introduced. The netlink event is simply sent to userspace – essentially a notification mechanism. Userspace can subscribe to the multicast group, which is a standard netlink functionality. The actual event itself is generated by the kernel in response to a hardware error condition. The `drm_ras.yaml` file confirms this: it describes the `error-event` as a reporting mechanism that includes attributes like device name, node ID, and error information. I'm checking the enumeration for `DRM_RAS_CMD_ERROR_EVENT`, but it's an event, not a command. There are no new operations defined within `drm_ras_nl.c` that would provide a way for userspace to trigger this event. Examining the `drm_ras_nl_ops` and the `drm_ras_nl_mcgrps` confirms that this patch only adds a new multicast group and an event. It doesn't enable userspace to send `DRM_RAS_CMD_ERROR_EVENT`. The patch creates the new multicast group `error-report`. Crucially, can Syzkaller, or any other fuzzer, trigger this event? Not directly, since the event relies on hardware error conditions within the `xe` driver, and it's simply informing userspace of something that has already happened. There's no new ioctl or netlink command to actively *trigger* this reporting. The added code is just responding to existing error conditions within the hardware itself. I'm now satisfied. There's no new attack surface created because there's no new input from userspace to fuzz. The only userspace interaction is subscribing to the multicast group, and that's handled by generic netlink code, so it is safe. I've confirmed that `xe_drm_ras_event` is indeed called from `ras_send_error_event`, which is, in turn, called by `xe_ras_counter_threshold_crossed` and `xe_ras_process_errors`. These functions are hardware error handling paths. No new input. Therefore, `WorthFuzzing` is `false`. The patch just adds a kernel-to-userspace multicast event to report RAS errors, with no added attack surface. |
| 4/2 | 2026/07/23 07:08 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch only adds a netlink multicast event sent from the kernel to userspace to report hardware RAS errors. It does not introduce any new userspace-controllable inputs, ioctls, or netlink commands that can be fuzzed.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only adds a netlink multicast event sent from the kernel to userspace to report hardware RAS errors. It does not introduce any new userspace-controllable inputs, ioctls, or netlink commands that can be fuzzed.",
"WorthFuzzing": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|