| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/06 15:21 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"IPV6",
"IPV6_MROUTE",
"IPV6_MROUTE_MULTIPLE_TABLES"
],
"FocusSymbols": [
"ip6_mroute_setsockopt",
"ip6_mroute_getsockopt",
"ip6mr_ioctl",
"ip6mr_compat_ioctl",
"ip6mr_sk_done",
"ip6mr_get_or_alloc_sk_table",
"ip6mr_maybe_destroy_table",
"ip6mr_destroy_workfn",
"ip6mr_device_event",
"ipmr_expire_process"
],
"KMSANReasoning": "The patch modifies IPv6 multicast routing table management (net/ipv6/ip6mr.c) to dynamically allocate tables on demand when socket options are configured and to destroy them when they become unreferenced or empty.\n\n- Memory Allocations: New dynamic allocations (such as `struct ip6mr_destroy_work` allocated via `kmalloc_obj`) have all member fields (`work`, `net`, `id`) fully initialized before use. The underlying multicast tables allocated via `mr_table_alloc()` use `kzalloc_obj()`.\n- Data sent to user space: ioctl/compat_ioctl and getsockopt handlers only copy explicitly initialized fields or data copied from user space back to user space without leaving uninitialized padding or reading uninitialized kernel memory.\n- Control flow and Lifetimes: Changes affect table lifecycle, RCU synchronization, list manipulations, and locking (RTNL/mrt_lock). Potential issues in these paths involve use-after-free, concurrent access, or memory leaks, which are handled by KASAN, LOCKDEP, and KMEMLEAK.\n\nThere are no uninitialized memory reads or information leaks introduced, so a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false,
"Reasoning": "The patch refactors IPv6 multicast routing (ip6mr) table lifecycle and locking. It adds dynamic table allocation, asynchronous table destruction via workqueues, and updates setsockopt, getsockopt, ioctl, timer expiration, and netdev notifier handling. These paths are directly accessible from userspace via raw IPv6 sockets.",
"WorthFuzzing": true
} |
| 1/1 | 2026/09/06 15:21 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 521c0b02a6814200b0eeb20aaf13c5d84e98fe5b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Sep 6 15:21:56 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c\nindex 3f2ed9b77deb5..26bd2ccd4201a 100644\n--- a/net/ipv6/ip6mr.c\n+++ b/net/ipv6/ip6mr.c\n@@ -28,6 +28,7 @@\n #include \u003clinux/init.h\u003e\n #include \u003clinux/compat.h\u003e\n #include \u003clinux/rhashtable.h\u003e\n+#include \u003clinux/workqueue.h\u003e\n #include \u003cnet/protocol.h\u003e\n #include \u003clinux/skbuff.h\u003e\n #include \u003cnet/raw.h\u003e\n@@ -368,6 +369,12 @@ static struct mr_table *ip6mr_get_table(struct net *net, u32 id)\n \treturn mrt;\n }\n \n+static struct mr_table *ip6mr_lookup_sk_table(struct sock *sk)\n+{\n+\treturn __ip6mr_get_table(sock_net(sk),\n+\t\t\t\t raw6_sk(sk)-\u003eip6mr_table ? : RT6_TABLE_DFLT);\n+}\n+\n static int ip6mr_hash_cmp(struct rhashtable_compare_arg *arg,\n \t\t\t const void *ptr)\n {\n@@ -417,6 +424,124 @@ static struct mr_table *ip6mr_new_table(struct net *net, u32 id)\n \t\t\t ipmr_expire_process, ip6mr_new_table_set);\n }\n \n+/* table_set callback used while the new table is still unpublished. */\n+static void ip6mr_table_no_publish(struct mr_table *mrt, struct net *net)\n+{\n+}\n+\n+static struct mr_table *ip6mr_get_or_alloc_sk_table(struct sock *sk,\n+\t\t\t\t\t\t bool *new_table)\n+{\n+\tu32 id = raw6_sk(sk)-\u003eip6mr_table ? : RT6_TABLE_DFLT;\n+\tstruct net *net = sock_net(sk);\n+\tstruct mr_table *mrt;\n+\n+\tASSERT_RTNL();\n+\t*new_table = false;\n+\n+\tmrt = __ip6mr_get_table(net, id);\n+\tif (mrt)\n+\t\treturn mrt;\n+\n+\tmrt = mr_table_alloc(net, id, \u0026ip6mr_mr_table_ops,\n+\t\t\t ipmr_expire_process, ip6mr_table_no_publish);\n+\tif (!IS_ERR(mrt))\n+\t\t*new_table = true;\n+\treturn mrt;\n+}\n+\n+static void ip6mr_publish_new_table(struct mr_table *mrt, bool new_table)\n+{\n+\tif (new_table)\n+\t\tip6mr_new_table_set(mrt, read_pnet(\u0026mrt-\u003enet));\n+}\n+\n+static void ip6mr_maybe_destroy_table(struct mr_table *mrt)\n+{\n+\tASSERT_RTNL();\n+\n+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\n+\tif (mrt-\u003eid == RT6_TABLE_DFLT)\n+\t\treturn;\n+\t/* Nested NETDEV_UNREGISTER may already have unlinked this table. */\n+\tif (__ip6mr_get_table(read_pnet(\u0026mrt-\u003enet), mrt-\u003eid) != mrt)\n+\t\treturn;\n+\tif (rtnl_dereference(mrt-\u003emroute_sk) ||\n+\t mrt-\u003emaxvif ||\n+\t !list_empty(\u0026mrt-\u003emfc_cache_list))\n+\t\treturn;\n+\n+\tspin_lock_bh(\u0026mfc_unres_lock);\n+\tif (!list_empty(\u0026mrt-\u003emfc_unres_queue)) {\n+\t\tspin_unlock_bh(\u0026mfc_unres_lock);\n+\t\treturn;\n+\t}\n+\tspin_unlock_bh(\u0026mfc_unres_lock);\n+\n+\tlist_del_rcu(\u0026mrt-\u003elist);\n+\ttimer_shutdown_sync(\u0026mrt-\u003eipmr_expire_timer);\n+\tmr_table_free(mrt);\n+#endif\n+}\n+\n+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\n+struct ip6mr_destroy_work {\n+\tstruct work_struct work;\n+\tstruct net *net;\n+\tu32 id;\n+};\n+\n+static void ip6mr_destroy_workfn(struct work_struct *work)\n+{\n+\tstruct ip6mr_destroy_work *dw =\n+\t\tcontainer_of(work, struct ip6mr_destroy_work, work);\n+\tstruct mr_table *mrt;\n+\n+\trtnl_lock();\n+\tmrt = __ip6mr_get_table(dw-\u003enet, dw-\u003eid);\n+\tif (mrt)\n+\t\tip6mr_maybe_destroy_table(mrt);\n+\trtnl_unlock();\n+\tput_net(dw-\u003enet);\n+\tkfree(dw);\n+}\n+\n+static void ip6mr_queue_maybe_destroy(struct mr_table *mrt)\n+{\n+\tstruct net *net = read_pnet(\u0026mrt-\u003enet);\n+\tstruct ip6mr_destroy_work *dw;\n+\n+\tif (mrt-\u003eid == RT6_TABLE_DFLT)\n+\t\treturn;\n+\n+\tdw = kmalloc_obj(*dw, GFP_ATOMIC);\n+\tif (!dw) {\n+\t\tmod_timer(\u0026mrt-\u003eipmr_expire_timer, jiffies + HZ);\n+\t\treturn;\n+\t}\n+\tif (!maybe_get_net(net)) {\n+\t\tkfree(dw);\n+\t\treturn;\n+\t}\n+\tINIT_WORK(\u0026dw-\u003ework, ip6mr_destroy_workfn);\n+\tdw-\u003enet = net;\n+\tdw-\u003eid = mrt-\u003eid;\n+\tqueue_work(system_dfl_wq, \u0026dw-\u003ework);\n+}\n+#else\n+static void ip6mr_queue_maybe_destroy(struct mr_table *mrt)\n+{\n+}\n+#endif\n+\n+static int ip6mr_finish_new_table(struct mr_table *mrt, bool new_table,\n+\t\t\t\t int err)\n+{\n+\tif (new_table \u0026\u0026 err)\n+\t\tip6mr_maybe_destroy_table(mrt);\n+\treturn err;\n+}\n+\n static void ip6mr_free_table(struct mr_table *mrt,\n \t\t\t struct list_head *dev_kill_list)\n {\n@@ -866,16 +991,25 @@ static void ipmr_do_expire_process(struct mr_table *mrt)\n static void ipmr_expire_process(struct timer_list *t)\n {\n \tstruct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer);\n+\tbool empty = false;\n \n \tif (!spin_trylock(\u0026mfc_unres_lock)) {\n \t\tmod_timer(\u0026mrt-\u003eipmr_expire_timer, jiffies + 1);\n \t\treturn;\n \t}\n \n-\tif (!list_empty(\u0026mrt-\u003emfc_unres_queue))\n+\tif (!list_empty(\u0026mrt-\u003emfc_unres_queue)) {\n \t\tipmr_do_expire_process(mrt);\n+\t\tempty = list_empty(\u0026mrt-\u003emfc_unres_queue);\n+\t} else {\n+\t\t/* Retry after GFP_ATOMIC allocation failure. */\n+\t\tempty = true;\n+\t}\n \n \tspin_unlock(\u0026mfc_unres_lock);\n+\n+\tif (empty)\n+\t\tip6mr_queue_maybe_destroy(mrt);\n }\n \n /* Fill oifs list. It is called under locked mrt_lock. */\n@@ -1290,19 +1424,34 @@ static int ip6mr_device_event(struct notifier_block *this,\n {\n \tstruct net_device *dev = netdev_notifier_info_to_dev(ptr);\n \tstruct net *net = dev_net(dev);\n+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\n+\tstruct mr_table *mrt, *next;\n+#else\n \tstruct mr_table *mrt;\n+#endif\n \tstruct vif_device *v;\n \tint ct;\n \n \tif (event != NETDEV_UNREGISTER)\n \t\treturn NOTIFY_DONE;\n \n-\tip6mr_for_each_table(mrt, net) {\n+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\n+\tlist_for_each_entry_safe(mrt, next, \u0026net-\u003eipv6.mr6_tables, list)\n+#else\n+\tip6mr_for_each_table(mrt, net)\n+#endif\n+\t{\n+\t\tbool vif_gone = false;\n+\n \t\tv = \u0026mrt-\u003evif_table[0];\n \t\tfor (ct = 0; ct \u003c mrt-\u003emaxvif; ct++, v++) {\n-\t\t\tif (rcu_access_pointer(v-\u003edev) == dev)\n+\t\t\tif (rcu_access_pointer(v-\u003edev) == dev) {\n \t\t\t\tmif6_delete(mrt, ct, 1, NULL);\n+\t\t\t\tvif_gone = true;\n+\t\t\t}\n \t\t}\n+\t\tif (vif_gone)\n+\t\t\tip6mr_maybe_destroy_table(mrt);\n \t}\n \n \treturn NOTIFY_DONE;\n@@ -1618,10 +1767,11 @@ static void mroute_clean_tables(struct mr_table *mrt, int flags,\n \n static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)\n {\n-\tint err = 0;\n \tstruct net *net = sock_net(sk);\n+\tint err = 0;\n+\n+\tASSERT_RTNL();\n \n-\trtnl_lock();\n \tspin_lock(\u0026mrt_lock);\n \tif (rtnl_dereference(mrt-\u003emroute_sk)) {\n \t\terr = -EADDRINUSE;\n@@ -1637,8 +1787,6 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)\n \t\t\t\t\t NETCONFA_MC_FORWARDING,\n \t\t\t\t\t NETCONFA_IFINDEX_ALL,\n \t\t\t\t\t net-\u003eipv6.devconf_all);\n-\trtnl_unlock();\n-\n \treturn err;\n }\n \n@@ -1677,6 +1825,7 @@ int ip6mr_sk_done(struct sock *sk)\n \t\t\tmroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MFC,\n \t\t\t\t\t \u0026dev_kill_list);\n \t\t\terr = 0;\n+\t\t\tip6mr_maybe_destroy_table(mrt);\n \t\t\tbreak;\n \t\t}\n \t}\n@@ -1723,27 +1872,45 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t inet_sk(sk)-\u003einet_num != IPPROTO_ICMPV6)\n \t\treturn -EOPNOTSUPP;\n \n-\tmrt = ip6mr_get_table(net, raw6_sk(sk)-\u003eip6mr_table ? : RT6_TABLE_DFLT);\n-\tif (!mrt)\n-\t\treturn -ENOENT;\n-\n \tif (optname != MRT6_INIT) {\n-\t\tif (sk != rcu_access_pointer(mrt-\u003emroute_sk) \u0026\u0026\n-\t\t !ns_capable(net-\u003euser_ns, CAP_NET_ADMIN))\n+\t\tbool is_mroute_sk = false;\n+\n+\t\trcu_read_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (mrt \u0026\u0026 sk == rcu_access_pointer(mrt-\u003emroute_sk))\n+\t\t\tis_mroute_sk = true;\n+\t\trcu_read_unlock();\n+\n+\t\tif (!is_mroute_sk \u0026\u0026 !ns_capable(net-\u003euser_ns, CAP_NET_ADMIN))\n \t\t\treturn -EACCES;\n \t}\n \n \tswitch (optname) {\n-\tcase MRT6_INIT:\n+\tcase MRT6_INIT: {\n+\t\tbool new_table = false;\n+\n \t\tif (optlen \u003c sizeof(int))\n \t\t\treturn -EINVAL;\n \n-\t\treturn ip6mr_sk_init(mrt, sk);\n+\t\trtnl_lock();\n+\t\tmrt = ip6mr_get_or_alloc_sk_table(sk, \u0026new_table);\n+\t\tif (IS_ERR(mrt)) {\n+\t\t\trtnl_unlock();\n+\t\t\treturn PTR_ERR(mrt);\n+\t\t}\n+\t\tip6mr_publish_new_table(mrt, new_table);\n+\t\tret = ip6mr_sk_init(mrt, sk);\n+\t\tret = ip6mr_finish_new_table(mrt, new_table, ret);\n+\t\trtnl_unlock();\n+\t\treturn ret;\n+\t}\n \n \tcase MRT6_DONE:\n \t\treturn ip6mr_sk_done(sk);\n \n-\tcase MRT6_ADD_MIF:\n+\tcase MRT6_ADD_MIF: {\n+\t\tbool new_table = false;\n+\n \t\tif (optlen \u003c sizeof(vif))\n \t\t\treturn -EINVAL;\n \t\tif (copy_from_sockptr(\u0026vif, optval, sizeof(vif)))\n@@ -1751,10 +1918,18 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\tif (vif.mif6c_mifi \u003e= MAXMIFS)\n \t\t\treturn -ENFILE;\n \t\trtnl_lock();\n+\t\tmrt = ip6mr_get_or_alloc_sk_table(sk, \u0026new_table);\n+\t\tif (IS_ERR(mrt)) {\n+\t\t\trtnl_unlock();\n+\t\t\treturn PTR_ERR(mrt);\n+\t\t}\n+\t\tip6mr_publish_new_table(mrt, new_table);\n \t\tret = mif6_add(net, mrt, \u0026vif,\n \t\t\t sk == rtnl_dereference(mrt-\u003emroute_sk));\n+\t\tret = ip6mr_finish_new_table(mrt, new_table, ret);\n \t\trtnl_unlock();\n \t\treturn ret;\n+\t}\n \n \tcase MRT6_DEL_MIF:\n \t\tif (optlen \u003c sizeof(mifi_t))\n@@ -1762,7 +1937,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\tif (copy_from_sockptr(\u0026mifi, optval, sizeof(mifi_t)))\n \t\t\treturn -EFAULT;\n \t\trtnl_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (!mrt) {\n+\t\t\trtnl_unlock();\n+\t\t\treturn -ENOENT;\n+\t\t}\n \t\tret = mif6_delete(mrt, mifi, 0, NULL);\n+\t\tif (!ret)\n+\t\t\tip6mr_maybe_destroy_table(mrt);\n \t\trtnl_unlock();\n \t\treturn ret;\n \n@@ -1783,17 +1965,39 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\tif (parent == 0)\n \t\t\tparent = mfc.mf6cc_parent;\n \n-\t\tmutex_lock(\u0026net-\u003eipv6.mfc_mutex);\n+\t\trtnl_lock();\n+\t\tif (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY) {\n+\t\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\t\tif (!mrt) {\n+\t\t\t\trtnl_unlock();\n+\t\t\t\treturn -ENOENT;\n+\t\t\t}\n+\t\t} else {\n+\t\t\tbool new_table = false;\n \n-\t\tif (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY)\n-\t\t\tret = ip6mr_mfc_delete(mrt, \u0026mfc, parent);\n-\t\telse\n+\t\t\tmrt = ip6mr_get_or_alloc_sk_table(sk, \u0026new_table);\n+\t\t\tif (IS_ERR(mrt)) {\n+\t\t\t\trtnl_unlock();\n+\t\t\t\treturn PTR_ERR(mrt);\n+\t\t\t}\n+\t\t\tip6mr_publish_new_table(mrt, new_table);\n+\t\t\tmutex_lock(\u0026net-\u003eipv6.mfc_mutex);\n \t\t\tret = ip6mr_mfc_add(net, mrt, \u0026mfc,\n \t\t\t\t\t sk ==\n \t\t\t\t\t rcu_access_pointer(mrt-\u003emroute_sk),\n \t\t\t\t\t parent);\n+\t\t\tmutex_unlock(\u0026net-\u003eipv6.mfc_mutex);\n+\t\t\tret = ip6mr_finish_new_table(mrt, new_table, ret);\n+\t\t\trtnl_unlock();\n+\t\t\treturn ret;\n+\t\t}\n \n+\t\tmutex_lock(\u0026net-\u003eipv6.mfc_mutex);\n+\t\tret = ip6mr_mfc_delete(mrt, \u0026mfc, parent);\n \t\tmutex_unlock(\u0026net-\u003eipv6.mfc_mutex);\n+\t\tif (!ret)\n+\t\t\tip6mr_maybe_destroy_table(mrt);\n+\t\trtnl_unlock();\n \t\treturn ret;\n \n \tcase MRT6_FLUSH:\n@@ -1807,8 +2011,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\t\treturn -EFAULT;\n \n \t\trtnl_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (!mrt) {\n+\t\t\trtnl_unlock();\n+\t\t\treturn -ENOENT;\n+\t\t}\n \t\tmroute_clean_tables(mrt, flags, \u0026dev_kill_list);\n \t\tunregister_netdevice_many(\u0026dev_kill_list);\n+\t\tip6mr_maybe_destroy_table(mrt);\n \t\trtnl_unlock();\n \t\treturn 0;\n \t}\n@@ -1824,7 +2034,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\t\treturn -EINVAL;\n \t\tif (copy_from_sockptr(\u0026v, optval, sizeof(v)))\n \t\t\treturn -EFAULT;\n+\t\trcu_read_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (!mrt) {\n+\t\t\trcu_read_unlock();\n+\t\t\treturn -ENOENT;\n+\t\t}\n \t\tWRITE_ONCE(mrt-\u003emroute_do_assert, v);\n+\t\trcu_read_unlock();\n \t\treturn 0;\n \t}\n \n@@ -1842,6 +2059,11 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\tdo_wrmifwhole = (v == MRT6MSG_WRMIFWHOLE);\n \t\tv = !!v;\n \t\trtnl_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (!mrt) {\n+\t\t\trtnl_unlock();\n+\t\t\treturn -ENOENT;\n+\t\t}\n \t\tret = 0;\n \t\tif (v != mrt-\u003emroute_do_pim) {\n \t\t\tWRITE_ONCE(mrt-\u003emroute_do_pim, v);\n@@ -1865,18 +2087,16 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\t/* \"pim6reg%u\" should not exceed 16 bytes (IFNAMSIZ) */\n \t\tif (v != RT_TABLE_DEFAULT \u0026\u0026 v \u003e= 100000000)\n \t\t\treturn -EINVAL;\n-\t\tif (sk == rcu_access_pointer(mrt-\u003emroute_sk))\n+\t\trcu_read_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (mrt \u0026\u0026 sk == rcu_access_pointer(mrt-\u003emroute_sk)) {\n+\t\t\trcu_read_unlock();\n \t\t\treturn -EBUSY;\n+\t\t}\n+\t\trcu_read_unlock();\n \n-\t\trtnl_lock();\n-\t\tret = 0;\n-\t\tmrt = ip6mr_new_table(net, v);\n-\t\tif (IS_ERR(mrt))\n-\t\t\tret = PTR_ERR(mrt);\n-\t\telse\n-\t\t\traw6_sk(sk)-\u003eip6mr_table = v;\n-\t\trtnl_unlock();\n-\t\treturn ret;\n+\t\traw6_sk(sk)-\u003eip6mr_table = v;\n+\t\treturn 0;\n \t}\n #endif\n \t/*\n@@ -1897,16 +2117,18 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,\n {\n \tint olr;\n \tint val;\n-\tstruct net *net = sock_net(sk);\n \tstruct mr_table *mrt;\n \n \tif (sk-\u003esk_type != SOCK_RAW ||\n \t inet_sk(sk)-\u003einet_num != IPPROTO_ICMPV6)\n \t\treturn -EOPNOTSUPP;\n \n-\tmrt = ip6mr_get_table(net, raw6_sk(sk)-\u003eip6mr_table ? : RT6_TABLE_DFLT);\n-\tif (!mrt)\n+\trcu_read_lock();\n+\tmrt = ip6mr_lookup_sk_table(sk);\n+\tif (!mrt) {\n+\t\trcu_read_unlock();\n \t\treturn -ENOENT;\n+\t}\n \n \tswitch (optname) {\n \tcase MRT6_VERSION:\n@@ -1921,8 +2143,10 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,\n \t\tval = READ_ONCE(mrt-\u003emroute_do_assert);\n \t\tbreak;\n \tdefault:\n+\t\trcu_read_unlock();\n \t\treturn -ENOPROTOOPT;\n \t}\n+\trcu_read_unlock();\n \n \tif (copy_from_sockptr(\u0026olr, optlen, sizeof(int)))\n \t\treturn -EFAULT;\n@@ -1947,20 +2171,23 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)\n \tstruct sioc_mif_req6 *vr;\n \tstruct vif_device *vif;\n \tstruct mfc6_cache *c;\n-\tstruct net *net = sock_net(sk);\n \tstruct mr_table *mrt;\n \n-\tmrt = ip6mr_get_table(net, raw6_sk(sk)-\u003eip6mr_table ? : RT6_TABLE_DFLT);\n-\tif (!mrt)\n+\trcu_read_lock();\n+\tmrt = ip6mr_lookup_sk_table(sk);\n+\tif (!mrt) {\n+\t\trcu_read_unlock();\n \t\treturn -ENOENT;\n+\t}\n \n \tswitch (cmd) {\n \tcase SIOCGETMIFCNT_IN6:\n \t\tvr = (struct sioc_mif_req6 *)arg;\n-\t\tif (vr-\u003emifi \u003e= mrt-\u003emaxvif)\n+\t\tif (vr-\u003emifi \u003e= mrt-\u003emaxvif) {\n+\t\t\trcu_read_unlock();\n \t\t\treturn -EINVAL;\n+\t\t}\n \t\tvr-\u003emifi = array_index_nospec(vr-\u003emifi, mrt-\u003emaxvif);\n-\t\trcu_read_lock();\n \t\tvif = \u0026mrt-\u003evif_table[vr-\u003emifi];\n \t\tif (VIF_EXISTS(mrt, vr-\u003emifi)) {\n \t\t\tvr-\u003eicount = READ_ONCE(vif-\u003epkt_in);\n@@ -1974,8 +2201,6 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)\n \t\treturn -EADDRNOTAVAIL;\n \tcase SIOCGETSGCNT_IN6:\n \t\tsr = (struct sioc_sg_req6 *)arg;\n-\n-\t\trcu_read_lock();\n \t\tc = ip6mr_cache_find(mrt, \u0026sr-\u003esrc.sin6_addr,\n \t\t\t\t \u0026sr-\u003egrp.sin6_addr);\n \t\tif (c) {\n@@ -1988,6 +2213,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)\n \t\trcu_read_unlock();\n \t\treturn -EADDRNOTAVAIL;\n \tdefault:\n+\t\trcu_read_unlock();\n \t\treturn -ENOIOCTLCMD;\n \t}\n }\n@@ -2015,21 +2241,23 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)\n \tstruct compat_sioc_mif_req6 vr;\n \tstruct vif_device *vif;\n \tstruct mfc6_cache *c;\n-\tstruct net *net = sock_net(sk);\n \tstruct mr_table *mrt;\n \n-\tmrt = ip6mr_get_table(net, raw6_sk(sk)-\u003eip6mr_table ? : RT6_TABLE_DFLT);\n-\tif (!mrt)\n-\t\treturn -ENOENT;\n-\n \tswitch (cmd) {\n \tcase SIOCGETMIFCNT_IN6:\n \t\tif (copy_from_user(\u0026vr, arg, sizeof(vr)))\n \t\t\treturn -EFAULT;\n-\t\tif (vr.mifi \u003e= mrt-\u003emaxvif)\n+\t\trcu_read_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (!mrt) {\n+\t\t\trcu_read_unlock();\n+\t\t\treturn -ENOENT;\n+\t\t}\n+\t\tif (vr.mifi \u003e= mrt-\u003emaxvif) {\n+\t\t\trcu_read_unlock();\n \t\t\treturn -EINVAL;\n+\t\t}\n \t\tvr.mifi = array_index_nospec(vr.mifi, mrt-\u003emaxvif);\n-\t\trcu_read_lock();\n \t\tvif = \u0026mrt-\u003evif_table[vr.mifi];\n \t\tif (VIF_EXISTS(mrt, vr.mifi)) {\n \t\t\tvr.icount = READ_ONCE(vif-\u003epkt_in);\n@@ -2049,6 +2277,11 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)\n \t\t\treturn -EFAULT;\n \n \t\trcu_read_lock();\n+\t\tmrt = ip6mr_lookup_sk_table(sk);\n+\t\tif (!mrt) {\n+\t\t\trcu_read_unlock();\n+\t\t\treturn -ENOENT;\n+\t\t}\n \t\tc = ip6mr_cache_find(mrt, \u0026sr.src.sin6_addr, \u0026sr.grp.sin6_addr);\n \t\tif (c) {\n \t\t\tsr.pktcnt = atomic_long_read(\u0026c-\u003e_c.mfc_un.res.pkt);\n"
} |
| 2/1 | 2026/09/06 15:21 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": [
"IPV6",
"IPV6_MROUTE",
"IPV6_MROUTE_MULTIPLE_TABLES"
],
"FocusSymbols": [
"ip6_mroute_setsockopt",
"ip6_mroute_getsockopt",
"ip6mr_ioctl",
"ip6mr_compat_ioctl",
"ip6mr_sk_done",
"ip6mr_get_or_alloc_sk_table",
"ip6mr_maybe_destroy_table",
"ip6mr_destroy_workfn",
"ip6mr_device_event",
"ipmr_expire_process"
],
"Reasoning": "The patch refactors IPv6 multicast routing (ip6mr) table lifecycle and locking. It adds dynamic table allocation, asynchronous table destruction via workqueues, and updates setsockopt, getsockopt, ioctl, timer expiration, and netdev notifier handling. These paths are directly accessible from userspace via raw IPv6 sockets.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 521c0b02a6814200b0eeb20aaf13c5d84e98fe5b
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Sep 6 15:21:56 2026 +0000
syz-cluster: applied patch under review
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3f2ed9b77deb5..26bd2ccd4201a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -28,6 +28,7 @@
#include <linux/init.h>
#include <linux/compat.h>
#include <linux/rhashtable.h>
+#include <linux/workqueue.h>
#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/raw.h>
@@ -368,6 +369,12 @@ static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
return mrt;
}
+static struct mr_table *ip6mr_lookup_sk_table(struct sock *sk)
+{
+ return __ip6mr_get_table(sock_net(sk),
+ raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
+}
+
static int ip6mr_hash_cmp(struct rhashtable_compare_arg *arg,
const void *ptr)
{
@@ -417,6 +424,124 @@ static struct mr_table *ip6mr_new_table(struct net *net, u32 id)
ipmr_expire_process, ip6mr_new_table_set);
}
+/* table_set callback used while the new table is still unpublished. */
+static void ip6mr_table_no_publish(struct mr_table *mrt, struct net *net)
+{
+}
+
+static struct mr_table *ip6mr_get_or_alloc_sk_table(struct sock *sk,
+ bool *new_table)
+{
+ u32 id = raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT;
+ struct net *net = sock_net(sk);
+ struct mr_table *mrt;
+
+ ASSERT_RTNL();
+ *new_table = false;
+
+ mrt = __ip6mr_get_table(net, id);
+ if (mrt)
+ return mrt;
+
+ mrt = mr_table_alloc(net, id, &ip6mr_mr_table_ops,
+ ipmr_expire_process, ip6mr_table_no_publish);
+ if (!IS_ERR(mrt))
+ *new_table = true;
+ return mrt;
+}
+
+static void ip6mr_publish_new_table(struct mr_table *mrt, bool new_table)
+{
+ if (new_table)
+ ip6mr_new_table_set(mrt, read_pnet(&mrt->net));
+}
+
+static void ip6mr_maybe_destroy_table(struct mr_table *mrt)
+{
+ ASSERT_RTNL();
+
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ if (mrt->id == RT6_TABLE_DFLT)
+ return;
+ /* Nested NETDEV_UNREGISTER may already have unlinked this table. */
+ if (__ip6mr_get_table(read_pnet(&mrt->net), mrt->id) != mrt)
+ return;
+ if (rtnl_dereference(mrt->mroute_sk) ||
+ mrt->maxvif ||
+ !list_empty(&mrt->mfc_cache_list))
+ return;
+
+ spin_lock_bh(&mfc_unres_lock);
+ if (!list_empty(&mrt->mfc_unres_queue)) {
+ spin_unlock_bh(&mfc_unres_lock);
+ return;
+ }
+ spin_unlock_bh(&mfc_unres_lock);
+
+ list_del_rcu(&mrt->list);
+ timer_shutdown_sync(&mrt->ipmr_expire_timer);
+ mr_table_free(mrt);
+#endif
+}
+
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+struct ip6mr_destroy_work {
+ struct work_struct work;
+ struct net *net;
+ u32 id;
+};
+
+static void ip6mr_destroy_workfn(struct work_struct *work)
+{
+ struct ip6mr_destroy_work *dw =
+ container_of(work, struct ip6mr_destroy_work, work);
+ struct mr_table *mrt;
+
+ rtnl_lock();
+ mrt = __ip6mr_get_table(dw->net, dw->id);
+ if (mrt)
+ ip6mr_maybe_destroy_table(mrt);
+ rtnl_unlock();
+ put_net(dw->net);
+ kfree(dw);
+}
+
+static void ip6mr_queue_maybe_destroy(struct mr_table *mrt)
+{
+ struct net *net = read_pnet(&mrt->net);
+ struct ip6mr_destroy_work *dw;
+
+ if (mrt->id == RT6_TABLE_DFLT)
+ return;
+
+ dw = kmalloc_obj(*dw, GFP_ATOMIC);
+ if (!dw) {
+ mod_timer(&mrt->ipmr_expire_timer, jiffies + HZ);
+ return;
+ }
+ if (!maybe_get_net(net)) {
+ kfree(dw);
+ return;
+ }
+ INIT_WORK(&dw->work, ip6mr_destroy_workfn);
+ dw->net = net;
+ dw->id = mrt->id;
+ queue_work(system_dfl_wq, &dw->work);
+}
+#else
+static void ip6mr_queue_maybe_destroy(struct mr_table *mrt)
+{
+}
+#endif
+
+static int ip6mr_finish_new_table(struct mr_table *mrt, bool new_table,
+ int err)
+{
+ if (new_table && err)
+ ip6mr_maybe_destroy_table(mrt);
+ return err;
+}
+
static void ip6mr_free_table(struct mr_table *mrt,
struct list_head *dev_kill_list)
{
@@ -866,16 +991,25 @@ static void ipmr_do_expire_process(struct mr_table *mrt)
static void ipmr_expire_process(struct timer_list *t)
{
struct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer);
+ bool empty = false;
if (!spin_trylock(&mfc_unres_lock)) {
mod_timer(&mrt->ipmr_expire_timer, jiffies + 1);
return;
}
- if (!list_empty(&mrt->mfc_unres_queue))
+ if (!list_empty(&mrt->mfc_unres_queue)) {
ipmr_do_expire_process(mrt);
+ empty = list_empty(&mrt->mfc_unres_queue);
+ } else {
+ /* Retry after GFP_ATOMIC allocation failure. */
+ empty = true;
+ }
spin_unlock(&mfc_unres_lock);
+
+ if (empty)
+ ip6mr_queue_maybe_destroy(mrt);
}
/* Fill oifs list. It is called under locked mrt_lock. */
@@ -1290,19 +1424,34 @@ static int ip6mr_device_event(struct notifier_block *this,
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct net *net = dev_net(dev);
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ struct mr_table *mrt, *next;
+#else
struct mr_table *mrt;
+#endif
struct vif_device *v;
int ct;
if (event != NETDEV_UNREGISTER)
return NOTIFY_DONE;
- ip6mr_for_each_table(mrt, net) {
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list)
+#else
+ ip6mr_for_each_table(mrt, net)
+#endif
+ {
+ bool vif_gone = false;
+
v = &mrt->vif_table[0];
for (ct = 0; ct < mrt->maxvif; ct++, v++) {
- if (rcu_access_pointer(v->dev) == dev)
+ if (rcu_access_pointer(v->dev) == dev) {
mif6_delete(mrt, ct, 1, NULL);
+ vif_gone = true;
+ }
}
+ if (vif_gone)
+ ip6mr_maybe_destroy_table(mrt);
}
return NOTIFY_DONE;
@@ -1618,10 +1767,11 @@ static void mroute_clean_tables(struct mr_table *mrt, int flags,
static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)
{
- int err = 0;
struct net *net = sock_net(sk);
+ int err = 0;
+
+ ASSERT_RTNL();
- rtnl_lock();
spin_lock(&mrt_lock);
if (rtnl_dereference(mrt->mroute_sk)) {
err = -EADDRINUSE;
@@ -1637,8 +1787,6 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)
NETCONFA_MC_FORWARDING,
NETCONFA_IFINDEX_ALL,
net->ipv6.devconf_all);
- rtnl_unlock();
-
return err;
}
@@ -1677,6 +1825,7 @@ int ip6mr_sk_done(struct sock *sk)
mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MFC,
&dev_kill_list);
err = 0;
+ ip6mr_maybe_destroy_table(mrt);
break;
}
}
@@ -1723,27 +1872,45 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
return -EOPNOTSUPP;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
- return -ENOENT;
-
if (optname != MRT6_INIT) {
- if (sk != rcu_access_pointer(mrt->mroute_sk) &&
- !ns_capable(net->user_ns, CAP_NET_ADMIN))
+ bool is_mroute_sk = false;
+
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (mrt && sk == rcu_access_pointer(mrt->mroute_sk))
+ is_mroute_sk = true;
+ rcu_read_unlock();
+
+ if (!is_mroute_sk && !ns_capable(net->user_ns, CAP_NET_ADMIN))
return -EACCES;
}
switch (optname) {
- case MRT6_INIT:
+ case MRT6_INIT: {
+ bool new_table = false;
+
if (optlen < sizeof(int))
return -EINVAL;
- return ip6mr_sk_init(mrt, sk);
+ rtnl_lock();
+ mrt = ip6mr_get_or_alloc_sk_table(sk, &new_table);
+ if (IS_ERR(mrt)) {
+ rtnl_unlock();
+ return PTR_ERR(mrt);
+ }
+ ip6mr_publish_new_table(mrt, new_table);
+ ret = ip6mr_sk_init(mrt, sk);
+ ret = ip6mr_finish_new_table(mrt, new_table, ret);
+ rtnl_unlock();
+ return ret;
+ }
case MRT6_DONE:
return ip6mr_sk_done(sk);
- case MRT6_ADD_MIF:
+ case MRT6_ADD_MIF: {
+ bool new_table = false;
+
if (optlen < sizeof(vif))
return -EINVAL;
if (copy_from_sockptr(&vif, optval, sizeof(vif)))
@@ -1751,10 +1918,18 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
if (vif.mif6c_mifi >= MAXMIFS)
return -ENFILE;
rtnl_lock();
+ mrt = ip6mr_get_or_alloc_sk_table(sk, &new_table);
+ if (IS_ERR(mrt)) {
+ rtnl_unlock();
+ return PTR_ERR(mrt);
+ }
+ ip6mr_publish_new_table(mrt, new_table);
ret = mif6_add(net, mrt, &vif,
sk == rtnl_dereference(mrt->mroute_sk));
+ ret = ip6mr_finish_new_table(mrt, new_table, ret);
rtnl_unlock();
return ret;
+ }
case MRT6_DEL_MIF:
if (optlen < sizeof(mifi_t))
@@ -1762,7 +1937,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
if (copy_from_sockptr(&mifi, optval, sizeof(mifi_t)))
return -EFAULT;
rtnl_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
ret = mif6_delete(mrt, mifi, 0, NULL);
+ if (!ret)
+ ip6mr_maybe_destroy_table(mrt);
rtnl_unlock();
return ret;
@@ -1783,17 +1965,39 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
if (parent == 0)
parent = mfc.mf6cc_parent;
- mutex_lock(&net->ipv6.mfc_mutex);
+ rtnl_lock();
+ if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY) {
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
+ } else {
+ bool new_table = false;
- if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY)
- ret = ip6mr_mfc_delete(mrt, &mfc, parent);
- else
+ mrt = ip6mr_get_or_alloc_sk_table(sk, &new_table);
+ if (IS_ERR(mrt)) {
+ rtnl_unlock();
+ return PTR_ERR(mrt);
+ }
+ ip6mr_publish_new_table(mrt, new_table);
+ mutex_lock(&net->ipv6.mfc_mutex);
ret = ip6mr_mfc_add(net, mrt, &mfc,
sk ==
rcu_access_pointer(mrt->mroute_sk),
parent);
+ mutex_unlock(&net->ipv6.mfc_mutex);
+ ret = ip6mr_finish_new_table(mrt, new_table, ret);
+ rtnl_unlock();
+ return ret;
+ }
+ mutex_lock(&net->ipv6.mfc_mutex);
+ ret = ip6mr_mfc_delete(mrt, &mfc, parent);
mutex_unlock(&net->ipv6.mfc_mutex);
+ if (!ret)
+ ip6mr_maybe_destroy_table(mrt);
+ rtnl_unlock();
return ret;
case MRT6_FLUSH:
@@ -1807,8 +2011,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
return -EFAULT;
rtnl_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
mroute_clean_tables(mrt, flags, &dev_kill_list);
unregister_netdevice_many(&dev_kill_list);
+ ip6mr_maybe_destroy_table(mrt);
rtnl_unlock();
return 0;
}
@@ -1824,7 +2034,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
return -EINVAL;
if (copy_from_sockptr(&v, optval, sizeof(v)))
return -EFAULT;
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
+ return -ENOENT;
+ }
WRITE_ONCE(mrt->mroute_do_assert, v);
+ rcu_read_unlock();
return 0;
}
@@ -1842,6 +2059,11 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
do_wrmifwhole = (v == MRT6MSG_WRMIFWHOLE);
v = !!v;
rtnl_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
ret = 0;
if (v != mrt->mroute_do_pim) {
WRITE_ONCE(mrt->mroute_do_pim, v);
@@ -1865,18 +2087,16 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
/* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
if (v != RT_TABLE_DEFAULT && v >= 100000000)
return -EINVAL;
- if (sk == rcu_access_pointer(mrt->mroute_sk))
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (mrt && sk == rcu_access_pointer(mrt->mroute_sk)) {
+ rcu_read_unlock();
return -EBUSY;
+ }
+ rcu_read_unlock();
- rtnl_lock();
- ret = 0;
- mrt = ip6mr_new_table(net, v);
- if (IS_ERR(mrt))
- ret = PTR_ERR(mrt);
- else
- raw6_sk(sk)->ip6mr_table = v;
- rtnl_unlock();
- return ret;
+ raw6_sk(sk)->ip6mr_table = v;
+ return 0;
}
#endif
/*
@@ -1897,16 +2117,18 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
{
int olr;
int val;
- struct net *net = sock_net(sk);
struct mr_table *mrt;
if (sk->sk_type != SOCK_RAW ||
inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
return -EOPNOTSUPP;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
return -ENOENT;
+ }
switch (optname) {
case MRT6_VERSION:
@@ -1921,8 +2143,10 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
val = READ_ONCE(mrt->mroute_do_assert);
break;
default:
+ rcu_read_unlock();
return -ENOPROTOOPT;
}
+ rcu_read_unlock();
if (copy_from_sockptr(&olr, optlen, sizeof(int)))
return -EFAULT;
@@ -1947,20 +2171,23 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
struct sioc_mif_req6 *vr;
struct vif_device *vif;
struct mfc6_cache *c;
- struct net *net = sock_net(sk);
struct mr_table *mrt;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
return -ENOENT;
+ }
switch (cmd) {
case SIOCGETMIFCNT_IN6:
vr = (struct sioc_mif_req6 *)arg;
- if (vr->mifi >= mrt->maxvif)
+ if (vr->mifi >= mrt->maxvif) {
+ rcu_read_unlock();
return -EINVAL;
+ }
vr->mifi = array_index_nospec(vr->mifi, mrt->maxvif);
- rcu_read_lock();
vif = &mrt->vif_table[vr->mifi];
if (VIF_EXISTS(mrt, vr->mifi)) {
vr->icount = READ_ONCE(vif->pkt_in);
@@ -1974,8 +2201,6 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
return -EADDRNOTAVAIL;
case SIOCGETSGCNT_IN6:
sr = (struct sioc_sg_req6 *)arg;
-
- rcu_read_lock();
c = ip6mr_cache_find(mrt, &sr->src.sin6_addr,
&sr->grp.sin6_addr);
if (c) {
@@ -1988,6 +2213,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
rcu_read_unlock();
return -EADDRNOTAVAIL;
default:
+ rcu_read_unlock();
return -ENOIOCTLCMD;
}
}
@@ -2015,21 +2241,23 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
struct compat_sioc_mif_req6 vr;
struct vif_device *vif;
struct mfc6_cache *c;
- struct net *net = sock_net(sk);
struct mr_table *mrt;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
- return -ENOENT;
-
switch (cmd) {
case SIOCGETMIFCNT_IN6:
if (copy_from_user(&vr, arg, sizeof(vr)))
return -EFAULT;
- if (vr.mifi >= mrt->maxvif)
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
+ return -ENOENT;
+ }
+ if (vr.mifi >= mrt->maxvif) {
+ rcu_read_unlock();
return -EINVAL;
+ }
vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
- rcu_read_lock();
vif = &mrt->vif_table[vr.mifi];
if (VIF_EXISTS(mrt, vr.mifi)) {
vr.icount = READ_ONCE(vif->pkt_in);
@@ -2049,6 +2277,11 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
return -EFAULT;
rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
+ return -ENOENT;
+ }
c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
if (c) {
sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt);
|
| 3/2 | 2026/09/06 15:21 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 9654 output: 31 thoughts: 383 Thoughts: **My Fuzzing Strategy for This IPv6 Multicast Routing Patch** Okay, let's dive into this patch modifying `net/ipv6/ip6mr.c` – it's all about IPv6 multicast routing, and I need to figure out the optimal fuzzing approach. My initial assessment is that this is absolutely WorthFuzzing. The changes are quite significant, touching on crucial areas like table creation and destruction, dynamic allocation, setsockopt/getsockopt/ioctl handling, and the introduction of workqueues and timers. This screams potential for interesting bugs. Specifically, the patch seems to overhaul how `mr_tables` are handled. We're seeing dynamic creation, delayed publishing, and destruction – that's a red flag for race conditions and memory management issues, which are always prime targets. I see changes in the handling of MRT6_*, SIOCGETMIFCNT_IN6, and SIOCGETSGCNT_IN6 via setsockopt/getsockopt/ioctl, and the `ipmr_expire_process`, `ip6mr_device_event`, `ip6mr_sk_init`, and `ip6mr_sk_done` functions are all in the mix too. Workqueues (`ip6mr_destroy_workfn`) and timers also get thrown in. That's a good mix of potential fuzz targets. The good news is, this should be reachable in a standard syzkaller / QEMU setup. IPv6 multicast routing is core networking code, accessible via raw sockets (IPPROTO_ICMPV6, etc.) and those setsockopt/ioctl calls. That makes it easier to target and test. Given the modifications, I'll be paying close attention to locking mechanisms, table lifecycle management, memory allocation and freeing, how the timers and workqueues interact, and the handling of netdev notifier events. Now, I need to figure out any necessary Kconfig dependencies to get the relevant code enabled. I'll use `grepper` to quickly scan `net/ipv6/Kconfig` and `net/ipv6/Makefile` to identify any required configurations. This will guide my syzkaller configuration. |
| 4/2 | 2026/09/06 15:22 | tool | grepper |
0mArgs:{
"Expression": "CONFIG_IPV6_MROUTE",
"PathPrefix": "net/ipv6"
}Results: {
"Output": "net/ipv6/Makefile=15=ipv6-$(CONFIG_SYSCTL) += sysctl_net_ipv6.o\nnet/ipv6/Makefile:16:ipv6-$(CONFIG_IPV6_MROUTE) += ip6mr.o\nnet/ipv6/Makefile-17-\n--\nnet/ipv6/addrconf.c=508=static int inet6_netconf_msgsize_devconf(int type)\n--\nnet/ipv6/addrconf.c-518-\t\tsize += nla_total_size(4);\nnet/ipv6/addrconf.c:519:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/addrconf.c-520-\tif (all || type == NETCONFA_MC_FORWARDING)\n--\nnet/ipv6/addrconf.c=532=static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,\n--\nnet/ipv6/addrconf.c-561-\t\tgoto nla_put_failure;\nnet/ipv6/addrconf.c:562:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/addrconf.c-563-\tif ((all || type == NETCONFA_MC_FORWARDING) \u0026\u0026\n--\nnet/ipv6/addrconf.c=5664=static void ipv6_store_devconf(const struct ipv6_devconf *cnf,\n--\nnet/ipv6/addrconf.c-5717-#endif\nnet/ipv6/addrconf.c:5718:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/addrconf.c-5719-\tarray[DEVCONF_MC_FORWARDING] = atomic_read(\u0026cnf-\u003emc_forwarding);\n--\nnet/ipv6/addrconf.c=6849=static const struct ctl_table addrconf_sysctl[] = {\n--\nnet/ipv6/addrconf.c-7117-#endif\nnet/ipv6/addrconf.c:7118:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/addrconf.c-7119-\t{\n--\nnet/ipv6/ip6_input.c=554=int ip6_mc_input(struct sk_buff *skb)\n--\nnet/ipv6/ip6_input.c-576-\nnet/ipv6/ip6_input.c:577:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/ip6_input.c-578-\t/*\n--\nnet/ipv6/ip6mr.c=106=static void ipmr_expire_process(struct timer_list *t);\nnet/ipv6/ip6mr.c-107-\nnet/ipv6/ip6mr.c:108:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-109-#define ip6mr_for_each_table(mrt, net) \\\n--\nnet/ipv6/ip6mr.c=397=static void ip6mr_new_table_set(struct mr_table *mrt,\n--\nnet/ipv6/ip6mr.c-399-{\nnet/ipv6/ip6mr.c:400:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-401-\tlist_add_tail_rcu(\u0026mrt-\u003elist, \u0026net-\u003eipv6.mr6_tables);\n--\nnet/ipv6/ip6mr.c=459=static void ip6mr_maybe_destroy_table(struct mr_table *mrt)\n--\nnet/ipv6/ip6mr.c-462-\nnet/ipv6/ip6mr.c:463:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-464-\tif (mrt-\u003eid == RT6_TABLE_DFLT)\n--\nnet/ipv6/ip6mr.c-486-\nnet/ipv6/ip6mr.c:487:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-488-struct ip6mr_destroy_work {\n--\nnet/ipv6/ip6mr.c=1422=static int ip6mr_device_event(struct notifier_block *this,\n--\nnet/ipv6/ip6mr.c-1426-\tstruct net *net = dev_net(dev);\nnet/ipv6/ip6mr.c:1427:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-1428-\tstruct mr_table *mrt, *next;\n--\nnet/ipv6/ip6mr.c-1437-\nnet/ipv6/ip6mr.c:1438:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-1439-\tlist_for_each_entry_safe(mrt, next, \u0026net-\u003eipv6.mr6_tables, list)\n--\nnet/ipv6/ip6mr.c=1861=int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,\n--\nnet/ipv6/ip6mr.c-2077-#endif\nnet/ipv6/ip6mr.c:2078:#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/ip6mr.c-2079-\tcase MRT6_TABLE:\n--\nnet/ipv6/raw.c=1126=static int rawv6_ioctl(struct sock *sk, int cmd, int *karg)\n--\nnet/ipv6/raw.c-1146-\tdefault:\nnet/ipv6/raw.c:1147:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/raw.c-1148-\t\treturn ip6mr_ioctl(sk, cmd, karg);\n--\nnet/ipv6/raw.c=1156=static int compat_rawv6_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)\n--\nnet/ipv6/raw.c-1162-\tdefault:\nnet/ipv6/raw.c:1163:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/raw.c-1164-\t\treturn ip6mr_compat_ioctl(sk, cmd, compat_ptr(arg));\n--\nnet/ipv6/route.c=5787=static int rt6_fill_node(struct net *net, struct sk_buff *skb,\n--\nnet/ipv6/route.c-5852-\tif (iif) {\nnet/ipv6/route.c:5853:#ifdef CONFIG_IPV6_MROUTE\nnet/ipv6/route.c-5854-\t\tif (ipv6_addr_is_multicast(\u0026rt6_dst-\u003eaddr)) {\n"
} |
| 5/2 | 2026/09/06 15:22 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12289 output: 32 thoughts: 28 Thoughts: Here's a summary of my thought process: **Diving into IPv6 Multicast Configuration** Okay, so I need to get a handle on the IPv6 multicast configuration options. My initial thought is to navigate the kernel configuration files, specifically `net/ipv6/Kconfig`. That's the logical place to start digging into the details of anything related to IPv6. I'm particularly interested in anything related to `IPV6_MROUTE`, as that's my focal point. I figure by examining the `Kconfig` file and the surrounding code I'll find the specific config names, dependencies, and relationships between various IPv6 multicast features. This should give me a solid foundation for understanding the available options and how they interact. |
| 6/2 | 2026/09/06 15:22 | tool | grepper |
0mArgs:{
"Expression": "IPV6_MROUTE",
"PathPrefix": "net/ipv6/Kconfig"
}Results: {
"Output": "net/ipv6/Kconfig=243=config IPV6_SUBTREES\n--\nnet/ipv6/Kconfig-256-\nnet/ipv6/Kconfig:257:config IPV6_MROUTE\nnet/ipv6/Kconfig-258-\tbool \"IPv6: multicast routing\"\n--\nnet/ipv6/Kconfig-264-\nnet/ipv6/Kconfig:265:config IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/Kconfig-266-\tbool \"IPv6: multicast policy routing\"\nnet/ipv6/Kconfig:267:\tdepends on IPV6_MROUTE\nnet/ipv6/Kconfig-268-\tselect FIB_RULES\n--\nnet/ipv6/Kconfig=279=config IPV6_PIMSM_V2\nnet/ipv6/Kconfig-280-\tbool \"IPv6: PIM-SM version 2 support\"\nnet/ipv6/Kconfig:281:\tdepends on IPV6_MROUTE\nnet/ipv6/Kconfig-282-\thelp\n"
} |
| 7/2 | 2026/09/06 15:22 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12789 output: 35 thoughts: 36 Thoughts: Here's a summary of my thought process: **Diving into IPv6 Configuration** Okay, I need to get a clear picture of the IPv6 configuration options. My instinct is to head straight to the source. Specifically, I should check the `read-file` in the `net/ipv6/Kconfig` file, focusing on the lines between 250 and 290. That's usually where the meat of the configuration variables and dependencies are defined. This will give me the most direct and reliable information about what's available and how they interact. This approach should offer a good overview of the relevant Kconfig options. |
| 8/2 | 2026/09/06 15:22 | tool | read-file |
0mArgs:{
"File": "net/ipv6/Kconfig",
"FirstLine": 250,
"LineCount": 40
}Results: {
"Contents": " 250:\t\t normal and source prefix specific routes in the same routing table\n 251:\t\t may sometimes lead to unintended routing behavior. This can be\n 252:\t\t avoided by defining different routing tables for the normal and\n 253:\t\t source prefix specific routes.\n 254:\t\n 255:\t\t If unsure, say N.\n 256:\t\n 257:\tconfig IPV6_MROUTE\n 258:\t\tbool \"IPv6: multicast routing\"\n 259:\t\tdepends on IPV6\n 260:\t\tselect IP_MROUTE_COMMON\n 261:\t\thelp\n 262:\t\t Support for IPv6 multicast forwarding.\n 263:\t\t If unsure, say N.\n 264:\t\n 265:\tconfig IPV6_MROUTE_MULTIPLE_TABLES\n 266:\t\tbool \"IPv6: multicast policy routing\"\n 267:\t\tdepends on IPV6_MROUTE\n 268:\t\tselect FIB_RULES\n 269:\t\thelp\n 270:\t\t Normally, a multicast router runs a userspace daemon and decides\n 271:\t\t what to do with a multicast packet based on the source and\n 272:\t\t destination addresses. If you say Y here, the multicast router\n 273:\t\t will also be able to take interfaces and packet marks into\n 274:\t\t account and run multiple instances of userspace daemons\n 275:\t\t simultaneously, each one handling a single table.\n 276:\t\n 277:\t\t If unsure, say N.\n 278:\t\n 279:\tconfig IPV6_PIMSM_V2\n 280:\t\tbool \"IPv6: PIM-SM version 2 support\"\n 281:\t\tdepends on IPV6_MROUTE\n 282:\t\thelp\n 283:\t\t Support for IPv6 PIM multicast routing protocol PIM-SMv2.\n 284:\t\t If unsure, say N.\n 285:\t\n 286:\tconfig IPV6_SEG6_LWTUNNEL\n 287:\t\tbool \"IPv6: Segment Routing Header encapsulation support\"\n 288:\t\tdepends on IPV6\n 289:\t\tselect LWTUNNEL\n"
} |
| 9/2 | 2026/09/06 15:22 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13589 output: 234 thoughts: 970 Thoughts: **Analysis of the IPv6 Multicast Routing Patch** Okay, let's break this down. First, I see we're dealing with a patch related to IPv6 multicast routing, indicated by the key symbols `IPV6_MROUTE` and `IPV6_MROUTE_MULTIPLE_TABLES`. The presence of multiple `#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES` blocks for things like table destruction and `MRT6_TABLE` `setsockopt` usage immediately flags that this isn't a trivial change. We are definitely working with some new logic for multiple tables here, which means we have to dive a little deeper. Of course, `IPV6` is also a critical config. Now, I need to understand the scope. Let's look at the functions added or modified: a list of functions, both static and exported. I see functions dealing with table lookup, allocation, publishing, and destruction (potentially delayed via a workqueue which is very interesting for concurrency), along with timer and notifier callbacks. Critically, I have to pay attention to these: `ip6_mroute_setsockopt`, `ip6_mroute_getsockopt`, `ip6mr_ioctl`, `ip6mr_compat_ioctl`, and `ip6mr_sk_done` as these represent the user-space interface. They are definitely going to be the entrypoints. `ip6mr_device_event`, `ipmr_expire_process`, `ip6mr_maybe_destroy_table`, `ip6mr_get_or_alloc_sk_table`, and `ip6mr_destroy_workfn` are key as well, as these are the core internal functions. A quick check confirms that only `net/ipv6/ip6mr.c` has been modified. That's good, keeps the focus somewhat manageable. Alright, what symbols are absolutely critical? `ip6_mroute_setsockopt`, `ip6_mroute_getsockopt`, `ip6mr_ioctl`, `ip6mr_compat_ioctl`, `ip6mr_sk_done`, `ip6mr_get_or_alloc_sk_table`, `ip6mr_maybe_destroy_table`, `ip6mr_destroy_workfn`, `ip6mr_device_event`, and `ipmr_expire_process` are the ones to focus on. They are specific to IPv6 multicast routing (`ip6mr`), and not ubiquitous, so that reduces the chance of conflicts with other functions. For the configurations, `IPV6`, `IPV6_MROUTE`, and `IPV6_MROUTE_MULTIPLE_TABLES` are essential for enabling this functionality. Now, let's confirm the fuzzing strategy. The patch's impact is significant: it modifies IPv6 multicast routing table management in `ip6mr.c`, introducing dynamic table allocation, delayed publishing, asynchronous table destruction via workqueues, and significant modifications to locking and lifecycle handling across the user-space interface (setsockopt, getsockopt, ioctls) and internal mechanisms like netdev event notification and timer expiration. This code is also directly accessible from user space via raw IPv6 sockets and the ioctl/setsockopt syscalls. Definitely worth fuzzing. The goal of this fuzz is to ensure that these key functions, particularly the ones that deal with the user-space interaction and table management, are robust and secure and to ensure there are no race conditions or memory errors present. So, to summarize, the `FocusSymbols` are: `ip6_mroute_setsockopt`, `ip6_mroute_getsockopt`, `ip6mr_ioctl`, `ip6mr_compat_ioctl`, `ip6mr_sk_done`, `ip6mr_get_or_alloc_sk_table`, `ip6mr_maybe_destroy_table`, `ip6mr_destroy_workfn`, `ip6mr_device_event`, and `ipmr_expire_process`. The required `EnableConfigs` are: `IPV6`, `IPV6_MROUTE`, and `IPV6_MROUTE_MULTIPLE_TABLES`. Ready to proceed with `set-results`. |
| 10/2 | 2026/09/06 15:22 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"IPV6",
"IPV6_MROUTE",
"IPV6_MROUTE_MULTIPLE_TABLES"
],
"FocusSymbols": [
"ip6_mroute_setsockopt",
"ip6_mroute_getsockopt",
"ip6mr_ioctl",
"ip6mr_compat_ioctl",
"ip6mr_sk_done",
"ip6mr_get_or_alloc_sk_table",
"ip6mr_maybe_destroy_table",
"ip6mr_destroy_workfn",
"ip6mr_device_event",
"ipmr_expire_process"
],
"Reasoning": "The patch refactors IPv6 multicast routing (ip6mr) table lifecycle and locking. It adds dynamic table allocation, asynchronous table destruction via workqueues, and updates setsockopt, getsockopt, ioctl, timer expiration, and netdev notifier handling. These paths are directly accessible from userspace via raw IPv6 sockets.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"IPV6",
"IPV6_MROUTE",
"IPV6_MROUTE_MULTIPLE_TABLES"
],
"FocusSymbols": [
"ip6_mroute_setsockopt",
"ip6_mroute_getsockopt",
"ip6mr_ioctl",
"ip6mr_compat_ioctl",
"ip6mr_sk_done",
"ip6mr_get_or_alloc_sk_table",
"ip6mr_maybe_destroy_table",
"ip6mr_destroy_workfn",
"ip6mr_device_event",
"ipmr_expire_process"
],
"Reasoning": "The patch refactors IPv6 multicast routing (ip6mr) table lifecycle and locking. It adds dynamic table allocation, asynchronous table destruction via workqueues, and updates setsockopt, getsockopt, ioctl, timer expiration, and netdev notifier handling. These paths are directly accessible from userspace via raw IPv6 sockets.",
"WorthFuzzing": true
} |
| 11/1 | 2026/09/06 15:22 | action | If |
0mArgs:{
"WorthFuzzing": true
}Results: null |
| 12/2 | 2026/09/06 15:22 | agent | kmsan-evaluator |
0mModel:core Args: null Results: {
"KMSANReasoning": "The patch modifies IPv6 multicast routing table management (net/ipv6/ip6mr.c) to dynamically allocate tables on demand when socket options are configured and to destroy them when they become unreferenced or empty.\n\n- Memory Allocations: New dynamic allocations (such as `struct ip6mr_destroy_work` allocated via `kmalloc_obj`) have all member fields (`work`, `net`, `id`) fully initialized before use. The underlying multicast tables allocated via `mr_table_alloc()` use `kzalloc_obj()`.\n- Data sent to user space: ioctl/compat_ioctl and getsockopt handlers only copy explicitly initialized fields or data copied from user space back to user space without leaving uninitialized padding or reading uninitialized kernel memory.\n- Control flow and Lifetimes: Changes affect table lifecycle, RCU synchronization, list manipulations, and locking (RTNL/mrt_lock). Potential issues in these paths involve use-after-free, concurrent access, or memory leaks, which are handled by KASAN, LOCKDEP, and KMEMLEAK.\n\nThere are no uninitialized memory reads or information leaks introduced, so a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 521c0b02a6814200b0eeb20aaf13c5d84e98fe5b
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Sep 6 15:21:56 2026 +0000
syz-cluster: applied patch under review
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3f2ed9b77deb5..26bd2ccd4201a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -28,6 +28,7 @@
#include <linux/init.h>
#include <linux/compat.h>
#include <linux/rhashtable.h>
+#include <linux/workqueue.h>
#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/raw.h>
@@ -368,6 +369,12 @@ static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
return mrt;
}
+static struct mr_table *ip6mr_lookup_sk_table(struct sock *sk)
+{
+ return __ip6mr_get_table(sock_net(sk),
+ raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
+}
+
static int ip6mr_hash_cmp(struct rhashtable_compare_arg *arg,
const void *ptr)
{
@@ -417,6 +424,124 @@ static struct mr_table *ip6mr_new_table(struct net *net, u32 id)
ipmr_expire_process, ip6mr_new_table_set);
}
+/* table_set callback used while the new table is still unpublished. */
+static void ip6mr_table_no_publish(struct mr_table *mrt, struct net *net)
+{
+}
+
+static struct mr_table *ip6mr_get_or_alloc_sk_table(struct sock *sk,
+ bool *new_table)
+{
+ u32 id = raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT;
+ struct net *net = sock_net(sk);
+ struct mr_table *mrt;
+
+ ASSERT_RTNL();
+ *new_table = false;
+
+ mrt = __ip6mr_get_table(net, id);
+ if (mrt)
+ return mrt;
+
+ mrt = mr_table_alloc(net, id, &ip6mr_mr_table_ops,
+ ipmr_expire_process, ip6mr_table_no_publish);
+ if (!IS_ERR(mrt))
+ *new_table = true;
+ return mrt;
+}
+
+static void ip6mr_publish_new_table(struct mr_table *mrt, bool new_table)
+{
+ if (new_table)
+ ip6mr_new_table_set(mrt, read_pnet(&mrt->net));
+}
+
+static void ip6mr_maybe_destroy_table(struct mr_table *mrt)
+{
+ ASSERT_RTNL();
+
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ if (mrt->id == RT6_TABLE_DFLT)
+ return;
+ /* Nested NETDEV_UNREGISTER may already have unlinked this table. */
+ if (__ip6mr_get_table(read_pnet(&mrt->net), mrt->id) != mrt)
+ return;
+ if (rtnl_dereference(mrt->mroute_sk) ||
+ mrt->maxvif ||
+ !list_empty(&mrt->mfc_cache_list))
+ return;
+
+ spin_lock_bh(&mfc_unres_lock);
+ if (!list_empty(&mrt->mfc_unres_queue)) {
+ spin_unlock_bh(&mfc_unres_lock);
+ return;
+ }
+ spin_unlock_bh(&mfc_unres_lock);
+
+ list_del_rcu(&mrt->list);
+ timer_shutdown_sync(&mrt->ipmr_expire_timer);
+ mr_table_free(mrt);
+#endif
+}
+
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+struct ip6mr_destroy_work {
+ struct work_struct work;
+ struct net *net;
+ u32 id;
+};
+
+static void ip6mr_destroy_workfn(struct work_struct *work)
+{
+ struct ip6mr_destroy_work *dw =
+ container_of(work, struct ip6mr_destroy_work, work);
+ struct mr_table *mrt;
+
+ rtnl_lock();
+ mrt = __ip6mr_get_table(dw->net, dw->id);
+ if (mrt)
+ ip6mr_maybe_destroy_table(mrt);
+ rtnl_unlock();
+ put_net(dw->net);
+ kfree(dw);
+}
+
+static void ip6mr_queue_maybe_destroy(struct mr_table *mrt)
+{
+ struct net *net = read_pnet(&mrt->net);
+ struct ip6mr_destroy_work *dw;
+
+ if (mrt->id == RT6_TABLE_DFLT)
+ return;
+
+ dw = kmalloc_obj(*dw, GFP_ATOMIC);
+ if (!dw) {
+ mod_timer(&mrt->ipmr_expire_timer, jiffies + HZ);
+ return;
+ }
+ if (!maybe_get_net(net)) {
+ kfree(dw);
+ return;
+ }
+ INIT_WORK(&dw->work, ip6mr_destroy_workfn);
+ dw->net = net;
+ dw->id = mrt->id;
+ queue_work(system_dfl_wq, &dw->work);
+}
+#else
+static void ip6mr_queue_maybe_destroy(struct mr_table *mrt)
+{
+}
+#endif
+
+static int ip6mr_finish_new_table(struct mr_table *mrt, bool new_table,
+ int err)
+{
+ if (new_table && err)
+ ip6mr_maybe_destroy_table(mrt);
+ return err;
+}
+
static void ip6mr_free_table(struct mr_table *mrt,
struct list_head *dev_kill_list)
{
@@ -866,16 +991,25 @@ static void ipmr_do_expire_process(struct mr_table *mrt)
static void ipmr_expire_process(struct timer_list *t)
{
struct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer);
+ bool empty = false;
if (!spin_trylock(&mfc_unres_lock)) {
mod_timer(&mrt->ipmr_expire_timer, jiffies + 1);
return;
}
- if (!list_empty(&mrt->mfc_unres_queue))
+ if (!list_empty(&mrt->mfc_unres_queue)) {
ipmr_do_expire_process(mrt);
+ empty = list_empty(&mrt->mfc_unres_queue);
+ } else {
+ /* Retry after GFP_ATOMIC allocation failure. */
+ empty = true;
+ }
spin_unlock(&mfc_unres_lock);
+
+ if (empty)
+ ip6mr_queue_maybe_destroy(mrt);
}
/* Fill oifs list. It is called under locked mrt_lock. */
@@ -1290,19 +1424,34 @@ static int ip6mr_device_event(struct notifier_block *this,
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct net *net = dev_net(dev);
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ struct mr_table *mrt, *next;
+#else
struct mr_table *mrt;
+#endif
struct vif_device *v;
int ct;
if (event != NETDEV_UNREGISTER)
return NOTIFY_DONE;
- ip6mr_for_each_table(mrt, net) {
+#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list)
+#else
+ ip6mr_for_each_table(mrt, net)
+#endif
+ {
+ bool vif_gone = false;
+
v = &mrt->vif_table[0];
for (ct = 0; ct < mrt->maxvif; ct++, v++) {
- if (rcu_access_pointer(v->dev) == dev)
+ if (rcu_access_pointer(v->dev) == dev) {
mif6_delete(mrt, ct, 1, NULL);
+ vif_gone = true;
+ }
}
+ if (vif_gone)
+ ip6mr_maybe_destroy_table(mrt);
}
return NOTIFY_DONE;
@@ -1618,10 +1767,11 @@ static void mroute_clean_tables(struct mr_table *mrt, int flags,
static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)
{
- int err = 0;
struct net *net = sock_net(sk);
+ int err = 0;
+
+ ASSERT_RTNL();
- rtnl_lock();
spin_lock(&mrt_lock);
if (rtnl_dereference(mrt->mroute_sk)) {
err = -EADDRINUSE;
@@ -1637,8 +1787,6 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)
NETCONFA_MC_FORWARDING,
NETCONFA_IFINDEX_ALL,
net->ipv6.devconf_all);
- rtnl_unlock();
-
return err;
}
@@ -1677,6 +1825,7 @@ int ip6mr_sk_done(struct sock *sk)
mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MFC,
&dev_kill_list);
err = 0;
+ ip6mr_maybe_destroy_table(mrt);
break;
}
}
@@ -1723,27 +1872,45 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
return -EOPNOTSUPP;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
- return -ENOENT;
-
if (optname != MRT6_INIT) {
- if (sk != rcu_access_pointer(mrt->mroute_sk) &&
- !ns_capable(net->user_ns, CAP_NET_ADMIN))
+ bool is_mroute_sk = false;
+
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (mrt && sk == rcu_access_pointer(mrt->mroute_sk))
+ is_mroute_sk = true;
+ rcu_read_unlock();
+
+ if (!is_mroute_sk && !ns_capable(net->user_ns, CAP_NET_ADMIN))
return -EACCES;
}
switch (optname) {
- case MRT6_INIT:
+ case MRT6_INIT: {
+ bool new_table = false;
+
if (optlen < sizeof(int))
return -EINVAL;
- return ip6mr_sk_init(mrt, sk);
+ rtnl_lock();
+ mrt = ip6mr_get_or_alloc_sk_table(sk, &new_table);
+ if (IS_ERR(mrt)) {
+ rtnl_unlock();
+ return PTR_ERR(mrt);
+ }
+ ip6mr_publish_new_table(mrt, new_table);
+ ret = ip6mr_sk_init(mrt, sk);
+ ret = ip6mr_finish_new_table(mrt, new_table, ret);
+ rtnl_unlock();
+ return ret;
+ }
case MRT6_DONE:
return ip6mr_sk_done(sk);
- case MRT6_ADD_MIF:
+ case MRT6_ADD_MIF: {
+ bool new_table = false;
+
if (optlen < sizeof(vif))
return -EINVAL;
if (copy_from_sockptr(&vif, optval, sizeof(vif)))
@@ -1751,10 +1918,18 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
if (vif.mif6c_mifi >= MAXMIFS)
return -ENFILE;
rtnl_lock();
+ mrt = ip6mr_get_or_alloc_sk_table(sk, &new_table);
+ if (IS_ERR(mrt)) {
+ rtnl_unlock();
+ return PTR_ERR(mrt);
+ }
+ ip6mr_publish_new_table(mrt, new_table);
ret = mif6_add(net, mrt, &vif,
sk == rtnl_dereference(mrt->mroute_sk));
+ ret = ip6mr_finish_new_table(mrt, new_table, ret);
rtnl_unlock();
return ret;
+ }
case MRT6_DEL_MIF:
if (optlen < sizeof(mifi_t))
@@ -1762,7 +1937,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
if (copy_from_sockptr(&mifi, optval, sizeof(mifi_t)))
return -EFAULT;
rtnl_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
ret = mif6_delete(mrt, mifi, 0, NULL);
+ if (!ret)
+ ip6mr_maybe_destroy_table(mrt);
rtnl_unlock();
return ret;
@@ -1783,17 +1965,39 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
if (parent == 0)
parent = mfc.mf6cc_parent;
- mutex_lock(&net->ipv6.mfc_mutex);
+ rtnl_lock();
+ if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY) {
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
+ } else {
+ bool new_table = false;
- if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY)
- ret = ip6mr_mfc_delete(mrt, &mfc, parent);
- else
+ mrt = ip6mr_get_or_alloc_sk_table(sk, &new_table);
+ if (IS_ERR(mrt)) {
+ rtnl_unlock();
+ return PTR_ERR(mrt);
+ }
+ ip6mr_publish_new_table(mrt, new_table);
+ mutex_lock(&net->ipv6.mfc_mutex);
ret = ip6mr_mfc_add(net, mrt, &mfc,
sk ==
rcu_access_pointer(mrt->mroute_sk),
parent);
+ mutex_unlock(&net->ipv6.mfc_mutex);
+ ret = ip6mr_finish_new_table(mrt, new_table, ret);
+ rtnl_unlock();
+ return ret;
+ }
+ mutex_lock(&net->ipv6.mfc_mutex);
+ ret = ip6mr_mfc_delete(mrt, &mfc, parent);
mutex_unlock(&net->ipv6.mfc_mutex);
+ if (!ret)
+ ip6mr_maybe_destroy_table(mrt);
+ rtnl_unlock();
return ret;
case MRT6_FLUSH:
@@ -1807,8 +2011,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
return -EFAULT;
rtnl_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
mroute_clean_tables(mrt, flags, &dev_kill_list);
unregister_netdevice_many(&dev_kill_list);
+ ip6mr_maybe_destroy_table(mrt);
rtnl_unlock();
return 0;
}
@@ -1824,7 +2034,14 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
return -EINVAL;
if (copy_from_sockptr(&v, optval, sizeof(v)))
return -EFAULT;
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
+ return -ENOENT;
+ }
WRITE_ONCE(mrt->mroute_do_assert, v);
+ rcu_read_unlock();
return 0;
}
@@ -1842,6 +2059,11 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
do_wrmifwhole = (v == MRT6MSG_WRMIFWHOLE);
v = !!v;
rtnl_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rtnl_unlock();
+ return -ENOENT;
+ }
ret = 0;
if (v != mrt->mroute_do_pim) {
WRITE_ONCE(mrt->mroute_do_pim, v);
@@ -1865,18 +2087,16 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
/* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
if (v != RT_TABLE_DEFAULT && v >= 100000000)
return -EINVAL;
- if (sk == rcu_access_pointer(mrt->mroute_sk))
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (mrt && sk == rcu_access_pointer(mrt->mroute_sk)) {
+ rcu_read_unlock();
return -EBUSY;
+ }
+ rcu_read_unlock();
- rtnl_lock();
- ret = 0;
- mrt = ip6mr_new_table(net, v);
- if (IS_ERR(mrt))
- ret = PTR_ERR(mrt);
- else
- raw6_sk(sk)->ip6mr_table = v;
- rtnl_unlock();
- return ret;
+ raw6_sk(sk)->ip6mr_table = v;
+ return 0;
}
#endif
/*
@@ -1897,16 +2117,18 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
{
int olr;
int val;
- struct net *net = sock_net(sk);
struct mr_table *mrt;
if (sk->sk_type != SOCK_RAW ||
inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
return -EOPNOTSUPP;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
return -ENOENT;
+ }
switch (optname) {
case MRT6_VERSION:
@@ -1921,8 +2143,10 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
val = READ_ONCE(mrt->mroute_do_assert);
break;
default:
+ rcu_read_unlock();
return -ENOPROTOOPT;
}
+ rcu_read_unlock();
if (copy_from_sockptr(&olr, optlen, sizeof(int)))
return -EFAULT;
@@ -1947,20 +2171,23 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
struct sioc_mif_req6 *vr;
struct vif_device *vif;
struct mfc6_cache *c;
- struct net *net = sock_net(sk);
struct mr_table *mrt;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
return -ENOENT;
+ }
switch (cmd) {
case SIOCGETMIFCNT_IN6:
vr = (struct sioc_mif_req6 *)arg;
- if (vr->mifi >= mrt->maxvif)
+ if (vr->mifi >= mrt->maxvif) {
+ rcu_read_unlock();
return -EINVAL;
+ }
vr->mifi = array_index_nospec(vr->mifi, mrt->maxvif);
- rcu_read_lock();
vif = &mrt->vif_table[vr->mifi];
if (VIF_EXISTS(mrt, vr->mifi)) {
vr->icount = READ_ONCE(vif->pkt_in);
@@ -1974,8 +2201,6 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
return -EADDRNOTAVAIL;
case SIOCGETSGCNT_IN6:
sr = (struct sioc_sg_req6 *)arg;
-
- rcu_read_lock();
c = ip6mr_cache_find(mrt, &sr->src.sin6_addr,
&sr->grp.sin6_addr);
if (c) {
@@ -1988,6 +2213,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
rcu_read_unlock();
return -EADDRNOTAVAIL;
default:
+ rcu_read_unlock();
return -ENOIOCTLCMD;
}
}
@@ -2015,21 +2241,23 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
struct compat_sioc_mif_req6 vr;
struct vif_device *vif;
struct mfc6_cache *c;
- struct net *net = sock_net(sk);
struct mr_table *mrt;
- mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
- return -ENOENT;
-
switch (cmd) {
case SIOCGETMIFCNT_IN6:
if (copy_from_user(&vr, arg, sizeof(vr)))
return -EFAULT;
- if (vr.mifi >= mrt->maxvif)
+ rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
+ return -ENOENT;
+ }
+ if (vr.mifi >= mrt->maxvif) {
+ rcu_read_unlock();
return -EINVAL;
+ }
vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
- rcu_read_lock();
vif = &mrt->vif_table[vr.mifi];
if (VIF_EXISTS(mrt, vr.mifi)) {
vr.icount = READ_ONCE(vif->pkt_in);
@@ -2049,6 +2277,11 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
return -EFAULT;
rcu_read_lock();
+ mrt = ip6mr_lookup_sk_table(sk);
+ if (!mrt) {
+ rcu_read_unlock();
+ return -ENOENT;
+ }
c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
if (c) {
sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt);
|
| 13/3 | 2026/09/06 15:22 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 8866 output: 37 thoughts: 1005 Thoughts: **KMSAN Fuzzing Session Assessment** Okay, let's break down this patch and see if it warrants a dedicated KMSAN fuzzing session. My initial thought is to understand the scope of the changes. It's touching `net/ipv6/ip6mr.c`, which tells me this concerns IPv6 multicast routing. Now, focusing on the core changes, it appears this patch is about dynamic table management for IPv6 multicast routing (`ip6mr`). Specifically, it seems to be moving from pre-allocation or allocation during `MRT6_TABLE` to dynamic allocation using `ip6mr_get_or_alloc_sk_table` when `setsockopt` calls like `MRT6_INIT`, `MRT6_ADD_MIF`, and `MRT6_ADD_MFC` are made. The patch also introduces dynamic table destruction (`ip6mr_maybe_destroy_table`, `ip6mr_queue_maybe_destroy`) when tables are empty, unregistered, or the socket is closed. I'm noting that within `ip6_mroute_setsockopt` with `MRT6_TABLE`, the code now *just* sets the pointer `raw6_sk(sk)->ip6mr_table = v;` without immediately allocating the table, further reinforcing this dynamic behavior. Also, in `ip6mr_ioctl` and `ip6mr_compat_ioctl`, it now looks up the table using `ip6mr_lookup_sk_table(sk)` under `rcu_read_lock()` rather than an upfront lookup. Lastly, I see changes to locking and lifecycle management, with `ip6mr_destroy_work` now being allocated via `kmalloc_obj(*dw, GFP_ATOMIC)`. My next major concern is uninitialized memory. Let's dig in here. Specifically, I need to check the allocation and use of `kmalloc_obj(*dw, GFP_ATOMIC)` within `ip6mr_queue_maybe_destroy`. From what I see in that code, all the fields of the `ip6mr_destroy_work` struct (`work`, `net`, `id`) are explicitly initialized *before* the work is queued. The `ip6mr_destroy_workfn` only reads `dw->net` and `dw->id`, then frees `dw`. That looks safe. I'll also quickly check that `ip6mr_get_or_alloc_sk_table(sk, &new_table)` initializes `new_table` to `false` and sets it to `true` on allocation success. I'm also glancing at `ipmr_expire_process`, which initializes a boolean `empty` and then assigns it based on `list_empty` calls or sets to `true`. Similarly, `ip6mr_device_event` initializes `vif_gone = false;`. Finally, the ioctl and compat ioctl handling catches my attention. In the regular ioctl (`ip6mr_ioctl`), the arguments (`vr` and `sr`) are cast. In the compat ioctl (`ip6mr_compat_ioctl`), the data from user space is copied via `copy_from_user`. If successful, the modified values are copied back to user space using `copy_to_user`. I need to confirm whether this behavior is consistent with the pre-patch versions to assess any potential issues here. This deserves a closer look at the original code to confirm. Given my analysis, I am going to determine if the changes are enough to warrant a KMSAN fuzzing session. |
| 14/3 | 2026/09/06 15:22 | tool | grepper |
0mArgs:{
"Expression": "ip6mr_compat_ioctl",
"PathPrefix": "net/ipv6/ip6mr.c"
}Results: {
"Output": "net/ipv6/ip6mr.c=2230=struct compat_sioc_mif_req6 {\n--\nnet/ipv6/ip6mr.c-2237-\nnet/ipv6/ip6mr.c:2238:int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)\nnet/ipv6/ip6mr.c-2239-{\n"
} |
| 15/3 | 2026/09/06 15:22 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10787 output: 39 thoughts: 24 Thoughts: Here's a summary of my thought process: **Diving into `ip6mr_compat_ioctl`** Okay, so I'm digging into this code, and I need to make absolutely sure I understand the interaction around `ip6mr_compat_ioctl`. Let's zero in on that section, specifically around line 2238. I'm going to carefully review that function to make certain I'm not missing any subtle details or potential edge cases. Need to get a really good handle on how this thing is actually working, so let's start there. |
| 16/3 | 2026/09/06 15:22 | tool | read-file |
0mArgs:{
"File": "net/ipv6/ip6mr.c",
"FirstLine": 2238,
"LineCount": 60
}Results: {
"Contents": "2238:\tint ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)\n2239:\t{\n2240:\t\tstruct compat_sioc_sg_req6 sr;\n2241:\t\tstruct compat_sioc_mif_req6 vr;\n2242:\t\tstruct vif_device *vif;\n2243:\t\tstruct mfc6_cache *c;\n2244:\t\tstruct mr_table *mrt;\n2245:\t\n2246:\t\tswitch (cmd) {\n2247:\t\tcase SIOCGETMIFCNT_IN6:\n2248:\t\t\tif (copy_from_user(\u0026vr, arg, sizeof(vr)))\n2249:\t\t\t\treturn -EFAULT;\n2250:\t\t\trcu_read_lock();\n2251:\t\t\tmrt = ip6mr_lookup_sk_table(sk);\n2252:\t\t\tif (!mrt) {\n2253:\t\t\t\trcu_read_unlock();\n2254:\t\t\t\treturn -ENOENT;\n2255:\t\t\t}\n2256:\t\t\tif (vr.mifi \u003e= mrt-\u003emaxvif) {\n2257:\t\t\t\trcu_read_unlock();\n2258:\t\t\t\treturn -EINVAL;\n2259:\t\t\t}\n2260:\t\t\tvr.mifi = array_index_nospec(vr.mifi, mrt-\u003emaxvif);\n2261:\t\t\tvif = \u0026mrt-\u003evif_table[vr.mifi];\n2262:\t\t\tif (VIF_EXISTS(mrt, vr.mifi)) {\n2263:\t\t\t\tvr.icount = READ_ONCE(vif-\u003epkt_in);\n2264:\t\t\t\tvr.ocount = READ_ONCE(vif-\u003epkt_out);\n2265:\t\t\t\tvr.ibytes = READ_ONCE(vif-\u003ebytes_in);\n2266:\t\t\t\tvr.obytes = READ_ONCE(vif-\u003ebytes_out);\n2267:\t\t\t\trcu_read_unlock();\n2268:\t\n2269:\t\t\t\tif (copy_to_user(arg, \u0026vr, sizeof(vr)))\n2270:\t\t\t\t\treturn -EFAULT;\n2271:\t\t\t\treturn 0;\n2272:\t\t\t}\n2273:\t\t\trcu_read_unlock();\n2274:\t\t\treturn -EADDRNOTAVAIL;\n2275:\t\tcase SIOCGETSGCNT_IN6:\n2276:\t\t\tif (copy_from_user(\u0026sr, arg, sizeof(sr)))\n2277:\t\t\t\treturn -EFAULT;\n2278:\t\n2279:\t\t\trcu_read_lock();\n2280:\t\t\tmrt = ip6mr_lookup_sk_table(sk);\n2281:\t\t\tif (!mrt) {\n2282:\t\t\t\trcu_read_unlock();\n2283:\t\t\t\treturn -ENOENT;\n2284:\t\t\t}\n2285:\t\t\tc = ip6mr_cache_find(mrt, \u0026sr.src.sin6_addr, \u0026sr.grp.sin6_addr);\n2286:\t\t\tif (c) {\n2287:\t\t\t\tsr.pktcnt = atomic_long_read(\u0026c-\u003e_c.mfc_un.res.pkt);\n2288:\t\t\t\tsr.bytecnt = atomic_long_read(\u0026c-\u003e_c.mfc_un.res.bytes);\n2289:\t\t\t\tsr.wrong_if = atomic_long_read(\u0026c-\u003e_c.mfc_un.res.wrong_if);\n2290:\t\t\t\trcu_read_unlock();\n2291:\t\n2292:\t\t\t\tif (copy_to_user(arg, \u0026sr, sizeof(sr)))\n2293:\t\t\t\t\treturn -EFAULT;\n2294:\t\t\t\treturn 0;\n2295:\t\t\t}\n2296:\t\t\trcu_read_unlock();\n2297:\t\t\treturn -EADDRNOTAVAIL;\n"
} |
| 17/3 | 2026/09/06 15:22 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 11994 output: 24 thoughts: 394 Thoughts: **My Analysis of the IPv6 Multicast Routing Code Changes** Okay, so looking at this `ip6mr_compat_ioctl` function, the code's been reorganized. It used to grab the multicast routing table (`mrt = ip6mr_get_table(...)`) before any user data copying. Now, it does the `copy_from_user` *first*, then locks RCU, finds the table, and then, if it exists, proceeds to populate the user-space fields and copy them back – essentially the same end result as before, just a re-ordering. The good news is, I don't see any obvious introduction of uninitialized data, which is always a critical concern with these sorts of changes. That's a relief. Now, I want to drill down further, so I need to check out `mr_table_alloc` and the `ip6mr_table_no_publish` function. Let's see... looking at the code, it looks like `ip6mr_table_no_publish` is a callback that does nothing, which is fine, especially if it's used *while* the table is still unpublished, as the comment suggests. We can ignore that for now. Then, the `ip6mr_get_or_alloc_sk_table` function uses `__ip6mr_get_table` to get the MRT. If it's not found, `mr_table_alloc` is called to allocate a new table. Alright. `mr_table_alloc` looks like the place where the core table allocation happens. Let's dig deeper. I need to examine the actual implementation of `mr_table_alloc`, probably in `net/ipv4/ipmr_base.c` or a similar file. I need to see exactly what memory initialization is done during table creation. It's likely that table allocation does some initialization. I'll need to verify that initialization to confirm that the changes don't introduce any vulnerabilities there. |
| 18/3 | 2026/09/06 15:22 | tool | grepper |
0mError:no matches Args: {
"Expression": "struct mr_table \\*mr_table_alloc"
}Results: {
"error": "no matches"
} |
| 19/3 | 2026/09/06 15:22 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12851 output: 20 thoughts: 11 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Hunting Down `mr_table_alloc`** Okay, so the task at hand is to locate `mr_table_alloc`. Immediately, my mind starts to map out the possibilities. This is likely a memory resource allocation function, judging by the prefix "mr" and the suffix "alloc". Given the potential scope of a system like this, I need to figure out the best approach to find it efficiently. My initial thought is to employ all my usual tricks. Where does this codebase likely reside? What libraries would be expected? I'd immediately lean towards examining header files first. A quick `grep` (or equivalent depending on the platform) across the project with a pattern that looks for a declaration would be a good starting point. I'll need to remember to check for preprocessor conditionals as well. Maybe it's defined within an `#ifdef` block. If the function isn't readily apparent in the headers, I'll switch to looking at the source files themselves. Given its name, it's likely a relatively low-level memory management function, so I'll prioritize examining modules related to the memory management subsystem, table structures, and any associated resource management or allocation layers. I'll have to keep in mind, depending on the system, it may be a more general-purpose routine. I should also consider whether it's part of a third-party library. If so, I’ll need to familiarize myself with its documentation and build process to see if I can narrow down where it's included. I can also imagine there are static analysis tools that could assist. A symbol lookup from a debugger if that's available would speed things along. The goal here is efficiency and precision. I'll need to balance speed and accuracy in my search. My immediate thought is to consider the context of the usage as that will also likely guide my process. |
| 20/3 | 2026/09/06 15:22 | tool | grepper |
0mArgs:{
"Expression": "mr_table_alloc\\("
}Results: {
"Output": "include/linux/mroute_base.h=280=struct mr_table *\ninclude/linux/mroute_base.h:281:mr_table_alloc(struct net *net, u32 id,\ninclude/linux/mroute_base.h-282-\t struct mr_table_ops *ops,\n--\nnet/ipv4/ipmr.c=426=static struct mr_table *ipmr_new_table(struct net *net, u32 id)\n--\nnet/ipv4/ipmr.c-437-\nnet/ipv4/ipmr.c:438:\treturn mr_table_alloc(net, id, \u0026ipmr_mr_table_ops,\nnet/ipv4/ipmr.c-439-\t\t\t ipmr_expire_process, ipmr_new_table_set);\n--\nnet/ipv4/ipmr_base.c=45=struct mr_table *\nnet/ipv4/ipmr_base.c:46:mr_table_alloc(struct net *net, u32 id,\nnet/ipv4/ipmr_base.c-47-\t struct mr_table_ops *ops,\n--\nnet/ipv6/ip6mr.c=415=static struct mr_table *ip6mr_new_table(struct net *net, u32 id)\n--\nnet/ipv6/ip6mr.c-422-\nnet/ipv6/ip6mr.c:423:\treturn mr_table_alloc(net, id, \u0026ip6mr_mr_table_ops,\nnet/ipv6/ip6mr.c-424-\t\t\t ipmr_expire_process, ip6mr_new_table_set);\n--\nnet/ipv6/ip6mr.c=432=static struct mr_table *ip6mr_get_or_alloc_sk_table(struct sock *sk,\n--\nnet/ipv6/ip6mr.c-445-\nnet/ipv6/ip6mr.c:446:\tmrt = mr_table_alloc(net, id, \u0026ip6mr_mr_table_ops,\nnet/ipv6/ip6mr.c-447-\t\t\t ipmr_expire_process, ip6mr_table_no_publish);\n"
} |
| 21/3 | 2026/09/06 15:22 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13861 output: 38 thoughts: 25 Thoughts: Here's my take on the thought process, as if it were my own: **Diving into the IPv4 Multicast Router Code** Okay, time to get to the bottom of this. I need to understand how multicast routing tables are allocated, so let's zero in on `mr_table_alloc`. That's the function I need to investigate, and it lives in `net/ipv4/ipmr_base.c`. I'm going to start there and see what the function does, what it interacts with, and how it handles memory allocation, any spinlocks, and other concurrent access. I expect to be digging deep into the intricacies of kernel data structures and memory management to get a complete picture. This is where the real work begins. |
| 22/3 | 2026/09/06 15:22 | tool | read-file |
0mArgs:{
"File": "net/ipv4/ipmr_base.c",
"FirstLine": 45,
"LineCount": 40
}Results: {
"Contents": " 45:\tstruct mr_table *\n 46:\tmr_table_alloc(struct net *net, u32 id,\n 47:\t\t struct mr_table_ops *ops,\n 48:\t\t void (*expire_func)(struct timer_list *t),\n 49:\t\t void (*table_set)(struct mr_table *mrt,\n 50:\t\t\t\t\t struct net *net))\n 51:\t{\n 52:\t\tstruct mr_table *mrt;\n 53:\t\tint err;\n 54:\t\n 55:\t\tmrt = kzalloc_obj(*mrt);\n 56:\t\tif (!mrt)\n 57:\t\t\treturn ERR_PTR(-ENOMEM);\n 58:\t\tmrt-\u003eid = id;\n 59:\t\twrite_pnet(\u0026mrt-\u003enet, net);\n 60:\t\n 61:\t\tmrt-\u003eops = *ops;\n 62:\t\terr = rhltable_init(\u0026mrt-\u003emfc_hash, mrt-\u003eops.rht_params);\n 63:\t\tif (err) {\n 64:\t\t\tkfree(mrt);\n 65:\t\t\treturn ERR_PTR(err);\n 66:\t\t}\n 67:\t\n 68:\t\tINIT_RCU_WORK(\u0026mrt-\u003ework, __mr_free_table);\n 69:\t\tINIT_LIST_HEAD(\u0026mrt-\u003emfc_cache_list);\n 70:\t\tINIT_LIST_HEAD(\u0026mrt-\u003emfc_unres_queue);\n 71:\t\n 72:\t\ttimer_setup(\u0026mrt-\u003eipmr_expire_timer, expire_func, 0);\n 73:\t\n 74:\t\tmrt-\u003emroute_reg_vif_num = -1;\n 75:\t\ttable_set(mrt, net);\n 76:\t\treturn mrt;\n 77:\t}\n 78:\t\n 79:\tvoid *mr_mfc_find_parent(struct mr_table *mrt, void *hasharg, int parent)\n 80:\t{\n 81:\t\tstruct rhlist_head *tmp, *list;\n 82:\t\tstruct mr_mfc *c;\n 83:\t\n 84:\t\tlist = rhltable_lookup(\u0026mrt-\u003emfc_hash, hasharg, *mrt-\u003eops.rht_params);\n"
} |
| 23/3 | 2026/09/06 15:22 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 14689 output: 277 thoughts: 273 Thoughts: **My Assessment of the `mr_table` Changes** Okay, so `mr_table_alloc` uses `kzalloc_obj` on the `struct mr_table`. That's good – it means the entire structure is zero-initialized right off the bat. No uninitialized garbage left lingering there. Now, let's think about where else this thing is touched. Destruction, refcounting, RCU, locking, list management… classic memory lifetime issues, synchronization, and RCU management fixes, as expected. We're talking about preventing memory leaks or use-after-free situations when multicast tables are no longer needed. Any bugs that *could* pop up here would likely be standard: use-after-free or double-free, which KASAN should nail; locking problems or deadlocks, LOCKDEP will catch those; null pointer dereferences or dodgy error handling, standard kernel checks and KASAN would take care of that; and, finally, memory leaks, which KMEMLEAK is specifically designed to expose. Crucially, from my expert point of view, none of these changes seem to introduce *any* risks of uninitialized memory reads or any potential information leaks to user space. All the new or modified variables – stack and heap – are fully initialized. `kmalloc_obj` with explicit field initialization, `kzalloc_obj`, or zero-initialized primitives. So, no surprises there. Therefore, this patch doesn't trigger any of the uninitialized memory pitfalls that would require KMSAN's attention. I'm confident that standard KASAN and LOCKDEP testing are more than sufficient to cover this. I'm going to set `NeedsKMSAN=false` with a detailed explanation. That's my call. |
| 24/3 | 2026/09/06 15:22 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch modifies IPv6 multicast routing table management (net/ipv6/ip6mr.c) to dynamically allocate tables on demand when socket options are configured and to destroy them when they become unreferenced or empty.\n\n- Memory Allocations: New dynamic allocations (such as `struct ip6mr_destroy_work` allocated via `kmalloc_obj`) have all member fields (`work`, `net`, `id`) fully initialized before use. The underlying multicast tables allocated via `mr_table_alloc()` use `kzalloc_obj()`.\n- Data sent to user space: ioctl/compat_ioctl and getsockopt handlers only copy explicitly initialized fields or data copied from user space back to user space without leaving uninitialized padding or reading uninitialized kernel memory.\n- Control flow and Lifetimes: Changes affect table lifecycle, RCU synchronization, list manipulations, and locking (RTNL/mrt_lock). Potential issues in these paths involve use-after-free, concurrent access, or memory leaks, which are handled by KASAN, LOCKDEP, and KMEMLEAK.\n\nThere are no uninitialized memory reads or information leaks introduced, so a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch modifies IPv6 multicast routing table management (net/ipv6/ip6mr.c) to dynamically allocate tables on demand when socket options are configured and to destroy them when they become unreferenced or empty.\n\n- Memory Allocations: New dynamic allocations (such as `struct ip6mr_destroy_work` allocated via `kmalloc_obj`) have all member fields (`work`, `net`, `id`) fully initialized before use. The underlying multicast tables allocated via `mr_table_alloc()` use `kzalloc_obj()`.\n- Data sent to user space: ioctl/compat_ioctl and getsockopt handlers only copy explicitly initialized fields or data copied from user space back to user space without leaving uninitialized padding or reading uninitialized kernel memory.\n- Control flow and Lifetimes: Changes affect table lifecycle, RCU synchronization, list manipulations, and locking (RTNL/mrt_lock). Potential issues in these paths involve use-after-free, concurrent access, or memory leaks, which are handled by KASAN, LOCKDEP, and KMEMLEAK.\n\nThere are no uninitialized memory reads or information leaks introduced, so a dedicated KMSAN fuzzing session is not warranted.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|