AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the stmmac (Synopsys DesignWare / STMicroelectronics Ethernet) driver, specifically adjusting buffer size calculations for jumbo frames and updating internal ethtool selftest logic. This driver drives physical Ethernet MAC hardware (SoCs and specific PCIe adapters) that is not emulated in standard QEMU or GCE amd64 virtualized environments. Because the underlying hardware is absent, the driver cannot probe and the modified code paths are structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit d0750d1d901a63fa02aaf0769f4d95cb96e65986\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Sep 20 00:37:30 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c\nindex 2994df41ec2c4..c6a8f8d735015 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c\n@@ -474,11 +474,11 @@ static void dwmac4_set_sarc(struct dma_desc *p, u32 sarc_type)\n \t\t\t\t\t  sarc_type));\n }\n \n-static int set_16kib_bfsize(int mtu)\n+static int set_16kib_bfsize(int len)\n {\n \tint ret = 0;\n \n-\tif (unlikely(mtu \u003e= BUF_SIZE_8KiB))\n+\tif (unlikely(len \u003e BUF_SIZE_8KiB))\n \t\tret = BUF_SIZE_16KiB;\n \treturn ret;\n }\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h\nindex 04dafec021b4f..de7aa6d28148e 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h\n+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h\n@@ -540,7 +540,7 @@ struct stmmac_mode_ops {\n \tbool (*is_jumbo_frm)(unsigned int len, bool enh_desc);\n \tint (*jumbo_frm)(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,\n \t\t\t int csum);\n-\tint (*set_16kib_bfsize)(int mtu);\n+\tint (*set_16kib_bfsize)(int len);\n \tvoid (*init_desc3)(struct dma_desc *p);\n \tvoid (*refill_desc3)(struct stmmac_rx_queue *rx_q, struct dma_desc *p);\n \tvoid (*clean_desc3)(struct stmmac_tx_queue *tx_q, struct dma_desc *p);\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c\nindex f7949419eb9fd..d2f0c321661d9 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c\n@@ -124,10 +124,10 @@ static void clean_desc3(struct stmmac_tx_queue *tx_q, struct dma_desc *p)\n \t\tp-\u003edes3 = 0;\n }\n \n-static int set_16kib_bfsize(int mtu)\n+static int set_16kib_bfsize(int len)\n {\n \tint ret = 0;\n-\tif (unlikely(mtu \u003e BUF_SIZE_8KiB))\n+\tif (unlikely(len \u003e BUF_SIZE_8KiB))\n \t\tret = BUF_SIZE_16KiB;\n \treturn ret;\n }\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\nindex 1fb5f804ea234..d5a984ad864f2 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\n@@ -1536,17 +1536,17 @@ static unsigned int stmmac_rx_offset(struct stmmac_priv *priv)\n \treturn NET_SKB_PAD + NET_IP_ALIGN;\n }\n \n-static int stmmac_set_bfsize(int mtu)\n+static int stmmac_set_bfsize(int len)\n {\n \tint ret;\n \n-\tif (mtu \u003e= BUF_SIZE_8KiB)\n+\tif (len \u003e BUF_SIZE_8KiB)\n \t\tret = BUF_SIZE_16KiB;\n-\telse if (mtu \u003e= BUF_SIZE_4KiB)\n+\telse if (len \u003e BUF_SIZE_4KiB)\n \t\tret = BUF_SIZE_8KiB;\n-\telse if (mtu \u003e= BUF_SIZE_2KiB)\n+\telse if (len \u003e BUF_SIZE_2KiB)\n \t\tret = BUF_SIZE_4KiB;\n-\telse if (mtu \u003e DEFAULT_BUFSIZE)\n+\telse if (len \u003e DEFAULT_BUFSIZE)\n \t\tret = BUF_SIZE_2KiB;\n \telse\n \t\tret = DEFAULT_BUFSIZE;\n@@ -4063,7 +4063,7 @@ static struct stmmac_dma_conf *\n stmmac_setup_dma_desc(struct stmmac_priv *priv, unsigned int mtu)\n {\n \tstruct stmmac_dma_conf *dma_conf;\n-\tint bfsize, ret;\n+\tint bfsize, len, ret;\n \tu8 chan;\n \n \tdma_conf = kzalloc_obj(*dma_conf);\n@@ -4073,13 +4073,15 @@ stmmac_setup_dma_desc(struct stmmac_priv *priv, unsigned int mtu)\n \t\treturn ERR_PTR(-ENOMEM);\n \t}\n \n-\t/* Returns 0 or BUF_SIZE_16KiB if mtu \u003e 8KiB and dwmac4 or ring mode */\n-\tbfsize = stmmac_set_16kib_bfsize(priv, mtu);\n+\tlen = mtu + ETH_HLEN + 2 * VLAN_HLEN + ETH_FCS_LEN;\n+\n+\t/* Returns 0 or BUF_SIZE_16KiB if len \u003e 8KiB and dwmac4 or ring mode */\n+\tbfsize = stmmac_set_16kib_bfsize(priv, len);\n \tif (bfsize \u003c 0)\n \t\tbfsize = 0;\n \n \tif (bfsize \u003c BUF_SIZE_16KiB)\n-\t\tbfsize = stmmac_set_bfsize(mtu);\n+\t\tbfsize = stmmac_set_bfsize(len);\n \n \tdma_conf-\u003edma_buf_sz = bfsize;\n \t/* Chose the tx/rx size from the already defined one in the\ndiff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c\nindex 6372ec7c3f317..c25dc9f89270c 100644\n--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c\n+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c\n@@ -12,6 +12,7 @@\n #include \u003clinux/ethtool.h\u003e\n #include \u003clinux/ip.h\u003e\n #include \u003clinux/udp.h\u003e\n+#include \u003cnet/dsa.h\u003e\n #include \u003cnet/pkt_cls.h\u003e\n #include \u003cnet/pkt_sched.h\u003e\n #include \u003cnet/tcp.h\u003e\n@@ -29,6 +30,7 @@ struct stmmachdr {\n \t\t\t      sizeof(struct stmmachdr))\n #define STMMAC_TEST_PKT_MAGIC\t0xdeadcafecafedeadULL\n #define STMMAC_LB_TIMEOUT\tmsecs_to_jiffies(200)\n+#define STMMAC_SFT_MAX_LPI\t(5 * USEC_PER_SEC)\n \n struct stmmac_packet_attrs {\n \tint vlan;\n@@ -237,6 +239,10 @@ struct stmmac_test_priv {\n \tstruct stmmac_packet_attrs *packet;\n \tstruct packet_type pt;\n \tstruct completion comp;\n+\t__be16 packet_type;\n+\tint (*func)(struct sk_buff *skb, struct net_device *ndev,\n+\t\t    struct packet_type *pt, struct net_device *orig_ndev);\n+\tbool capture_all;\n \tint double_vlan;\n \tint vlan_id;\n \tint ok;\n@@ -316,6 +322,52 @@ static int stmmac_test_loopback_validate(struct sk_buff *skb,\n \treturn 0;\n }\n \n+static int stmmac_sft_filter(struct sk_buff *skb, struct net_device *ndev,\n+\t\t\t     struct packet_type *pt,\n+\t\t\t     struct net_device *orig_ndev)\n+{\n+\tstruct stmmac_test_priv *tpriv = pt-\u003eaf_packet_priv;\n+\tstruct ethhdr *hdr = eth_hdr(skb);\n+\tint ret = 0;\n+\n+\tif (hdr-\u003eh_proto == tpriv-\u003epacket_type) {\n+\t\tstruct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);\n+\n+\t\tif (nskb)\n+\t\t\tret = tpriv-\u003efunc(nskb, ndev, pt, orig_ndev);\n+\t}\n+\n+\tkfree_skb(skb);\n+\treturn ret;\n+}\n+\n+static void stmmac_sft_add_pack(struct packet_type *pt)\n+{\n+\tstruct stmmac_test_priv *tpriv = pt-\u003eaf_packet_priv;\n+\n+\tif (netdev_uses_dsa(tpriv-\u003ept.dev) || tpriv-\u003ecapture_all) {\n+\t\ttpriv-\u003epacket_type = tpriv-\u003ept.type;\n+\t\ttpriv-\u003efunc = tpriv-\u003ept.func;\n+\n+\t\t/* DSA conduit will report ETH_P_XDSA, so our packet handler\n+\t\t * won't match. Let's register a ETH_P_ALL match and filter\n+\t\t * manually in stmmac_sft_filter. This is also useful for\n+\t\t * VLAN tests, to capture packets otherwise marked as\n+\t\t * OTHERHOST.\n+\t\t */\n+\t\ttpriv-\u003ept.type = htons(ETH_P_ALL);\n+\t\ttpriv-\u003ept.func = stmmac_sft_filter;\n+\t\ttpriv-\u003ept.ignore_outgoing = true;\n+\t}\n+\n+\tdev_add_pack(pt);\n+}\n+\n+static void stmmac_sft_remove_pack(struct packet_type *pt)\n+{\n+\tdev_remove_pack(pt);\n+}\n+\n static int __stmmac_test_loopback(struct stmmac_priv *priv,\n \t\t\t\t  struct stmmac_packet_attrs *attr)\n {\n@@ -337,7 +389,7 @@ static int __stmmac_test_loopback(struct stmmac_priv *priv,\n \ttpriv-\u003epacket = attr;\n \n \tif (!attr-\u003edont_wait)\n-\t\tdev_add_pack(\u0026tpriv-\u003ept);\n+\t\tstmmac_sft_add_pack(\u0026tpriv-\u003ept);\n \n \tskb = stmmac_test_get_udp_skb(priv, attr);\n \tif (!skb) {\n@@ -360,7 +412,7 @@ static int __stmmac_test_loopback(struct stmmac_priv *priv,\n \n cleanup:\n \tif (!attr-\u003edont_wait)\n-\t\tdev_remove_pack(\u0026tpriv-\u003ept);\n+\t\tstmmac_sft_remove_pack(\u0026tpriv-\u003ept);\n \tkfree(tpriv);\n \treturn ret;\n }\n@@ -414,12 +466,16 @@ static int stmmac_test_mmc(struct stmmac_priv *priv)\n static int stmmac_test_eee(struct stmmac_priv *priv)\n {\n \tstruct stmmac_extra_stats *initial, *final;\n-\tint retries = 10;\n+\tunsigned long timeout, max_duration;\n \tint ret;\n \n \tif (!priv-\u003edma_cap.eee || !priv-\u003eeee_active)\n \t\treturn -EOPNOTSUPP;\n \n+\t/* Bail out if the configured LPI timer is too long */\n+\tif (priv-\u003etx_lpi_timer \u003e STMMAC_SFT_MAX_LPI)\n+\t\treturn -EOPNOTSUPP;\n+\n \tinitial = kzalloc_obj(*initial);\n \tif (!initial)\n \t\treturn -ENOMEM;\n@@ -430,14 +486,21 @@ static int stmmac_test_eee(struct stmmac_priv *priv)\n \t\tgoto out_free_initial;\n \t}\n \n+\t/* Snapshot stats, we want to count the in_lpi events. We may enter\n+\t * LPI just after the packet was sent.\n+\t */\n \tmemcpy(initial, \u0026priv-\u003exstats, sizeof(*initial));\n \n+\t/* Send a frame, then wait to enter LPI */\n \tret = stmmac_test_mac_loopback(priv);\n \tif (ret)\n \t\tgoto out_free_final;\n \n+\tmax_duration = usecs_to_jiffies(2 * priv-\u003etx_lpi_timer);\n+\n \t/* We have no traffic in the line so, sooner or later it will go LPI */\n-\twhile (--retries) {\n+\ttimeout = jiffies + max_duration;\n+\twhile (!time_after(jiffies, timeout)) {\n \t\tmemcpy(final, \u0026priv-\u003exstats, sizeof(*final));\n \n \t\tif (final-\u003eirq_tx_path_in_lpi_mode_n \u003e\n@@ -446,20 +509,38 @@ static int stmmac_test_eee(struct stmmac_priv *priv)\n \t\tmsleep(100);\n \t}\n \n-\tif (!retries) {\n+\tmemcpy(final, \u0026priv-\u003exstats, sizeof(*final));\n+\tif (final-\u003eirq_tx_path_in_lpi_mode_n \u003c=\n+\t    initial-\u003eirq_tx_path_in_lpi_mode_n) {\n \t\tret = -ETIMEDOUT;\n \t\tgoto out_free_final;\n \t}\n \n-\tif (final-\u003eirq_tx_path_in_lpi_mode_n \u003c=\n-\t    initial-\u003eirq_tx_path_in_lpi_mode_n) {\n-\t\tret = -EINVAL;\n+\t/* Re-snapshot, as we want to measure exit_lpi events. We should be\n+\t * in LPI right now.\n+\t */\n+\tmemcpy(initial, \u0026priv-\u003exstats, sizeof(*initial));\n+\n+\t/* TX something so we go out of LPI */\n+\tret = stmmac_test_mac_loopback(priv);\n+\tif (ret)\n \t\tgoto out_free_final;\n+\n+\t/* Wait for the exit LPI interrupt */\n+\ttimeout = jiffies + max_duration;\n+\twhile (!time_after(jiffies, timeout)) {\n+\t\tmemcpy(final, \u0026priv-\u003exstats, sizeof(*final));\n+\n+\t\tif (final-\u003eirq_tx_path_exit_lpi_mode_n \u003e\n+\t\t    initial-\u003eirq_tx_path_exit_lpi_mode_n)\n+\t\t\tbreak;\n+\t\tmsleep(100);\n \t}\n \n+\tmemcpy(final, \u0026priv-\u003exstats, sizeof(*final));\n \tif (final-\u003eirq_tx_path_exit_lpi_mode_n \u003c=\n \t    initial-\u003eirq_tx_path_exit_lpi_mode_n) {\n-\t\tret = -EINVAL;\n+\t\tret = -ETIMEDOUT;\n \t\tgoto out_free_final;\n \t}\n \n@@ -767,7 +848,7 @@ static int stmmac_test_flowctrl(struct stmmac_priv *priv)\n \ttpriv-\u003ept.func = stmmac_test_flowctrl_validate;\n \ttpriv-\u003ept.dev = priv-\u003edev;\n \ttpriv-\u003ept.af_packet_priv = tpriv;\n-\tdev_add_pack(\u0026tpriv-\u003ept);\n+\tstmmac_sft_add_pack(\u0026tpriv-\u003ept);\n \n \t/* Compute minimum number of packets to make FIFO full */\n \tpkt_count = rx_fifo_size;\n@@ -823,7 +904,7 @@ static int stmmac_test_flowctrl(struct stmmac_priv *priv)\n cleanup:\n \tdev_mc_del(priv-\u003edev, paddr);\n \tdev_set_promiscuity(priv-\u003edev, -1);\n-\tdev_remove_pack(\u0026tpriv-\u003ept);\n+\tstmmac_sft_remove_pack(\u0026tpriv-\u003ept);\n \tkfree(tpriv);\n \treturn ret;\n }\n@@ -865,6 +946,11 @@ static int stmmac_test_vlan_validate(struct sk_buff *skb,\n \t\tgoto out;\n \tif (skb_headlen(skb) \u003c (STMMAC_TEST_PKT_SIZE - ETH_HLEN))\n \t\tgoto out;\n+\n+\tehdr = (struct ethhdr *)skb_mac_header(skb);\n+\tif (!ether_addr_equal_unaligned(ehdr-\u003eh_dest, tpriv-\u003epacket-\u003edst))\n+\t\tgoto out;\n+\n \tif (tpriv-\u003evlan_id) {\n \t\tif (skb-\u003evlan_proto != htons(proto))\n \t\t\tgoto out;\n@@ -876,10 +962,6 @@ static int stmmac_test_vlan_validate(struct sk_buff *skb,\n \t\t}\n \t}\n \n-\tehdr = (struct ethhdr *)skb_mac_header(skb);\n-\tif (!ether_addr_equal_unaligned(ehdr-\u003eh_dest, tpriv-\u003epacket-\u003edst))\n-\t\tgoto out;\n-\n \tihdr = ip_hdr(skb);\n \tif (tpriv-\u003edouble_vlan)\n \t\tihdr = (struct iphdr *)(skb_network_header(skb) + 4);\n@@ -921,6 +1003,7 @@ static int __stmmac_test_vlanfilt(struct stmmac_priv *priv)\n \ttpriv-\u003ept.dev = priv-\u003edev;\n \ttpriv-\u003ept.af_packet_priv = tpriv;\n \ttpriv-\u003epacket = \u0026attr;\n+\ttpriv-\u003ecapture_all = true;\n \n \t/*\n \t * As we use HASH filtering, false positives may appear. This is a\n@@ -928,18 +1011,20 @@ static int __stmmac_test_vlanfilt(struct stmmac_priv *priv)\n \t * HASH values.\n \t */\n \ttpriv-\u003evlan_id = 0x123;\n-\tdev_add_pack(\u0026tpriv-\u003ept);\n \n \tret = vlan_vid_add(priv-\u003edev, htons(ETH_P_8021Q), tpriv-\u003evlan_id);\n \tif (ret)\n \t\tgoto cleanup;\n \n+\tattr.vlan = 1;\n+\tattr.dst = priv-\u003edev-\u003edev_addr;\n+\tattr.sport = 9;\n+\tattr.dport = 9;\n+\n+\tstmmac_sft_add_pack(\u0026tpriv-\u003ept);\n+\n \tfor (i = 0; i \u003c 4; i++) {\n-\t\tattr.vlan = 1;\n \t\tattr.vlan_id_out = tpriv-\u003evlan_id + i;\n-\t\tattr.dst = priv-\u003edev-\u003edev_addr;\n-\t\tattr.sport = 9;\n-\t\tattr.dport = 9;\n \n \t\tskb = stmmac_test_get_udp_skb(priv, \u0026attr);\n \t\tif (!skb) {\n@@ -966,9 +1051,9 @@ static int __stmmac_test_vlanfilt(struct stmmac_priv *priv)\n \t}\n \n vlan_del:\n+\tstmmac_sft_remove_pack(\u0026tpriv-\u003ept);\n \tvlan_vid_del(priv-\u003edev, htons(ETH_P_8021Q), tpriv-\u003evlan_id);\n cleanup:\n-\tdev_remove_pack(\u0026tpriv-\u003ept);\n \tkfree(tpriv);\n \treturn ret;\n }\n@@ -1015,6 +1100,7 @@ static int __stmmac_test_dvlanfilt(struct stmmac_priv *priv)\n \ttpriv-\u003ept.dev = priv-\u003edev;\n \ttpriv-\u003ept.af_packet_priv = tpriv;\n \ttpriv-\u003epacket = \u0026attr;\n+\ttpriv-\u003ecapture_all = true;\n \n \t/*\n \t * As we use HASH filtering, false positives may appear. This is a\n@@ -1022,18 +1108,20 @@ static int __stmmac_test_dvlanfilt(struct stmmac_priv *priv)\n \t * HASH values.\n \t */\n \ttpriv-\u003evlan_id = 0x123;\n-\tdev_add_pack(\u0026tpriv-\u003ept);\n \n \tret = vlan_vid_add(priv-\u003edev, htons(ETH_P_8021AD), tpriv-\u003evlan_id);\n \tif (ret)\n \t\tgoto cleanup;\n \n+\tattr.vlan = 2;\n+\tattr.dst = priv-\u003edev-\u003edev_addr;\n+\tattr.sport = 9;\n+\tattr.dport = 9;\n+\n+\tstmmac_sft_add_pack(\u0026tpriv-\u003ept);\n+\n \tfor (i = 0; i \u003c 4; i++) {\n-\t\tattr.vlan = 2;\n \t\tattr.vlan_id_out = tpriv-\u003evlan_id + i;\n-\t\tattr.dst = priv-\u003edev-\u003edev_addr;\n-\t\tattr.sport = 9;\n-\t\tattr.dport = 9;\n \n \t\tskb = stmmac_test_get_udp_skb(priv, \u0026attr);\n \t\tif (!skb) {\n@@ -1060,9 +1148,9 @@ static int __stmmac_test_dvlanfilt(struct stmmac_priv *priv)\n \t}\n \n vlan_del:\n+\tstmmac_sft_remove_pack(\u0026tpriv-\u003ept);\n \tvlan_vid_del(priv-\u003edev, htons(ETH_P_8021AD), tpriv-\u003evlan_id);\n cleanup:\n-\tdev_remove_pack(\u0026tpriv-\u003ept);\n \tkfree(tpriv);\n \treturn ret;\n }\n@@ -1293,7 +1381,7 @@ static int stmmac_test_vlanoff_common(struct stmmac_priv *priv, bool svlan)\n \ttpriv-\u003ept.af_packet_priv = tpriv;\n \ttpriv-\u003epacket = \u0026attr;\n \ttpriv-\u003evlan_id = 0x123;\n-\tdev_add_pack(\u0026tpriv-\u003ept);\n+\ttpriv-\u003ecapture_all = true;\n \n \tret = vlan_vid_add(priv-\u003edev, htons(proto), tpriv-\u003evlan_id);\n \tif (ret)\n@@ -1301,6 +1389,8 @@ static int stmmac_test_vlanoff_common(struct stmmac_priv *priv, bool svlan)\n \n \tattr.dst = priv-\u003edev-\u003edev_addr;\n \n+\tstmmac_sft_add_pack(\u0026tpriv-\u003ept);\n+\n \tskb = stmmac_test_get_udp_skb(priv, \u0026attr);\n \tif (!skb) {\n \t\tret = -ENOMEM;\n@@ -1318,9 +1408,9 @@ static int stmmac_test_vlanoff_common(struct stmmac_priv *priv, bool svlan)\n \tret = tpriv-\u003eok ? 0 : -ETIMEDOUT;\n \n vlan_del:\n+\tstmmac_sft_remove_pack(\u0026tpriv-\u003ept);\n \tvlan_vid_del(priv-\u003edev, htons(proto), tpriv-\u003evlan_id);\n cleanup:\n-\tdev_remove_pack(\u0026tpriv-\u003ept);\n \tkfree(tpriv);\n \treturn ret;\n }\n@@ -1332,7 +1422,7 @@ static int stmmac_test_vlanoff(struct stmmac_priv *priv)\n \n static int stmmac_test_svlanoff(struct stmmac_priv *priv)\n {\n-\tif (!priv-\u003edma_cap.dvlan)\n+\tif (!(priv-\u003edev-\u003efeatures \u0026 NETIF_F_HW_VLAN_STAG_TX))\n \t\treturn -EOPNOTSUPP;\n \treturn stmmac_test_vlanoff_common(priv, true);\n }\n@@ -1699,6 +1789,9 @@ static int __stmmac_test_jumbo(struct stmmac_priv *priv, u16 queue)\n \tstruct stmmac_packet_attrs attr = { };\n \tint size = priv-\u003edma_conf.dma_buf_sz;\n \n+\tif (!dwmac_is_xmac(priv-\u003eplat-\u003ecore_type))\n+\t\tsize -= NET_IP_ALIGN;\n+\n \tattr.dst = priv-\u003edev-\u003edev_addr;\n \tattr.max_size = size - ETH_FCS_LEN;\n \tattr.queue_mapping = queue;\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the stmmac (Synopsys DesignWare / STMicroelectronics Ethernet) driver, specifically adjusting buffer size calculations for jumbo frames and updating internal ethtool selftest logic. This driver drives physical Ethernet MAC hardware (SoCs and specific PCIe adapters) that is not emulated in standard QEMU or GCE amd64 virtualized environments. Because the underlying hardware is absent, the driver cannot probe and the modified code paths are structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit d0750d1d901a63fa02aaf0769f4d95cb96e65986
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 20 00:37:30 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 2994df41ec2c4..c6a8f8d735015 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -474,11 +474,11 @@ static void dwmac4_set_sarc(struct dma_desc *p, u32 sarc_type)
 					  sarc_type));
 }
 
-static int set_16kib_bfsize(int mtu)
+static int set_16kib_bfsize(int len)
 {
 	int ret = 0;
 
-	if (unlikely(mtu >= BUF_SIZE_8KiB))
+	if (unlikely(len > BUF_SIZE_8KiB))
 		ret = BUF_SIZE_16KiB;
 	return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index 04dafec021b4f..de7aa6d28148e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -540,7 +540,7 @@ struct stmmac_mode_ops {
 	bool (*is_jumbo_frm)(unsigned int len, bool enh_desc);
 	int (*jumbo_frm)(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
 			 int csum);
-	int (*set_16kib_bfsize)(int mtu);
+	int (*set_16kib_bfsize)(int len);
 	void (*init_desc3)(struct dma_desc *p);
 	void (*refill_desc3)(struct stmmac_rx_queue *rx_q, struct dma_desc *p);
 	void (*clean_desc3)(struct stmmac_tx_queue *tx_q, struct dma_desc *p);
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index f7949419eb9fd..d2f0c321661d9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -124,10 +124,10 @@ static void clean_desc3(struct stmmac_tx_queue *tx_q, struct dma_desc *p)
 		p->des3 = 0;
 }
 
-static int set_16kib_bfsize(int mtu)
+static int set_16kib_bfsize(int len)
 {
 	int ret = 0;
-	if (unlikely(mtu > BUF_SIZE_8KiB))
+	if (unlikely(len > BUF_SIZE_8KiB))
 		ret = BUF_SIZE_16KiB;
 	return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 1fb5f804ea234..d5a984ad864f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1536,17 +1536,17 @@ static unsigned int stmmac_rx_offset(struct stmmac_priv *priv)
 	return NET_SKB_PAD + NET_IP_ALIGN;
 }
 
-static int stmmac_set_bfsize(int mtu)
+static int stmmac_set_bfsize(int len)
 {
 	int ret;
 
-	if (mtu >= BUF_SIZE_8KiB)
+	if (len > BUF_SIZE_8KiB)
 		ret = BUF_SIZE_16KiB;
-	else if (mtu >= BUF_SIZE_4KiB)
+	else if (len > BUF_SIZE_4KiB)
 		ret = BUF_SIZE_8KiB;
-	else if (mtu >= BUF_SIZE_2KiB)
+	else if (len > BUF_SIZE_2KiB)
 		ret = BUF_SIZE_4KiB;
-	else if (mtu > DEFAULT_BUFSIZE)
+	else if (len > DEFAULT_BUFSIZE)
 		ret = BUF_SIZE_2KiB;
 	else
 		ret = DEFAULT_BUFSIZE;
@@ -4063,7 +4063,7 @@ static struct stmmac_dma_conf *
 stmmac_setup_dma_desc(struct stmmac_priv *priv, unsigned int mtu)
 {
 	struct stmmac_dma_conf *dma_conf;
-	int bfsize, ret;
+	int bfsize, len, ret;
 	u8 chan;
 
 	dma_conf = kzalloc_obj(*dma_conf);
@@ -4073,13 +4073,15 @@ stmmac_setup_dma_desc(struct stmmac_priv *priv, unsigned int mtu)
 		return ERR_PTR(-ENOMEM);
 	}
 
-	/* Returns 0 or BUF_SIZE_16KiB if mtu > 8KiB and dwmac4 or ring mode */
-	bfsize = stmmac_set_16kib_bfsize(priv, mtu);
+	len = mtu + ETH_HLEN + 2 * VLAN_HLEN + ETH_FCS_LEN;
+
+	/* Returns 0 or BUF_SIZE_16KiB if len > 8KiB and dwmac4 or ring mode */
+	bfsize = stmmac_set_16kib_bfsize(priv, len);
 	if (bfsize < 0)
 		bfsize = 0;
 
 	if (bfsize < BUF_SIZE_16KiB)
-		bfsize = stmmac_set_bfsize(mtu);
+		bfsize = stmmac_set_bfsize(len);
 
 	dma_conf->dma_buf_sz = bfsize;
 	/* Chose the tx/rx size from the already defined one in the
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
index 6372ec7c3f317..c25dc9f89270c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
@@ -12,6 +12,7 @@
 #include <linux/ethtool.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
+#include <net/dsa.h>
 #include <net/pkt_cls.h>
 #include <net/pkt_sched.h>
 #include <net/tcp.h>
@@ -29,6 +30,7 @@ struct stmmachdr {
 			      sizeof(struct stmmachdr))
 #define STMMAC_TEST_PKT_MAGIC	0xdeadcafecafedeadULL
 #define STMMAC_LB_TIMEOUT	msecs_to_jiffies(200)
+#define STMMAC_SFT_MAX_LPI	(5 * USEC_PER_SEC)
 
 struct stmmac_packet_attrs {
 	int vlan;
@@ -237,6 +239,10 @@ struct stmmac_test_priv {
 	struct stmmac_packet_attrs *packet;
 	struct packet_type pt;
 	struct completion comp;
+	__be16 packet_type;
+	int (*func)(struct sk_buff *skb, struct net_device *ndev,
+		    struct packet_type *pt, struct net_device *orig_ndev);
+	bool capture_all;
 	int double_vlan;
 	int vlan_id;
 	int ok;
@@ -316,6 +322,52 @@ static int stmmac_test_loopback_validate(struct sk_buff *skb,
 	return 0;
 }
 
+static int stmmac_sft_filter(struct sk_buff *skb, struct net_device *ndev,
+			     struct packet_type *pt,
+			     struct net_device *orig_ndev)
+{
+	struct stmmac_test_priv *tpriv = pt->af_packet_priv;
+	struct ethhdr *hdr = eth_hdr(skb);
+	int ret = 0;
+
+	if (hdr->h_proto == tpriv->packet_type) {
+		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+		if (nskb)
+			ret = tpriv->func(nskb, ndev, pt, orig_ndev);
+	}
+
+	kfree_skb(skb);
+	return ret;
+}
+
+static void stmmac_sft_add_pack(struct packet_type *pt)
+{
+	struct stmmac_test_priv *tpriv = pt->af_packet_priv;
+
+	if (netdev_uses_dsa(tpriv->pt.dev) || tpriv->capture_all) {
+		tpriv->packet_type = tpriv->pt.type;
+		tpriv->func = tpriv->pt.func;
+
+		/* DSA conduit will report ETH_P_XDSA, so our packet handler
+		 * won't match. Let's register a ETH_P_ALL match and filter
+		 * manually in stmmac_sft_filter. This is also useful for
+		 * VLAN tests, to capture packets otherwise marked as
+		 * OTHERHOST.
+		 */
+		tpriv->pt.type = htons(ETH_P_ALL);
+		tpriv->pt.func = stmmac_sft_filter;
+		tpriv->pt.ignore_outgoing = true;
+	}
+
+	dev_add_pack(pt);
+}
+
+static void stmmac_sft_remove_pack(struct packet_type *pt)
+{
+	dev_remove_pack(pt);
+}
+
 static int __stmmac_test_loopback(struct stmmac_priv *priv,
 				  struct stmmac_packet_attrs *attr)
 {
@@ -337,7 +389,7 @@ static int __stmmac_test_loopback(struct stmmac_priv *priv,
 	tpriv->packet = attr;
 
 	if (!attr->dont_wait)
-		dev_add_pack(&tpriv->pt);
+		stmmac_sft_add_pack(&tpriv->pt);
 
 	skb = stmmac_test_get_udp_skb(priv, attr);
 	if (!skb) {
@@ -360,7 +412,7 @@ static int __stmmac_test_loopback(struct stmmac_priv *priv,
 
 cleanup:
 	if (!attr->dont_wait)
-		dev_remove_pack(&tpriv->pt);
+		stmmac_sft_remove_pack(&tpriv->pt);
 	kfree(tpriv);
 	return ret;
 }
@@ -414,12 +466,16 @@ static int stmmac_test_mmc(struct stmmac_priv *priv)
 static int stmmac_test_eee(struct stmmac_priv *priv)
 {
 	struct stmmac_extra_stats *initial, *final;
-	int retries = 10;
+	unsigned long timeout, max_duration;
 	int ret;
 
 	if (!priv->dma_cap.eee || !priv->eee_active)
 		return -EOPNOTSUPP;
 
+	/* Bail out if the configured LPI timer is too long */
+	if (priv->tx_lpi_timer > STMMAC_SFT_MAX_LPI)
+		return -EOPNOTSUPP;
+
 	initial = kzalloc_obj(*initial);
 	if (!initial)
 		return -ENOMEM;
@@ -430,14 +486,21 @@ static int stmmac_test_eee(struct stmmac_priv *priv)
 		goto out_free_initial;
 	}
 
+	/* Snapshot stats, we want to count the in_lpi events. We may enter
+	 * LPI just after the packet was sent.
+	 */
 	memcpy(initial, &priv->xstats, sizeof(*initial));
 
+	/* Send a frame, then wait to enter LPI */
 	ret = stmmac_test_mac_loopback(priv);
 	if (ret)
 		goto out_free_final;
 
+	max_duration = usecs_to_jiffies(2 * priv->tx_lpi_timer);
+
 	/* We have no traffic in the line so, sooner or later it will go LPI */
-	while (--retries) {
+	timeout = jiffies + max_duration;
+	while (!time_after(jiffies, timeout)) {
 		memcpy(final, &priv->xstats, sizeof(*final));
 
 		if (final->irq_tx_path_in_lpi_mode_n >
@@ -446,20 +509,38 @@ static int stmmac_test_eee(struct stmmac_priv *priv)
 		msleep(100);
 	}
 
-	if (!retries) {
+	memcpy(final, &priv->xstats, sizeof(*final));
+	if (final->irq_tx_path_in_lpi_mode_n <=
+	    initial->irq_tx_path_in_lpi_mode_n) {
 		ret = -ETIMEDOUT;
 		goto out_free_final;
 	}
 
-	if (final->irq_tx_path_in_lpi_mode_n <=
-	    initial->irq_tx_path_in_lpi_mode_n) {
-		ret = -EINVAL;
+	/* Re-snapshot, as we want to measure exit_lpi events. We should be
+	 * in LPI right now.
+	 */
+	memcpy(initial, &priv->xstats, sizeof(*initial));
+
+	/* TX something so we go out of LPI */
+	ret = stmmac_test_mac_loopback(priv);
+	if (ret)
 		goto out_free_final;
+
+	/* Wait for the exit LPI interrupt */
+	timeout = jiffies + max_duration;
+	while (!time_after(jiffies, timeout)) {
+		memcpy(final, &priv->xstats, sizeof(*final));
+
+		if (final->irq_tx_path_exit_lpi_mode_n >
+		    initial->irq_tx_path_exit_lpi_mode_n)
+			break;
+		msleep(100);
 	}
 
+	memcpy(final, &priv->xstats, sizeof(*final));
 	if (final->irq_tx_path_exit_lpi_mode_n <=
 	    initial->irq_tx_path_exit_lpi_mode_n) {
-		ret = -EINVAL;
+		ret = -ETIMEDOUT;
 		goto out_free_final;
 	}
 
@@ -767,7 +848,7 @@ static int stmmac_test_flowctrl(struct stmmac_priv *priv)
 	tpriv->pt.func = stmmac_test_flowctrl_validate;
 	tpriv->pt.dev = priv->dev;
 	tpriv->pt.af_packet_priv = tpriv;
-	dev_add_pack(&tpriv->pt);
+	stmmac_sft_add_pack(&tpriv->pt);
 
 	/* Compute minimum number of packets to make FIFO full */
 	pkt_count = rx_fifo_size;
@@ -823,7 +904,7 @@ static int stmmac_test_flowctrl(struct stmmac_priv *priv)
 cleanup:
 	dev_mc_del(priv->dev, paddr);
 	dev_set_promiscuity(priv->dev, -1);
-	dev_remove_pack(&tpriv->pt);
+	stmmac_sft_remove_pack(&tpriv->pt);
 	kfree(tpriv);
 	return ret;
 }
@@ -865,6 +946,11 @@ static int stmmac_test_vlan_validate(struct sk_buff *skb,
 		goto out;
 	if (skb_headlen(skb) < (STMMAC_TEST_PKT_SIZE - ETH_HLEN))
 		goto out;
+
+	ehdr = (struct ethhdr *)skb_mac_header(skb);
+	if (!ether_addr_equal_unaligned(ehdr->h_dest, tpriv->packet->dst))
+		goto out;
+
 	if (tpriv->vlan_id) {
 		if (skb->vlan_proto != htons(proto))
 			goto out;
@@ -876,10 +962,6 @@ static int stmmac_test_vlan_validate(struct sk_buff *skb,
 		}
 	}
 
-	ehdr = (struct ethhdr *)skb_mac_header(skb);
-	if (!ether_addr_equal_unaligned(ehdr->h_dest, tpriv->packet->dst))
-		goto out;
-
 	ihdr = ip_hdr(skb);
 	if (tpriv->double_vlan)
 		ihdr = (struct iphdr *)(skb_network_header(skb) + 4);
@@ -921,6 +1003,7 @@ static int __stmmac_test_vlanfilt(struct stmmac_priv *priv)
 	tpriv->pt.dev = priv->dev;
 	tpriv->pt.af_packet_priv = tpriv;
 	tpriv->packet = &attr;
+	tpriv->capture_all = true;
 
 	/*
 	 * As we use HASH filtering, false positives may appear. This is a
@@ -928,18 +1011,20 @@ static int __stmmac_test_vlanfilt(struct stmmac_priv *priv)
 	 * HASH values.
 	 */
 	tpriv->vlan_id = 0x123;
-	dev_add_pack(&tpriv->pt);
 
 	ret = vlan_vid_add(priv->dev, htons(ETH_P_8021Q), tpriv->vlan_id);
 	if (ret)
 		goto cleanup;
 
+	attr.vlan = 1;
+	attr.dst = priv->dev->dev_addr;
+	attr.sport = 9;
+	attr.dport = 9;
+
+	stmmac_sft_add_pack(&tpriv->pt);
+
 	for (i = 0; i < 4; i++) {
-		attr.vlan = 1;
 		attr.vlan_id_out = tpriv->vlan_id + i;
-		attr.dst = priv->dev->dev_addr;
-		attr.sport = 9;
-		attr.dport = 9;
 
 		skb = stmmac_test_get_udp_skb(priv, &attr);
 		if (!skb) {
@@ -966,9 +1051,9 @@ static int __stmmac_test_vlanfilt(struct stmmac_priv *priv)
 	}
 
 vlan_del:
+	stmmac_sft_remove_pack(&tpriv->pt);
 	vlan_vid_del(priv->dev, htons(ETH_P_8021Q), tpriv->vlan_id);
 cleanup:
-	dev_remove_pack(&tpriv->pt);
 	kfree(tpriv);
 	return ret;
 }
@@ -1015,6 +1100,7 @@ static int __stmmac_test_dvlanfilt(struct stmmac_priv *priv)
 	tpriv->pt.dev = priv->dev;
 	tpriv->pt.af_packet_priv = tpriv;
 	tpriv->packet = &attr;
+	tpriv->capture_all = true;
 
 	/*
 	 * As we use HASH filtering, false positives may appear. This is a
@@ -1022,18 +1108,20 @@ static int __stmmac_test_dvlanfilt(struct stmmac_priv *priv)
 	 * HASH values.
 	 */
 	tpriv->vlan_id = 0x123;
-	dev_add_pack(&tpriv->pt);
 
 	ret = vlan_vid_add(priv->dev, htons(ETH_P_8021AD), tpriv->vlan_id);
 	if (ret)
 		goto cleanup;
 
+	attr.vlan = 2;
+	attr.dst = priv->dev->dev_addr;
+	attr.sport = 9;
+	attr.dport = 9;
+
+	stmmac_sft_add_pack(&tpriv->pt);
+
 	for (i = 0; i < 4; i++) {
-		attr.vlan = 2;
 		attr.vlan_id_out = tpriv->vlan_id + i;
-		attr.dst = priv->dev->dev_addr;
-		attr.sport = 9;
-		attr.dport = 9;
 
 		skb = stmmac_test_get_udp_skb(priv, &attr);
 		if (!skb) {
@@ -1060,9 +1148,9 @@ static int __stmmac_test_dvlanfilt(struct stmmac_priv *priv)
 	}
 
 vlan_del:
+	stmmac_sft_remove_pack(&tpriv->pt);
 	vlan_vid_del(priv->dev, htons(ETH_P_8021AD), tpriv->vlan_id);
 cleanup:
-	dev_remove_pack(&tpriv->pt);
 	kfree(tpriv);
 	return ret;
 }
@@ -1293,7 +1381,7 @@ static int stmmac_test_vlanoff_common(struct stmmac_priv *priv, bool svlan)
 	tpriv->pt.af_packet_priv = tpriv;
 	tpriv->packet = &attr;
 	tpriv->vlan_id = 0x123;
-	dev_add_pack(&tpriv->pt);
+	tpriv->capture_all = true;
 
 	ret = vlan_vid_add(priv->dev, htons(proto), tpriv->vlan_id);
 	if (ret)
@@ -1301,6 +1389,8 @@ static int stmmac_test_vlanoff_common(struct stmmac_priv *priv, bool svlan)
 
 	attr.dst = priv->dev->dev_addr;
 
+	stmmac_sft_add_pack(&tpriv->pt);
+
 	skb = stmmac_test_get_udp_skb(priv, &attr);
 	if (!skb) {
 		ret = -ENOMEM;
@@ -1318,9 +1408,9 @@ static int stmmac_test_vlanoff_common(struct stmmac_priv *priv, bool svlan)
 	ret = tpriv->ok ? 0 : -ETIMEDOUT;
 
 vlan_del:
+	stmmac_sft_remove_pack(&tpriv->pt);
 	vlan_vid_del(priv->dev, htons(proto), tpriv->vlan_id);
 cleanup:
-	dev_remove_pack(&tpriv->pt);
 	kfree(tpriv);
 	return ret;
 }
@@ -1332,7 +1422,7 @@ static int stmmac_test_vlanoff(struct stmmac_priv *priv)
 
 static int stmmac_test_svlanoff(struct stmmac_priv *priv)
 {
-	if (!priv->dma_cap.dvlan)
+	if (!(priv->dev->features & NETIF_F_HW_VLAN_STAG_TX))
 		return -EOPNOTSUPP;
 	return stmmac_test_vlanoff_common(priv, true);
 }
@@ -1699,6 +1789,9 @@ static int __stmmac_test_jumbo(struct stmmac_priv *priv, u16 queue)
 	struct stmmac_packet_attrs attr = { };
 	int size = priv->dma_conf.dma_buf_sz;
 
+	if (!dwmac_is_xmac(priv->plat->core_type))
+		size -= NET_IP_ALIGN;
+
 	attr.dst = priv->dev->dev_addr;
 	attr.max_size = size - ETH_FCS_LEN;
 	attr.queue_mapping = queue;

gemini-3.8-flash

null

null

							input: 9326
							output: 41
							thoughts: 288
						

**Analyzing the Patch for Syzkaller Fuzzing Potential**

Okay, let's break this down. My initial assessment is: should we even bother fuzzing this patch with syzkaller? It's a quick triage step.

First, let's see where the changes are located. Ah, I see:

*   `drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c`
*   `drivers/net/ethernet/stmicro/stmmac/hwif.h`
*   `drivers/net/ethernet/stmicro/stmmac/ring_mode.c`
*   `drivers/net/ethernet/stmicro/stmmac/stmmac_main.c`
*   `drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c`

Right, all within the `stmmac` directory. So, it's the STMicroelectronics Ethernet driver, 10/100/1000/EQOS/DWMAC. A vital part of many embedded systems, that may be used in several platforms. The question is, can we realistically reach this in a standard virtualized environment, like GCE or QEMU? That's the crucial point. We need to be able to execute the code.

Hang on... Before jumping to conclusions, let's figure out *how* `stmmac` is loaded and instantiated. Does it use PCI drivers, platform drivers, or are there QEMU emulated devices? I'm going to search the kernel source tree for PCI IDs associated with `stmmac`, or any QEMU emulation mentions. That'll tell us if we can easily spin up an environment for fuzzing.

{
  "Expression": "pci_driver.*stmmac",
  "PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}

{
  "Output": "drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c=210=MODULE_DEVICE_TABLE(pci, stmmac_id_table);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-211-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:212:static struct pci_driver stmmac_pci_driver = {\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-213-\t.name = STMMAC_RESOURCE_NAME,\n--\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-221-\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c:222:module_pci_driver(stmmac_pci_driver);\ndrivers/net/ethernet/stmicro/stmmac/stmmac_pci.c-223-\n"
}

gemini-3.8-flash

null

null

							input: 10314
							output: 50
							thoughts: 55
						

**Diving into the STMMAC PCI Driver**

Okay, so I'm trying to get a handle on the `stmmac` ecosystem, specifically the PCI-specific implementation. My immediate thought is to figure out which devices this `stmmac_pci.c` module in the `drivers/net/ethernet/stmicro/stmmac/` directory actually supports. Knowing the exact devices it's designed to interface with is key to understanding its scope and function. With that question in mind, I need to get into the source code itself to start to piece together the picture and that means a quick dive into `stmmac_pci.c` is in order. Let's see what gems are hidden in there.

{
  "File": "drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c",
  "FirstLine": 140,
  "LineCount": 80
}

{
  "Contents": " 140:\t\tif (!plat-\u003esafety_feat_cfg)\n 141:\t\t\treturn -ENOMEM;\n 142:\t\n 143:\t\t/* Enable pci device */\n 144:\t\tret = pcim_enable_device(pdev);\n 145:\t\tif (ret) {\n 146:\t\t\tdev_err(\u0026pdev-\u003edev, \"%s: ERROR: failed to enable device\\n\",\n 147:\t\t\t\t__func__);\n 148:\t\t\treturn ret;\n 149:\t\t}\n 150:\t\n 151:\t\t/* Get the base address of device */\n 152:\t\tfor (i = 0; i \u003c PCI_STD_NUM_BARS; i++) {\n 153:\t\t\tif (pci_resource_len(pdev, i) == 0)\n 154:\t\t\t\tcontinue;\n 155:\t\t\tres.addr = pcim_iomap_region(pdev, i, STMMAC_RESOURCE_NAME);\n 156:\t\t\tif (IS_ERR(res.addr))\n 157:\t\t\t\treturn PTR_ERR(res.addr);\n 158:\t\t\tbreak;\n 159:\t\t}\n 160:\t\n 161:\t\tpci_set_master(pdev);\n 162:\t\n 163:\t\tret = info-\u003esetup(pdev, plat);\n 164:\t\tif (ret)\n 165:\t\t\treturn ret;\n 166:\t\n 167:\t\tres.wol_irq = pdev-\u003eirq;\n 168:\t\tres.irq = pdev-\u003eirq;\n 169:\t\n 170:\t\tplat-\u003esafety_feat_cfg-\u003etsoee = 1;\n 171:\t\tplat-\u003esafety_feat_cfg-\u003emrxpee = 1;\n 172:\t\tplat-\u003esafety_feat_cfg-\u003emestee = 1;\n 173:\t\tplat-\u003esafety_feat_cfg-\u003emrxee = 1;\n 174:\t\tplat-\u003esafety_feat_cfg-\u003emtxee = 1;\n 175:\t\tplat-\u003esafety_feat_cfg-\u003eepsi = 1;\n 176:\t\tplat-\u003esafety_feat_cfg-\u003eedpp = 1;\n 177:\t\tplat-\u003esafety_feat_cfg-\u003eprtyen = 1;\n 178:\t\tplat-\u003esafety_feat_cfg-\u003etmouten = 1;\n 179:\t\n 180:\t\tplat-\u003esuspend = stmmac_pci_plat_suspend;\n 181:\t\tplat-\u003eresume = stmmac_pci_plat_resume;\n 182:\t\n 183:\t\treturn stmmac_dvr_probe(\u0026pdev-\u003edev, plat, \u0026res);\n 184:\t}\n 185:\t\n 186:\t/**\n 187:\t * stmmac_pci_remove\n 188:\t *\n 189:\t * @pdev: platform device pointer\n 190:\t * Description: this function calls the main to free the net resources.\n 191:\t */\n 192:\tstatic void stmmac_pci_remove(struct pci_dev *pdev)\n 193:\t{\n 194:\t\tstmmac_dvr_remove(\u0026pdev-\u003edev);\n 195:\t}\n 196:\t\n 197:\t/* synthetic ID, no official vendor */\n 198:\t#define PCI_VENDOR_ID_STMMAC\t\t0x0700\n 199:\t\n 200:\t#define PCI_DEVICE_ID_STMMAC_STMMAC\t\t0x1108\n 201:\t#define PCI_DEVICE_ID_SYNOPSYS_GMAC5_ID\t\t0x7102\n 202:\t\n 203:\tstatic const struct pci_device_id stmmac_id_table[] = {\n 204:\t\t{ PCI_DEVICE_DATA(STMMAC, STMMAC, \u0026stmmac_pci_info) },\n 205:\t\t{ PCI_DEVICE_DATA(STMICRO, MAC, \u0026stmmac_pci_info) },\n 206:\t\t{ PCI_DEVICE_DATA(SYNOPSYS, GMAC5_ID, \u0026snps_gmac5_pci_info) },\n 207:\t\t{}\n 208:\t};\n 209:\t\n 210:\tMODULE_DEVICE_TABLE(pci, stmmac_id_table);\n 211:\t\n 212:\tstatic struct pci_driver stmmac_pci_driver = {\n 213:\t\t.name = STMMAC_RESOURCE_NAME,\n 214:\t\t.id_table = stmmac_id_table,\n 215:\t\t.probe = stmmac_pci_probe,\n 216:\t\t.remove = stmmac_pci_remove,\n 217:\t\t.driver         = {\n 218:\t\t\t.pm     = \u0026stmmac_simple_pm_ops,\n 219:\t\t},\n"
}

gemini-3.8-flash

null

null

							input: 11897
							output: 39
							thoughts: 233
						

**My QEMU/STMMAC Investigation**

Okay, so I'm thinking, does QEMU even *try* to emulate stmmac? Or, for that matter, any DWMAC? I need to check if QEMU or Google Compute Engine handles either Synopsys DesignWare Ethernet MAC or STMMAC. Hmmm, I know QEMU supports various ARM boards, like Allwinner A10, and maybe something like stm32, xilinx, imx, or Starfive. But this project is targeting amd64! Can I even *probe* or instantiate stmmac on amd64 within QEMU or GCE? This feels like it might be a dead end.

Wait a second, is there *any* virtual bus, like a USB gadget, loopback, netlink, binder, sockets, anything, that could be a bridge here? No, no, that's not right. stmmac is a driver intended for actual hardware: SoCs, PCI add-in cards, the whole nine yards – think Synopsys GMAC/DWMAC IP cores, or Intel Quark, Elkhart Lake, that kind of thing.

Aha! That's it! *Those* Intel platforms, Quark, Elkhart Lake, Keem Bay, whatever… don't they usually have dwmac or stmmac? I should look into `dwmac-intel.c`. That's where I need to focus my efforts.

{
  "Expression": "pci_driver.*intel",
  "PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}

{
  "Output": "drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c=1415=MODULE_DEVICE_TABLE(pci, intel_eth_pci_id_table);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1416-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c:1417:static struct pci_driver intel_eth_pci_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1418-\t.name = \"intel-eth-pci\",\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1426-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c:1427:module_pci_driver(intel_eth_pci_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel.c-1428-\n"
}

gemini-3.8-flash

null

null

							input: 12751
							output: 36
							thoughts: 620
						

**My Fuzzing Triage: Unreachable Code Investigation**

Okay, let's break this down. My goal is to determine if this code modification is even *worth* fuzzing. The guidelines are clear: reachability is the primary gate. Can the code actually *execute* in a standard virtualized environment like QEMU or GCE? If it's structurally unreachable, it's a no-go, plain and simple.

First, I need to understand if the code I'm looking at falls into any of the *negative* criteria. Specifically, are we dealing with "structurally unreachable hardware" or "unreachable execution paths"? Looking at the examples, I see things like vendor-specific PCIe switches, GPU drivers requiring physical hardware, or driver teardown callbacks that only trigger during hot-unplug operations. That's a good starting point for filtering.

The key question now is, does QEMU, our standard virtualized environment, provide an emulation of the STMMAC (or DWMAC) ethernet driver on x86_64 or amd64? I have to know. From my knowledge of QEMU, I know the usual suspects for emulated network devices – e1000, rtl8139, virtio-net, etc. – but I don't immediately recall seeing `dwmac` or `stmmac` on x86/amd64. I should verify that.

I remember these drivers often relate to ARM SoCs (like Allwinner, i.MX, or Cadence). Even if QEMU *did* emulate `dwmac` for *some* platform, the target architecture is amd64. That is key to confirm, as I know that on amd64, `stmmac` typically deals with vendor NICs, or Intel's Elkhart Lake/Tiger Lake/Quark PCI devices. I strongly suspect there's no native emulation for it in standard QEMU x86_64, but I need to confirm this.

Even if there's no direct device emulation, is there *any* way to instantiate this thing? Could it be via a platform device or anything exposed to userspace? I'll need to check the kernel source, specifically the `drivers/net/ethernet/stmicro/stmmac/` directory, to see if there's any evidence of virtual instantiation or other methods. If I find something there, then I need to consider if it opens the code up for testing. But, for now, my gut says "likely not fuzzable".

{
  "Expression": "platform_driver",
  "PathPrefix": "drivers/net/ethernet/stmicro/stmmac"
}

{
  "Output": "drivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c=123=MODULE_DEVICE_TABLE(of, anarion_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-124-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c:125:static struct platform_driver anarion_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-126-\t.probe  = anarion_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-132-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c:133:module_platform_driver(anarion_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-anarion.c-134-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c=359=MODULE_DEVICE_TABLE(of, dwc_eth_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-360-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c:361:static struct platform_driver dwc_eth_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-362-\t.probe  = dwc_eth_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-369-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c:370:module_platform_driver(dwc_eth_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c-371-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c=360=MODULE_DEVICE_TABLE(of, eic7700_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-361-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c:362:static struct platform_driver eic7700_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-363-\t.probe  = eic7700_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-369-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c:370:module_platform_driver(eic7700_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-eic7700.c-371-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c=67=MODULE_DEVICE_TABLE(of, dwmac_generic_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-68-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c:69:static struct platform_driver dwmac_generic_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-70-\t.probe  = dwmac_generic_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-76-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c:77:module_platform_driver(dwmac_generic_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-generic.c-78-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c=390=MODULE_DEVICE_TABLE(of, imx_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-391-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c:392:static struct platform_driver imx_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-393-\t.probe  = imx_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-400-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c:401:module_platform_driver(imx_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-imx.c-402-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c=270=MODULE_DEVICE_TABLE(of, ingenic_mac_of_matches);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-271-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c:272:static struct platform_driver ingenic_mac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-273-\t.probe\t\t= ingenic_mac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-279-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c:280:module_platform_driver(ingenic_mac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ingenic.c-281-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c=130=static void intel_eth_plat_remove(struct platform_device *pdev)\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-138-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c:139:static struct platform_driver intel_eth_plat_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-140-\t.probe  = intel_eth_plat_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-147-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c:148:module_platform_driver(intel_eth_plat_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c-149-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c=495=MODULE_DEVICE_TABLE(of, ipq806x_gmac_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-496-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c:497:static struct platform_driver ipq806x_gmac_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-498-\t.probe = ipq806x_gmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-505-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c:506:module_platform_driver(ipq806x_gmac_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c-507-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c=227=MODULE_DEVICE_TABLE(of, ls1x_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-228-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c:229:static struct platform_driver ls1x_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-230-\t.probe = ls1x_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-235-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c:236:module_platform_driver(ls1x_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-loongson1.c-237-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c=75=MODULE_DEVICE_TABLE(of, lpc18xx_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-76-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c:77:static struct platform_driver lpc18xx_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-78-\t.probe  = lpc18xx_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-85-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c:86:module_platform_driver(lpc18xx_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c-87-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c=670=MODULE_DEVICE_TABLE(of, mediatek_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-671-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c:672:static struct platform_driver mediatek_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-673-\t.probe  = mediatek_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-680-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c:681:module_platform_driver(mediatek_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-mediatek.c-682-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c=80=MODULE_DEVICE_TABLE(of, meson6_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-81-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c:82:static struct platform_driver meson6_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-83-\t.probe  = meson6_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-90-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c:91:module_platform_driver(meson6_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson.c-92-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c=505=MODULE_DEVICE_TABLE(of, meson8b_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-506-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c:507:static struct platform_driver meson8b_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-508-\t.probe  = meson8b_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-515-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c:516:module_platform_driver(meson8b_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c-517-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c=122=MODULE_DEVICE_TABLE(of, nvt_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-123-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c:124:static struct platform_driver nvt_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-125-\t.probe  = nvt_gmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-132-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c:133:module_platform_driver(nvt_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-nuvoton.c-134-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c=807=MODULE_DEVICE_TABLE(of, qcom_ethqos_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-808-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c:809:static struct platform_driver qcom_ethqos_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-810-\t.probe  = qcom_ethqos_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-816-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c:817:module_platform_driver(qcom_ethqos_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c-818-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c=222=MODULE_DEVICE_TABLE(of, renesas_gbeth_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-223-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c:224:static struct platform_driver renesas_gbeth_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-225-\t.probe  = renesas_gbeth_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-231-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c:232:module_platform_driver(renesas_gbeth_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.c-233-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c=1635=MODULE_DEVICE_TABLE(of, rk_gmac_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1636-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c:1637:static struct platform_driver rk_gmac_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1638-\t.probe  = rk_gmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1644-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c:1645:module_platform_driver(rk_gmac_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rk.c-1646-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c=79=MODULE_DEVICE_TABLE(of, rzn1_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-80-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c:81:static struct platform_driver rzn1_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-82-\t.probe  = rzn1_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-88-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c:89:module_platform_driver(rzn1_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-rzn1.c-90-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c=220=MODULE_DEVICE_TABLE(of, s32_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-221-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c:222:static struct platform_driver s32_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-223-\t.probe = s32_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-230-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c:231:module_platform_driver(s32_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-s32.c-232-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c=679=MODULE_DEVICE_TABLE(of, socfpga_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-680-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c:681:static struct platform_driver socfpga_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-682-\t.probe  = socfpga_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-688-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c:689:module_platform_driver(socfpga_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c-690-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c=77=MODULE_DEVICE_TABLE(of, sophgo_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-78-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c:79:static struct platform_driver sophgo_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-80-\t.probe  = sophgo_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-87-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c:88:module_platform_driver(sophgo_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c-89-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c=214=MODULE_DEVICE_TABLE(of, spacemit_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-215-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c:216:static struct platform_driver spacemit_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-217-\t.probe  = spacemit_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-224-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c:225:module_platform_driver(spacemit_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-spacemit.c-226-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c=165=MODULE_DEVICE_TABLE(of, starfive_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-166-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c:167:static struct platform_driver starfive_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-168-\t.probe  = starfive_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-175-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c:176:module_platform_driver(starfive_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c-177-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c=300=MODULE_DEVICE_TABLE(of, sti_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-301-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c:302:static struct platform_driver sti_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-303-\t.probe  = sti_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-309-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c:310:module_platform_driver(sti_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sti.c-311-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c=669=MODULE_DEVICE_TABLE(of, stm32_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-670-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c:671:static struct platform_driver stm32_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-672-\t.probe  = stm32_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-679-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c:680:module_platform_driver(stm32_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c-681-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c=145=MODULE_DEVICE_TABLE(of, sun55i_gmac200_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-146-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c:147:static struct platform_driver sun55i_gmac200_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-148-\t.probe  = sun55i_gmac200_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-154-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c:155:module_platform_driver(sun55i_gmac200_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.c-156-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c=1283=MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1284-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:1285:static struct platform_driver sun8i_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1286-\t.probe  = sun8i_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1294-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:1295:module_platform_driver(sun8i_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c-1296-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c=154=MODULE_DEVICE_TABLE(of, sun7i_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-155-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c:156:static struct platform_driver sun7i_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-157-\t.probe  = sun7i_gmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-163-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c:164:module_platform_driver(sun7i_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c-165-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c=403=static SIMPLE_DEV_PM_OPS(tegra_mgbe_pm_ops, tegra_mgbe_suspend, tegra_mgbe_resume);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-404-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c:405:static struct platform_driver tegra_mgbe_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-406-\t.probe = tegra_mgbe_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-413-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c:414:module_platform_driver(tegra_mgbe_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c-415-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c=271=MODULE_DEVICE_TABLE(of, thead_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-272-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c:273:static struct platform_driver thead_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-274-\t.probe = thead_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-280-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c:281:module_platform_driver(thead_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-thead.c-282-\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c=259=MODULE_DEVICE_TABLE(of, visconti_eth_dwmac_match);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-260-\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c:261:static struct platform_driver visconti_eth_dwmac_driver = {\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-262-\t.probe  = visconti_eth_dwmac_probe,\n--\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-268-};\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c:269:module_platform_driver(visconti_eth_dwmac_driver);\ndrivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c-270-\n"
}

gemini-3.8-flash

null

null

							input: 22071
							output: 127
							thoughts: 1146
						

**Unreachable Hardware: Examining the stmmac Driver**

Okay, here's the breakdown of this situation. I'm looking at a patch that touches the `stmmac` driver, which is a driver for Synopsys DesignWare Ethernet MAC (DWMAC) hardware. My initial thought is, "Ah, another platform-specific driver." There are so many of these things: `anarion`, `dwc-qos`, `eic7700`, `imx`, the list goes on and on. Then there are the PCI NICs like `stmmac_pci` and `dwmac-intel`. None of these, as far as I know, are emulated by standard QEMU on amd64 or Google Compute Engine, which is the baseline for fuzzing.

Let me confirm that real quick. I check the list of network interfaces QEMU emulates – things like `e1000`, `virtio-net-pci`, etc. – and yep, none of them are `stmmac` or `dwmac`. So, in a standard QEMU environment, there's no way to probe or instantiate an `stmmac` network device.

Now, could it possibly be done through some other means, like USB? No, that's not how it works, it's PCI/platform. Software instantiation? Nope, it's a physical MAC controller.

This immediately brings up Section 2 of the triage philosophy: "Structurally unreachable hardware." Specifically, drivers that require physical ASICs or PCIe cards not emulated in standard QEMU. That's *exactly* what this is: `stmmac` requires physical hardware. It's a driver for the STMicroelectronics / Synopsys DesignWare Ethernet MAC IP cores, and it relies on that hardware.

The fact that the patch affects files like `dwmac4_descs.c`, `ring_mode.c`, and `stmmac_selftests.c` solidifies this. These are all intimately linked to the hardware-specific aspects of the `stmmac` driver. None of the modified code touches core networking components or any virtual device drivers.

Therefore, this falls squarely under "Structurally unreachable hardware." Because the driver cannot be probed or instantiated in the QEMU/GCE environment, the code paths modified by this patch are, for all practical purposes, unreachable for fuzzing.

To be extra certain, I need to do a final sanity check. Let me verify my reasoning:

1.  **Patch Function:** The patch fine-tunes buffer size calculations for jumbo frames in the `stmmac` driver, accounting for packet overhead, and updates the `stmmac` ethtool selftests.
2.  **Unreachability:** The `stmmac` driver is for Synopsys DesignWare Ethernet MAC (DWMAC) hardware, and found in specific SoCs and dedicated PCI devices (like Intel Elkhart Lake). Standard QEMU/GCE *do not* emulate this hardware. Therefore, the driver cannot be probed or instantiated, and these code paths are unreachable.
3.  **Verdict:** Given this, it makes sense that `WorthFuzzing = false`. FocusSymbols and EnableConfigs are empty.

I'm confident in my analysis. I will now `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the stmmac (Synopsys DesignWare / STMicroelectronics Ethernet) driver, specifically adjusting buffer size calculations for jumbo frames and updating internal ethtool selftest logic. This driver drives physical Ethernet MAC hardware (SoCs and specific PCIe adapters) that is not emulated in standard QEMU or GCE amd64 virtualized environments. Because the underlying hardware is absent, the driver cannot probe and the modified code paths are structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the stmmac (Synopsys DesignWare / STMicroelectronics Ethernet) driver, specifically adjusting buffer size calculations for jumbo frames and updating internal ethtool selftest logic. This driver drives physical Ethernet MAC hardware (SoCs and specific PCIe adapters) that is not emulated in standard QEMU or GCE amd64 virtualized environments. Because the underlying hardware is absent, the driver cannot probe and the modified code paths are structurally unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null