nix/STATUS, pr-tracker: F12b, F13 and F14 drafted on the fork

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: randomizedcoder

analysis-reports/pr-tracker.md

@@ -16,6 +16,21 @@ John Ousterhout lands PRs by applying our commits to `main` himself, so a landed
 | 2, fuzzing + 7.x port (2026-10-21) | 2 | 2 | 0 |
 | 3, sparse (2026-10-22) | 4 | 4 | 0 |
 
+## Round 5: VM and sanitizer findings (fork drafts, not yet sent)
+
+Drafted 2026-10-31 on the fork, to go upstream as one batch once reviewed.
+
+| Fork | Branch | Change | Found by |
+|---|---|---|---|
+| #22 | `fix/peer-free-net-rcu-barrier` | `rcu_barrier()` in `homa_peer_free_net`: `homa_route_free` use-after-free (F8) | KASAN, test-first |
+| #23 | `fix/qdisc-unknown-link-speed` | Homa qdisc on a link reporting `SPEED_UNKNOWN` (F11) | pair lifecycle, test-first |
+| #26 | `fix/rpc-memcg-without-config-memcg` | `mem_cgroup_from_sk()`, not `sk_memcg` (F12b: no build without `CONFIG_MEMCG`) | `analysis-netdev` |
+| #27 | `fix/peertab-lock-rhashtable-walk` | Walk `route_ht` outside `peertab->lock` (F13: softirq lock-order inversion) | lockdep |
+| #28 | `fix/qdisc-deferred-offset-data-race` | Annotate `homa_qdisc_deferred_offset`'s lockless reads (F14) | KCSAN |
+
+F12a (`strip.py` `#else` after `#ifndef`) was fork #25, closed as a duplicate of upstream
+[#134](https://github.com/PlatformLab/HomaModule/pull/134).
+
 ## Round 4: hand-found bugs (open)
 
 Opened 2026-10-28. Each was test-first: the new test fails on `main` and passes with the fix.

nix/STATUS.md

@@ -522,9 +522,9 @@ is `homa_route_free`, in an RCU callback, taking `peertab->lock` after the walk
 | 11 | Bootable 7.0–7.2 kernels (PLAN-pairs phase 6) | Full VM coverage of the 7.x series | large (kernel builds) | optional |
 | 14 | Does `util/` need to build off x86? (F9) If so, a portable `rdtsc()` and `REG_RIP` guard | riscv64/aarch64 `util/` builds fail | small | ask John |
 | 15 | riscv `homa_clock_khz()`: `riscv_timebase / 1000` (F9) | Timers 100× off on riscv in the normal build | small | us → upstream (if John wants riscv) |
-| 19 | F13: walk the route table outside `peertab->lock` | A possible hard hang at netns exit; lockdep fails the KASAN VM until it is fixed | small | us → upstream |
-| 18 | F12: `strip.py` `#else` toggle and `mem_cgroup_from_sk()`, test-first | The net-next files must build in-tree before any submission | small | us → upstream |
-| 20 | F14: `skb_queue_len_lockless()` and `READ_ONCE`/`WRITE_ONCE` on `tx_left` | KCSAN fails the pair lifecycle until the intended race is annotated | small | us → upstream |
+| 19 | F13: walk the route table outside `peertab->lock`, drafted (fork #27) | A possible hard hang at netns exit; lockdep fails the KASAN VM until it is fixed | small | us → upstream |
+| 18 | F12: `strip.py` `#else` toggle (upstream #134, not ours) and `mem_cgroup_from_sk()`, drafted (fork #26) | The net-next files must build in-tree before any submission | small | us → upstream |
+| 20 | F14: `skb_queue_len_lockless()` and `READ_ONCE`/`WRITE_ONCE` on `tx_left`, drafted (fork #28) | KCSAN fails the pair lifecycle until the intended race is annotated | small | us → upstream |
 | 12 | Keep `nix/fuzz/known-findings.txt` in step with upstream | Entries come out as fixes land, so the fuzz-mock gate stays meaningful; currently empty | ongoing | us |
 
 ---
@@ -543,3 +543,4 @@ is `homa_route_free`, in an RCU callback, taking `peertab->lock` after the walk
 | 2026-10-30 | Nix workflows for the drivers: `homa-tcl-test` (the suite or part of it: `-file`, `-match`, `--tcl9`) and `homa-tcl-lint`, which the `tcl-tests` check now runs; `homa-vm-compare old new` compares two matrix runs phase by phase (`parse shape`, `report diff`); `nix develop` has Tcl, Expect, tcllib, nagelfar and tclint |
 | 2026-10-30 | Nix review and refactor, same targets: the debug VM boots its KASAN/KMEMLEAK kernel (it booted the plain one before) with a homa.ko built for it, and passes; kernel trees keep their name; `homa-lint` is `analysis-quick`; dead code and unused exports removed (drvPaths checked against a baseline); pair tests build their link port from their name and share one cp_node command line; stale comments fixed |
 | 2026-10-30 | Demo evidence: `analysis-netdev` (netdev's checks on the `make net-next` files: found F12, they do not build in-tree), `homa-tests-coverage` (gcov: 86.7 % of lines), sanitizer VMs (`-debug`: KASAN, KFENCE, KMEMLEAK, lockdep, UBSAN; `-kcsan`) for the smoke test and the pair lifecycle (found F13 and F14; KASAN names F8), and `homa-evidence`, one HTML report of all of it. The netem drop check accepts a quarter of the configured loss (0.1 % measured 0.04 % over 82k packets) |
+| 2026-10-31 | Fixes drafted on the fork: #26 (F12b), #27 (F13), #28 (F14); F12a is upstream #134. Gated with temporary `nix/patches` (all of F8, F11, F12a/b, F13, F14): 884/884 unit tests; `analysis-netdev` builds in-tree (gcc, clang, i386 W=1: 0 warnings); KASAN/lockdep smoke PASS and pair lifecycle with no sanitizer report (its 7 failures are echo 5/6 on the default qdisc, see above); KCSAN pair lifecycle PASS 3 of 3. `homaLib` drops a patch with no hunks in a subset (a `util/`-only fix in the module's source) |