AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies only userspace code (bpftool under tools/bpf/bpftool and BPF selftests under tools/testing/selftests), which does not affect the compiled kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit b628b9ce4acfa2859edc2bb4cba3c5ab318d40e9\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Sep 7 06:12:21 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c\nindex 684a8fb724146..ea6f1389245fb 100644\n--- a/tools/bpf/bpftool/map.c\n+++ b/tools/bpf/bpftool/map.c\n@@ -740,15 +740,10 @@ static int do_show(int argc, char **argv)\n \treturn errno == ENOENT ? 0 : -1;\n }\n \n-static int dump_map_elem(int fd, void *key, void *value,\n-\t\t\t struct bpf_map_info *map_info, struct btf *btf,\n-\t\t\t json_writer_t *btf_wtr)\n+static void print_map_elem(void *key, void *value,\n+\t\t\t   struct bpf_map_info *map_info, struct btf *btf,\n+\t\t\t   json_writer_t *btf_wtr)\n {\n-\tif (bpf_map_lookup_elem(fd, key, value)) {\n-\t\tprint_entry_error(map_info, key, errno);\n-\t\treturn -1;\n-\t}\n-\n \tif (json_output) {\n \t\tprint_entry_json(map_info, key, value, btf);\n \t} else if (btf) {\n@@ -762,10 +757,111 @@ static int dump_map_elem(int fd, void *key, void *value,\n \t} else {\n \t\tprint_entry_plain(map_info, key, value);\n \t}\n+}\n+\n+static int dump_map_elem(int fd, void *key, void *value,\n+\t\t\t struct bpf_map_info *map_info, struct btf *btf,\n+\t\t\t json_writer_t *btf_wtr)\n+{\n+\tif (bpf_map_lookup_elem(fd, key, value)) {\n+\t\tprint_entry_error(map_info, key, errno);\n+\t\treturn -1;\n+\t}\n \n+\tprint_map_elem(key, value, map_info, btf, btf_wtr);\n \treturn 0;\n }\n \n+#define MAP_DUMP_BATCH_SIZE 256U\n+#define MAP_DUMP_BATCH_MAX_BYTES (4 * 1024 * 1024)\n+\n+/* Return 1 to use individual lookups, but only before batch traversal starts. */\n+static int dump_map_batch(int fd, void *key, void *value,\n+\t\t\t  struct bpf_map_info *info, struct btf *btf,\n+\t\t\t  json_writer_t *wtr, unsigned int *num_elems)\n+{\n+\t__u32 capacity, count, batch = 0, next_batch = 0, i;\n+\tvoid *keys = NULL, *values = NULL, *buf;\n+\tbool first = true, can_fallback = true;\n+\tint err;\n+\n+\t/*\n+\t * Hash lookup batches must accommodate a whole bucket. Restrict the\n+\t * optimization to maps whose worst-case bucket fits the memory budget,\n+\t * so a later ENOSPC never forces a restart after printing some entries.\n+\t * Division also bounds the allocation multiplications on 32-bit hosts.\n+\t */\n+\tif (info-\u003etype != BPF_MAP_TYPE_HASH || !info-\u003emax_entries ||\n+\t    (__u64)info-\u003ekey_size + info-\u003evalue_size \u003e\n+\t    MAP_DUMP_BATCH_MAX_BYTES / info-\u003emax_entries)\n+\t\treturn 1;\n+\n+\tcapacity = min(info-\u003emax_entries, MAP_DUMP_BATCH_SIZE);\n+resize:\n+\tbuf = realloc(keys, (size_t)capacity * info-\u003ekey_size);\n+\tif (!buf) {\n+\t\terr = ENOMEM;\n+\t\tgoto error;\n+\t}\n+\tkeys = buf;\n+\tbuf = realloc(values, (size_t)capacity * info-\u003evalue_size);\n+\tif (!buf) {\n+\t\terr = ENOMEM;\n+\t\tgoto error;\n+\t}\n+\tvalues = buf;\n+\n+\twhile (true) {\n+\t\tcount = capacity;\n+\t\terr = bpf_map_lookup_batch(fd, first ? NULL : \u0026batch,\n+\t\t\t\t\t   \u0026next_batch, keys, values, \u0026count, NULL);\n+\t\terr = err ? errno : 0;\n+\t\t/*\n+\t\t * Older kernels reject the command before updating count. Do not\n+\t\t * inspect the buffers on these errors, or fall back after progress.\n+\t\t */\n+\t\tif (can_fallback \u0026\u0026 (err == EINVAL || err == EOPNOTSUPP ||\n+\t\t\t\t     err == 524 /* ENOTSUPP */)) {\n+\t\t\terr = 1;\n+\t\t\tgoto out;\n+\t\t}\n+\t\tcan_fallback = false;\n+\t\tif (err == ENOSPC) {\n+\t\t\tif (capacity == info-\u003emax_entries)\n+\t\t\t\tgoto error;\n+\t\t\tcapacity += min(capacity, info-\u003emax_entries - capacity);\n+\t\t\t/* Preserve the input cursor: the oversized bucket was not read. */\n+\t\t\tgoto resize;\n+\t\t}\n+\t\t/* In particular, EFAULT can leave count and the buffers invalid. */\n+\t\tif (err \u0026\u0026 err != ENOENT)\n+\t\t\tgoto error;\n+\t\tfor (i = 0; i \u003c count; i++) {\n+\t\t\t/*\n+\t\t\t * Keep the alignment provided by individual lookups, including\n+\t\t\t * for BTF types whose map key/value size is not aligned.\n+\t\t\t */\n+\t\t\tmemcpy(key, keys + (size_t)i * info-\u003ekey_size, info-\u003ekey_size);\n+\t\t\tmemcpy(value, values + (size_t)i * info-\u003evalue_size, info-\u003evalue_size);\n+\t\t\tprint_map_elem(key, value, info, btf, wtr);\n+\t\t\t(*num_elems)++;\n+\t\t}\n+\t\tif (err == ENOENT) {\n+\t\t\terr = 0;\n+\t\t\tgoto out;\n+\t\t}\n+\t\tfirst = false;\n+\t\tbatch = next_batch;\n+\t}\n+error:\n+\tfprintf(stderr, \"Error: can't lookup map batch: %s\\n\", strerror(err));\n+\terr = -1;\n+out:\n+\tfree(keys);\n+\tfree(values);\n+\treturn err;\n+}\n+\n static int maps_have_btf(int *fds, int nb_fds)\n {\n \tstruct bpf_map_info info = {};\n@@ -869,6 +965,9 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \t\tp_info(\"Warning: cannot read values from %s map with value_size != 8\",\n \t\t       map_type_str);\n \t}\n+\terr = dump_map_batch(fd, key, value, info, btf, wtr, \u0026num_elems);\n+\tif (err != 1)\n+\t\tgoto end_dump;\n \twhile (true) {\n \t\terr = bpf_map_get_next_key(fd, prev_key, key);\n \t\tif (err) {\n@@ -881,6 +980,7 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \t\tprev_key = key;\n \t}\n \n+end_dump:\n \tif (wtr) {\n \t\tjsonw_end_array(wtr);\t/* elements */\n \t\tif (show_header)\ndiff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c\nnew file mode 100644\nindex 0000000000000..b4216ed778ef9\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c\n@@ -0,0 +1,187 @@\n+// SPDX-License-Identifier: GPL-2.0\n+#include \u003ctest_progs.h\u003e\n+#include \u003cbpftool_helpers.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+#include \u003cctype.h\u003e\n+\n+#define MAX_ENTRIES 1025\n+#define RECORD_SIZE 256\n+#define OUTPUT_SIZE (MAX_ENTRIES * RECORD_SIZE + 1024)\n+\n+struct dump_case {\n+\tconst char *name;\n+\tunsigned int count;\n+\tunsigned int key_size;\n+\tunsigned int value_size;\n+\tbool btf;\n+};\n+\n+static void hex_bytes(char *out, const void *data, unsigned int size, bool json)\n+{\n+\tconst unsigned char *bytes = data;\n+\tunsigned int i;\n+\n+\tif (json)\n+\t\t*out++ = '[';\n+\tfor (i = 0; i \u003c size; i++) {\n+\t\tif (json \u0026\u0026 i)\n+\t\t\t*out++ = ',';\n+\t\tout += sprintf(out, json ? \"\\\"0x%02x\\\"\" : \"%02x\", bytes[i]);\n+\t}\n+\tif (json)\n+\t\t*out++ = ']';\n+\t*out = '\\0';\n+}\n+\n+static void expected_record(char *record, const struct dump_case *test,\n+\t\t\t    unsigned int index, bool json)\n+{\n+\t__u32 key = index, value = index * 37 + 11;\n+\tunsigned char short_key = index;\n+\tchar key_hex[64], value_hex[64], formatted[96];\n+\n+\thex_bytes(key_hex, test-\u003ekey_size == 1 ? (void *)\u0026short_key : \u0026key,\n+\t\t  test-\u003ekey_size, json);\n+\thex_bytes(value_hex, \u0026value, test-\u003evalue_size, json);\n+\tsnprintf(formatted, sizeof(formatted), \"{\\\"key\\\":%u,\\\"value\\\":%u}\",\n+\t\t key, value);\n+\tif (json \u0026\u0026 test-\u003ebtf)\n+\t\tsnprintf(record, RECORD_SIZE,\n+\t\t\t \"{\\\"key\\\":%s,\\\"value\\\":%s,\\\"formatted\\\":%s}\",\n+\t\t\t key_hex, value_hex, formatted);\n+\telse if (json)\n+\t\tsnprintf(record, RECORD_SIZE, \"{\\\"key\\\":%s,\\\"value\\\":%s}\",\n+\t\t\t key_hex, value_hex);\n+\telse if (test-\u003ebtf)\n+\t\tsnprintf(record, RECORD_SIZE, \"%s\", formatted);\n+\telse\n+\t\tsnprintf(record, RECORD_SIZE, \"key:%svalue:%s\", key_hex, value_hex);\n+}\n+\n+static void check_dump(const struct dump_case *test, __u32 id, bool json, bool pretty)\n+{\n+\tbool array = json || test-\u003ebtf;\n+\tchar command[MAX_BPFTOOL_CMD_LEN], expected[RECORD_SIZE], footer[64];\n+\tbool seen[MAX_ENTRIES] = {};\n+\tchar *output, *src, *dst, *cursor;\n+\tunsigned int i, n;\n+\tint err;\n+\n+\toutput = calloc(1, OUTPUT_SIZE);\n+\tif (!ASSERT_OK_PTR(output, \"alloc_output\"))\n+\t\treturn;\n+\tsnprintf(command, sizeof(command), \"%smap dump id %u\",\n+\t\t pretty ? \"-p \" : json ? \"-j \" : \"\", id);\n+\terr = get_bpftool_command_output(command, output, OUTPUT_SIZE);\n+\tif (!ASSERT_OK(err, \"map_dump\"))\n+\t\tgoto out;\n+\t/*\n+\t * Ignore presentation whitespace, but compare complete records and all\n+\t * punctuation. Expected contents come only from the input data, never\n+\t * from another map walk or bpftool invocation.\n+\t */\n+\tfor (src = output, dst = output; *src; src++)\n+\t\tif (!isspace((unsigned char)*src))\n+\t\t\t*dst++ = *src;\n+\t*dst = '\\0';\n+\tcursor = output;\n+\tif (array) {\n+\t\tif (!ASSERT_EQ(*cursor, '[', \"array_start\"))\n+\t\t\tgoto out;\n+\t\tcursor++;\n+\t}\n+\tfor (n = 0; n \u003c test-\u003ecount; n++) {\n+\t\tif (array \u0026\u0026 n) {\n+\t\t\tif (!ASSERT_EQ(*cursor, ',', \"record_separator\"))\n+\t\t\t\tgoto out;\n+\t\t\tcursor++;\n+\t\t}\n+\t\tfor (i = 0; i \u003c test-\u003ecount; i++) {\n+\t\t\tif (seen[i])\n+\t\t\t\tcontinue;\n+\t\t\texpected_record(expected, test, i, json);\n+\t\t\tif (!strncmp(cursor, expected, strlen(expected)))\n+\t\t\t\tbreak;\n+\t\t}\n+\t\tif (!ASSERT_LT(i, test-\u003ecount, \"unique_expected_record\"))\n+\t\t\tgoto out;\n+\t\tseen[i] = true;\n+\t\tcursor += strlen(expected);\n+\t}\n+\tif (array) {\n+\t\tASSERT_STREQ(cursor, \"]\", \"array_end_and_count\");\n+\t} else {\n+\t\tsnprintf(footer, sizeof(footer), \"Found%uelement%s\", test-\u003ecount,\n+\t\t\t test-\u003ecount == 1 ? \"\" : \"s\");\n+\t\tASSERT_STREQ(cursor, footer, \"plain_count\");\n+\t}\n+out:\n+\tfree(output);\n+}\n+\n+static void run_dump_case(const struct dump_case *test)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tstruct bpf_map_info info = {};\n+\t__u32 info_len = sizeof(info);\n+\tstruct btf *btf = NULL;\n+\tunsigned int i;\n+\tint fd = -1;\n+\n+\tif (test-\u003ebtf) {\n+\t\tbtf = btf__new_empty();\n+\t\tif (!ASSERT_OK_PTR(btf, \"btf_new\"))\n+\t\t\treturn;\n+\t\tif (!ASSERT_EQ(btf__add_int(btf, \"unsigned int\", 4, 0), 1,\n+\t\t\t       \"btf_int\") ||\n+\t\t    !ASSERT_OK(btf__load_into_kernel(btf), \"btf_load\"))\n+\t\t\tgoto out;\n+\t\topts.btf_fd = btf__fd(btf);\n+\t\topts.btf_key_type_id = 1;\n+\t\topts.btf_value_type_id = 1;\n+\t}\n+\tfd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_batch\", test-\u003ekey_size,\n+\t\t\t    test-\u003evalue_size, test-\u003ecount ?: 1, \u0026opts);\n+\tif (!ASSERT_OK_FD(fd, \"map_create\"))\n+\t\tgoto out;\n+\tfor (i = 0; i \u003c test-\u003ecount; i++) {\n+\t\t__u32 key = i, value = i * 37 + 11;\n+\t\tunsigned char short_key = i;\n+\t\tvoid *key_ptr = test-\u003ekey_size == 1 ? (void *)\u0026short_key : \u0026key;\n+\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fd, key_ptr, \u0026value, BPF_ANY),\n+\t\t\t       \"map_update\"))\n+\t\t\tgoto out;\n+\t}\n+\tif (!ASSERT_OK(bpf_map_get_info_by_fd(fd, \u0026info, \u0026info_len), \"map_info\"))\n+\t\tgoto out;\n+\tcheck_dump(test, info.id, false, false);\n+\tcheck_dump(test, info.id, true, false);\n+\tcheck_dump(test, info.id, true, true);\n+out:\n+\tif (fd \u003e= 0)\n+\t\tclose(fd);\n+\tbtf__free(btf);\n+}\n+\n+void test_bpftool_map_batch(void)\n+{\n+\tstatic const struct dump_case cases[] = {\n+\t\t{ \"empty\", 0, 4, 4 },\n+\t\t{ \"single\", 1, 4, 4 },\n+\t\t{ \"below_batch\", 255, 4, 4 },\n+\t\t{ \"exact_batch\", 256, 4, 4 },\n+\t\t{ \"above_batch\", 257, 4, 4 },\n+\t\t{ \"multiple_batches\", 1025, 4, 4 },\n+\t\t{ \"one_byte_key\", 256, 1, 4 },\n+\t\t{ \"odd_value_size\", 257, 4, 3 },\n+\t\t{ \"btf_empty\", 0, 4, 4, true },\n+\t\t{ \"btf_single\", 1, 4, 4, true },\n+\t\t{ \"btf_multiple_batches\", 1025, 4, 4, true },\n+\t};\n+\tunsigned int i;\n+\n+\tfor (i = 0; i \u003c ARRAY_SIZE(cases); i++)\n+\t\tif (test__start_subtest(cases[i].name))\n+\t\t\trun_dump_case(\u0026cases[i]);\n+}\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies only userspace code (bpftool under tools/bpf/bpftool and BPF selftests under tools/testing/selftests), which does not affect the compiled kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit b628b9ce4acfa2859edc2bb4cba3c5ab318d40e9
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 06:12:21 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 684a8fb724146..ea6f1389245fb 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -740,15 +740,10 @@ static int do_show(int argc, char **argv)
 	return errno == ENOENT ? 0 : -1;
 }
 
-static int dump_map_elem(int fd, void *key, void *value,
-			 struct bpf_map_info *map_info, struct btf *btf,
-			 json_writer_t *btf_wtr)
+static void print_map_elem(void *key, void *value,
+			   struct bpf_map_info *map_info, struct btf *btf,
+			   json_writer_t *btf_wtr)
 {
-	if (bpf_map_lookup_elem(fd, key, value)) {
-		print_entry_error(map_info, key, errno);
-		return -1;
-	}
-
 	if (json_output) {
 		print_entry_json(map_info, key, value, btf);
 	} else if (btf) {
@@ -762,10 +757,111 @@ static int dump_map_elem(int fd, void *key, void *value,
 	} else {
 		print_entry_plain(map_info, key, value);
 	}
+}
+
+static int dump_map_elem(int fd, void *key, void *value,
+			 struct bpf_map_info *map_info, struct btf *btf,
+			 json_writer_t *btf_wtr)
+{
+	if (bpf_map_lookup_elem(fd, key, value)) {
+		print_entry_error(map_info, key, errno);
+		return -1;
+	}
 
+	print_map_elem(key, value, map_info, btf, btf_wtr);
 	return 0;
 }
 
+#define MAP_DUMP_BATCH_SIZE 256U
+#define MAP_DUMP_BATCH_MAX_BYTES (4 * 1024 * 1024)
+
+/* Return 1 to use individual lookups, but only before batch traversal starts. */
+static int dump_map_batch(int fd, void *key, void *value,
+			  struct bpf_map_info *info, struct btf *btf,
+			  json_writer_t *wtr, unsigned int *num_elems)
+{
+	__u32 capacity, count, batch = 0, next_batch = 0, i;
+	void *keys = NULL, *values = NULL, *buf;
+	bool first = true, can_fallback = true;
+	int err;
+
+	/*
+	 * Hash lookup batches must accommodate a whole bucket. Restrict the
+	 * optimization to maps whose worst-case bucket fits the memory budget,
+	 * so a later ENOSPC never forces a restart after printing some entries.
+	 * Division also bounds the allocation multiplications on 32-bit hosts.
+	 */
+	if (info->type != BPF_MAP_TYPE_HASH || !info->max_entries ||
+	    (__u64)info->key_size + info->value_size >
+	    MAP_DUMP_BATCH_MAX_BYTES / info->max_entries)
+		return 1;
+
+	capacity = min(info->max_entries, MAP_DUMP_BATCH_SIZE);
+resize:
+	buf = realloc(keys, (size_t)capacity * info->key_size);
+	if (!buf) {
+		err = ENOMEM;
+		goto error;
+	}
+	keys = buf;
+	buf = realloc(values, (size_t)capacity * info->value_size);
+	if (!buf) {
+		err = ENOMEM;
+		goto error;
+	}
+	values = buf;
+
+	while (true) {
+		count = capacity;
+		err = bpf_map_lookup_batch(fd, first ? NULL : &batch,
+					   &next_batch, keys, values, &count, NULL);
+		err = err ? errno : 0;
+		/*
+		 * Older kernels reject the command before updating count. Do not
+		 * inspect the buffers on these errors, or fall back after progress.
+		 */
+		if (can_fallback && (err == EINVAL || err == EOPNOTSUPP ||
+				     err == 524 /* ENOTSUPP */)) {
+			err = 1;
+			goto out;
+		}
+		can_fallback = false;
+		if (err == ENOSPC) {
+			if (capacity == info->max_entries)
+				goto error;
+			capacity += min(capacity, info->max_entries - capacity);
+			/* Preserve the input cursor: the oversized bucket was not read. */
+			goto resize;
+		}
+		/* In particular, EFAULT can leave count and the buffers invalid. */
+		if (err && err != ENOENT)
+			goto error;
+		for (i = 0; i < count; i++) {
+			/*
+			 * Keep the alignment provided by individual lookups, including
+			 * for BTF types whose map key/value size is not aligned.
+			 */
+			memcpy(key, keys + (size_t)i * info->key_size, info->key_size);
+			memcpy(value, values + (size_t)i * info->value_size, info->value_size);
+			print_map_elem(key, value, info, btf, wtr);
+			(*num_elems)++;
+		}
+		if (err == ENOENT) {
+			err = 0;
+			goto out;
+		}
+		first = false;
+		batch = next_batch;
+	}
+error:
+	fprintf(stderr, "Error: can't lookup map batch: %s\n", strerror(err));
+	err = -1;
+out:
+	free(keys);
+	free(values);
+	return err;
+}
+
 static int maps_have_btf(int *fds, int nb_fds)
 {
 	struct bpf_map_info info = {};
@@ -869,6 +965,9 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 		p_info("Warning: cannot read values from %s map with value_size != 8",
 		       map_type_str);
 	}
+	err = dump_map_batch(fd, key, value, info, btf, wtr, &num_elems);
+	if (err != 1)
+		goto end_dump;
 	while (true) {
 		err = bpf_map_get_next_key(fd, prev_key, key);
 		if (err) {
@@ -881,6 +980,7 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 		prev_key = key;
 	}
 
+end_dump:
 	if (wtr) {
 		jsonw_end_array(wtr);	/* elements */
 		if (show_header)
diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c
new file mode 100644
index 0000000000000..b4216ed778ef9
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c
@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include <bpftool_helpers.h>
+#include <bpf/btf.h>
+#include <ctype.h>
+
+#define MAX_ENTRIES 1025
+#define RECORD_SIZE 256
+#define OUTPUT_SIZE (MAX_ENTRIES * RECORD_SIZE + 1024)
+
+struct dump_case {
+	const char *name;
+	unsigned int count;
+	unsigned int key_size;
+	unsigned int value_size;
+	bool btf;
+};
+
+static void hex_bytes(char *out, const void *data, unsigned int size, bool json)
+{
+	const unsigned char *bytes = data;
+	unsigned int i;
+
+	if (json)
+		*out++ = '[';
+	for (i = 0; i < size; i++) {
+		if (json && i)
+			*out++ = ',';
+		out += sprintf(out, json ? "\"0x%02x\"" : "%02x", bytes[i]);
+	}
+	if (json)
+		*out++ = ']';
+	*out = '\0';
+}
+
+static void expected_record(char *record, const struct dump_case *test,
+			    unsigned int index, bool json)
+{
+	__u32 key = index, value = index * 37 + 11;
+	unsigned char short_key = index;
+	char key_hex[64], value_hex[64], formatted[96];
+
+	hex_bytes(key_hex, test->key_size == 1 ? (void *)&short_key : &key,
+		  test->key_size, json);
+	hex_bytes(value_hex, &value, test->value_size, json);
+	snprintf(formatted, sizeof(formatted), "{\"key\":%u,\"value\":%u}",
+		 key, value);
+	if (json && test->btf)
+		snprintf(record, RECORD_SIZE,
+			 "{\"key\":%s,\"value\":%s,\"formatted\":%s}",
+			 key_hex, value_hex, formatted);
+	else if (json)
+		snprintf(record, RECORD_SIZE, "{\"key\":%s,\"value\":%s}",
+			 key_hex, value_hex);
+	else if (test->btf)
+		snprintf(record, RECORD_SIZE, "%s", formatted);
+	else
+		snprintf(record, RECORD_SIZE, "key:%svalue:%s", key_hex, value_hex);
+}
+
+static void check_dump(const struct dump_case *test, __u32 id, bool json, bool pretty)
+{
+	bool array = json || test->btf;
+	char command[MAX_BPFTOOL_CMD_LEN], expected[RECORD_SIZE], footer[64];
+	bool seen[MAX_ENTRIES] = {};
+	char *output, *src, *dst, *cursor;
+	unsigned int i, n;
+	int err;
+
+	output = calloc(1, OUTPUT_SIZE);
+	if (!ASSERT_OK_PTR(output, "alloc_output"))
+		return;
+	snprintf(command, sizeof(command), "%smap dump id %u",
+		 pretty ? "-p " : json ? "-j " : "", id);
+	err = get_bpftool_command_output(command, output, OUTPUT_SIZE);
+	if (!ASSERT_OK(err, "map_dump"))
+		goto out;
+	/*
+	 * Ignore presentation whitespace, but compare complete records and all
+	 * punctuation. Expected contents come only from the input data, never
+	 * from another map walk or bpftool invocation.
+	 */
+	for (src = output, dst = output; *src; src++)
+		if (!isspace((unsigned char)*src))
+			*dst++ = *src;
+	*dst = '\0';
+	cursor = output;
+	if (array) {
+		if (!ASSERT_EQ(*cursor, '[', "array_start"))
+			goto out;
+		cursor++;
+	}
+	for (n = 0; n < test->count; n++) {
+		if (array && n) {
+			if (!ASSERT_EQ(*cursor, ',', "record_separator"))
+				goto out;
+			cursor++;
+		}
+		for (i = 0; i < test->count; i++) {
+			if (seen[i])
+				continue;
+			expected_record(expected, test, i, json);
+			if (!strncmp(cursor, expected, strlen(expected)))
+				break;
+		}
+		if (!ASSERT_LT(i, test->count, "unique_expected_record"))
+			goto out;
+		seen[i] = true;
+		cursor += strlen(expected);
+	}
+	if (array) {
+		ASSERT_STREQ(cursor, "]", "array_end_and_count");
+	} else {
+		snprintf(footer, sizeof(footer), "Found%uelement%s", test->count,
+			 test->count == 1 ? "" : "s");
+		ASSERT_STREQ(cursor, footer, "plain_count");
+	}
+out:
+	free(output);
+}
+
+static void run_dump_case(const struct dump_case *test)
+{
+	LIBBPF_OPTS(bpf_map_create_opts, opts);
+	struct bpf_map_info info = {};
+	__u32 info_len = sizeof(info);
+	struct btf *btf = NULL;
+	unsigned int i;
+	int fd = -1;
+
+	if (test->btf) {
+		btf = btf__new_empty();
+		if (!ASSERT_OK_PTR(btf, "btf_new"))
+			return;
+		if (!ASSERT_EQ(btf__add_int(btf, "unsigned int", 4, 0), 1,
+			       "btf_int") ||
+		    !ASSERT_OK(btf__load_into_kernel(btf), "btf_load"))
+			goto out;
+		opts.btf_fd = btf__fd(btf);
+		opts.btf_key_type_id = 1;
+		opts.btf_value_type_id = 1;
+	}
+	fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_batch", test->key_size,
+			    test->value_size, test->count ?: 1, &opts);
+	if (!ASSERT_OK_FD(fd, "map_create"))
+		goto out;
+	for (i = 0; i < test->count; i++) {
+		__u32 key = i, value = i * 37 + 11;
+		unsigned char short_key = i;
+		void *key_ptr = test->key_size == 1 ? (void *)&short_key : &key;
+
+		if (!ASSERT_OK(bpf_map_update_elem(fd, key_ptr, &value, BPF_ANY),
+			       "map_update"))
+			goto out;
+	}
+	if (!ASSERT_OK(bpf_map_get_info_by_fd(fd, &info, &info_len), "map_info"))
+		goto out;
+	check_dump(test, info.id, false, false);
+	check_dump(test, info.id, true, false);
+	check_dump(test, info.id, true, true);
+out:
+	if (fd >= 0)
+		close(fd);
+	btf__free(btf);
+}
+
+void test_bpftool_map_batch(void)
+{
+	static const struct dump_case cases[] = {
+		{ "empty", 0, 4, 4 },
+		{ "single", 1, 4, 4 },
+		{ "below_batch", 255, 4, 4 },
+		{ "exact_batch", 256, 4, 4 },
+		{ "above_batch", 257, 4, 4 },
+		{ "multiple_batches", 1025, 4, 4 },
+		{ "one_byte_key", 256, 1, 4 },
+		{ "odd_value_size", 257, 4, 3 },
+		{ "btf_empty", 0, 4, 4, true },
+		{ "btf_single", 1, 4, 4, true },
+		{ "btf_multiple_batches", 1025, 4, 4, true },
+	};
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(cases); i++)
+		if (test__start_subtest(cases[i].name))
+			run_dump_case(&cases[i]);
+}

gemini-3.7-flash

null

null

							input: 6996
							output: 83
							thoughts: 331
						

**Fuzzing Evaluation: Non-Kernel Tooling**

Okay, let's take a look at this patch series and see if it's a candidate for syzkaller fuzzing. The files modified are `tools/bpf/bpftool/map.c` and `tools/testing/selftests/bpf/prog_tests/bpftool_map_batch.c`. Right away, the location within the `tools/` directory raises a flag.

Now, let's consult the established rules. Section 2 clearly outlines negative criteria for WorthFuzzing – specifically, "Non-kernel and non-executable changes". This includes things like user-space directories, self-tests, samples, or scripts, as long as they *don't* impact the compiled kernel image or modules. Given that both modified files are nestled firmly within the `tools/` structure, they fall squarely into this category. `bpftool` is a user-space utility, and the selftests are just that: tests. These changes aren't going to affect the core kernel, vmlinux.

Therefore, after this review, it's clear: WorthFuzzing is `false` in this case.

I'm confident in this assessment. Time to formulate the tool call: `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies only userspace code (bpftool under tools/bpf/bpftool and BPF selftests under tools/testing/selftests), which does not affect the compiled kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies only userspace code (bpftool under tools/bpf/bpftool and BPF selftests under tools/testing/selftests), which does not affect the compiled kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null