AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch series contains exclusively comment and spelling typo fixes across various kernel files, headers, and selftests, without altering any executable code.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 4797067847891d9699c53ed6ef71e6aba7512bf4\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Sep 7 08:29:48 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c\nindex 9ede81afbc50e..b1c21c014c9cf 100644\n--- a/arch/arm/net/bpf_jit_32.c\n+++ b/arch/arm/net/bpf_jit_32.c\n@@ -1346,7 +1346,7 @@ static inline void emit_ldsx_r(const s8 dst[], const s8 src,\n \tarm_bpf_put_reg64(dst, rd, ctx);\n }\n \n-/* Arithmatic Operation */\n+/* Arithmetic Operation */\n static inline void emit_ar_r(const u8 rd, const u8 rt, const u8 rm,\n \t\t\t     const u8 rn, struct jit_ctx *ctx, u8 op,\n \t\t\t     bool is_jmp64) {\ndiff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c\nindex bfdc50740da8e..cf8c1b49da257 100644\n--- a/arch/powerpc/net/bpf_jit_comp32.c\n+++ b/arch/powerpc/net/bpf_jit_comp32.c\n@@ -23,7 +23,7 @@\n  *\n  *\t\t[\tprev sp\t\t] \u003c-------------\n  *\t\t[   nv gpr save area\t] 16 * 4\t|\n- * fp (r31) --\u003e\t[   ebpf stack space\t] upto 512\t|\n+ * fp (r31) --\u003e\t[   ebpf stack space\t] up to 512\t|\n  *\t\t[     frame header\t] 16\t\t|\n  * sp (r1) ---\u003e\t[    stack pointer\t] --------------\n  */\ndiff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c\nindex fc9db691e8203..8a1a00026c69f 100644\n--- a/arch/powerpc/net/bpf_jit_comp64.c\n+++ b/arch/powerpc/net/bpf_jit_comp64.c\n@@ -23,7 +23,7 @@\n  * Stack layout with frame:\n  * Layout when setting up our own stack frame.\n  * Note: r1 at bottom, component offsets positive wrt r1.\n- * Ensure the top half (upto local_tmp_var) stays consistent\n+ * Ensure the top half (up to local_tmp_var) stays consistent\n  * with our redzone usage.\n  *\n  * tail_call_info - stores tailcall count value in main program's\n@@ -35,7 +35,7 @@\n  *\t\t[   nv gpr save area\t] (6 * 8)\t|\n  *\t\t[ addl. nv gpr save area] (12 * 8)\t| \u003c--- exception boundary/callback program\n  *\t\t[    local_tmp_var\t] 24\t\t|\n- * fp (r31) --\u003e\t[   ebpf stack space\t] upto 512\t|\n+ * fp (r31) --\u003e\t[   ebpf stack space\t] up to 512\t|\n  *\t\t[     frame header\t] 32/112\t|\n  * sp (r1) ---\u003e\t[    stack pointer\t] --------------\n  *\ndiff --git a/arch/sparc/net/bpf_jit_asm_32.S b/arch/sparc/net/bpf_jit_asm_32.S\nindex a2e28e0464a33..81430f065ac97 100644\n--- a/arch/sparc/net/bpf_jit_asm_32.S\n+++ b/arch/sparc/net/bpf_jit_asm_32.S\n@@ -195,7 +195,7 @@ bpf_error:\n \t/* Make the JIT program return zero.  The JIT epilogue\n \t * stores away the original %o7 into r_saved_O7.  The\n \t * normal leaf function return is to use \"retl\" which\n-\t * would evalute to \"jmpl %o7 + 8, %g0\" but we want to\n+\t * would evaluate to \"jmpl %o7 + 8, %g0\" but we want to\n \t * use the saved value thus the sequence you see here.\n \t */\n \tjmpl\tr_saved_O7 + 8, %g0\ndiff --git a/include/linux/filter.h b/include/linux/filter.h\nindex 4a9bc6a848f2e..0a067c2e923da 100644\n--- a/include/linux/filter.h\n+++ b/include/linux/filter.h\n@@ -147,7 +147,7 @@ struct ctl_table_header;\n #define BPF_ALU32_IMM(OP, DST, IMM)\t\t\t\t\\\n \tBPF_ALU32_IMM_OFF(OP, DST, IMM, 0)\n \n-/* Endianess conversion, cpu_to_{l,b}e(), {l,b}e_to_cpu() */\n+/* Endianness conversion, cpu_to_{l,b}e(), {l,b}e_to_cpu() */\n \n #define BPF_ENDIAN(TYPE, DST, LEN)\t\t\t\t\\\n \t((struct bpf_insn) {\t\t\t\t\t\\\n@@ -1029,7 +1029,7 @@ static inline u8 *bpf_skb_cb(const struct sk_buff *skb)\n \t *\n \t * In some socket filter cases, the cb unfortunately needs to be\n \t * saved/restored so that protocol specific skb-\u003ecb[] data won't\n-\t * be lost. In any case, due to unpriviledged eBPF programs\n+\t * be lost. In any case, due to unprivileged eBPF programs\n \t * attached to sockets, we need to clear the bpf_skb_cb() area\n \t * to not leak previous contents to user space.\n \t */\ndiff --git a/kernel/bpf/reuseport_array.c b/kernel/bpf/reuseport_array.c\nindex 49b8e5a0c6b4f..4de08abfd94ed 100644\n--- a/kernel/bpf/reuseport_array.c\n+++ b/kernel/bpf/reuseport_array.c\n@@ -207,7 +207,7 @@ reuseport_array_update_check(const struct reuseport_array *array,\n \t\treturn -ENOTSUPP;\n \n \t/*\n-\t * sk must be hashed (i.e. listening in the TCP case or binded\n+\t * sk must be hashed (i.e. listening in the TCP case or bound\n \t * in the UDP case) and\n \t * it must also be a SO_REUSEPORT sk (i.e. reuse cannot be NULL).\n \t *\ndiff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c\nindex be9ce98e94692..54f5be1289d2b 100644\n--- a/kernel/bpf/stream.c\n+++ b/kernel/bpf/stream.c\n@@ -24,7 +24,7 @@ static struct bpf_stream_elem *bpf_stream_elem_alloc(int len)\n \t/*\n \t * Length denotes the amount of data to be written as part of stream element,\n \t * thus includes '\\0' byte. We're capped by how much bpf_bprintf_buffers can\n-\t * accomodate, therefore deny allocations that won't fit into them.\n+\t * accommodate, therefore deny allocations that won't fit into them.\n \t */\n \tif (len \u003c 0 || len \u003e max_len)\n \t\treturn NULL;\ndiff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c\nindex 8417de92d0282..c1745bee37c0a 100644\n--- a/tools/lib/bpf/btf.c\n+++ b/tools/lib/bpf/btf.c\n@@ -3843,7 +3843,7 @@ static int btf_dedup_remap_types(struct btf_dedup *d);\n  * types, in general, can form graphs containing cycles, not just DAGs.\n  *\n  * While algorithm does deduplication, it also merges and resolves type\n- * information (unless disabled throught `struct btf_opts`), whenever possible.\n+ * information (unless disabled through `struct btf_opts`), whenever possible.\n  * E.g., in the example above with two compilation units having partial type\n  * information for structs `A` and `B`, the output of algorithm will emit\n  * a single copy of each BTF type that describes structs `A`, `B`, and `S`\n@@ -5644,7 +5644,7 @@ static int btf_dedup_resolve_fwds(struct btf_dedup *d)\n  *\n  * After we established for each type its corresponding canonical representative\n  * type, we now can eliminate types that are not canonical and leave only\n- * canonical ones layed out sequentially in memory by copying them over\n+ * canonical ones laid out sequentially in memory by copying them over\n  * duplicates. During compaction btf_dedup-\u003ehypot_map array is reused to store\n  * a map from original type ID to a new compacted type ID, which will be used\n  * during next phase to \"fix up\" type IDs, referenced from struct/union and\ndiff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c\nindex 2e56e3ab5b6cc..c0933580930bc 100644\n--- a/tools/lib/bpf/usdt.c\n+++ b/tools/lib/bpf/usdt.c\n@@ -144,7 +144,7 @@\n  * about. This state has to be maintained per-BPF object and coordinate\n  * between different USDT attachments within the same BPF object.\n  *\n- * Spec ID is the key in spec BPF map, value is the actual USDT spec layed out\n+ * Spec ID is the key in spec BPF map, value is the actual USDT spec laid out\n  * as struct usdt_spec. Each invocation of BPF program at runtime needs to\n  * know its associated spec ID. It gets it either through BPF cookie, which\n  * libbpf sets to spec ID during attach time, or, if kernel is too old to\ndiff --git a/tools/testing/selftests/bpf/libarena/src/asan.bpf.c b/tools/testing/selftests/bpf/libarena/src/asan.bpf.c\nindex 5135d5c72a46d..158d95c2520bf 100644\n--- a/tools/testing/selftests/bpf/libarena/src/asan.bpf.c\n+++ b/tools/testing/selftests/bpf/libarena/src/asan.bpf.c\n@@ -221,7 +221,7 @@ static __always_inline bool check_asan_args(s8 __arena *addr, size_t size,\n \t\tgoto confirmed_valid;\n \n \t/*\n-\t * Wraparound is possible for values close to the the edge of the\n+\t * Wraparound is possible for values close to the edge of the\n \t * 4GiB boundary of the arena (last valid address is 1UL \u003c\u003c 32 - 1).\n \t *\n \t *\ndiff --git a/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c b/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c\nindex 1b25d5c5f8fb8..8b96fb8613688 100644\n--- a/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c\n+++ b/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c\n@@ -13,7 +13,7 @@\n  * IPv6 header with a Segment Routing Header, with segments :\n  *\tfd00::1 -\u003e fd00::2 -\u003e fd00::3 -\u003e fd00::4\n  *\n- * 3 fd00::/16 IPv6 addresses are binded to seg6local End.BPF actions :\n+ * 3 fd00::/16 IPv6 addresses are bound to seg6local End.BPF actions :\n  * - fd00::1 : add a TLV, change the flags and apply a End.X action to fc42::1\n  * - fd00::2 : remove the TLV, change the flags, add a tag\n  * - fd00::3 : apply an End.T action to fd00::4, through routing table 117\ndiff --git a/tools/testing/selftests/bpf/prog_tests/task_local_data.h b/tools/testing/selftests/bpf/prog_tests/task_local_data.h\nindex 8ae4fb2027f73..9f2971fc7cd54 100644\n--- a/tools/testing/selftests/bpf/prog_tests/task_local_data.h\n+++ b/tools/testing/selftests/bpf/prog_tests/task_local_data.h\n@@ -243,7 +243,7 @@ static tld_key_t __tld_create_key(const char *name, size_t size, bool dyn_data)\n \t\t}\n \n \t\t/*\n-\t\t * TLD_DEFINE_KEY() is given memory upto a page while at most\n+\t\t * TLD_DEFINE_KEY() is given memory up to a page while at most\n \t\t * TLD_DYN_DATA_SIZE is allocated for tld_create_key()\n \t\t */\n \t\tif (dyn_data) {\ndiff --git a/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c b/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c\nindex 624078abf3dea..d7e30ee576c93 100644\n--- a/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c\n+++ b/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c\n@@ -7,7 +7,7 @@\n \n SEC(\"freplace/btf_unreliable_kprobe\")\n /* context type is what BPF verifier expects for kprobe context, but target\n- * program has `stuct whatever *ctx` argument, so freplace operation will be\n+ * program has `struct whatever *ctx` argument, so freplace operation will be\n  * rejected with the following message:\n  *\n  * arg0 replace_btf_unreliable_kprobe(struct pt_regs *) doesn't match btf_unreliable_kprobe(struct whatever *)\ndiff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c\nindex 62d7df9e80beb..340670e89ba92 100644\n--- a/tools/testing/selftests/bpf/progs/iters.c\n+++ b/tools/testing/selftests/bpf/progs/iters.c\n@@ -1511,7 +1511,7 @@ __naked int checkpoint_states_deletion(void)\n \t * would get equal to one of the explored states and thus loop\n \t * exploration would be finished (at-least for a specific path).\n \t * Verifier evicts explored states with high miss to hit ratio\n-\t * to to avoid comparing current state with too many explored\n+\t * to avoid comparing current state with too many explored\n \t * states per instruction.\n \t * This test is designed to \"stress test\" eviction policy defined using formula:\n \t *\ndiff --git a/tools/testing/selftests/bpf/progs/verifier_var_off.c b/tools/testing/selftests/bpf/progs/verifier_var_off.c\nindex a63e336750918..227dea0da3a05 100644\n--- a/tools/testing/selftests/bpf/progs/verifier_var_off.c\n+++ b/tools/testing/selftests/bpf/progs/verifier_var_off.c\n@@ -225,7 +225,7 @@ __naked void stack_write_priv_vs_unpriv(void)\n }\n \n /* Similar to the previous test, but this time also perform a read from the\n- * address written to with a variable offet. The read is allowed, showing that,\n+ * address written to with a variable offset. The read is allowed, showing that,\n  * after a variable-offset write, a privileged program can read the slots that\n  * were in the range of that write (even if the verifier doesn't actually know if\n  * the slot being read was really written to or not.\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch series contains exclusively comment and spelling typo fixes across various kernel files, headers, and selftests, without altering any executable code.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 4797067847891d9699c53ed6ef71e6aba7512bf4
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 08:29:48 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 9ede81afbc50e..b1c21c014c9cf 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -1346,7 +1346,7 @@ static inline void emit_ldsx_r(const s8 dst[], const s8 src,
 	arm_bpf_put_reg64(dst, rd, ctx);
 }
 
-/* Arithmatic Operation */
+/* Arithmetic Operation */
 static inline void emit_ar_r(const u8 rd, const u8 rt, const u8 rm,
 			     const u8 rn, struct jit_ctx *ctx, u8 op,
 			     bool is_jmp64) {
diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c
index bfdc50740da8e..cf8c1b49da257 100644
--- a/arch/powerpc/net/bpf_jit_comp32.c
+++ b/arch/powerpc/net/bpf_jit_comp32.c
@@ -23,7 +23,7 @@
  *
  *		[	prev sp		] <-------------
  *		[   nv gpr save area	] 16 * 4	|
- * fp (r31) -->	[   ebpf stack space	] upto 512	|
+ * fp (r31) -->	[   ebpf stack space	] up to 512	|
  *		[     frame header	] 16		|
  * sp (r1) --->	[    stack pointer	] --------------
  */
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index fc9db691e8203..8a1a00026c69f 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -23,7 +23,7 @@
  * Stack layout with frame:
  * Layout when setting up our own stack frame.
  * Note: r1 at bottom, component offsets positive wrt r1.
- * Ensure the top half (upto local_tmp_var) stays consistent
+ * Ensure the top half (up to local_tmp_var) stays consistent
  * with our redzone usage.
  *
  * tail_call_info - stores tailcall count value in main program's
@@ -35,7 +35,7 @@
  *		[   nv gpr save area	] (6 * 8)	|
  *		[ addl. nv gpr save area] (12 * 8)	| <--- exception boundary/callback program
  *		[    local_tmp_var	] 24		|
- * fp (r31) -->	[   ebpf stack space	] upto 512	|
+ * fp (r31) -->	[   ebpf stack space	] up to 512	|
  *		[     frame header	] 32/112	|
  * sp (r1) --->	[    stack pointer	] --------------
  *
diff --git a/arch/sparc/net/bpf_jit_asm_32.S b/arch/sparc/net/bpf_jit_asm_32.S
index a2e28e0464a33..81430f065ac97 100644
--- a/arch/sparc/net/bpf_jit_asm_32.S
+++ b/arch/sparc/net/bpf_jit_asm_32.S
@@ -195,7 +195,7 @@ bpf_error:
 	/* Make the JIT program return zero.  The JIT epilogue
 	 * stores away the original %o7 into r_saved_O7.  The
 	 * normal leaf function return is to use "retl" which
-	 * would evalute to "jmpl %o7 + 8, %g0" but we want to
+	 * would evaluate to "jmpl %o7 + 8, %g0" but we want to
 	 * use the saved value thus the sequence you see here.
 	 */
 	jmpl	r_saved_O7 + 8, %g0
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 4a9bc6a848f2e..0a067c2e923da 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -147,7 +147,7 @@ struct ctl_table_header;
 #define BPF_ALU32_IMM(OP, DST, IMM)				\
 	BPF_ALU32_IMM_OFF(OP, DST, IMM, 0)
 
-/* Endianess conversion, cpu_to_{l,b}e(), {l,b}e_to_cpu() */
+/* Endianness conversion, cpu_to_{l,b}e(), {l,b}e_to_cpu() */
 
 #define BPF_ENDIAN(TYPE, DST, LEN)				\
 	((struct bpf_insn) {					\
@@ -1029,7 +1029,7 @@ static inline u8 *bpf_skb_cb(const struct sk_buff *skb)
 	 *
 	 * In some socket filter cases, the cb unfortunately needs to be
 	 * saved/restored so that protocol specific skb->cb[] data won't
-	 * be lost. In any case, due to unpriviledged eBPF programs
+	 * be lost. In any case, due to unprivileged eBPF programs
 	 * attached to sockets, we need to clear the bpf_skb_cb() area
 	 * to not leak previous contents to user space.
 	 */
diff --git a/kernel/bpf/reuseport_array.c b/kernel/bpf/reuseport_array.c
index 49b8e5a0c6b4f..4de08abfd94ed 100644
--- a/kernel/bpf/reuseport_array.c
+++ b/kernel/bpf/reuseport_array.c
@@ -207,7 +207,7 @@ reuseport_array_update_check(const struct reuseport_array *array,
 		return -ENOTSUPP;
 
 	/*
-	 * sk must be hashed (i.e. listening in the TCP case or binded
+	 * sk must be hashed (i.e. listening in the TCP case or bound
 	 * in the UDP case) and
 	 * it must also be a SO_REUSEPORT sk (i.e. reuse cannot be NULL).
 	 *
diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
index be9ce98e94692..54f5be1289d2b 100644
--- a/kernel/bpf/stream.c
+++ b/kernel/bpf/stream.c
@@ -24,7 +24,7 @@ static struct bpf_stream_elem *bpf_stream_elem_alloc(int len)
 	/*
 	 * Length denotes the amount of data to be written as part of stream element,
 	 * thus includes '\0' byte. We're capped by how much bpf_bprintf_buffers can
-	 * accomodate, therefore deny allocations that won't fit into them.
+	 * accommodate, therefore deny allocations that won't fit into them.
 	 */
 	if (len < 0 || len > max_len)
 		return NULL;
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 8417de92d0282..c1745bee37c0a 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -3843,7 +3843,7 @@ static int btf_dedup_remap_types(struct btf_dedup *d);
  * types, in general, can form graphs containing cycles, not just DAGs.
  *
  * While algorithm does deduplication, it also merges and resolves type
- * information (unless disabled throught `struct btf_opts`), whenever possible.
+ * information (unless disabled through `struct btf_opts`), whenever possible.
  * E.g., in the example above with two compilation units having partial type
  * information for structs `A` and `B`, the output of algorithm will emit
  * a single copy of each BTF type that describes structs `A`, `B`, and `S`
@@ -5644,7 +5644,7 @@ static int btf_dedup_resolve_fwds(struct btf_dedup *d)
  *
  * After we established for each type its corresponding canonical representative
  * type, we now can eliminate types that are not canonical and leave only
- * canonical ones layed out sequentially in memory by copying them over
+ * canonical ones laid out sequentially in memory by copying them over
  * duplicates. During compaction btf_dedup->hypot_map array is reused to store
  * a map from original type ID to a new compacted type ID, which will be used
  * during next phase to "fix up" type IDs, referenced from struct/union and
diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
index 2e56e3ab5b6cc..c0933580930bc 100644
--- a/tools/lib/bpf/usdt.c
+++ b/tools/lib/bpf/usdt.c
@@ -144,7 +144,7 @@
  * about. This state has to be maintained per-BPF object and coordinate
  * between different USDT attachments within the same BPF object.
  *
- * Spec ID is the key in spec BPF map, value is the actual USDT spec layed out
+ * Spec ID is the key in spec BPF map, value is the actual USDT spec laid out
  * as struct usdt_spec. Each invocation of BPF program at runtime needs to
  * know its associated spec ID. It gets it either through BPF cookie, which
  * libbpf sets to spec ID during attach time, or, if kernel is too old to
diff --git a/tools/testing/selftests/bpf/libarena/src/asan.bpf.c b/tools/testing/selftests/bpf/libarena/src/asan.bpf.c
index 5135d5c72a46d..158d95c2520bf 100644
--- a/tools/testing/selftests/bpf/libarena/src/asan.bpf.c
+++ b/tools/testing/selftests/bpf/libarena/src/asan.bpf.c
@@ -221,7 +221,7 @@ static __always_inline bool check_asan_args(s8 __arena *addr, size_t size,
 		goto confirmed_valid;
 
 	/*
-	 * Wraparound is possible for values close to the the edge of the
+	 * Wraparound is possible for values close to the edge of the
 	 * 4GiB boundary of the arena (last valid address is 1UL << 32 - 1).
 	 *
 	 *
diff --git a/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c b/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c
index 1b25d5c5f8fb8..8b96fb8613688 100644
--- a/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c
+++ b/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c
@@ -13,7 +13,7 @@
  * IPv6 header with a Segment Routing Header, with segments :
  *	fd00::1 -> fd00::2 -> fd00::3 -> fd00::4
  *
- * 3 fd00::/16 IPv6 addresses are binded to seg6local End.BPF actions :
+ * 3 fd00::/16 IPv6 addresses are bound to seg6local End.BPF actions :
  * - fd00::1 : add a TLV, change the flags and apply a End.X action to fc42::1
  * - fd00::2 : remove the TLV, change the flags, add a tag
  * - fd00::3 : apply an End.T action to fd00::4, through routing table 117
diff --git a/tools/testing/selftests/bpf/prog_tests/task_local_data.h b/tools/testing/selftests/bpf/prog_tests/task_local_data.h
index 8ae4fb2027f73..9f2971fc7cd54 100644
--- a/tools/testing/selftests/bpf/prog_tests/task_local_data.h
+++ b/tools/testing/selftests/bpf/prog_tests/task_local_data.h
@@ -243,7 +243,7 @@ static tld_key_t __tld_create_key(const char *name, size_t size, bool dyn_data)
 		}
 
 		/*
-		 * TLD_DEFINE_KEY() is given memory upto a page while at most
+		 * TLD_DEFINE_KEY() is given memory up to a page while at most
 		 * TLD_DYN_DATA_SIZE is allocated for tld_create_key()
 		 */
 		if (dyn_data) {
diff --git a/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c b/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c
index 624078abf3dea..d7e30ee576c93 100644
--- a/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c
+++ b/tools/testing/selftests/bpf/progs/freplace_unreliable_prog.c
@@ -7,7 +7,7 @@
 
 SEC("freplace/btf_unreliable_kprobe")
 /* context type is what BPF verifier expects for kprobe context, but target
- * program has `stuct whatever *ctx` argument, so freplace operation will be
+ * program has `struct whatever *ctx` argument, so freplace operation will be
  * rejected with the following message:
  *
  * arg0 replace_btf_unreliable_kprobe(struct pt_regs *) doesn't match btf_unreliable_kprobe(struct whatever *)
diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c
index 62d7df9e80beb..340670e89ba92 100644
--- a/tools/testing/selftests/bpf/progs/iters.c
+++ b/tools/testing/selftests/bpf/progs/iters.c
@@ -1511,7 +1511,7 @@ __naked int checkpoint_states_deletion(void)
 	 * would get equal to one of the explored states and thus loop
 	 * exploration would be finished (at-least for a specific path).
 	 * Verifier evicts explored states with high miss to hit ratio
-	 * to to avoid comparing current state with too many explored
+	 * to avoid comparing current state with too many explored
 	 * states per instruction.
 	 * This test is designed to "stress test" eviction policy defined using formula:
 	 *
diff --git a/tools/testing/selftests/bpf/progs/verifier_var_off.c b/tools/testing/selftests/bpf/progs/verifier_var_off.c
index a63e336750918..227dea0da3a05 100644
--- a/tools/testing/selftests/bpf/progs/verifier_var_off.c
+++ b/tools/testing/selftests/bpf/progs/verifier_var_off.c
@@ -225,7 +225,7 @@ __naked void stack_write_priv_vs_unpriv(void)
 }
 
 /* Similar to the previous test, but this time also perform a read from the
- * address written to with a variable offet. The read is allowed, showing that,
+ * address written to with a variable offset. The read is allowed, showing that,
  * after a variable-offset write, a privileged program can read the slots that
  * were in the range of that write (even if the verifier doesn't actually know if
  * the slot being read was really written to or not.

gemini-3.7-flash

null

null

							input: 7054
							output: 59
							thoughts: 494
						

**My Assessment of This Patch**

Okay, so I've just reviewed this patch and, frankly, it's pretty straightforward. It's essentially a comprehensive cleanup of comment typos and minor spelling errors across a range of files within the kernel and associated tools. We're talking about things like "Arithmatic" becoming "Arithmetic," "upto" becoming "up to," "Endianess" becoming "Endianness," and so on. There's nothing here that touches any actual executable C code; it's all strictly documentation and comments, and a smattering of selftests.

Now, given my expertise, I immediately went through the process of determining if this is an area that needs more in-depth testing. I know the rules well, and I can say confidently that I'm not going to include this patch to "WorthFuzzing". Section 2 of the guidelines makes it clear that changes limited to documentation, comments, or spelling fixes are explicitly excluded from further consideration. These changes *do not* affect the compiled kernel image or kernel modules. This is all user-space, even if it's within the kernel tree, from a testing perspective.

So, this patch is a low-impact correction. This is something that doesn't need "FocusSymbols" or any "EnableConfigs". I'm calling `set-results` now.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch series contains exclusively comment and spelling typo fixes across various kernel files, headers, and selftests, without altering any executable code.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch series contains exclusively comment and spelling typo fixes across various kernel files, headers, and selftests, without altering any executable code.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null