AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only changes the signature of the task_setscheduler LSM hook to pass additional arguments (attr and in_mask). All in-tree LSMs (capability, selinux, smack) are updated to ignore these new arguments, so there is no functional change to the kernel's execution flow.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit d9996f931d633c1b282199f4e519ddce3ee19362\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jul 20 02:18:56 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c\nindex 4fead87d2f4330..c7a5d55cf7cad5 100644\n--- a/arch/mips/kernel/mips-mt-fpaff.c\n+++ b/arch/mips/kernel/mips-mt-fpaff.c\n@@ -110,7 +110,7 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,\n \t\tgoto out_unlock;\n \t}\n \n-\tretval = security_task_setscheduler(p);\n+\tretval = security_task_setscheduler(p, NULL, new_mask);\n \tif (retval)\n \t\tgoto out_unlock;\n \ndiff --git a/fs/proc/base.c b/fs/proc/base.c\nindex 780f812590527c..b14401030e5cd5 100644\n--- a/fs/proc/base.c\n+++ b/fs/proc/base.c\n@@ -2589,7 +2589,7 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,\n \t\t}\n \t\trcu_read_unlock();\n \n-\t\terr = security_task_setscheduler(p);\n+\t\terr = security_task_setscheduler(p, NULL, NULL);\n \t\tif (err) {\n \t\t\tcount = err;\n \t\t\tgoto out;\ndiff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h\nindex 65c9609ec20770..80ca02879620a1 100644\n--- a/include/linux/lsm_hook_defs.h\n+++ b/include/linux/lsm_hook_defs.h\n@@ -255,7 +255,9 @@ LSM_HOOK(int, 0, task_prlimit, const struct cred *cred,\n \t const struct cred *tcred, unsigned int flags)\n LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource,\n \t struct rlimit *new_rlim)\n-LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p)\n+LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p,\n+\t const struct sched_attr *attr__nullable,\n+\t const struct cpumask *in_mask__nullable)\n LSM_HOOK(int, 0, task_getscheduler, struct task_struct *p)\n LSM_HOOK(int, 0, task_movememory, struct task_struct *p)\n LSM_HOOK(int, 0, task_kill, struct task_struct *p, struct kernel_siginfo *info,\ndiff --git a/include/linux/security.h b/include/linux/security.h\nindex 153e9043058f88..82dfe4e3f8d16e 100644\n--- a/include/linux/security.h\n+++ b/include/linux/security.h\n@@ -82,6 +82,7 @@ struct ctl_table;\n struct audit_krule;\n struct user_namespace;\n struct timezone;\n+struct sched_attr;\n \n enum lsm_event {\n \tLSM_POLICY_CHANGE,\n@@ -196,7 +197,9 @@ extern int cap_mmap_addr(unsigned long addr);\n extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);\n extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,\n \t\t\t  unsigned long arg4, unsigned long arg5);\n-extern int cap_task_setscheduler(struct task_struct *p);\n+extern int cap_task_setscheduler(struct task_struct *p,\n+\t\t\t\t const struct sched_attr *attr,\n+\t\t\t\t const struct cpumask *in_mask);\n extern int cap_task_setioprio(struct task_struct *p, int ioprio);\n extern int cap_task_setnice(struct task_struct *p, int nice);\n extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);\n@@ -531,7 +534,9 @@ int security_task_prlimit(const struct cred *cred, const struct cred *tcred,\n \t\t\t  unsigned int flags);\n int security_task_setrlimit(struct task_struct *p, unsigned int resource,\n \t\tstruct rlimit *new_rlim);\n-int security_task_setscheduler(struct task_struct *p);\n+int security_task_setscheduler(struct task_struct *p,\n+\t\t\t       const struct sched_attr *attr,\n+\t\t\t       const struct cpumask *in_mask);\n int security_task_getscheduler(struct task_struct *p);\n int security_task_movememory(struct task_struct *p);\n int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,\n@@ -1393,9 +1398,11 @@ static inline int security_task_setrlimit(struct task_struct *p,\n \treturn 0;\n }\n \n-static inline int security_task_setscheduler(struct task_struct *p)\n+static inline int security_task_setscheduler(struct task_struct *p,\n+\t\t\t\t\t     const struct sched_attr *attr,\n+\t\t\t\t\t     const struct cpumask *in_mask)\n {\n-\treturn cap_task_setscheduler(p);\n+\treturn cap_task_setscheduler(p, attr, in_mask);\n }\n \n static inline int security_task_getscheduler(struct task_struct *p)\ndiff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c\nindex 45944b3e31ca49..6ab47cf5582bc4 100644\n--- a/kernel/cgroup/cpuset.c\n+++ b/kernel/cgroup/cpuset.c\n@@ -3042,7 +3042,7 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)\n \t\t\tgoto out_unlock;\n \n \t\tif (setsched_check) {\n-\t\t\tret = security_task_setscheduler(task);\n+\t\t\tret = security_task_setscheduler(task, NULL, cs-\u003eeffective_cpus);\n \t\t\tif (ret)\n \t\t\t\tgoto out_unlock;\n \t\t}\n@@ -3600,7 +3600,7 @@ static int cpuset_can_fork(struct task_struct *task, struct css_set *cset)\n \tif (ret)\n \t\tgoto out_unlock;\n \n-\tret = security_task_setscheduler(task);\n+\tret = security_task_setscheduler(task, NULL, cs-\u003eeffective_cpus);\n \tif (ret)\n \t\tgoto out_unlock;\n \ndiff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c\nindex b215b0ead9a60b..86490035e81548 100644\n--- a/kernel/sched/syscalls.c\n+++ b/kernel/sched/syscalls.c\n@@ -540,7 +540,7 @@ int __sched_setscheduler(struct task_struct *p,\n \t\tif (attr-\u003esched_flags \u0026 SCHED_FLAG_SUGOV)\n \t\t\treturn -EINVAL;\n \n-\t\tretval = security_task_setscheduler(p);\n+\t\tretval = security_task_setscheduler(p, attr, NULL);\n \t\tif (retval)\n \t\t\treturn retval;\n \t}\n@@ -1213,7 +1213,7 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)\n \t\t\treturn -EPERM;\n \t}\n \n-\tretval = security_task_setscheduler(p);\n+\tretval = security_task_setscheduler(p, NULL, in_mask);\n \tif (retval)\n \t\treturn retval;\n \ndiff --git a/security/commoncap.c b/security/commoncap.c\nindex 3399535808fec7..d83eee0459fede 100644\n--- a/security/commoncap.c\n+++ b/security/commoncap.c\n@@ -1222,13 +1222,18 @@ static int cap_safe_nice(struct task_struct *p)\n /**\n  * cap_task_setscheduler - Determine if scheduler policy change is permitted\n  * @p: The task to affect\n+ * @attr: Requested scheduling attributes (ignored)\n+ * @in_mask: Requested CPU affinity mask (ignored)\n  *\n  * Determine if the requested scheduler policy change is permitted for the\n- * specified task.\n+ * specified task. The capabilities security module does not evaluate the\n+ * @attr or @in_mask parameters, relying solely on cap_safe_nice().\n  *\n  * Return: 0 if permission is granted, -ve if denied.\n  */\n-int cap_task_setscheduler(struct task_struct *p)\n+int cap_task_setscheduler(struct task_struct *p,\n+\t\t\t  const struct sched_attr *attr __always_unused,\n+\t\t\t  const struct cpumask *in_mask __always_unused)\n {\n \treturn cap_safe_nice(p);\n }\ndiff --git a/security/security.c b/security/security.c\nindex 71aea8fdf01429..a6725dddc34fbf 100644\n--- a/security/security.c\n+++ b/security/security.c\n@@ -3240,17 +3240,21 @@ int security_task_setrlimit(struct task_struct *p, unsigned int resource,\n }\n \n /**\n- * security_task_setscheduler() - Check if setting sched policy/param is allowed\n+ * security_task_setscheduler() - Check if setting sched policy/param/affinity is allowed\n  * @p: target task\n+ * @attr: requested scheduling attributes, or NULL if not changing parameters\n+ * @in_mask: requested CPU affinity mask, or NULL if not changing affinity\n  *\n- * Check permission before setting scheduling policy and/or parameters of\n- * process @p.\n+ * Check permission before setting the scheduling policy, parameters, and/or\n+ * CPU affinity of process @p.\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_task_setscheduler(struct task_struct *p)\n+int security_task_setscheduler(struct task_struct *p,\n+\t\t\t       const struct sched_attr *attr,\n+\t\t\t       const struct cpumask *in_mask)\n {\n-\treturn call_int_hook(task_setscheduler, p);\n+\treturn call_int_hook(task_setscheduler, p, attr, in_mask);\n }\n \n /**\ndiff --git a/security/selinux/hooks.c b/security/selinux/hooks.c\nindex 8d6945edae7aac..d77a8d5c364c59 100644\n--- a/security/selinux/hooks.c\n+++ b/security/selinux/hooks.c\n@@ -4559,7 +4559,9 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,\n \treturn 0;\n }\n \n-static int selinux_task_setscheduler(struct task_struct *p)\n+static int selinux_task_setscheduler(struct task_struct *p,\n+\t\t\t\t     const struct sched_attr *attr __always_unused,\n+\t\t\t\t     const struct cpumask *in_mask __always_unused)\n {\n \treturn avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,\n \t\t\t    PROCESS__SETSCHED, NULL);\ndiff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c\nindex ff115068c5c06f..cf28ccc28b8087 100644\n--- a/security/smack/smack_lsm.c\n+++ b/security/smack/smack_lsm.c\n@@ -2338,10 +2338,19 @@ static int smack_task_getioprio(struct task_struct *p)\n /**\n  * smack_task_setscheduler - Smack check on setting scheduler\n  * @p: the task object\n+ * @attr: Requested scheduling attributes (ignored)\n+ * @in_mask: Requested CPU affinity mask (ignored)\n  *\n- * Return 0 if read access is permitted\n+ * Evaluate whether the current task has write access to the target task @p\n+ * to change its scheduling policy. The Smack security module relies\n+ * strictly on label-based access control and does not evaluate CPU\n+ * affinity masks or scheduling attributes.\n+ *\n+ * Return: 0 if write access is permitted\n  */\n-static int smack_task_setscheduler(struct task_struct *p)\n+static int smack_task_setscheduler(struct task_struct *p,\n+\t\t\t\t   const struct sched_attr *attr __always_unused,\n+\t\t\t\t   const struct cpumask *in_mask __always_unused)\n {\n \treturn smk_curacc_on_task(p, MAY_WRITE, __func__);\n }\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only changes the signature of the task_setscheduler LSM hook to pass additional arguments (attr and in_mask). All in-tree LSMs (capability, selinux, smack) are updated to ignore these new arguments, so there is no functional change to the kernel's execution flow.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit d9996f931d633c1b282199f4e519ddce3ee19362
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jul 20 02:18:56 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index 4fead87d2f4330..c7a5d55cf7cad5 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -110,7 +110,7 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
 		goto out_unlock;
 	}
 
-	retval = security_task_setscheduler(p);
+	retval = security_task_setscheduler(p, NULL, new_mask);
 	if (retval)
 		goto out_unlock;
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 780f812590527c..b14401030e5cd5 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2589,7 +2589,7 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,
 		}
 		rcu_read_unlock();
 
-		err = security_task_setscheduler(p);
+		err = security_task_setscheduler(p, NULL, NULL);
 		if (err) {
 			count = err;
 			goto out;
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 65c9609ec20770..80ca02879620a1 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -255,7 +255,9 @@ LSM_HOOK(int, 0, task_prlimit, const struct cred *cred,
 	 const struct cred *tcred, unsigned int flags)
 LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource,
 	 struct rlimit *new_rlim)
-LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p)
+LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p,
+	 const struct sched_attr *attr__nullable,
+	 const struct cpumask *in_mask__nullable)
 LSM_HOOK(int, 0, task_getscheduler, struct task_struct *p)
 LSM_HOOK(int, 0, task_movememory, struct task_struct *p)
 LSM_HOOK(int, 0, task_kill, struct task_struct *p, struct kernel_siginfo *info,
diff --git a/include/linux/security.h b/include/linux/security.h
index 153e9043058f88..82dfe4e3f8d16e 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -82,6 +82,7 @@ struct ctl_table;
 struct audit_krule;
 struct user_namespace;
 struct timezone;
+struct sched_attr;
 
 enum lsm_event {
 	LSM_POLICY_CHANGE,
@@ -196,7 +197,9 @@ extern int cap_mmap_addr(unsigned long addr);
 extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
 extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 			  unsigned long arg4, unsigned long arg5);
-extern int cap_task_setscheduler(struct task_struct *p);
+extern int cap_task_setscheduler(struct task_struct *p,
+				 const struct sched_attr *attr,
+				 const struct cpumask *in_mask);
 extern int cap_task_setioprio(struct task_struct *p, int ioprio);
 extern int cap_task_setnice(struct task_struct *p, int nice);
 extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
@@ -531,7 +534,9 @@ int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
 			  unsigned int flags);
 int security_task_setrlimit(struct task_struct *p, unsigned int resource,
 		struct rlimit *new_rlim);
-int security_task_setscheduler(struct task_struct *p);
+int security_task_setscheduler(struct task_struct *p,
+			       const struct sched_attr *attr,
+			       const struct cpumask *in_mask);
 int security_task_getscheduler(struct task_struct *p);
 int security_task_movememory(struct task_struct *p);
 int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
@@ -1393,9 +1398,11 @@ static inline int security_task_setrlimit(struct task_struct *p,
 	return 0;
 }
 
-static inline int security_task_setscheduler(struct task_struct *p)
+static inline int security_task_setscheduler(struct task_struct *p,
+					     const struct sched_attr *attr,
+					     const struct cpumask *in_mask)
 {
-	return cap_task_setscheduler(p);
+	return cap_task_setscheduler(p, attr, in_mask);
 }
 
 static inline int security_task_getscheduler(struct task_struct *p)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 45944b3e31ca49..6ab47cf5582bc4 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -3042,7 +3042,7 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
 			goto out_unlock;
 
 		if (setsched_check) {
-			ret = security_task_setscheduler(task);
+			ret = security_task_setscheduler(task, NULL, cs->effective_cpus);
 			if (ret)
 				goto out_unlock;
 		}
@@ -3600,7 +3600,7 @@ static int cpuset_can_fork(struct task_struct *task, struct css_set *cset)
 	if (ret)
 		goto out_unlock;
 
-	ret = security_task_setscheduler(task);
+	ret = security_task_setscheduler(task, NULL, cs->effective_cpus);
 	if (ret)
 		goto out_unlock;
 
diff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c
index b215b0ead9a60b..86490035e81548 100644
--- a/kernel/sched/syscalls.c
+++ b/kernel/sched/syscalls.c
@@ -540,7 +540,7 @@ int __sched_setscheduler(struct task_struct *p,
 		if (attr->sched_flags & SCHED_FLAG_SUGOV)
 			return -EINVAL;
 
-		retval = security_task_setscheduler(p);
+		retval = security_task_setscheduler(p, attr, NULL);
 		if (retval)
 			return retval;
 	}
@@ -1213,7 +1213,7 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
 			return -EPERM;
 	}
 
-	retval = security_task_setscheduler(p);
+	retval = security_task_setscheduler(p, NULL, in_mask);
 	if (retval)
 		return retval;
 
diff --git a/security/commoncap.c b/security/commoncap.c
index 3399535808fec7..d83eee0459fede 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -1222,13 +1222,18 @@ static int cap_safe_nice(struct task_struct *p)
 /**
  * cap_task_setscheduler - Determine if scheduler policy change is permitted
  * @p: The task to affect
+ * @attr: Requested scheduling attributes (ignored)
+ * @in_mask: Requested CPU affinity mask (ignored)
  *
  * Determine if the requested scheduler policy change is permitted for the
- * specified task.
+ * specified task. The capabilities security module does not evaluate the
+ * @attr or @in_mask parameters, relying solely on cap_safe_nice().
  *
  * Return: 0 if permission is granted, -ve if denied.
  */
-int cap_task_setscheduler(struct task_struct *p)
+int cap_task_setscheduler(struct task_struct *p,
+			  const struct sched_attr *attr __always_unused,
+			  const struct cpumask *in_mask __always_unused)
 {
 	return cap_safe_nice(p);
 }
diff --git a/security/security.c b/security/security.c
index 71aea8fdf01429..a6725dddc34fbf 100644
--- a/security/security.c
+++ b/security/security.c
@@ -3240,17 +3240,21 @@ int security_task_setrlimit(struct task_struct *p, unsigned int resource,
 }
 
 /**
- * security_task_setscheduler() - Check if setting sched policy/param is allowed
+ * security_task_setscheduler() - Check if setting sched policy/param/affinity is allowed
  * @p: target task
+ * @attr: requested scheduling attributes, or NULL if not changing parameters
+ * @in_mask: requested CPU affinity mask, or NULL if not changing affinity
  *
- * Check permission before setting scheduling policy and/or parameters of
- * process @p.
+ * Check permission before setting the scheduling policy, parameters, and/or
+ * CPU affinity of process @p.
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_task_setscheduler(struct task_struct *p)
+int security_task_setscheduler(struct task_struct *p,
+			       const struct sched_attr *attr,
+			       const struct cpumask *in_mask)
 {
-	return call_int_hook(task_setscheduler, p);
+	return call_int_hook(task_setscheduler, p, attr, in_mask);
 }
 
 /**
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8d6945edae7aac..d77a8d5c364c59 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4559,7 +4559,9 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
 	return 0;
 }
 
-static int selinux_task_setscheduler(struct task_struct *p)
+static int selinux_task_setscheduler(struct task_struct *p,
+				     const struct sched_attr *attr __always_unused,
+				     const struct cpumask *in_mask __always_unused)
 {
 	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 			    PROCESS__SETSCHED, NULL);
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index ff115068c5c06f..cf28ccc28b8087 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2338,10 +2338,19 @@ static int smack_task_getioprio(struct task_struct *p)
 /**
  * smack_task_setscheduler - Smack check on setting scheduler
  * @p: the task object
+ * @attr: Requested scheduling attributes (ignored)
+ * @in_mask: Requested CPU affinity mask (ignored)
  *
- * Return 0 if read access is permitted
+ * Evaluate whether the current task has write access to the target task @p
+ * to change its scheduling policy. The Smack security module relies
+ * strictly on label-based access control and does not evaluate CPU
+ * affinity masks or scheduling attributes.
+ *
+ * Return: 0 if write access is permitted
  */
-static int smack_task_setscheduler(struct task_struct *p)
+static int smack_task_setscheduler(struct task_struct *p,
+				   const struct sched_attr *attr __always_unused,
+				   const struct cpumask *in_mask __always_unused)
 {
 	return smk_curacc_on_task(p, MAY_WRITE, __func__);
 }

gemini-3.1-pro-preview

null

null

							input: 5026
							output: 25
							thoughts: 274
						

**Analyzing the Scheduler Patch**

Okay, so I've got this patch in front of me that's tweaking the `security_task_setscheduler` LSM hook. It looks like it's adding `const struct sched_attr *attr` and `const struct cpumask *in_mask` as new parameters. Right, so this changes the hook definition itself, and the patch has also updated the implementations for `cap_task_setscheduler`, `selinux_task_setscheduler`, and `smack_task_setscheduler`. And looking further, it seems the callers in a few kernel locations, `arch/mips/kernel/mips-mt-fpaff.c`, `fs/proc/base.c`, `kernel/cgroup/cpuset.c`, and `kernel/sched/syscalls.c`, have been updated as well.

But wait, the actual *functionality* here seems pretty minimal, doesn't it? The patch mainly just modifies the signature of the LSM hook and passes along the new arguments. I need to know if this actually *uses* those arguments in any meaningful way within an LSM. Let's delve into the implementations, shall we?

Alright, let's take a look. `cap_task_setscheduler`… yep, both new arguments are marked as `__always_unused`. Same goes for `selinux_task_setscheduler` – unused. And `smack_task_setscheduler`? Yep, unused as well. So it appears none of the default implementations actually *do* anything with the new parameters.

Okay, let's make sure we've explored all the possibilities. Are there any other LSMs that implement `task_setscheduler`? I'll run a quick search through `security/` to see if there are any other implementations I haven't considered.

{
  "Expression": "LSM_HOOK_INIT\\(task_setscheduler"
}

{
  "Output": "security/commoncap.c=1495=static struct security_hook_list capability_hooks[] __ro_after_init = {\n--\nsecurity/commoncap.c-1508-\tLSM_HOOK_INIT(task_prctl, cap_task_prctl),\nsecurity/commoncap.c:1509:\tLSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),\nsecurity/commoncap.c-1510-\tLSM_HOOK_INIT(task_setioprio, cap_task_setioprio),\n--\nsecurity/selinux/hooks.c=7555=static struct security_hook_list selinux_hooks[] __ro_after_init = {\n--\nsecurity/selinux/hooks.c-7666-\tLSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),\nsecurity/selinux/hooks.c:7667:\tLSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),\nsecurity/selinux/hooks.c-7668-\tLSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),\n--\nsecurity/smack/smack_lsm.c=5133=static struct security_hook_list smack_hooks[] __ro_after_init = {\n--\nsecurity/smack/smack_lsm.c-5200-\tLSM_HOOK_INIT(task_getioprio, smack_task_getioprio),\nsecurity/smack/smack_lsm.c:5201:\tLSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),\nsecurity/smack/smack_lsm.c-5202-\tLSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),\n"
}

gemini-3.1-pro-preview

null

null

							input: 6185
							output: 19
							thoughts: 858
						

**Fuzzing Feasibility of the LSM Hook Change**

Okay, let's break this down. My initial reaction is to think about BPF LSM. This patch introduces `attr` and `in_mask` to the `task_setscheduler` LSM hook via `lsm_hook_defs.h`. This means BPF programs can now attach and potentially access those arguments. But, does this patch *itself* fundamentally change kernel behavior? No, it's just passing the pointers; existing LSMs will just ignore them.

So, is this fuzzable? Well, passing `attr` and `in_mask` to the hook *could* enable new BPF LSM functionality, but the core kernel logic remains untouched beyond the pointer passing.

Now, a critical question: could passing these arguments *cause* issues? Looking at the code in `kernel/sched/syscalls.c`, `kernel/cgroup/cpuset.c`, `fs/proc/base.c` and `arch/mips/kernel/mips-mt-fpaff.c` this change doesn't alter how the hook is called, only *what* is passed to it. The only real change is in what BPF LSM can do.

Okay, so the real functional change is solely that BPF LSM gains access to `attr` and `in_mask`. What about other LSMs? AppArmor, Tomoyo, Yama, LoadPin, SafeSetID, LockDown, and Landlock? None of those implement `task_setscheduler`.

So, it boils down to BPF LSM. Is this fuzzable? Normally, I'd say "not really" if a patch *just* adds arguments to an LSM hook, and all in-tree LSMs ignore them. The kernel's execution flow isn't significantly altered in a way that Syzkaller can easily trigger a bug. Unless there's a problem with the pointer passing itself, but `attr` and `in_mask` are kernel pointers.

Ah, wait, `attr` is a pointer to `struct sched_attr`, which is user-space copied in `sched_setattr`, which means it is a kernel pointer.

So, am I saying WorthFuzzing=false? My reasoning would be: this patch only modifies the `task_setscheduler` LSM hook signature to pass additional arguments. All existing LSMs ignore these new arguments. So, there is no functional change to the kernel's execution flow. However... what about BPF programs? Syzkaller *does* fuzz BPF. However, the patch itself doesn't introduce any new logic that can crash.

Let me double-check `__sched_setscheduler` again in `kernel/sched/syscalls.c`... Okay, still seems like this patch doesn't introduce any new attack surface beyond what already exists for BPF LSM. Ultimately, it provides more data for a BPF program but doesn't, on its own, create new vulnerabilities.

{
  "Expression": "__sched_setscheduler"
}

{
  "Output": "kernel/sched/autogroup.c=87=static inline struct autogroup *autogroup_create(void)\n--\nkernel/sched/autogroup.c-107-\t * or flail around trying to allocate bandwidth on the fly.\nkernel/sched/autogroup.c:108:\t * A bandwidth exception in __sched_setscheduler() allows\nkernel/sched/autogroup.c-109-\t * the policy change to proceed.\n--\nkernel/sched/core.c=551=int task_llc(const struct task_struct *p)\n--\nkernel/sched/core.c-591- *  - set_user_nice():\t\tp-\u003ese.load, p-\u003e*prio\nkernel/sched/core.c:592: *  - __sched_setscheduler():\tp-\u003esched_class, p-\u003epolicy, p-\u003e*prio,\nkernel/sched/core.c-593- *\t\t\t\tp-\u003ese.load, p-\u003ert_priority,\n--\nkernel/sched/core.c=9265=void normalize_rt_tasks(void)\n--\nkernel/sched/core.c-9294-\nkernel/sched/core.c:9295:\t\t__sched_setscheduler(p, \u0026attr, false, false);\nkernel/sched/core.c-9296-\t}\n--\nkernel/sched/sched.h=4160=static inline int rt_effective_prio(struct task_struct *p, int prio)\n--\nkernel/sched/sched.h-4166-\nkernel/sched/sched.h:4167:extern int __sched_setscheduler(struct task_struct *p, const struct sched_attr *attr, bool user, bool pi);\nkernel/sched/sched.h-4168-extern int __sched_setaffinity(struct task_struct *p, struct affinity_context *ctx);\n--\nkernel/sched/syscalls.c=241=static void __setscheduler_params(struct task_struct *p,\n--\nkernel/sched/syscalls.c-264-\t/*\nkernel/sched/syscalls.c:265:\t * __sched_setscheduler() ensures attr-\u003esched_priority == 0 when\nkernel/sched/syscalls.c-266-\t * !rt_policy. Always setting this ensures that things like\n--\nkernel/sched/syscalls.c=435=static int user_check_sched_setscheduler(struct task_struct *p,\n--\nkernel/sched/syscalls.c-492-\nkernel/sched/syscalls.c:493:int __sched_setscheduler(struct task_struct *p,\nkernel/sched/syscalls.c-494-\t\t\t const struct sched_attr *attr,\n--\nkernel/sched/syscalls.c=725=static int _sched_setscheduler(struct task_struct *p, int policy,\n--\nkernel/sched/syscalls.c-743-\nkernel/sched/syscalls.c:744:\treturn __sched_setscheduler(p, \u0026attr, check, true);\nkernel/sched/syscalls.c-745-}\n--\nkernel/sched/syscalls.c=764=int sched_setattr(struct task_struct *p, const struct sched_attr *attr)\nkernel/sched/syscalls.c-765-{\nkernel/sched/syscalls.c:766:\treturn __sched_setscheduler(p, attr, true, true);\nkernel/sched/syscalls.c-767-}\n--\nkernel/sched/syscalls.c=769=int sched_setattr_nocheck(struct task_struct *p, const struct sched_attr *attr)\nkernel/sched/syscalls.c-770-{\nkernel/sched/syscalls.c:771:\treturn __sched_setscheduler(p, attr, false, true);\nkernel/sched/syscalls.c-772-}\n"
}

gemini-3.1-pro-preview

null

null

							input: 8662
							output: 18
							thoughts: 191
						

**My Assessment of the Patch**

Okay, so this patch is straightforward. Essentially, it boils down to *just* adding two more arguments – `attr` and `in_mask` – to the `task_setscheduler` LSM hook and then updating all the places that call it. The beauty of it is that it doesn't actually alter the kernel's fundamental logic. Given this, I can confidently mark this as WorthFuzzing=false.

My reasoning? The in-tree LSMs, the ones we ship with the kernel – like capability, SELinux, and Smack – have been updated to *ignore* these newly introduced arguments. The code is structured in a way that avoids functional changes. This refactoring won't open any new attack surfaces or reveal any interesting, fuzzable behavior.

Just to be absolutely sure, I did a quick sweep through the codebase to verify there aren't any other, perhaps less obvious, LSM integrations. I looked for `LSM_HOOK_INIT(task_setscheduler` and confirmed it's only used in `security/commoncap.c`, `security/selinux/hooks.c`, and `security/smack/smack_lsm.c`. I am confident there are no other integrations to worry about.

{
  "Expression": "task_setscheduler"
}

{
  "Output": "arch/mips/kernel/mips-mt-fpaff.c=66=asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,\n--\narch/mips/kernel/mips-mt-fpaff.c-112-\narch/mips/kernel/mips-mt-fpaff.c:113:\tretval = security_task_setscheduler(p, NULL, new_mask);\narch/mips/kernel/mips-mt-fpaff.c-114-\tif (retval)\n--\nfs/proc/base.c=2567=static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,\n--\nfs/proc/base.c-2591-\nfs/proc/base.c:2592:\t\terr = security_task_setscheduler(p, NULL, NULL);\nfs/proc/base.c-2593-\t\tif (err) {\n--\ninclude/linux/lsm_hook_defs.h=256=LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource,\ninclude/linux/lsm_hook_defs.h-257-\t struct rlimit *new_rlim)\ninclude/linux/lsm_hook_defs.h:258:LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p,\ninclude/linux/lsm_hook_defs.h-259-\t const struct sched_attr *attr__nullable,\n--\ninclude/linux/security.h=198=extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,\ninclude/linux/security.h-199-\t\t\t  unsigned long arg4, unsigned long arg5);\ninclude/linux/security.h:200:extern int cap_task_setscheduler(struct task_struct *p,\ninclude/linux/security.h-201-\t\t\t\t const struct sched_attr *attr,\n--\ninclude/linux/security.h=535=int security_task_setrlimit(struct task_struct *p, unsigned int resource,\ninclude/linux/security.h-536-\t\tstruct rlimit *new_rlim);\ninclude/linux/security.h:537:int security_task_setscheduler(struct task_struct *p,\ninclude/linux/security.h-538-\t\t\t       const struct sched_attr *attr,\n--\ninclude/linux/security.h=1394=static inline int security_task_setrlimit(struct task_struct *p,\n--\ninclude/linux/security.h-1400-\ninclude/linux/security.h:1401:static inline int security_task_setscheduler(struct task_struct *p,\ninclude/linux/security.h-1402-\t\t\t\t\t     const struct sched_attr *attr,\n--\ninclude/linux/security.h-1404-{\ninclude/linux/security.h:1405:\treturn cap_task_setscheduler(p, attr, in_mask);\ninclude/linux/security.h-1406-}\n--\nkernel/bpf/bpf_lsm.c=383=BTF_ID(func, bpf_lsm_task_prctl)\nkernel/bpf/bpf_lsm.c:384:BTF_ID(func, bpf_lsm_task_setscheduler)\nkernel/bpf/bpf_lsm.c-385-BTF_ID(func, bpf_lsm_userns_create)\n--\nkernel/cgroup/cpuset.c=3000=static int cpuset_can_attach(struct cgroup_taskset *tset)\n--\nkernel/cgroup/cpuset.c-3044-\t\tif (setsched_check) {\nkernel/cgroup/cpuset.c:3045:\t\t\tret = security_task_setscheduler(task, NULL, cs-\u003eeffective_cpus);\nkernel/cgroup/cpuset.c-3046-\t\t\tif (ret)\n--\nkernel/cgroup/cpuset.c=3578=static int cpuset_can_fork(struct task_struct *task, struct css_set *cset)\n--\nkernel/cgroup/cpuset.c-3602-\nkernel/cgroup/cpuset.c:3603:\tret = security_task_setscheduler(task, NULL, cs-\u003eeffective_cpus);\nkernel/cgroup/cpuset.c-3604-\tif (ret)\n--\nkernel/sched/syscalls.c=493=int __sched_setscheduler(struct task_struct *p,\n--\nkernel/sched/syscalls.c-542-\nkernel/sched/syscalls.c:543:\t\tretval = security_task_setscheduler(p, attr, NULL);\nkernel/sched/syscalls.c-544-\t\tif (retval)\n--\nkernel/sched/syscalls.c=1197=long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)\n--\nkernel/sched/syscalls.c-1215-\nkernel/sched/syscalls.c:1216:\tretval = security_task_setscheduler(p, NULL, in_mask);\nkernel/sched/syscalls.c-1217-\tif (retval)\n--\nsecurity/commoncap.c=1159=int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)\n--\nsecurity/commoncap.c-1198-/*\nsecurity/commoncap.c:1199: * Rationale: code calling task_setscheduler, task_setioprio, and\nsecurity/commoncap.c-1200- * task_setnice, assumes that\n--\nsecurity/commoncap.c=1208=static int cap_safe_nice(struct task_struct *p)\n--\nsecurity/commoncap.c-1222-/**\nsecurity/commoncap.c:1223: * cap_task_setscheduler - Determine if scheduler policy change is permitted\nsecurity/commoncap.c-1224- * @p: The task to affect\n--\nsecurity/commoncap.c-1233- */\nsecurity/commoncap.c:1234:int cap_task_setscheduler(struct task_struct *p,\nsecurity/commoncap.c-1235-\t\t\t  const struct sched_attr *attr __always_unused,\n--\nsecurity/commoncap.c=1495=static struct security_hook_list capability_hooks[] __ro_after_init = {\n--\nsecurity/commoncap.c-1508-\tLSM_HOOK_INIT(task_prctl, cap_task_prctl),\nsecurity/commoncap.c:1509:\tLSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),\nsecurity/commoncap.c-1510-\tLSM_HOOK_INIT(task_setioprio, cap_task_setioprio),\n--\nsecurity/security.c=3236=int security_task_setrlimit(struct task_struct *p, unsigned int resource,\n--\nsecurity/security.c-3242-/**\nsecurity/security.c:3243: * security_task_setscheduler() - Check if setting sched policy/param/affinity is allowed\nsecurity/security.c-3244- * @p: target task\n--\nsecurity/security.c-3252- */\nsecurity/security.c:3253:int security_task_setscheduler(struct task_struct *p,\nsecurity/security.c-3254-\t\t\t       const struct sched_attr *attr,\n--\nsecurity/security.c-3256-{\nsecurity/security.c:3257:\treturn call_int_hook(task_setscheduler, p, attr, in_mask);\nsecurity/security.c-3258-}\n--\nsecurity/selinux/hooks.c=4546=static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,\n--\nsecurity/selinux/hooks.c-4561-\nsecurity/selinux/hooks.c:4562:static int selinux_task_setscheduler(struct task_struct *p,\nsecurity/selinux/hooks.c-4563-\t\t\t\t     const struct sched_attr *attr __always_unused,\n--\nsecurity/selinux/hooks.c=7555=static struct security_hook_list selinux_hooks[] __ro_after_init = {\n--\nsecurity/selinux/hooks.c-7666-\tLSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),\nsecurity/selinux/hooks.c:7667:\tLSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),\nsecurity/selinux/hooks.c-7668-\tLSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),\n--\nsecurity/smack/smack_lsm.c=2333=static int smack_task_getioprio(struct task_struct *p)\n--\nsecurity/smack/smack_lsm.c-2338-/**\nsecurity/smack/smack_lsm.c:2339: * smack_task_setscheduler - Smack check on setting scheduler\nsecurity/smack/smack_lsm.c-2340- * @p: the task object\n--\nsecurity/smack/smack_lsm.c-2350- */\nsecurity/smack/smack_lsm.c:2351:static int smack_task_setscheduler(struct task_struct *p,\nsecurity/smack/smack_lsm.c-2352-\t\t\t\t   const struct sched_attr *attr __always_unused,\n--\nsecurity/smack/smack_lsm.c=5133=static struct security_hook_list smack_hooks[] __ro_after_init = {\n--\nsecurity/smack/smack_lsm.c-5200-\tLSM_HOOK_INIT(task_getioprio, smack_task_getioprio),\nsecurity/smack/smack_lsm.c:5201:\tLSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),\nsecurity/smack/smack_lsm.c-5202-\tLSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),\n--\ntools/testing/selftests/cgroup/test_cpuset.c=30=static int do_controller_fn(const char *cgroup, void *arg)\n--\ntools/testing/selftests/cgroup/test_cpuset.c-59- * migrated process itself (cpuset controller is in place because it uses\ntools/testing/selftests/cgroup/test_cpuset.c:60: * security_task_setscheduler() in cgroup v1).\ntools/testing/selftests/cgroup/test_cpuset.c-61- *\n"
}

gemini-3.1-pro-preview

null

null

							input: 11900
							output: 93
							thoughts: 135
						

**My Assessment of the Patch's Impact**

Alright, based on my understanding, I'm comfortable stating this patch doesn't warrant fuzzing from a functional perspective. My evaluation is that it only modifies the signature of the `task_setscheduler` LSM hook. Crucially, it's adding arguments, `attr` and `in_mask`, but all of the in-tree LSMs are already updated to simply disregard these new parameters. Therefore, there's zero alteration to the kernel's operational flow; no new code paths are introduced and no existing logic is altered. My conclusion is straightforward: this patch doesn't unlock new fuzzing targets within the kernel.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only changes the signature of the task_setscheduler LSM hook to pass additional arguments (attr and in_mask). All in-tree LSMs (capability, selinux, smack) are updated to ignore these new arguments, so there is no functional change to the kernel's execution flow.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only changes the signature of the task_setscheduler LSM hook to pass additional arguments (attr and in_mask). All in-tree LSMs (capability, selinux, smack) are updated to ignore these new arguments, so there is no functional change to the kernel's execution flow.",
  "WorthFuzzing": false
}