| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/26 21:46 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch only modifies user-space files in tools/bpf/bpftool and tools/testing/selftests/bpf (adding a recursive dump option to bpftool and associated selftests). It does not alter any code compiled into the kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/26 21:46 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit a04d9884807a16feb64ede2ff22e7b9b0687630f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sat Sep 26 21:46:19 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst\nindex e4ed7e701c9e4..0b804926d829c 100644\n--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst\n+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst\n@@ -16,7 +16,8 @@ SYNOPSIS\n \n **bpftool** [*OPTIONS*] **map** *COMMAND*\n \n-*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }\n+*OPTIONS* := { |COMMON_OPTIONS| |\n+{ **-f** | **--bpffs** } | { **-n** | **--nomount** } }\n \n *COMMANDS* :=\n { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |\n@@ -29,7 +30,7 @@ MAP COMMANDS\n | **bpftool** **map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* \\\n | **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] \\\n | [**offload_dev** *NAME*]\n-| **bpftool** **map dump** *MAP*\n+| **bpftool** **map dump** *MAP* [**recursive**]\n | **bpftool** **map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*]\n | **bpftool** **map lookup** *MAP* [**key** *DATA*]\n | **bpftool** **map getnext** *MAP* [**key** *DATA*]\n@@ -87,10 +88,18 @@ bpftool map create *FILE* type *TYPE* key *KEY_SIZE* value *VALUE_SIZE* entries\n Keyword **offload_dev** expects a network interface name, and is used to\n request hardware offload for the map.\n \n-bpftool map dump *MAP*\n+bpftool map dump *MAP* [recursive]\n Dump all entries in a given *MAP*. In case of **name**, *MAP* may match\n several maps which will all be dumped.\n \n+ With **recursive**, also dump the inner maps referenced by **array_of_maps**\n+ and **hash_of_maps** entries. Each map ID is visited once, even if several\n+ entries refer to it. Selected maps are followed by their inner maps.\n+\n+ Inner map IDs are resolved when the maps are visited. The dump is not an\n+ atomic snapshot: concurrent updates can change map contents or remove a\n+ referenced inner map before it is visited.\n+\n bpftool map update *MAP* [key *DATA*] [value *VALUE*] [*UPDATE_FLAGS*]\n Update map entry for a given *KEY*.\n \ndiff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool\nindex c9e8761e4ef2a..c78339e825cf0 100644\n--- a/tools/bpf/bpftool/bash-completion/bpftool\n+++ b/tools/bpf/bpftool/bash-completion/bpftool\n@@ -718,6 +718,9 @@ _bpftool()\n return 0\n ;;\n *)\n+ if [[ $command == dump \u0026\u0026 $cword -eq 5 ]]; then\n+ COMPREPLY=( $( compgen -W 'recursive' -- \"$cur\" ) )\n+ fi\n return 0\n ;;\n esac\ndiff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c\nindex 20d59eab09a12..ef47de7da200f 100644\n--- a/tools/bpf/bpftool/map.c\n+++ b/tools/bpf/bpftool/map.c\n@@ -17,6 +17,7 @@\n #include \u003cbpf/bpf.h\u003e\n #include \u003cbpf/btf.h\u003e\n #include \u003cbpf/hashmap.h\u003e\n+#include \u003cbpf/libbpf_internal.h\u003e\n \n #include \"json_writer.h\"\n #include \"main.h\"\n@@ -827,12 +828,43 @@ static void free_map_kv_btf(struct btf *btf)\n \t\tbtf__free(btf);\n }\n \n+struct map_dump_ctx {\n+\tstruct hashmap *seen;\n+\t__u32 *pending_ids;\n+\tsize_t pending_cnt;\n+\tsize_t pending_cap;\n+};\n+\n+static int collect_inner_map(struct map_dump_ctx *ctx, __u32 id)\n+{\n+\tint err;\n+\n+\tif (hashmap__find(ctx-\u003eseen, id, NULL))\n+\t\treturn 0;\n+\n+\terr = libbpf_ensure_mem((void **)\u0026ctx-\u003epending_ids, \u0026ctx-\u003epending_cap,\n+\t\t\t\t sizeof(*ctx-\u003epending_ids), ctx-\u003epending_cnt + 1);\n+\tif (err) {\n+\t\tp_err(\"mem alloc failed\");\n+\t\treturn -1;\n+\t}\n+\n+\terr = hashmap__add(ctx-\u003eseen, id, 0);\n+\tif (err) {\n+\t\tp_err(\"failed to record inner map id %u: %s\", id, strerror(-err));\n+\t\treturn -1;\n+\t}\n+\tctx-\u003epending_ids[ctx-\u003epending_cnt++] = id;\n+\treturn 0;\n+}\n+\n static int\n map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n-\t bool show_header)\n+\t bool show_header, struct map_dump_ctx *ctx)\n {\n \tvoid *key, *value, *prev_key;\n \tunsigned int num_elems = 0;\n+\tjson_writer_t *plain_btf_wtr = NULL;\n \tstruct btf *btf = NULL;\n \tint *cpu_ids = NULL;\n \tint cpu_cnt = 0;\n@@ -856,6 +888,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \t\t}\n \t}\n \n+\tif (ctx \u0026\u0026 !wtr \u0026\u0026 (info-\u003ebtf_value_type_id ||\n+\t\t\t info-\u003ebtf_vmlinux_value_type_id)) {\n+\t\tplain_btf_wtr = get_btf_writer();\n+\t\tif (plain_btf_wtr) {\n+\t\t\tif (show_header)\n+\t\t\t\tshow_map_header_plain(info);\n+\t\t\tshow_header = false;\n+\t\t\twtr = plain_btf_wtr;\n+\t\t}\n+\t}\n+\n \tif (wtr) {\n \t\terr = get_map_kv_btf(info, \u0026btf);\n \t\tif (err) {\n@@ -885,11 +928,21 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \t\tif (err) {\n \t\t\tif (errno == ENOENT)\n \t\t\t\terr = 0;\n+\t\t\telse if (ctx)\n+\t\t\t\tp_err(\"can't get next key for map id %u: %s\",\n+\t\t\t\t info-\u003eid, strerror(errno));\n \t\t\tbreak;\n \t\t}\n-\t\tif (!dump_map_elem(fd, key, value, info, btf, wtr,\n-\t\t\t\t cpu_ids, cpu_cnt))\n+\t\terr = dump_map_elem(fd, key, value, info, btf, wtr,\n+\t\t\t\t cpu_ids, cpu_cnt);\n+\t\tif (!err) {\n \t\t\tnum_elems++;\n+\t\t\tif (ctx \u0026\u0026 map_is_map_of_maps(info-\u003etype)) {\n+\t\t\t\terr = collect_inner_map(ctx, *(__u32 *)value);\n+\t\t\t\tif (err)\n+\t\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n \t\tprev_key = key;\n \t}\n \n@@ -907,21 +960,37 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \tfree(value);\n \tfree(cpu_ids);\n \tfree_map_kv_btf(btf);\n+\tif (plain_btf_wtr)\n+\t\tjsonw_destroy(\u0026plain_btf_wtr);\n \n \treturn err;\n }\n \n static int do_dump(int argc, char **argv)\n {\n+\tLIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,\n+\t\t .open_flags = BPF_F_RDONLY,\n+\t);\n \tjson_writer_t *wtr = NULL, *btf_wtr = NULL;\n \tstruct bpf_map_info info = {};\n+\tstruct map_dump_ctx ctx = {};\n+\tbool recursive_dump = false;\n \tint nb_fds, i = 0;\n \t__u32 len = sizeof(info);\n \tint *fds = NULL;\n \tint err = -1;\n+\tsize_t j;\n \n-\tif (argc != 2)\n+\tif (argc != 2 \u0026\u0026 argc != 3)\n \t\tusage();\n+\tif (argc == 3) {\n+\t\tif (!*argv[2] || !is_prefix(argv[2], \"recursive\")) {\n+\t\t\tp_err(\"expected 'recursive', got: '%s'\", argv[2]);\n+\t\t\treturn -1;\n+\t\t}\n+\t\trecursive_dump = true;\n+\t\targc--;\n+\t}\n \n \tfds = malloc(sizeof(int));\n \tif (!fds) {\n@@ -932,9 +1001,35 @@ static int do_dump(int argc, char **argv)\n \tif (nb_fds \u003c 1)\n \t\tgoto exit_free;\n \n+\tif (recursive_dump) {\n+\t\tctx.seen = hashmap__new(hash_fn_for_key_as_id,\n+\t\t\t\t\tequal_fn_for_key_as_id, NULL);\n+\t\tif (IS_ERR(ctx.seen)) {\n+\t\t\tctx.seen = NULL;\n+\t\t\tp_err(\"failed to create hashmap for recursive dump\");\n+\t\t\tgoto exit_close;\n+\t\t}\n+\t\t/* Record the selected maps before discovering any inner maps. */\n+\t\tfor (i = 0; i \u003c nb_fds; i++) {\n+\t\t\tlen = sizeof(info);\n+\t\t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n+\t\t\t\tp_err(\"can't get map info: %s\", strerror(errno));\n+\t\t\t\terr = -1;\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t\terr = hashmap__add(ctx.seen, info.id, 0);\n+\t\t\tif (err) {\n+\t\t\t\tp_err(\"failed to record map id %u: %s\", info.id,\n+\t\t\t\t strerror(-err));\n+\t\t\t\terr = -1;\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t}\n+\t}\n+\n \tif (json_output) {\n \t\twtr = json_wtr;\n-\t} else {\n+\t} else if (!recursive_dump) {\n \t\tint do_plain_btf;\n \n \t\tdo_plain_btf = maps_have_btf(fds, nb_fds);\n@@ -949,7 +1044,7 @@ static int do_dump(int argc, char **argv)\n \t\t}\n \t}\n \n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 || recursive_dump))\n \t\tjsonw_start_array(wtr);\t/* root array */\n \tfor (i = 0; i \u003c nb_fds; i++) {\n \t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n@@ -957,22 +1052,50 @@ static int do_dump(int argc, char **argv)\n \t\t\terr = -1;\n \t\t\tbreak;\n \t\t}\n-\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1);\n+\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1 || recursive_dump,\n+\t\t\t recursive_dump ? \u0026ctx : NULL);\n \t\tif (!wtr \u0026\u0026 i != nb_fds - 1)\n \t\t\tprintf(\"\\n\");\n \n \t\tif (err)\n \t\t\tbreak;\n-\t\tclose(fds[i]);\n+\t\t/* Keep selected maps alive while visiting their inner maps. */\n+\t\tif (!recursive_dump)\n+\t\t\tclose(fds[i]);\n+\t}\n+\tfor (j = 0; !err \u0026\u0026 j \u003c ctx.pending_cnt; j++) {\n+\t\tint fd;\n+\n+\t\tfd = bpf_map_get_fd_by_id_opts(ctx.pending_ids[j], \u0026opts);\n+\t\tif (fd \u003c 0) {\n+\t\t\tp_err(\"can't open inner map id %u: %s\",\n+\t\t\t ctx.pending_ids[j], strerror(errno));\n+\t\t\terr = -1;\n+\t\t\tbreak;\n+\t\t}\n+\t\tlen = sizeof(info);\n+\t\tif (bpf_map_get_info_by_fd(fd, \u0026info, \u0026len)) {\n+\t\t\tp_err(\"can't get map info: %s\", strerror(errno));\n+\t\t\terr = -1;\n+\t\t} else {\n+\t\t\tif (!wtr)\n+\t\t\t\tprintf(\"\\n\");\n+\t\t\terr = map_dump(fd, \u0026info, wtr, true, \u0026ctx);\n+\t\t}\n+\t\tclose(fd);\n \t}\n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 || recursive_dump))\n \t\tjsonw_end_array(wtr);\t/* root array */\n \n \tif (btf_wtr)\n \t\tjsonw_destroy(\u0026btf_wtr);\n exit_close:\n+\tif (recursive_dump)\n+\t\ti = 0;\n \tfor (; i \u003c nb_fds; i++)\n \t\tclose(fds[i]);\n+\thashmap__free(ctx.seen);\n+\tfree(ctx.pending_ids);\n exit_free:\n \tfree(fds);\n \tfree_btf_vmlinux();\n@@ -1484,7 +1607,7 @@ static int do_help(int argc, char **argv)\n \t\t\" %1$s %2$s create FILE type TYPE key KEY_SIZE value VALUE_SIZE \\\\\\n\"\n \t\t\" entries MAX_ENTRIES name NAME [flags FLAGS] \\\\\\n\"\n \t\t\" [inner_map MAP] [offload_dev NAME]\\n\"\n-\t\t\" %1$s %2$s dump MAP\\n\"\n+\t\t\" %1$s %2$s dump MAP [recursive]\\n\"\n \t\t\" %1$s %2$s update MAP [key DATA] [value VALUE] [UPDATE_FLAGS]\\n\"\n \t\t\" %1$s %2$s lookup MAP [key DATA]\\n\"\n \t\t\" %1$s %2$s getnext MAP [key DATA]\\n\"\ndiff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\nnew file mode 100644\nindex 0000000000000..d36aaa6580101\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\n@@ -0,0 +1,507 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+#include \u003ctest_progs.h\u003e\n+#include \u003cbpftool_helpers.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+#include \u003csys/resource.h\u003e\n+#include \u003cdirent.h\u003e\n+\n+#define OUTPUT_SIZE 8192\n+#define MANY_MAPS_OUTPUT_SIZE 65536\n+\n+static bool dump_map(__u32 id, const char *options, bool recursive, char *output)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\n+\tsnprintf(command, sizeof(command), \"%s map dump id %u%s\", options, id,\n+\t\t recursive ? \" recursive\" : \"\");\n+\tmemset(output, 0, OUTPUT_SIZE);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),\n+\t\t \"dump_map\"))\n+\t\treturn false;\n+\t/* The helper leaves the trailing newline in place. */\n+\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\treturn true;\n+}\n+\n+static __u32 map_id(int fd)\n+{\n+\tstruct bpf_map_info info = {};\n+\t__u32 len = sizeof(info);\n+\n+\tif (!ASSERT_OK(bpf_map_get_info_by_fd(fd, \u0026info, \u0026len), \"map_info\"))\n+\t\treturn 0;\n+\treturn info.id;\n+}\n+\n+static int count_token(const char *output, const char *token)\n+{\n+\tint count = 0;\n+\n+\twhile ((output = strstr(output, token))) {\n+\t\tcount++;\n+\t\toutput += strlen(token);\n+\t}\n+\treturn count;\n+}\n+\n+static void check_plain(__u32 root_id, __u32 inner_id, const char *type,\n+\t\t\tint entries, bool typed)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN], header[128];\n+\tchar output[OUTPUT_SIZE] = {};\n+\tconst char *root, *inner;\n+\n+\tsnprintf(command, sizeof(command), \"map dump id %u recursive\", root_id);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"plain_dump\"))\n+\t\treturn;\n+\tsnprintf(header, sizeof(header), \"%u: %s name dump_outer \", root_id, type);\n+\troot = strstr(output, header);\n+\tif (!ASSERT_OK_PTR(root, \"plain_root_header\"))\n+\t\treturn;\n+\tASSERT_EQ(root - output, 0, \"plain_root_first\");\n+\tASSERT_EQ(count_token(output, \"inner_map_id:\"), entries, \"plain_references\");\n+\tif (entries) {\n+\t\tsnprintf(header, sizeof(header), \"%u: hash name dump_inner \", inner_id);\n+\t\tinner = strstr(output, header);\n+\t\tif (ASSERT_OK_PTR(inner, \"plain_inner_header\"))\n+\t\t\tASSERT_GT(inner - root, 0, \"plain_inner_after_root\");\n+\t\tASSERT_EQ(count_token(output, header), 1, \"plain_inner_once\");\n+\t}\n+\tASSERT_EQ(count_token(output, \"Found \"), entries \u0026\u0026 !typed ? 2 : 1,\n+\t\t \"plain_map_count\");\n+\tif (typed) {\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"key\\\": 0\", \"plain_btf_key\");\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"value\\\": 16843009\", \"plain_btf_value\");\n+\t}\n+}\n+\n+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,\n+\t\t bool typed)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tLIBBPF_OPTS(bpf_map_create_opts, inner_opts);\n+\tstruct btf *btf = NULL;\n+\tchar outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];\n+\tchar expected[OUTPUT_SIZE * 3], reference[64];\n+\tconst char *type_name = libbpf_bpf_map_type_str(type);\n+\tint inner_fd = -1, outer_fd = -1;\n+\t__u32 root_id, inner_id, key, value = 0x01010101;\n+\n+\tif (typed) {\n+\t\tbtf = btf__new_empty();\n+\t\tif (!ASSERT_OK_PTR(btf, \"create_btf\") ||\n+\t\t !ASSERT_EQ(btf__add_int(btf, \"unsigned int\", 4, 0), 1, \"btf_int\") ||\n+\t\t !ASSERT_OK(btf__load_into_kernel(btf), \"load_btf\"))\n+\t\t\tgoto out;\n+\t\tinner_opts.btf_fd = btf__fd(btf);\n+\t\tinner_opts.btf_key_type_id = 1;\n+\t\tinner_opts.btf_value_type_id = 1;\n+\t}\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", sizeof(key),\n+\t\t\t\t sizeof(value), 2, \u0026inner_opts);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_inner\"))\n+\t\tgoto out;\n+\tkey = 0;\n+\tif (!empty_inner \u0026\u0026\n+\t !ASSERT_OK(bpf_map_update_elem(inner_fd, \u0026key, \u0026value, BPF_ANY),\n+\t\t \"populate_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = inner_fd;\n+\touter_fd = bpf_map_create(type, \"dump_outer\", sizeof(key), sizeof(__u32),\n+\t\t\t\t 3, \u0026opts);\n+\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\"))\n+\t\tgoto out;\n+\t/* For arrays, unused slots also exercise failed lookups. */\n+\tfor (key = 0; key \u003c entries; key++)\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\troot_id = map_id(outer_fd);\n+\tinner_id = map_id(inner_fd);\n+\tif (!root_id || !inner_id || !dump_map(root_id, \"-j\", false, outer) ||\n+\t !dump_map(inner_id, \"-j\", false, inner))\n+\t\tgoto out;\n+\n+\tASSERT_EQ(outer[0], '[', \"default_array\");\n+\tASSERT_EQ(count_token(outer, \"\\\"elements\\\":\"), 0, \"default_no_wrapper\");\n+\tASSERT_EQ(count_token(outer, \"\\\"id\\\":\"), 0, \"default_no_header\");\n+\tsnprintf(reference, sizeof(reference), \"\\\"inner_map_id\\\":%u\", inner_id);\n+\tASSERT_EQ(count_token(outer, reference), entries, \"default_references\");\n+\tif (!entries)\n+\t\tASSERT_STREQ(outer, \"[]\", \"empty_outer_default\");\n+\tif (empty_inner)\n+\t\tASSERT_STREQ(inner, \"[]\", \"empty_inner_default\");\n+\telse if (typed)\n+\t\tASSERT_HAS_SUBSTR(inner, \"\\\"formatted\\\":{\\\"key\\\":0,\\\"value\\\":16843009}\",\n+\t\t\t\t \"typed_inner\");\n+\telse\n+\t\tASSERT_STREQ(inner,\n+\t\t\t \"[{\\\"key\\\":[\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\"],\"\n+\t\t\t \"\\\"value\\\":[\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\"]}]\",\n+\t\t\t \"ordinary_default\");\n+\n+\t/*\n+\t * Compare the complete JSON document: a flat array with the root first,\n+\t * one copy of the shared inner map, and unchanged entry representations.\n+\t */\n+\tif (entries)\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s},{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\"\n+\t\t\t \"\\\"name\\\":\\\"dump_inner\\\",\\\"flags\\\":0,\\\"elements\\\":%s}]\",\n+\t\t\t root_id, type_name, outer, inner_id, inner);\n+\telse\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":[]}]\", root_id, type_name);\n+\tif (dump_map(root_id, \"-j\", true, output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_json\");\n+\tif (dump_map(root_id, \"--json\", true, output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_long_json\");\n+\tcheck_plain(root_id, inner_id, type_name, entries, typed);\n+\n+\t/* Recursion on an ordinary map still emits a single map object. */\n+\tsnprintf(expected, sizeof(expected),\n+\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\\\"name\\\":\\\"dump_inner\\\",\"\n+\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}]\", inner_id, inner);\n+\tif (dump_map(inner_id, \"-j\", true, output))\n+\t\tASSERT_STREQ(output, expected, \"ordinary_recursive\");\n+out:\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+\tbtf__free(btf);\n+}\n+\n+static void test_multiple_roots(void)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tchar command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];\n+\tchar output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE * 4], elements[OUTPUT_SIZE];\n+\tstatic const char * const types[] = { \"hash\", \"array_of_maps\", \"hash_of_maps\", \"hash\" };\n+\tint fds[] = { -1, -1, -1, -1 };\n+\t__u32 ids[4], key;\n+\tsize_t len = 0;\n+\tint i, n;\n+\n+\t/*\n+\t * Select the first inner map and both outers as roots. The other inner\n+\t * map must be appended after all three roots, even though it is found\n+\t * while dumping the first outer. A process-specific name avoids other\n+\t * tests' maps joining the selection.\n+\t */\n+\tsnprintf(name, sizeof(name), \"dump_%u\", getpid());\n+\tfds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[0], \"create_selected_inner\"))\n+\t\tgoto out;\n+\tfds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_discovered\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[3], \"create_discovered_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = fds[0];\n+\tfds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[1], \"create_array_root\"))\n+\t\tgoto out;\n+\tfds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[2], \"create_hash_root\"))\n+\t\tgoto out;\n+\tfor (i = 1; i \u003c= 2; i++) {\n+\t\tkey = 0;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[0], BPF_ANY),\n+\t\t\t \"reference_selected_inner\"))\n+\t\t\tgoto out;\n+\t\tkey = 1;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[3], BPF_ANY),\n+\t\t\t \"reference_discovered_inner\"))\n+\t\t\tgoto out;\n+\t}\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++) {\n+\t\tids[i] = map_id(fds[i]);\n+\t\tif (!ids[i] || !dump_map(ids[i], \"-j\", false, elements))\n+\t\t\tgoto out;\n+\t\tn = snprintf(expected + len, sizeof(expected) - len,\n+\t\t\t \"%s{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"%s\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}%s\",\n+\t\t\t i ? \",\" : \"[\", ids[i], types[i],\n+\t\t\t i == 3 ? \"dump_discovered\" : name, elements, i == 3 ? \"]\" : \"\");\n+\t\tif (!ASSERT_GE(n, 0, \"format_expected\") ||\n+\t\t !ASSERT_LT(n, sizeof(expected) - len, \"expected_length\"))\n+\t\t\tgoto out;\n+\t\tlen += n;\n+\t}\n+\tsnprintf(command, sizeof(command), \"-j map dump name %s recursive\", name);\n+\tif (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"dump_multiple_roots\")) {\n+\t\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\t\tASSERT_STREQ(output, expected, \"roots_first_and_seed_dedup\");\n+\t}\n+out:\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++)\n+\t\tif (fds[i] \u003e= 0)\n+\t\t\tclose(fds[i]);\n+}\n+\n+static void test_unreadable(bool outer)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tchar elements[OUTPUT_SIZE], output[OUTPUT_SIZE], root[OUTPUT_SIZE];\n+\tchar expected[OUTPUT_SIZE * 3], plain[OUTPUT_SIZE] = {};\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\tint inner_fd = -1, outer_fd = -1, lookup_errno;\n+\t__u32 inner_id, root_id, key = 0, value;\n+\n+\t/*\n+\t * Every key is enumerable, but PERF_EVENT_ARRAY lookup returns\n+\t * ENOTSUPP (the kernel-internal errno). Check both entries so an\n+\t * early exit on the first lookup failure cannot pass.\n+\t */\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_PERF_EVENT_ARRAY, \"dump_unreadable\",\n+\t\t\t\t sizeof(key), sizeof(value), 2, NULL);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_unreadable\"))\n+\t\tgoto out;\n+\tif (!ASSERT_LT(bpf_map_lookup_elem(inner_fd, \u0026key, \u0026value), 0,\n+\t\t \"unreadable_lookup\"))\n+\t\tgoto out;\n+\tlookup_errno = errno;\n+\tif (!ASSERT_NEQ(lookup_errno, ENOENT, \"unreadable_not_missing\"))\n+\t\tgoto out;\n+\tinner_id = map_id(inner_fd);\n+\tif (!inner_id || !dump_map(inner_id, \"-j\", false, elements))\n+\t\tgoto out;\n+\tASSERT_EQ(count_token(elements, \"\\\"error\\\":\"), 2, \"default_json_errors\");\n+\tsnprintf(command, sizeof(command), \"map dump id %u\", inner_id);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, plain, sizeof(plain) - 1),\n+\t\t \"default_plain_unreadable\"))\n+\t\tgoto out;\n+\tASSERT_EQ(count_token(plain, strerror(lookup_errno)), 2, \"default_plain_errors\");\n+\tASSERT_HAS_SUBSTR(plain, \"Found 0 elements\", \"default_plain_count\");\n+\n+\troot_id = inner_id;\n+\tif (outer) {\n+\t\topts.inner_map_fd = inner_fd;\n+\t\touter_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, \"dump_outer\",\n+\t\t\t\t\t sizeof(key), sizeof(value), 1, \u0026opts);\n+\t\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\") ||\n+\t\t !ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\t\troot_id = map_id(outer_fd);\n+\t\tif (!root_id || !dump_map(root_id, \"-j\", false, root))\n+\t\t\tgoto out;\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"array_of_maps\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s},{\\\"id\\\":%u,\"\n+\t\t\t \"\\\"type\\\":\\\"perf_event_array\\\",\\\"name\\\":\\\"dump_unreadable\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}]\", root_id, root, inner_id, elements);\n+\t} else {\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"perf_event_array\\\",\"\n+\t\t\t \"\\\"name\\\":\\\"dump_unreadable\\\",\\\"flags\\\":0,\\\"elements\\\":%s}]\",\n+\t\t\t inner_id, elements);\n+\t}\n+\tif (dump_map(root_id, \"-j\", true, output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_unreadable_json\");\n+\tmemset(output, 0, sizeof(output));\n+\tsnprintf(command, sizeof(command), \"map dump id %u recursive\", root_id);\n+\tif (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"recursive_unreadable_plain\")) {\n+\t\tASSERT_HAS_SUBSTR(output, plain, \"recursive_plain_preserves_errors\");\n+\t\tASSERT_EQ(count_token(output, strerror(lookup_errno)), 2,\n+\t\t\t \"recursive_plain_errors\");\n+\t\tASSERT_EQ(count_token(output, \"Found \"), outer ? 2 : 1,\n+\t\t\t \"recursive_plain_maps\");\n+\t}\n+out:\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+}\n+\n+static void test_many_inner_maps(bool json)\n+{\n+\tenum {\n+\t\tDUMP_OK,\n+\t\tDUMP_ERR_RLIMIT,\n+\t\tDUMP_ERR_COMMAND,\n+\t\tDUMP_ERR_COUNTS,\n+\t\tDUMP_ERR_IDS,\n+\t\tDUMP_ERR_JSON,\n+\t\tDUMP_ERR_FDS,\n+\t};\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tconst struct rlimit limit = { .rlim_cur = 32, .rlim_max = 32 };\n+\tchar command[MAX_BPFTOOL_CMD_LEN], token[64];\n+\t__u32 ids[64], root_id, key;\n+\tint inner_fd = -1, outer_fd = -1, status;\n+\tint inherited_fds[32], nr_inherited = 0, i;\n+\tchar *output = NULL;\n+\tpid_t pid;\n+\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_template\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = inner_fd;\n+\touter_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, \"dump_outer\", 4, 4,\n+\t\t\t\t ARRAY_SIZE(ids), \u0026opts);\n+\tclose(inner_fd);\n+\tinner_fd = -1;\n+\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\"))\n+\t\tgoto out;\n+\tfor (key = 0; key \u003c ARRAY_SIZE(ids); key++) {\n+\t\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", 4, 4, 1, NULL);\n+\t\tif (!ASSERT_OK_FD(inner_fd, \"create_inner\") ||\n+\t\t !ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\t\tids[key] = map_id(inner_fd);\n+\t\tif (!ids[key])\n+\t\t\tgoto out;\n+\t\t/* The outer map keeps each distinct inner map alive. */\n+\t\tclose(inner_fd);\n+\t\tinner_fd = -1;\n+\t}\n+\troot_id = map_id(outer_fd);\n+\toutput = calloc(1, MANY_MAPS_OUTPUT_SIZE);\n+\tif (!root_id || !ASSERT_OK_PTR(output, \"allocate_output\"))\n+\t\tgoto out;\n+\n+\t/* Fill the low FD slots to exercise inherited descriptor cleanup. */\n+\tfor (i = 0; i \u003c ARRAY_SIZE(inherited_fds); i++) {\n+\t\tint fd = open(\"/dev/null\", O_RDONLY);\n+\n+\t\tif (!ASSERT_OK_FD(fd, \"open_inherited_fd\"))\n+\t\t\tgoto out;\n+\t\tinherited_fds[nr_inherited++] = fd;\n+\t}\n+\n+\t/*\n+\t * Create all fixtures before lowering the limit, and keep the test\n+\t * runner's limit unchanged. Retaining every discovered FD would exceed\n+\t * this limit before the recursive dump could visit all inner maps.\n+\t */\n+\tpid = fork();\n+\tif (!ASSERT_GE(pid, 0, \"fork\"))\n+\t\tgoto out;\n+\tif (!pid) {\n+\t\tstruct dirent *entry;\n+\t\tDIR *dir;\n+\n+\t\t/* Reserve a slot for the directory even if the parent is full. */\n+\t\tclose(inherited_fds[nr_inherited - 1]);\n+\t\tdir = opendir(\"/proc/self/fd\");\n+\t\tif (!dir)\n+\t\t\t_exit(DUMP_ERR_FDS);\n+\t\t/* The parent keeps the outer map and its inner maps alive. */\n+\t\tfor (;;) {\n+\t\t\tchar *end;\n+\t\t\tlong fd;\n+\n+\t\t\terrno = 0;\n+\t\t\tentry = readdir(dir);\n+\t\t\tif (!entry) {\n+\t\t\t\tif (errno)\n+\t\t\t\t\t_exit(DUMP_ERR_FDS);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t\tfd = strtol(entry-\u003ed_name, \u0026end, 10);\n+\t\t\tif (*end || fd \u003c 3 || fd == dirfd(dir))\n+\t\t\t\tcontinue;\n+\t\t\tclose(fd);\n+\t\t}\n+\t\tif (closedir(dir))\n+\t\t\t_exit(DUMP_ERR_FDS);\n+\t\tif (setrlimit(RLIMIT_NOFILE, \u0026limit))\n+\t\t\t_exit(DUMP_ERR_RLIMIT);\n+\t\tsnprintf(command, sizeof(command), \"%s map dump id %u recursive\",\n+\t\t\t json ? \"-j\" : \"\", root_id);\n+\t\tif (get_bpftool_command_output(command, output, MANY_MAPS_OUTPUT_SIZE - 1))\n+\t\t\t_exit(DUMP_ERR_COMMAND);\n+\t\tif (count_token(output, json ? \"\\\"id\\\":\" : \"Found \") != ARRAY_SIZE(ids) + 1 ||\n+\t\t count_token(output, json ? \"\\\"inner_map_id\\\":\" : \"inner_map_id:\") !=\n+\t\t ARRAY_SIZE(ids))\n+\t\t\t_exit(DUMP_ERR_COUNTS);\n+\t\tfor (key = 0; key \u003c ARRAY_SIZE(ids); key++) {\n+\t\t\tif (json)\n+\t\t\t\tsnprintf(token, sizeof(token), \"\\\"id\\\":%u,\", ids[key]);\n+\t\t\telse\n+\t\t\t\tsnprintf(token, sizeof(token), \"\\n%u: hash name dump_inner \",\n+\t\t\t\t\t ids[key]);\n+\t\t\tif (count_token(output, token) != 1)\n+\t\t\t\t_exit(DUMP_ERR_IDS);\n+\t\t}\n+\t\tif (json \u0026\u0026 (output[0] != '[' ||\n+\t\t\t strcmp(output + strlen(output) - 2, \"]\\n\")))\n+\t\t\t_exit(DUMP_ERR_JSON);\n+\t\t_exit(DUMP_OK);\n+\t}\n+\tif (ASSERT_EQ(waitpid(pid, \u0026status, 0), pid, \"waitpid\") \u0026\u0026\n+\t ASSERT_TRUE(WIFEXITED(status), \"child_exited\"))\n+\t\tASSERT_EQ(WEXITSTATUS(status), DUMP_OK, \"dump_with_low_fd_limit\");\n+\tfor (i = 0; i \u003c nr_inherited; i++)\n+\t\tASSERT_GE(fcntl(inherited_fds[i], F_GETFD), 0, \"parent_fd_preserved\");\n+\tASSERT_EQ(map_id(outer_fd), root_id, \"parent_outer_preserved\");\n+out:\n+\twhile (nr_inherited)\n+\t\tclose(inherited_fds[--nr_inherited]);\n+\tfree(output);\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+}\n+\n+static void test_dump_arguments(void)\n+{\n+\tconst char * const options[] = {\n+\t\t\"''\", \"unknown\", \"recursive recursive\", \"recursive unknown\",\n+\t};\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\t__u32 id;\n+\tint fd;\n+\tsize_t i;\n+\n+\tfd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_args\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fd, \"create_map\"))\n+\t\treturn;\n+\tid = map_id(fd);\n+\tif (!id)\n+\t\tgoto out;\n+\tfor (i = 0; i \u003c ARRAY_SIZE(options); i++) {\n+\t\tsnprintf(command, sizeof(command), \"map dump id %u %s\", id, options[i]);\n+\t\tASSERT_NEQ(run_bpftool_command(command), 0, options[i]);\n+\t}\n+out:\n+\tclose(fd);\n+}\n+\n+void test_bpftool_map_dump(void)\n+{\n+\tif (test__start_subtest(\"arguments\"))\n+\t\ttest_dump_arguments();\n+\tif (test__start_subtest(\"unreadable_ordinary\"))\n+\t\ttest_unreadable(false);\n+\tif (test__start_subtest(\"unreadable_inner\"))\n+\t\ttest_unreadable(true);\n+\tif (test__start_subtest(\"many_inner_maps_json\"))\n+\t\ttest_many_inner_maps(true);\n+\tif (test__start_subtest(\"many_inner_maps_plain\"))\n+\t\ttest_many_inner_maps(false);\n+\tif (test__start_subtest(\"multiple_roots\"))\n+\t\ttest_multiple_roots();\n+\tif (test__start_subtest(\"array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"shared_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);\n+\tif (test__start_subtest(\"empty_array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"empty_hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"btf_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);\n+\tif (test__start_subtest(\"empty_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);\n+}\n"
} |
| 2/1 | 2026/09/26 21:46 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies user-space files in tools/bpf/bpftool and tools/testing/selftests/bpf (adding a recursive dump option to bpftool and associated selftests). It does not alter any code compiled into the kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit a04d9884807a16feb64ede2ff22e7b9b0687630f
Author: syz-cluster <triage@syzkaller.com>
Date: Sat Sep 26 21:46:19 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index e4ed7e701c9e4..0b804926d829c 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -16,7 +16,8 @@ SYNOPSIS
**bpftool** [*OPTIONS*] **map** *COMMAND*
-*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }
+*OPTIONS* := { |COMMON_OPTIONS| |
+{ **-f** | **--bpffs** } | { **-n** | **--nomount** } }
*COMMANDS* :=
{ **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
@@ -29,7 +30,7 @@ MAP COMMANDS
| **bpftool** **map create** *FILE* **type** *TYPE* **key** *KEY_SIZE* **value** *VALUE_SIZE* \
| **entries** *MAX_ENTRIES* **name** *NAME* [**flags** *FLAGS*] [**inner_map** *MAP*] \
| [**offload_dev** *NAME*]
-| **bpftool** **map dump** *MAP*
+| **bpftool** **map dump** *MAP* [**recursive**]
| **bpftool** **map update** *MAP* [**key** *DATA*] [**value** *VALUE*] [*UPDATE_FLAGS*]
| **bpftool** **map lookup** *MAP* [**key** *DATA*]
| **bpftool** **map getnext** *MAP* [**key** *DATA*]
@@ -87,10 +88,18 @@ bpftool map create *FILE* type *TYPE* key *KEY_SIZE* value *VALUE_SIZE* entries
Keyword **offload_dev** expects a network interface name, and is used to
request hardware offload for the map.
-bpftool map dump *MAP*
+bpftool map dump *MAP* [recursive]
Dump all entries in a given *MAP*. In case of **name**, *MAP* may match
several maps which will all be dumped.
+ With **recursive**, also dump the inner maps referenced by **array_of_maps**
+ and **hash_of_maps** entries. Each map ID is visited once, even if several
+ entries refer to it. Selected maps are followed by their inner maps.
+
+ Inner map IDs are resolved when the maps are visited. The dump is not an
+ atomic snapshot: concurrent updates can change map contents or remove a
+ referenced inner map before it is visited.
+
bpftool map update *MAP* [key *DATA*] [value *VALUE*] [*UPDATE_FLAGS*]
Update map entry for a given *KEY*.
diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index c9e8761e4ef2a..c78339e825cf0 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -718,6 +718,9 @@ _bpftool()
return 0
;;
*)
+ if [[ $command == dump && $cword -eq 5 ]]; then
+ COMPREPLY=( $( compgen -W 'recursive' -- "$cur" ) )
+ fi
return 0
;;
esac
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 20d59eab09a12..ef47de7da200f 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -17,6 +17,7 @@
#include <bpf/bpf.h>
#include <bpf/btf.h>
#include <bpf/hashmap.h>
+#include <bpf/libbpf_internal.h>
#include "json_writer.h"
#include "main.h"
@@ -827,12 +828,43 @@ static void free_map_kv_btf(struct btf *btf)
btf__free(btf);
}
+struct map_dump_ctx {
+ struct hashmap *seen;
+ __u32 *pending_ids;
+ size_t pending_cnt;
+ size_t pending_cap;
+};
+
+static int collect_inner_map(struct map_dump_ctx *ctx, __u32 id)
+{
+ int err;
+
+ if (hashmap__find(ctx->seen, id, NULL))
+ return 0;
+
+ err = libbpf_ensure_mem((void **)&ctx->pending_ids, &ctx->pending_cap,
+ sizeof(*ctx->pending_ids), ctx->pending_cnt + 1);
+ if (err) {
+ p_err("mem alloc failed");
+ return -1;
+ }
+
+ err = hashmap__add(ctx->seen, id, 0);
+ if (err) {
+ p_err("failed to record inner map id %u: %s", id, strerror(-err));
+ return -1;
+ }
+ ctx->pending_ids[ctx->pending_cnt++] = id;
+ return 0;
+}
+
static int
map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
- bool show_header)
+ bool show_header, struct map_dump_ctx *ctx)
{
void *key, *value, *prev_key;
unsigned int num_elems = 0;
+ json_writer_t *plain_btf_wtr = NULL;
struct btf *btf = NULL;
int *cpu_ids = NULL;
int cpu_cnt = 0;
@@ -856,6 +888,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
}
}
+ if (ctx && !wtr && (info->btf_value_type_id ||
+ info->btf_vmlinux_value_type_id)) {
+ plain_btf_wtr = get_btf_writer();
+ if (plain_btf_wtr) {
+ if (show_header)
+ show_map_header_plain(info);
+ show_header = false;
+ wtr = plain_btf_wtr;
+ }
+ }
+
if (wtr) {
err = get_map_kv_btf(info, &btf);
if (err) {
@@ -885,11 +928,21 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
if (err) {
if (errno == ENOENT)
err = 0;
+ else if (ctx)
+ p_err("can't get next key for map id %u: %s",
+ info->id, strerror(errno));
break;
}
- if (!dump_map_elem(fd, key, value, info, btf, wtr,
- cpu_ids, cpu_cnt))
+ err = dump_map_elem(fd, key, value, info, btf, wtr,
+ cpu_ids, cpu_cnt);
+ if (!err) {
num_elems++;
+ if (ctx && map_is_map_of_maps(info->type)) {
+ err = collect_inner_map(ctx, *(__u32 *)value);
+ if (err)
+ break;
+ }
+ }
prev_key = key;
}
@@ -907,21 +960,37 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
free(value);
free(cpu_ids);
free_map_kv_btf(btf);
+ if (plain_btf_wtr)
+ jsonw_destroy(&plain_btf_wtr);
return err;
}
static int do_dump(int argc, char **argv)
{
+ LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,
+ .open_flags = BPF_F_RDONLY,
+ );
json_writer_t *wtr = NULL, *btf_wtr = NULL;
struct bpf_map_info info = {};
+ struct map_dump_ctx ctx = {};
+ bool recursive_dump = false;
int nb_fds, i = 0;
__u32 len = sizeof(info);
int *fds = NULL;
int err = -1;
+ size_t j;
- if (argc != 2)
+ if (argc != 2 && argc != 3)
usage();
+ if (argc == 3) {
+ if (!*argv[2] || !is_prefix(argv[2], "recursive")) {
+ p_err("expected 'recursive', got: '%s'", argv[2]);
+ return -1;
+ }
+ recursive_dump = true;
+ argc--;
+ }
fds = malloc(sizeof(int));
if (!fds) {
@@ -932,9 +1001,35 @@ static int do_dump(int argc, char **argv)
if (nb_fds < 1)
goto exit_free;
+ if (recursive_dump) {
+ ctx.seen = hashmap__new(hash_fn_for_key_as_id,
+ equal_fn_for_key_as_id, NULL);
+ if (IS_ERR(ctx.seen)) {
+ ctx.seen = NULL;
+ p_err("failed to create hashmap for recursive dump");
+ goto exit_close;
+ }
+ /* Record the selected maps before discovering any inner maps. */
+ for (i = 0; i < nb_fds; i++) {
+ len = sizeof(info);
+ if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
+ p_err("can't get map info: %s", strerror(errno));
+ err = -1;
+ goto exit_close;
+ }
+ err = hashmap__add(ctx.seen, info.id, 0);
+ if (err) {
+ p_err("failed to record map id %u: %s", info.id,
+ strerror(-err));
+ err = -1;
+ goto exit_close;
+ }
+ }
+ }
+
if (json_output) {
wtr = json_wtr;
- } else {
+ } else if (!recursive_dump) {
int do_plain_btf;
do_plain_btf = maps_have_btf(fds, nb_fds);
@@ -949,7 +1044,7 @@ static int do_dump(int argc, char **argv)
}
}
- if (wtr && nb_fds > 1)
+ if (wtr && (nb_fds > 1 || recursive_dump))
jsonw_start_array(wtr); /* root array */
for (i = 0; i < nb_fds; i++) {
if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
@@ -957,22 +1052,50 @@ static int do_dump(int argc, char **argv)
err = -1;
break;
}
- err = map_dump(fds[i], &info, wtr, nb_fds > 1);
+ err = map_dump(fds[i], &info, wtr, nb_fds > 1 || recursive_dump,
+ recursive_dump ? &ctx : NULL);
if (!wtr && i != nb_fds - 1)
printf("\n");
if (err)
break;
- close(fds[i]);
+ /* Keep selected maps alive while visiting their inner maps. */
+ if (!recursive_dump)
+ close(fds[i]);
+ }
+ for (j = 0; !err && j < ctx.pending_cnt; j++) {
+ int fd;
+
+ fd = bpf_map_get_fd_by_id_opts(ctx.pending_ids[j], &opts);
+ if (fd < 0) {
+ p_err("can't open inner map id %u: %s",
+ ctx.pending_ids[j], strerror(errno));
+ err = -1;
+ break;
+ }
+ len = sizeof(info);
+ if (bpf_map_get_info_by_fd(fd, &info, &len)) {
+ p_err("can't get map info: %s", strerror(errno));
+ err = -1;
+ } else {
+ if (!wtr)
+ printf("\n");
+ err = map_dump(fd, &info, wtr, true, &ctx);
+ }
+ close(fd);
}
- if (wtr && nb_fds > 1)
+ if (wtr && (nb_fds > 1 || recursive_dump))
jsonw_end_array(wtr); /* root array */
if (btf_wtr)
jsonw_destroy(&btf_wtr);
exit_close:
+ if (recursive_dump)
+ i = 0;
for (; i < nb_fds; i++)
close(fds[i]);
+ hashmap__free(ctx.seen);
+ free(ctx.pending_ids);
exit_free:
free(fds);
free_btf_vmlinux();
@@ -1484,7 +1607,7 @@ static int do_help(int argc, char **argv)
" %1$s %2$s create FILE type TYPE key KEY_SIZE value VALUE_SIZE \\\n"
" entries MAX_ENTRIES name NAME [flags FLAGS] \\\n"
" [inner_map MAP] [offload_dev NAME]\n"
- " %1$s %2$s dump MAP\n"
+ " %1$s %2$s dump MAP [recursive]\n"
" %1$s %2$s update MAP [key DATA] [value VALUE] [UPDATE_FLAGS]\n"
" %1$s %2$s lookup MAP [key DATA]\n"
" %1$s %2$s getnext MAP [key DATA]\n"
diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c
new file mode 100644
index 0000000000000..d36aaa6580101
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c
@@ -0,0 +1,507 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <test_progs.h>
+#include <bpftool_helpers.h>
+#include <bpf/btf.h>
+#include <sys/resource.h>
+#include <dirent.h>
+
+#define OUTPUT_SIZE 8192
+#define MANY_MAPS_OUTPUT_SIZE 65536
+
+static bool dump_map(__u32 id, const char *options, bool recursive, char *output)
+{
+ char command[MAX_BPFTOOL_CMD_LEN];
+
+ snprintf(command, sizeof(command), "%s map dump id %u%s", options, id,
+ recursive ? " recursive" : "");
+ memset(output, 0, OUTPUT_SIZE);
+ if (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),
+ "dump_map"))
+ return false;
+ /* The helper leaves the trailing newline in place. */
+ output[strcspn(output, "\n")] = '\0';
+ return true;
+}
+
+static __u32 map_id(int fd)
+{
+ struct bpf_map_info info = {};
+ __u32 len = sizeof(info);
+
+ if (!ASSERT_OK(bpf_map_get_info_by_fd(fd, &info, &len), "map_info"))
+ return 0;
+ return info.id;
+}
+
+static int count_token(const char *output, const char *token)
+{
+ int count = 0;
+
+ while ((output = strstr(output, token))) {
+ count++;
+ output += strlen(token);
+ }
+ return count;
+}
+
+static void check_plain(__u32 root_id, __u32 inner_id, const char *type,
+ int entries, bool typed)
+{
+ char command[MAX_BPFTOOL_CMD_LEN], header[128];
+ char output[OUTPUT_SIZE] = {};
+ const char *root, *inner;
+
+ snprintf(command, sizeof(command), "map dump id %u recursive", root_id);
+ if (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+ "plain_dump"))
+ return;
+ snprintf(header, sizeof(header), "%u: %s name dump_outer ", root_id, type);
+ root = strstr(output, header);
+ if (!ASSERT_OK_PTR(root, "plain_root_header"))
+ return;
+ ASSERT_EQ(root - output, 0, "plain_root_first");
+ ASSERT_EQ(count_token(output, "inner_map_id:"), entries, "plain_references");
+ if (entries) {
+ snprintf(header, sizeof(header), "%u: hash name dump_inner ", inner_id);
+ inner = strstr(output, header);
+ if (ASSERT_OK_PTR(inner, "plain_inner_header"))
+ ASSERT_GT(inner - root, 0, "plain_inner_after_root");
+ ASSERT_EQ(count_token(output, header), 1, "plain_inner_once");
+ }
+ ASSERT_EQ(count_token(output, "Found "), entries && !typed ? 2 : 1,
+ "plain_map_count");
+ if (typed) {
+ ASSERT_HAS_SUBSTR(output, "\"key\": 0", "plain_btf_key");
+ ASSERT_HAS_SUBSTR(output, "\"value\": 16843009", "plain_btf_value");
+ }
+}
+
+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,
+ bool typed)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ LIBBPF_OPTS(bpf_map_create_opts, inner_opts);
+ struct btf *btf = NULL;
+ char outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];
+ char expected[OUTPUT_SIZE * 3], reference[64];
+ const char *type_name = libbpf_bpf_map_type_str(type);
+ int inner_fd = -1, outer_fd = -1;
+ __u32 root_id, inner_id, key, value = 0x01010101;
+
+ if (typed) {
+ btf = btf__new_empty();
+ if (!ASSERT_OK_PTR(btf, "create_btf") ||
+ !ASSERT_EQ(btf__add_int(btf, "unsigned int", 4, 0), 1, "btf_int") ||
+ !ASSERT_OK(btf__load_into_kernel(btf), "load_btf"))
+ goto out;
+ inner_opts.btf_fd = btf__fd(btf);
+ inner_opts.btf_key_type_id = 1;
+ inner_opts.btf_value_type_id = 1;
+ }
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", sizeof(key),
+ sizeof(value), 2, &inner_opts);
+ if (!ASSERT_OK_FD(inner_fd, "create_inner"))
+ goto out;
+ key = 0;
+ if (!empty_inner &&
+ !ASSERT_OK(bpf_map_update_elem(inner_fd, &key, &value, BPF_ANY),
+ "populate_inner"))
+ goto out;
+ opts.inner_map_fd = inner_fd;
+ outer_fd = bpf_map_create(type, "dump_outer", sizeof(key), sizeof(__u32),
+ 3, &opts);
+ if (!ASSERT_OK_FD(outer_fd, "create_outer"))
+ goto out;
+ /* For arrays, unused slots also exercise failed lookups. */
+ for (key = 0; key < entries; key++)
+ if (!ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+ "populate_outer"))
+ goto out;
+ root_id = map_id(outer_fd);
+ inner_id = map_id(inner_fd);
+ if (!root_id || !inner_id || !dump_map(root_id, "-j", false, outer) ||
+ !dump_map(inner_id, "-j", false, inner))
+ goto out;
+
+ ASSERT_EQ(outer[0], '[', "default_array");
+ ASSERT_EQ(count_token(outer, "\"elements\":"), 0, "default_no_wrapper");
+ ASSERT_EQ(count_token(outer, "\"id\":"), 0, "default_no_header");
+ snprintf(reference, sizeof(reference), "\"inner_map_id\":%u", inner_id);
+ ASSERT_EQ(count_token(outer, reference), entries, "default_references");
+ if (!entries)
+ ASSERT_STREQ(outer, "[]", "empty_outer_default");
+ if (empty_inner)
+ ASSERT_STREQ(inner, "[]", "empty_inner_default");
+ else if (typed)
+ ASSERT_HAS_SUBSTR(inner, "\"formatted\":{\"key\":0,\"value\":16843009}",
+ "typed_inner");
+ else
+ ASSERT_STREQ(inner,
+ "[{\"key\":[\"0x00\",\"0x00\",\"0x00\",\"0x00\"],"
+ "\"value\":[\"0x01\",\"0x01\",\"0x01\",\"0x01\"]}]",
+ "ordinary_default");
+
+ /*
+ * Compare the complete JSON document: a flat array with the root first,
+ * one copy of the shared inner map, and unchanged entry representations.
+ */
+ if (entries)
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\","
+ "\"flags\":0,\"elements\":%s},{\"id\":%u,\"type\":\"hash\","
+ "\"name\":\"dump_inner\",\"flags\":0,\"elements\":%s}]",
+ root_id, type_name, outer, inner_id, inner);
+ else
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\","
+ "\"flags\":0,\"elements\":[]}]", root_id, type_name);
+ if (dump_map(root_id, "-j", true, output))
+ ASSERT_STREQ(output, expected, "recursive_json");
+ if (dump_map(root_id, "--json", true, output))
+ ASSERT_STREQ(output, expected, "recursive_long_json");
+ check_plain(root_id, inner_id, type_name, entries, typed);
+
+ /* Recursion on an ordinary map still emits a single map object. */
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"hash\",\"name\":\"dump_inner\","
+ "\"flags\":0,\"elements\":%s}]", inner_id, inner);
+ if (dump_map(inner_id, "-j", true, output))
+ ASSERT_STREQ(output, expected, "ordinary_recursive");
+out:
+ if (outer_fd >= 0)
+ close(outer_fd);
+ if (inner_fd >= 0)
+ close(inner_fd);
+ btf__free(btf);
+}
+
+static void test_multiple_roots(void)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ char command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];
+ char output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE * 4], elements[OUTPUT_SIZE];
+ static const char * const types[] = { "hash", "array_of_maps", "hash_of_maps", "hash" };
+ int fds[] = { -1, -1, -1, -1 };
+ __u32 ids[4], key;
+ size_t len = 0;
+ int i, n;
+
+ /*
+ * Select the first inner map and both outers as roots. The other inner
+ * map must be appended after all three roots, even though it is found
+ * while dumping the first outer. A process-specific name avoids other
+ * tests' maps joining the selection.
+ */
+ snprintf(name, sizeof(name), "dump_%u", getpid());
+ fds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(fds[0], "create_selected_inner"))
+ goto out;
+ fds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_discovered", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(fds[3], "create_discovered_inner"))
+ goto out;
+ opts.inner_map_fd = fds[0];
+ fds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, &opts);
+ if (!ASSERT_OK_FD(fds[1], "create_array_root"))
+ goto out;
+ fds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, &opts);
+ if (!ASSERT_OK_FD(fds[2], "create_hash_root"))
+ goto out;
+ for (i = 1; i <= 2; i++) {
+ key = 0;
+ if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[0], BPF_ANY),
+ "reference_selected_inner"))
+ goto out;
+ key = 1;
+ if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[3], BPF_ANY),
+ "reference_discovered_inner"))
+ goto out;
+ }
+ for (i = 0; i < ARRAY_SIZE(fds); i++) {
+ ids[i] = map_id(fds[i]);
+ if (!ids[i] || !dump_map(ids[i], "-j", false, elements))
+ goto out;
+ n = snprintf(expected + len, sizeof(expected) - len,
+ "%s{\"id\":%u,\"type\":\"%s\",\"name\":\"%s\","
+ "\"flags\":0,\"elements\":%s}%s",
+ i ? "," : "[", ids[i], types[i],
+ i == 3 ? "dump_discovered" : name, elements, i == 3 ? "]" : "");
+ if (!ASSERT_GE(n, 0, "format_expected") ||
+ !ASSERT_LT(n, sizeof(expected) - len, "expected_length"))
+ goto out;
+ len += n;
+ }
+ snprintf(command, sizeof(command), "-j map dump name %s recursive", name);
+ if (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+ "dump_multiple_roots")) {
+ output[strcspn(output, "\n")] = '\0';
+ ASSERT_STREQ(output, expected, "roots_first_and_seed_dedup");
+ }
+out:
+ for (i = 0; i < ARRAY_SIZE(fds); i++)
+ if (fds[i] >= 0)
+ close(fds[i]);
+}
+
+static void test_unreadable(bool outer)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ char elements[OUTPUT_SIZE], output[OUTPUT_SIZE], root[OUTPUT_SIZE];
+ char expected[OUTPUT_SIZE * 3], plain[OUTPUT_SIZE] = {};
+ char command[MAX_BPFTOOL_CMD_LEN];
+ int inner_fd = -1, outer_fd = -1, lookup_errno;
+ __u32 inner_id, root_id, key = 0, value;
+
+ /*
+ * Every key is enumerable, but PERF_EVENT_ARRAY lookup returns
+ * ENOTSUPP (the kernel-internal errno). Check both entries so an
+ * early exit on the first lookup failure cannot pass.
+ */
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_PERF_EVENT_ARRAY, "dump_unreadable",
+ sizeof(key), sizeof(value), 2, NULL);
+ if (!ASSERT_OK_FD(inner_fd, "create_unreadable"))
+ goto out;
+ if (!ASSERT_LT(bpf_map_lookup_elem(inner_fd, &key, &value), 0,
+ "unreadable_lookup"))
+ goto out;
+ lookup_errno = errno;
+ if (!ASSERT_NEQ(lookup_errno, ENOENT, "unreadable_not_missing"))
+ goto out;
+ inner_id = map_id(inner_fd);
+ if (!inner_id || !dump_map(inner_id, "-j", false, elements))
+ goto out;
+ ASSERT_EQ(count_token(elements, "\"error\":"), 2, "default_json_errors");
+ snprintf(command, sizeof(command), "map dump id %u", inner_id);
+ if (!ASSERT_OK(get_bpftool_command_output(command, plain, sizeof(plain) - 1),
+ "default_plain_unreadable"))
+ goto out;
+ ASSERT_EQ(count_token(plain, strerror(lookup_errno)), 2, "default_plain_errors");
+ ASSERT_HAS_SUBSTR(plain, "Found 0 elements", "default_plain_count");
+
+ root_id = inner_id;
+ if (outer) {
+ opts.inner_map_fd = inner_fd;
+ outer_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, "dump_outer",
+ sizeof(key), sizeof(value), 1, &opts);
+ if (!ASSERT_OK_FD(outer_fd, "create_outer") ||
+ !ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+ "populate_outer"))
+ goto out;
+ root_id = map_id(outer_fd);
+ if (!root_id || !dump_map(root_id, "-j", false, root))
+ goto out;
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"array_of_maps\",\"name\":\"dump_outer\","
+ "\"flags\":0,\"elements\":%s},{\"id\":%u,"
+ "\"type\":\"perf_event_array\",\"name\":\"dump_unreadable\","
+ "\"flags\":0,\"elements\":%s}]", root_id, root, inner_id, elements);
+ } else {
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"perf_event_array\","
+ "\"name\":\"dump_unreadable\",\"flags\":0,\"elements\":%s}]",
+ inner_id, elements);
+ }
+ if (dump_map(root_id, "-j", true, output))
+ ASSERT_STREQ(output, expected, "recursive_unreadable_json");
+ memset(output, 0, sizeof(output));
+ snprintf(command, sizeof(command), "map dump id %u recursive", root_id);
+ if (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+ "recursive_unreadable_plain")) {
+ ASSERT_HAS_SUBSTR(output, plain, "recursive_plain_preserves_errors");
+ ASSERT_EQ(count_token(output, strerror(lookup_errno)), 2,
+ "recursive_plain_errors");
+ ASSERT_EQ(count_token(output, "Found "), outer ? 2 : 1,
+ "recursive_plain_maps");
+ }
+out:
+ if (outer_fd >= 0)
+ close(outer_fd);
+ if (inner_fd >= 0)
+ close(inner_fd);
+}
+
+static void test_many_inner_maps(bool json)
+{
+ enum {
+ DUMP_OK,
+ DUMP_ERR_RLIMIT,
+ DUMP_ERR_COMMAND,
+ DUMP_ERR_COUNTS,
+ DUMP_ERR_IDS,
+ DUMP_ERR_JSON,
+ DUMP_ERR_FDS,
+ };
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ const struct rlimit limit = { .rlim_cur = 32, .rlim_max = 32 };
+ char command[MAX_BPFTOOL_CMD_LEN], token[64];
+ __u32 ids[64], root_id, key;
+ int inner_fd = -1, outer_fd = -1, status;
+ int inherited_fds[32], nr_inherited = 0, i;
+ char *output = NULL;
+ pid_t pid;
+
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(inner_fd, "create_template"))
+ goto out;
+ opts.inner_map_fd = inner_fd;
+ outer_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, "dump_outer", 4, 4,
+ ARRAY_SIZE(ids), &opts);
+ close(inner_fd);
+ inner_fd = -1;
+ if (!ASSERT_OK_FD(outer_fd, "create_outer"))
+ goto out;
+ for (key = 0; key < ARRAY_SIZE(ids); key++) {
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(inner_fd, "create_inner") ||
+ !ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+ "populate_outer"))
+ goto out;
+ ids[key] = map_id(inner_fd);
+ if (!ids[key])
+ goto out;
+ /* The outer map keeps each distinct inner map alive. */
+ close(inner_fd);
+ inner_fd = -1;
+ }
+ root_id = map_id(outer_fd);
+ output = calloc(1, MANY_MAPS_OUTPUT_SIZE);
+ if (!root_id || !ASSERT_OK_PTR(output, "allocate_output"))
+ goto out;
+
+ /* Fill the low FD slots to exercise inherited descriptor cleanup. */
+ for (i = 0; i < ARRAY_SIZE(inherited_fds); i++) {
+ int fd = open("/dev/null", O_RDONLY);
+
+ if (!ASSERT_OK_FD(fd, "open_inherited_fd"))
+ goto out;
+ inherited_fds[nr_inherited++] = fd;
+ }
+
+ /*
+ * Create all fixtures before lowering the limit, and keep the test
+ * runner's limit unchanged. Retaining every discovered FD would exceed
+ * this limit before the recursive dump could visit all inner maps.
+ */
+ pid = fork();
+ if (!ASSERT_GE(pid, 0, "fork"))
+ goto out;
+ if (!pid) {
+ struct dirent *entry;
+ DIR *dir;
+
+ /* Reserve a slot for the directory even if the parent is full. */
+ close(inherited_fds[nr_inherited - 1]);
+ dir = opendir("/proc/self/fd");
+ if (!dir)
+ _exit(DUMP_ERR_FDS);
+ /* The parent keeps the outer map and its inner maps alive. */
+ for (;;) {
+ char *end;
+ long fd;
+
+ errno = 0;
+ entry = readdir(dir);
+ if (!entry) {
+ if (errno)
+ _exit(DUMP_ERR_FDS);
+ break;
+ }
+ fd = strtol(entry->d_name, &end, 10);
+ if (*end || fd < 3 || fd == dirfd(dir))
+ continue;
+ close(fd);
+ }
+ if (closedir(dir))
+ _exit(DUMP_ERR_FDS);
+ if (setrlimit(RLIMIT_NOFILE, &limit))
+ _exit(DUMP_ERR_RLIMIT);
+ snprintf(command, sizeof(command), "%s map dump id %u recursive",
+ json ? "-j" : "", root_id);
+ if (get_bpftool_command_output(command, output, MANY_MAPS_OUTPUT_SIZE - 1))
+ _exit(DUMP_ERR_COMMAND);
+ if (count_token(output, json ? "\"id\":" : "Found ") != ARRAY_SIZE(ids) + 1 ||
+ count_token(output, json ? "\"inner_map_id\":" : "inner_map_id:") !=
+ ARRAY_SIZE(ids))
+ _exit(DUMP_ERR_COUNTS);
+ for (key = 0; key < ARRAY_SIZE(ids); key++) {
+ if (json)
+ snprintf(token, sizeof(token), "\"id\":%u,", ids[key]);
+ else
+ snprintf(token, sizeof(token), "\n%u: hash name dump_inner ",
+ ids[key]);
+ if (count_token(output, token) != 1)
+ _exit(DUMP_ERR_IDS);
+ }
+ if (json && (output[0] != '[' ||
+ strcmp(output + strlen(output) - 2, "]\n")))
+ _exit(DUMP_ERR_JSON);
+ _exit(DUMP_OK);
+ }
+ if (ASSERT_EQ(waitpid(pid, &status, 0), pid, "waitpid") &&
+ ASSERT_TRUE(WIFEXITED(status), "child_exited"))
+ ASSERT_EQ(WEXITSTATUS(status), DUMP_OK, "dump_with_low_fd_limit");
+ for (i = 0; i < nr_inherited; i++)
+ ASSERT_GE(fcntl(inherited_fds[i], F_GETFD), 0, "parent_fd_preserved");
+ ASSERT_EQ(map_id(outer_fd), root_id, "parent_outer_preserved");
+out:
+ while (nr_inherited)
+ close(inherited_fds[--nr_inherited]);
+ free(output);
+ if (outer_fd >= 0)
+ close(outer_fd);
+ if (inner_fd >= 0)
+ close(inner_fd);
+}
+
+static void test_dump_arguments(void)
+{
+ const char * const options[] = {
+ "''", "unknown", "recursive recursive", "recursive unknown",
+ };
+ char command[MAX_BPFTOOL_CMD_LEN];
+ __u32 id;
+ int fd;
+ size_t i;
+
+ fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_args", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(fd, "create_map"))
+ return;
+ id = map_id(fd);
+ if (!id)
+ goto out;
+ for (i = 0; i < ARRAY_SIZE(options); i++) {
+ snprintf(command, sizeof(command), "map dump id %u %s", id, options[i]);
+ ASSERT_NEQ(run_bpftool_command(command), 0, options[i]);
+ }
+out:
+ close(fd);
+}
+
+void test_bpftool_map_dump(void)
+{
+ if (test__start_subtest("arguments"))
+ test_dump_arguments();
+ if (test__start_subtest("unreadable_ordinary"))
+ test_unreadable(false);
+ if (test__start_subtest("unreadable_inner"))
+ test_unreadable(true);
+ if (test__start_subtest("many_inner_maps_json"))
+ test_many_inner_maps(true);
+ if (test__start_subtest("many_inner_maps_plain"))
+ test_many_inner_maps(false);
+ if (test__start_subtest("multiple_roots"))
+ test_multiple_roots();
+ if (test__start_subtest("array_of_maps"))
+ test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);
+ if (test__start_subtest("hash_of_maps"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);
+ if (test__start_subtest("shared_inner"))
+ test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);
+ if (test__start_subtest("empty_array_of_maps"))
+ test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);
+ if (test__start_subtest("empty_hash_of_maps"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);
+ if (test__start_subtest("btf_inner"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);
+ if (test__start_subtest("empty_inner"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);
+}
|
| 3/2 | 2026/09/26 21:46 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14142 output: 17 thoughts: 576 Thoughts: **Patch Analysis: WorthFuzzing Determination** Okay, let's break down this patch. The diff shows changes across several files: `tools/bpf/bpftool/Documentation/bpftool-map.rst`, `tools/bpf/bpftool/bash-completion/bpftool`, `tools/bpf/bpftool/map.c`, and `tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c`. Straight away, I see this is all within the `tools/` directory – specifically `tools/bpf/bpftool` and `tools/testing/selftests/bpf`. Now, according to our triage guidelines, we need to determine if this change warrants fuzzing. Specifically, under Section 2, we are looking for scenarios where `WorthFuzzing=false`. The criteria list explicitly states that changes to user-space tools like `bpftool`, located in `tools/`, or self-tests within `tools/testing/selftests/`, that *do not* impact the kernel image (vmlinux) or kernel modules, should result in `WorthFuzzing=false`. Given the files modified, `bpftool` is a userspace tool, and `tools/testing/selftests/bpf` contains only self-tests. Neither directly affects the kernel itself. There's no kernel code involved in any of these modifications. To be absolutely certain, I'll quickly double-check with a `git status` or a more detailed `diff` output to confirm there aren't any hidden changes lurking in other areas, but I am confident this is a straightforward case. Therefore, `WorthFuzzing` should be `false`. |
| 4/2 | 2026/09/26 21:46 | tool | grepper |
0mArgs:{
"Expression": "diff --git"
}Results: {
"Output": "Documentation/bpf/drgn.rst=99=For example, to print ``struct bpf_prog_aux`` for BPF program id 53077:\n--\nDocumentation/bpf/drgn.rst-103- % git diff\nDocumentation/bpf/drgn.rst:104: diff --git a/tools/bpf_inspect.py b/tools/bpf_inspect.py\nDocumentation/bpf/drgn.rst-105- index 650e228..aea2357 100755\n--\nDocumentation/dev-tools/checkuapi.rst=54=won't break userspace::\n--\nDocumentation/dev-tools/checkuapi.rst-69- * comp2_t is 24-bit with 5-bit base 2 exponent and 20 bit fraction\nDocumentation/dev-tools/checkuapi.rst:70: diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h\nDocumentation/dev-tools/checkuapi.rst-71- EOF\n--\nDocumentation/dev-tools/checkuapi.rst=310=Consider this change::\n--\nDocumentation/dev-tools/checkuapi.rst-312- cat \u003c\u003c 'EOF' | patch -l -p1\nDocumentation/dev-tools/checkuapi.rst:313: diff --git a/include/uapi/asm-generic/Kbuild b/include/uapi/asm-generic/Kbuild\nDocumentation/dev-tools/checkuapi.rst-314- index ebb180aac74e..a9c88b0a8b3b 100644\n--\nDocumentation/doc-guide/contributing.rst=84=looked like this::\n--\nDocumentation/doc-guide/contributing.rst-102-\nDocumentation/doc-guide/contributing.rst:103: diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c\nDocumentation/doc-guide/contributing.rst-104- index 57f6944d65a6..00c9b80b3d33 100644\n--\nDocumentation/mm/transhuge.rst=73=change::\nDocumentation/mm/transhuge.rst-74-\nDocumentation/mm/transhuge.rst:75:\tdiff --git a/mm/mremap.c b/mm/mremap.c\nDocumentation/mm/transhuge.rst-76-\t--- a/mm/mremap.c\n--\nDocumentation/translations/it_IT/doc-guide/contributing.rst=91=patch risultante era questa::\n--\nDocumentation/translations/it_IT/doc-guide/contributing.rst-109-\nDocumentation/translations/it_IT/doc-guide/contributing.rst:110: diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c\nDocumentation/translations/it_IT/doc-guide/contributing.rst-111- index 57f6944d65a6..00c9b80b3d33 100644\n--\nDocumentation/translations/zh_CN/doc-guide/contributing.rst=36=C代码编译器发出的警告常常会被视为误报，从而导致出现了旨在让编译器闭嘴的补丁。\n--\nDocumentation/translations/zh_CN/doc-guide/contributing.rst-86-\nDocumentation/translations/zh_CN/doc-guide/contributing.rst:87: diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c\nDocumentation/translations/zh_CN/doc-guide/contributing.rst-88- index 57f6944d65a6..00c9b80b3d33 100644\n--\nscripts/checkpatch.pl=2671=sub process {\n--\nscripts/checkpatch.pl-2844-\t\t ($line =~ /^rename (?:from|to) \\S+\\s*$/ ||\nscripts/checkpatch.pl:2845:\t\t $line =~ /^diff --git a\\/[\\w\\/\\.\\_\\-]+ b\\/\\S+\\s*$/))) {\nscripts/checkpatch.pl-2846-\t\t\t$is_patch = 1;\n--\nscripts/checkpatch.pl-2902-\t\t# extract the filename as it passes\nscripts/checkpatch.pl:2903:\t\tif ($line =~ /^diff --git.*?(\\S+)$/) {\nscripts/checkpatch.pl-2904-\t\t\t$realfile = $1;\n--\nscripts/get_maintainer.pl=552=foreach my $file (@ARGV) {\n--\nscripts/get_maintainer.pl-601-\t\tpush(@files, $filename);\nscripts/get_maintainer.pl:602:\t } elsif (m/^diff --git a\\/(\\S+) b\\/(\\S+)\\s*$/) {\nscripts/get_maintainer.pl-603-\t\tmy $filename1 = $1;\n"
} |
| 5/2 | 2026/09/26 21:46 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 16398 output: 95 thoughts: 147 Thoughts: **Fuzzing Verdict: No Kernel Impact** Okay, so the modifications are confined to `tools/bpf/bpftool` and `tools/testing/selftests`. That's a key indicator. Remembering the guidelines from Section 2, the text explicitly states that changes in user-space directories, self-tests, and related areas that *don't* affect the compiled kernel image (vmlinux) or kernel modules should result in `WorthFuzzing=false`. Let me quickly confirm the output format for `set-results`: `WorthFuzzing: false`, `FocusSymbols: []`, `EnableConfigs: []`, and a concise explanation. Yes, that's all in order. Given the localized nature of these changes, the lack of kernel impact is clear. Time to call `set-results`. |
| 6/2 | 2026/09/26 21:46 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch only modifies user-space files in tools/bpf/bpftool and tools/testing/selftests/bpf (adding a recursive dump option to bpftool and associated selftests). It does not alter any code compiled into the kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch only modifies user-space files in tools/bpf/bpftool and tools/testing/selftests/bpf (adding a recursive dump option to bpftool and associated selftests). It does not alter any code compiled into the kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
} |
| 7/1 | 2026/09/26 21:46 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|