| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/06/30 10:30 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"BPF_SYSCALL",
"DEBUG_INFO_BTF"
],
"FocusSymbols": [
"btf_struct_access",
"btf_struct_ids_match",
"map_kptr_match_type",
"process_kf_arg_ptr_to_btf_id",
"__process_kf_arg_ptr_to_graph_node"
],
"Reasoning": "The patch modifies the BPF verifier to prevent walking flexible arrays for allocated types during BTF struct access and type matching. This is a functional change in the core BPF verifier logic that affects how BPF programs are verified and should be fuzzed.",
"WorthFuzzing": true
} |
| 1/1 | 2026/06/30 10:30 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 246fa4ef426ec03fa12e0253838e523701c1db98\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Jun 30 10:30:05 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/linux/bpf.h b/include/linux/bpf.h\nindex 7719f652844560..314d606dc2c417 100644\n--- a/include/linux/bpf.h\n+++ b/include/linux/bpf.h\n@@ -3146,7 +3146,7 @@ int btf_struct_access(struct bpf_verifier_log *log,\n bool btf_struct_ids_match(struct bpf_verifier_log *log,\n \t\t\t const struct btf *btf, u32 id, int off,\n \t\t\t const struct btf *need_btf, u32 need_type_id,\n-\t\t\t bool strict);\n+\t\t\t bool strict, bool walk_flex_arrays);\n \n int btf_distill_func_proto(struct bpf_verifier_log *log,\n \t\t\t struct btf *btf,\ndiff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c\nindex 64572f85edc832..dff5c0d9164127 100644\n--- a/kernel/bpf/btf.c\n+++ b/kernel/bpf/btf.c\n@@ -7108,7 +7108,7 @@ enum bpf_struct_walk_result {\n static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,\n \t\t\t const struct btf_type *t, int off, int size,\n \t\t\t u32 *next_btf_id, enum bpf_type_flag *flag,\n-\t\t\t const char **field_name)\n+\t\t\t const char **field_name, bool walk_flex_arrays)\n {\n \tu32 i, moff, mtrue_end, msize = 0, total_nelems = 0;\n \tconst struct btf_type *mtype, *elem_type = NULL;\n@@ -7135,11 +7135,14 @@ static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,\n \t\t*flag |= PTR_UNTRUSTED;\n \n \tif (off + size \u003e t-\u003esize) {\n+\t\tstruct btf_array *array_elem;\n+\n+\t\tif (!walk_flex_arrays)\n+\t\t\tgoto error;\n+\n \t\t/* If the last element is a variable size array, we may\n \t\t * need to relax the rule.\n \t\t */\n-\t\tstruct btf_array *array_elem;\n-\n \t\tif (vlen == 0)\n \t\t\tgoto error;\n \n@@ -7404,7 +7407,8 @@ int btf_struct_access(struct bpf_verifier_log *log,\n \n \tt = btf_type_by_id(btf, id);\n \tdo {\n-\t\terr = btf_struct_walk(log, btf, t, off, size, \u0026id, \u0026tmp_flag, field_name);\n+\t\terr = btf_struct_walk(log, btf, t, off, size, \u0026id, \u0026tmp_flag,\n+\t\t\t\t field_name, !type_is_alloc(reg-\u003etype));\n \n \t\tswitch (err) {\n \t\tcase WALK_PTR:\n@@ -7463,7 +7467,7 @@ bool btf_types_are_same(const struct btf *btf1, u32 id1,\n bool btf_struct_ids_match(struct bpf_verifier_log *log,\n \t\t\t const struct btf *btf, u32 id, int off,\n \t\t\t const struct btf *need_btf, u32 need_type_id,\n-\t\t\t bool strict)\n+\t\t\t bool strict, bool walk_flex_arrays)\n {\n \tconst struct btf_type *type;\n \tenum bpf_type_flag flag = 0;\n@@ -7482,7 +7486,8 @@ bool btf_struct_ids_match(struct bpf_verifier_log *log,\n \ttype = btf_type_by_id(btf, id);\n \tif (!type)\n \t\treturn false;\n-\terr = btf_struct_walk(log, btf, type, off, 1, \u0026id, \u0026flag, NULL);\n+\terr = btf_struct_walk(log, btf, type, off, 1, \u0026id, \u0026flag, NULL,\n+\t\t\t walk_flex_arrays);\n \tif (err != WALK_STRUCT)\n \t\treturn false;\n \ndiff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c\nindex 25aea4271cd089..4d3bb715670d17 100644\n--- a/kernel/bpf/verifier.c\n+++ b/kernel/bpf/verifier.c\n@@ -4379,7 +4379,8 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,\n \t */\n \tif (!btf_struct_ids_match(\u0026env-\u003elog, reg-\u003ebtf, reg-\u003ebtf_id, reg-\u003evar_off.value,\n \t\t\t\t kptr_field-\u003ekptr.btf, kptr_field-\u003ekptr.btf_id,\n-\t\t\t\t kptr_field-\u003etype != BPF_KPTR_UNREF))\n+\t\t\t\t kptr_field-\u003etype != BPF_KPTR_UNREF,\n+\t\t\t\t !type_is_alloc(reg-\u003etype)))\n \t\tgoto bad_type;\n \treturn 0;\n bad_type:\n@@ -7970,7 +7971,7 @@ static int check_reg_type(struct bpf_verifier_env *env, struct bpf_reg_state *re\n \n \t\t\tif (!btf_struct_ids_match(\u0026env-\u003elog, reg-\u003ebtf, reg-\u003ebtf_id,\n \t\t\t\t\t\t reg-\u003evar_off.value, btf_vmlinux, *arg_btf_id,\n-\t\t\t\t\t\t strict_type_match)) {\n+\t\t\t\t\t\t strict_type_match, !type_is_alloc(reg-\u003etype))) {\n \t\t\t\tverbose(env, \"%s is of type %s but %s is expected\\n\",\n \t\t\t\t\treg_arg_name(env, argno),\n \t\t\t\t\tbtf_type_name(reg-\u003ebtf, reg-\u003ebtf_id),\n@@ -11429,7 +11430,8 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,\n \treg_ref_t = btf_type_skip_modifiers(reg_btf, reg_ref_id, \u0026reg_ref_id);\n \treg_ref_tname = btf_name_by_offset(reg_btf, reg_ref_t-\u003ename_off);\n \tstruct_same = btf_struct_ids_match(\u0026env-\u003elog, reg_btf, reg_ref_id, reg-\u003evar_off.value,\n-\t\t\t\t\t meta-\u003ebtf, ref_id, strict_type_match);\n+\t\t\t\t\t meta-\u003ebtf, ref_id, strict_type_match,\n+\t\t\t\t\t !type_is_alloc(reg-\u003etype));\n \t/* If kfunc is accepting a projection type (ie. __sk_buff), it cannot\n \t * actually use it -- it must cast to the underlying type. So we allow\n \t * caller to pass in the underlying type.\n@@ -11876,7 +11878,8 @@ __process_kf_arg_ptr_to_graph_node(struct bpf_verifier_env *env,\n \tet = btf_type_by_id(field-\u003egraph_root.btf, field-\u003egraph_root.value_btf_id);\n \tt = btf_type_by_id(reg-\u003ebtf, reg-\u003ebtf_id);\n \tif (!btf_struct_ids_match(\u0026env-\u003elog, reg-\u003ebtf, reg-\u003ebtf_id, 0, field-\u003egraph_root.btf,\n-\t\t\t\t field-\u003egraph_root.value_btf_id, true)) {\n+\t\t\t\t field-\u003egraph_root.value_btf_id, true,\n+\t\t\t\t !type_is_alloc(reg-\u003etype))) {\n \t\tverbose(env, \"operation on %s expects arg#1 %s at offset=%d \"\n \t\t\t\"in struct %s, but arg is at offset=%d in struct %s\\n\",\n \t\t\tbtf_field_type_name(head_field_type),\ndiff --git a/tools/testing/selftests/bpf/prog_tests/linked_list.c b/tools/testing/selftests/bpf/prog_tests/linked_list.c\nindex 8defea0253ed9a..c3d133c6a00d40 100644\n--- a/tools/testing/selftests/bpf/prog_tests/linked_list.c\n+++ b/tools/testing/selftests/bpf/prog_tests/linked_list.c\n@@ -68,6 +68,7 @@ static struct {\n \t{ \"obj_type_id_oor\", \"local type ID argument must be in range [0, U32_MAX]\" },\n \t{ \"obj_new_no_composite\", \"bpf_obj_new/bpf_percpu_obj_new type ID argument must be of a struct\" },\n \t{ \"obj_new_no_struct\", \"bpf_obj_new/bpf_percpu_obj_new type ID argument must be of a struct\" },\n+\t{ \"obj_new_flex_array\", \"access beyond struct obj_new_flex\" },\n \t{ \"obj_drop_non_zero_off\", \"R1 must have zero offset when passed to release func\" },\n \t{ \"new_null_ret\", \"R0 invalid mem access 'ptr_or_null_'\" },\n \t{ \"obj_new_acq\", \"Unreleased reference id=\" },\ndiff --git a/tools/testing/selftests/bpf/progs/linked_list_fail.c b/tools/testing/selftests/bpf/progs/linked_list_fail.c\nindex ddd26d1a083f72..031e77a288eec0 100644\n--- a/tools/testing/selftests/bpf/progs/linked_list_fail.c\n+++ b/tools/testing/selftests/bpf/progs/linked_list_fail.c\n@@ -167,6 +167,16 @@ CHECK_OP(push_back);\n #undef CHECK_OP\n #undef INIT\n \n+struct obj_new_flex_elem {\n+\tint lo;\n+\tint hi;\n+};\n+\n+struct obj_new_flex {\n+\tint hdr;\n+\tstruct obj_new_flex_elem cells[];\n+};\n+\n SEC(\"?kprobe/xyz\")\n int map_compat_kprobe(void *ctx)\n {\n@@ -230,6 +240,19 @@ int obj_new_no_struct(void *ctx)\n \treturn 0;\n }\n \n+SEC(\"?tc\")\n+int obj_new_flex_array(void *ctx)\n+{\n+\tstruct obj_new_flex *p;\n+\n+\tp = bpf_obj_new_impl(bpf_core_type_id_local(struct obj_new_flex), NULL);\n+\tif (!p)\n+\t\treturn 0;\n+\tp-\u003ecells[0].hi = 42;\n+\tbpf_obj_drop_impl(p, NULL);\n+\treturn 0;\n+}\n+\n SEC(\"?tc\")\n int obj_drop_non_zero_off(void *ctx)\n {\n"
} |
| 2/1 | 2026/06/30 10:30 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"BPF_SYSCALL",
"DEBUG_INFO_BTF"
],
"FocusSymbols": [
"btf_struct_access",
"btf_struct_ids_match",
"map_kptr_match_type",
"process_kf_arg_ptr_to_btf_id",
"__process_kf_arg_ptr_to_graph_node"
],
"Reasoning": "The patch modifies the BPF verifier to prevent walking flexible arrays for allocated types during BTF struct access and type matching. This is a functional change in the core BPF verifier logic that affects how BPF programs are verified and should be fuzzed.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 246fa4ef426ec03fa12e0253838e523701c1db98
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Jun 30 10:30:05 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 7719f652844560..314d606dc2c417 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -3146,7 +3146,7 @@ int btf_struct_access(struct bpf_verifier_log *log,
bool btf_struct_ids_match(struct bpf_verifier_log *log,
const struct btf *btf, u32 id, int off,
const struct btf *need_btf, u32 need_type_id,
- bool strict);
+ bool strict, bool walk_flex_arrays);
int btf_distill_func_proto(struct bpf_verifier_log *log,
struct btf *btf,
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 64572f85edc832..dff5c0d9164127 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -7108,7 +7108,7 @@ enum bpf_struct_walk_result {
static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,
const struct btf_type *t, int off, int size,
u32 *next_btf_id, enum bpf_type_flag *flag,
- const char **field_name)
+ const char **field_name, bool walk_flex_arrays)
{
u32 i, moff, mtrue_end, msize = 0, total_nelems = 0;
const struct btf_type *mtype, *elem_type = NULL;
@@ -7135,11 +7135,14 @@ static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,
*flag |= PTR_UNTRUSTED;
if (off + size > t->size) {
+ struct btf_array *array_elem;
+
+ if (!walk_flex_arrays)
+ goto error;
+
/* If the last element is a variable size array, we may
* need to relax the rule.
*/
- struct btf_array *array_elem;
-
if (vlen == 0)
goto error;
@@ -7404,7 +7407,8 @@ int btf_struct_access(struct bpf_verifier_log *log,
t = btf_type_by_id(btf, id);
do {
- err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag, field_name);
+ err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag,
+ field_name, !type_is_alloc(reg->type));
switch (err) {
case WALK_PTR:
@@ -7463,7 +7467,7 @@ bool btf_types_are_same(const struct btf *btf1, u32 id1,
bool btf_struct_ids_match(struct bpf_verifier_log *log,
const struct btf *btf, u32 id, int off,
const struct btf *need_btf, u32 need_type_id,
- bool strict)
+ bool strict, bool walk_flex_arrays)
{
const struct btf_type *type;
enum bpf_type_flag flag = 0;
@@ -7482,7 +7486,8 @@ bool btf_struct_ids_match(struct bpf_verifier_log *log,
type = btf_type_by_id(btf, id);
if (!type)
return false;
- err = btf_struct_walk(log, btf, type, off, 1, &id, &flag, NULL);
+ err = btf_struct_walk(log, btf, type, off, 1, &id, &flag, NULL,
+ walk_flex_arrays);
if (err != WALK_STRUCT)
return false;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 25aea4271cd089..4d3bb715670d17 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4379,7 +4379,8 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
*/
if (!btf_struct_ids_match(&env->log, reg->btf, reg->btf_id, reg->var_off.value,
kptr_field->kptr.btf, kptr_field->kptr.btf_id,
- kptr_field->type != BPF_KPTR_UNREF))
+ kptr_field->type != BPF_KPTR_UNREF,
+ !type_is_alloc(reg->type)))
goto bad_type;
return 0;
bad_type:
@@ -7970,7 +7971,7 @@ static int check_reg_type(struct bpf_verifier_env *env, struct bpf_reg_state *re
if (!btf_struct_ids_match(&env->log, reg->btf, reg->btf_id,
reg->var_off.value, btf_vmlinux, *arg_btf_id,
- strict_type_match)) {
+ strict_type_match, !type_is_alloc(reg->type))) {
verbose(env, "%s is of type %s but %s is expected\n",
reg_arg_name(env, argno),
btf_type_name(reg->btf, reg->btf_id),
@@ -11429,7 +11430,8 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,
reg_ref_t = btf_type_skip_modifiers(reg_btf, reg_ref_id, ®_ref_id);
reg_ref_tname = btf_name_by_offset(reg_btf, reg_ref_t->name_off);
struct_same = btf_struct_ids_match(&env->log, reg_btf, reg_ref_id, reg->var_off.value,
- meta->btf, ref_id, strict_type_match);
+ meta->btf, ref_id, strict_type_match,
+ !type_is_alloc(reg->type));
/* If kfunc is accepting a projection type (ie. __sk_buff), it cannot
* actually use it -- it must cast to the underlying type. So we allow
* caller to pass in the underlying type.
@@ -11876,7 +11878,8 @@ __process_kf_arg_ptr_to_graph_node(struct bpf_verifier_env *env,
et = btf_type_by_id(field->graph_root.btf, field->graph_root.value_btf_id);
t = btf_type_by_id(reg->btf, reg->btf_id);
if (!btf_struct_ids_match(&env->log, reg->btf, reg->btf_id, 0, field->graph_root.btf,
- field->graph_root.value_btf_id, true)) {
+ field->graph_root.value_btf_id, true,
+ !type_is_alloc(reg->type))) {
verbose(env, "operation on %s expects arg#1 %s at offset=%d "
"in struct %s, but arg is at offset=%d in struct %s\n",
btf_field_type_name(head_field_type),
diff --git a/tools/testing/selftests/bpf/prog_tests/linked_list.c b/tools/testing/selftests/bpf/prog_tests/linked_list.c
index 8defea0253ed9a..c3d133c6a00d40 100644
--- a/tools/testing/selftests/bpf/prog_tests/linked_list.c
+++ b/tools/testing/selftests/bpf/prog_tests/linked_list.c
@@ -68,6 +68,7 @@ static struct {
{ "obj_type_id_oor", "local type ID argument must be in range [0, U32_MAX]" },
{ "obj_new_no_composite", "bpf_obj_new/bpf_percpu_obj_new type ID argument must be of a struct" },
{ "obj_new_no_struct", "bpf_obj_new/bpf_percpu_obj_new type ID argument must be of a struct" },
+ { "obj_new_flex_array", "access beyond struct obj_new_flex" },
{ "obj_drop_non_zero_off", "R1 must have zero offset when passed to release func" },
{ "new_null_ret", "R0 invalid mem access 'ptr_or_null_'" },
{ "obj_new_acq", "Unreleased reference id=" },
diff --git a/tools/testing/selftests/bpf/progs/linked_list_fail.c b/tools/testing/selftests/bpf/progs/linked_list_fail.c
index ddd26d1a083f72..031e77a288eec0 100644
--- a/tools/testing/selftests/bpf/progs/linked_list_fail.c
+++ b/tools/testing/selftests/bpf/progs/linked_list_fail.c
@@ -167,6 +167,16 @@ CHECK_OP(push_back);
#undef CHECK_OP
#undef INIT
+struct obj_new_flex_elem {
+ int lo;
+ int hi;
+};
+
+struct obj_new_flex {
+ int hdr;
+ struct obj_new_flex_elem cells[];
+};
+
SEC("?kprobe/xyz")
int map_compat_kprobe(void *ctx)
{
@@ -230,6 +240,19 @@ int obj_new_no_struct(void *ctx)
return 0;
}
+SEC("?tc")
+int obj_new_flex_array(void *ctx)
+{
+ struct obj_new_flex *p;
+
+ p = bpf_obj_new_impl(bpf_core_type_id_local(struct obj_new_flex), NULL);
+ if (!p)
+ return 0;
+ p->cells[0].hi = 42;
+ bpf_obj_drop_impl(p, NULL);
+ return 0;
+}
+
SEC("?tc")
int obj_drop_non_zero_off(void *ctx)
{
|
| 3/2 | 2026/06/30 10:30 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4581 output: 22 thoughts: 630 Thoughts: **Fuzzing the BPF Verifier Patch** Okay, so I've got this patch – a core BPF verifier modification. It's adding a `walk_flex_arrays` parameter to `btf_struct_walk` and `btf_struct_ids_match`. The patch passes `!type_is_alloc(reg->type)` to that parameter in several spots in `kernel/bpf/verifier.c` and `kernel/bpf/btf.c`. Essentially, we're skipping flexible array walks for allocated types. This is definitely a functional change in the verifier, and that means fuzzing is crucial. First, I need to pinpoint the functions to focus on. I've identified the modified ones: `btf_struct_walk` (which is static, so a bit trickier), `btf_struct_access`, `btf_struct_ids_match`, `map_kptr_match_type` (also static), `check_reg_type` (again, static), `process_kf_arg_ptr_to_btf_id` (static), and `__process_kf_arg_ptr_to_graph_node` (static). Now, the real question is, how reachable are these and what configuration options do I need? Thankfully, BPF itself is enabled by `CONFIG_BPF` and `CONFIG_BPF_SYSCALL`, and since we are talking about the verifier, `BPF_SYSCALL` should be the key one. I've taken a look at these functions: - `btf_struct_access` - `btf_struct_ids_match` - `map_kptr_match_type` - `check_reg_type` - `process_kf_arg_ptr_to_btf_id` - `__process_kf_arg_ptr_to_graph_node` Are these good fuzzing targets? `btf_struct_access` is involved in memory access checks in the verifier. `btf_struct_ids_match` is used for type matching within the verifier. `map_kptr_match_type` handles kptr comparisons. `check_reg_type` is obviously about checking register types. `process_kf_arg_ptr_to_btf_id` is involved in kfunc arguments. Finally, `__process_kf_arg_ptr_to_graph_node` is tied to graph nodes, like linked lists and rbtrees. I'm leaning towards fuzzing `btf_struct_access`, `btf_struct_ids_match`, `map_kptr_match_type`, `process_kf_arg_ptr_to_btf_id`, and `__process_kf_arg_ptr_to_graph_node`. Let me do a quick sanity check to be sure, are there any other crucial configs? Aside from `CONFIG_BPF_SYSCALL`, I'll need `CONFIG_DEBUG_INFO_BTF` since this is related to BTF. I should do a quick grep just to confirm everything. |
| 4/2 | 2026/06/30 10:30 | tool | grepper |
0mArgs:{
"Expression": "btf_struct_ids_match"
}Results: {
"Output": "include/linux/bpf.h=3142=int btf_struct_access(struct bpf_verifier_log *log,\n--\ninclude/linux/bpf.h-3145-\t\t u32 *next_btf_id, enum bpf_type_flag *flag, const char **field_name);\ninclude/linux/bpf.h:3146:bool btf_struct_ids_match(struct bpf_verifier_log *log,\ninclude/linux/bpf.h-3147-\t\t\t const struct btf *btf, u32 id, int off,\n--\nkernel/bpf/btf.c=7457=bool btf_types_are_same(const struct btf *btf1, u32 id1,\n--\nkernel/bpf/btf.c-7466-\nkernel/bpf/btf.c:7467:bool btf_struct_ids_match(struct bpf_verifier_log *log,\nkernel/bpf/btf.c-7468-\t\t\t const struct btf *btf, u32 id, int off,\n--\nkernel/bpf/verifier.c=4318=static int map_kptr_match_type(struct bpf_verifier_env *env,\n--\nkernel/bpf/verifier.c-4374-\t * In the kptr_ref case, check_func_arg_reg_off already ensures reg-\u003evar_off\nkernel/bpf/verifier.c:4375:\t * is zero. We must also ensure that btf_struct_ids_match does not walk\nkernel/bpf/verifier.c-4376-\t * the struct to match type against first member of struct, i.e. reject\n--\nkernel/bpf/verifier.c-4379-\t */\nkernel/bpf/verifier.c:4380:\tif (!btf_struct_ids_match(\u0026env-\u003elog, reg-\u003ebtf, reg-\u003ebtf_id, reg-\u003evar_off.value,\nkernel/bpf/verifier.c-4381-\t\t\t\t kptr_field-\u003ekptr.btf, kptr_field-\u003ekptr.btf_id,\n--\nkernel/bpf/verifier.c=7857=static int check_reg_type(struct bpf_verifier_env *env, struct bpf_reg_state *reg, argno_t argno,\n--\nkernel/bpf/verifier.c-7971-\nkernel/bpf/verifier.c:7972:\t\t\tif (!btf_struct_ids_match(\u0026env-\u003elog, reg-\u003ebtf, reg-\u003ebtf_id,\nkernel/bpf/verifier.c-7973-\t\t\t\t\t\t reg-\u003evar_off.value, btf_vmlinux, *arg_btf_id,\n--\nkernel/bpf/verifier.c=11377=static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,\n--\nkernel/bpf/verifier.c-11420-\t * only difference here is that we're simply allowing\nkernel/bpf/verifier.c:11421:\t * btf_struct_ids_match() to walk the struct at the 0th offset, and\nkernel/bpf/verifier.c-11422-\t * resolve types.\n--\nkernel/bpf/verifier.c-11431-\treg_ref_tname = btf_name_by_offset(reg_btf, reg_ref_t-\u003ename_off);\nkernel/bpf/verifier.c:11432:\tstruct_same = btf_struct_ids_match(\u0026env-\u003elog, reg_btf, reg_ref_id, reg-\u003evar_off.value,\nkernel/bpf/verifier.c-11433-\t\t\t\t\t meta-\u003ebtf, ref_id, strict_type_match,\n--\nkernel/bpf/verifier.c=11841=__process_kf_arg_ptr_to_graph_node(struct bpf_verifier_env *env,\n--\nkernel/bpf/verifier.c-11879-\tt = btf_type_by_id(reg-\u003ebtf, reg-\u003ebtf_id);\nkernel/bpf/verifier.c:11880:\tif (!btf_struct_ids_match(\u0026env-\u003elog, reg-\u003ebtf, reg-\u003ebtf_id, 0, field-\u003egraph_root.btf,\nkernel/bpf/verifier.c-11881-\t\t\t\t field-\u003egraph_root.value_btf_id, true,\n--\ntools/testing/selftests/bpf/verifier/map_kptr.c-157-{\ntools/testing/selftests/bpf/verifier/map_kptr.c:158:\t\"map_kptr: unref: reject btf_struct_ids_match == false\",\ntools/testing/selftests/bpf/verifier/map_kptr.c-159-\t.insns = {\n"
} |
| 5/2 | 2026/06/30 10:30 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7173 output: 165 thoughts: 336 Thoughts: **Analyzing a BPF Verifier Patch** Okay, so this patch is definitely digging into the BPF verifier's core functionality, specifically related to how it handles flexible arrays within allocated objects. Seems like a bug fix related to that, which is good. The configs it depends on are pretty standard: `BPF_SYSCALL` and `DEBUG_INFO_BTF`. I need to focus on these symbols: `btf_struct_access`, `btf_struct_ids_match`, `map_kptr_match_type`, `process_kf_arg_ptr_to_btf_id`, and `__process_kf_arg_ptr_to_graph_node`. I need to be sure about their scope before proceeding. Alright, a quick check… `map_kptr_match_type` and `process_kf_arg_ptr_to_btf_id` are static, which is what I suspected. `btf_struct_access` and `btf_struct_ids_match` are exported/global, meaning they are more likely entry points that are needed for external access. So, I can use all these symbols I listed. The change seems to be targeted at preventing the verifier from incorrectly walking flexible arrays during BTF struct access and type matching for allocated types. This is a functional change. Let me double-check `check_reg_type` quickly. Hmm, it seems a little too general for this specific issue, so I'll probably leave that out of the set. The main point is that this patch changes the BPF verifier to address this BTF-related issue, and should be fuzzed as a result. Right, time to move on and set results. |
| 6/2 | 2026/06/30 10:30 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"BPF_SYSCALL",
"DEBUG_INFO_BTF"
],
"FocusSymbols": [
"btf_struct_access",
"btf_struct_ids_match",
"map_kptr_match_type",
"process_kf_arg_ptr_to_btf_id",
"__process_kf_arg_ptr_to_graph_node"
],
"Reasoning": "The patch modifies the BPF verifier to prevent walking flexible arrays for allocated types during BTF struct access and type matching. This is a functional change in the core BPF verifier logic that affects how BPF programs are verified and should be fuzzed.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"BPF_SYSCALL",
"DEBUG_INFO_BTF"
],
"FocusSymbols": [
"btf_struct_access",
"btf_struct_ids_match",
"map_kptr_match_type",
"process_kf_arg_ptr_to_btf_id",
"__process_kf_arg_ptr_to_graph_node"
],
"Reasoning": "The patch modifies the BPF verifier to prevent walking flexible arrays for allocated types during BTF struct access and type matching. This is a functional change in the core BPF verifier logic that affects how BPF programs are verified and should be fuzzed.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|