AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/05 18:31	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_check" ], "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.", "WorthFuzzing": true }
1/1	2026/08/05 18:31	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 0bd3522879f6b8f926e33564ca73ca8ccdae6386\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Aug 5 18:31:38 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/linux/btf.h b/include/linux/btf.h\nindex c09b7994de4eb..3f5255d095a27 100644\n--- a/include/linux/btf.h\n+++ b/include/linux/btf.h\n@@ -79,6 +79,7 @@\n #define KF_ARENA_ARG1 (1 \u003c\u003c 14) /* kfunc takes an arena pointer as its first argument /\n #define KF_ARENA_ARG2 (1 \u003c\u003c 15) / kfunc takes an arena pointer as its second argument /\n #define KF_IMPLICIT_ARGS (1 \u003c\u003c 16) / kfunc has implicit arguments supplied by the verifier /\n+#define KF_SPINLOCK_SAFE (1 \u003c\u003c 17) / kfunc is allowed inside bpf_spin_lock-ed region /\n \n /\n * Tag marking a kernel function as a kfunc. This is meant to minimize the\ndiff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c\nindex 555ee2531ef98..7b6847200b431 100644\n--- a/kernel/bpf/arena.c\n+++ b/kernel/bpf/arena.c\n@@ -1118,9 +1118,9 @@ __bpf_kfunc int bpf_arena_reserve_pages(void p__map, void ptr__ign, u32 page_c\n __bpf_kfunc_end_defs();\n \n BTF_KFUNCS_START(arena_kfuncs)\n-BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET \| KF_ARENA_ARG2)\n-BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2)\n-BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2)\n+BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET \| KF_ARENA_ARG2 \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2 \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2 \| KF_SPINLOCK_SAFE)\n BTF_KFUNCS_END(arena_kfuncs)\n \n static const struct btf_kfunc_id_set common_kfunc_set = {\ndiff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c\nindex 4709a5ad04747..6388b6b23e490 100644\n--- a/kernel/bpf/helpers.c\n+++ b/kernel/bpf/helpers.c\n@@ -4812,30 +4812,32 @@ BTF_ID_FLAGS(func, bpf_obj_drop, KF_RELEASE \| KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)\n BTF_ID_FLAGS(func, bpf_percpu_obj_drop, KF_RELEASE \| KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE)\n-BTF_ID_FLAGS(func, bpf_refcount_acquire, KF_ACQUIRE \| KF_RET_NULL \| KF_RCU \| KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE \| KF_RET_NULL \| KF_RCU)\n-BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_list_push_front_impl)\n-BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_list_push_back_impl)\n-BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE \| KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE \| KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE \| KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_is_first)\n-BTF_ID_FLAGS(func, bpf_list_is_last)\n-BTF_ID_FLAGS(func, bpf_list_empty)\n+BTF_ID_FLAGS(func, bpf_refcount_acquire,\n+\t KF_ACQUIRE \| KF_RET_NULL \| KF_RCU \| KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_refcount_acquire_impl,\n+\t KF_ACQUIRE \| KF_RET_NULL \| KF_RCU \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_front_impl, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_back_impl, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_is_first, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_is_last, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_empty, KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE \| KF_RCU \| KF_RET_NULL)\n BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE)\n-BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE \| KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_rbtree_add_impl)\n-BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL)\n+BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_add_impl, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n \n #ifdef CONFIG_CGROUPS\n BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE \| KF_RCU \| KF_RET_NULL)\n@@ -4885,9 +4887,9 @@ BTF_ID_FLAGS(func, bpf_rcu_read_lock)\n BTF_ID_FLAGS(func, bpf_rcu_read_unlock)\n BTF_ID_FLAGS(func, bpf_dynptr_slice, KF_RET_NULL)\n BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW)\n-BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT \| KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY)\n+BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT \| KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY \| KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_iter_task_vma_new, KF_ITER_NEW \| KF_RCU)\n BTF_ID_FLAGS(func, bpf_iter_task_vma_next, KF_ITER_NEXT \| KF_RET_NULL)\n BTF_ID_FLAGS(func, bpf_iter_task_vma_destroy, KF_ITER_DESTROY)\n@@ -4962,8 +4964,8 @@ BTF_ID_FLAGS(func, bpf_strncasestr);\n #if defined(CONFIG_BPF_LSM) \u0026\u0026 defined(CONFIG_CGROUPS)\n BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU)\n #endif\n-BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS)\n+BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_dynptr_from_file)\ndiff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c\nindex e4e338cdb437c..e527cb425cf45 100644\n--- a/kernel/bpf/rqspinlock.c\n+++ b/kernel/bpf/rqspinlock.c\n@@ -744,10 +744,10 @@ __bpf_kfunc void bpf_res_spin_unlock_irqrestore(struct bpf_res_spin_lock lock,\n __bpf_kfunc_end_defs();\n \n BTF_KFUNCS_START(rqspinlock_kfunc_ids)\n-BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_res_spin_unlock)\n-BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore)\n+BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_res_spin_unlock, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL \| KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore, KF_SPINLOCK_SAFE)\n BTF_KFUNCS_END(rqspinlock_kfunc_ids)\n \n static const struct btf_kfunc_id_set rqspinlock_kfunc_set = {\ndiff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c\nindex b274004fccfd9..7c1edcae293a8 100644\n--- a/kernel/bpf/verifier.c\n+++ b/kernel/bpf/verifier.c\n@@ -11797,20 +11797,6 @@ static bool is_bpf_rbtree_api_kfunc(u32 btf_id)\n \t btf_id == special_kfunc_list[KF_bpf_rbtree_right];\n }\n \n-static bool is_bpf_iter_num_api_kfunc(u32 btf_id)\n-{\n-\treturn btf_id == special_kfunc_list[KF_bpf_iter_num_new] \|\|\n-\t btf_id == special_kfunc_list[KF_bpf_iter_num_next] \|\|\n-\t btf_id == special_kfunc_list[KF_bpf_iter_num_destroy];\n-}\n-\n-static bool is_bpf_graph_api_kfunc(u32 btf_id)\n-{\n-\treturn is_bpf_list_api_kfunc(btf_id) \|\|\n-\t is_bpf_rbtree_api_kfunc(btf_id) \|\|\n-\t is_bpf_refcount_acquire_kfunc(btf_id);\n-}\n-\n static bool is_bpf_res_spin_lock_kfunc(u32 btf_id)\n {\n \treturn btf_id == special_kfunc_list[KF_bpf_res_spin_lock] \|\|\n@@ -11819,24 +11805,16 @@ static bool is_bpf_res_spin_lock_kfunc(u32 btf_id)\n \t btf_id == special_kfunc_list[KF_bpf_res_spin_unlock_irqrestore];\n }\n \n-static bool is_bpf_arena_kfunc(u32 btf_id)\n+static bool kfunc_spin_allowed(struct bpf_verifier_env env, s32 func_id, s16 offset)\n {\n-\treturn btf_id == special_kfunc_list[KF_bpf_arena_alloc_pages] \|\|\n-\t btf_id == special_kfunc_list[KF_bpf_arena_free_pages] \|\|\n-\t btf_id == special_kfunc_list[KF_bpf_arena_reserve_pages];\n-}\n+\tstruct bpf_kfunc_meta kfunc;\n+\tint err;\n \n-static bool is_bpf_stream_kfunc(u32 btf_id)\n-{\n-\treturn btf_id == special_kfunc_list[KF_bpf_stream_vprintk] \|\|\n-\t btf_id == special_kfunc_list[KF_bpf_stream_print_stack];\n-}\n+\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\n+\tif (err \|\| !kfunc.flags)\n+\t\treturn false;\n \n-static bool kfunc_spin_allowed(u32 btf_id)\n-{\n-\treturn is_bpf_graph_api_kfunc(btf_id) \|\| is_bpf_iter_num_api_kfunc(btf_id) \|\|\n-\t is_bpf_res_spin_lock_kfunc(btf_id) \|\| is_bpf_arena_kfunc(btf_id) \|\|\n-\t is_bpf_stream_kfunc(btf_id);\n+\treturn kfunc.flags \u0026 KF_SPINLOCK_SAFE;\n }\n \n static bool is_sync_callback_calling_kfunc(u32 btf_id)\n@@ -17415,7 +17393,7 @@ static int do_check_insn(struct bpf_verifier_env env, bool do_print_state)\n \t\t\t\t insn-\u003eimm != BPF_FUNC_spin_unlock \u0026\u0026\n \t\t\t\t insn-\u003eimm != BPF_FUNC_kptr_xchg) \|\|\n \t\t\t\t (insn-\u003esrc_reg == BPF_PSEUDO_KFUNC_CALL \u0026\u0026\n-\t\t\t\t (insn-\u003eoff != 0 \|\| !kfunc_spin_allowed(insn-\u003eimm)))) {\n+\t\t\t\t !kfunc_spin_allowed(env, insn-\u003eimm, insn-\u003eoff))) {\n \t\t\t\t\tverbose(env,\n \t\t\t\t\t\t\"function calls are not allowed while holding a lock\\n\");\n \t\t\t\t\treturn -EINVAL;\ndiff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c\nindex 7af5560f2a08c..2b39cc1b09f9a 100644\n--- a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c\n+++ b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c\n@@ -71,8 +71,10 @@ static struct kfunc_test_params kfunc_tests[] = {\n \tTC_FAIL(kfunc_call_test_get_mem_fail_not_const, 0, \"is not a const\"),\n \tTC_FAIL(kfunc_call_test_mem_acquire_fail, 0, \"acquire kernel function does not return PTR_TO_BTF_ID\"),\n \tTC_FAIL(kfunc_call_test_pointer_arg_type_mismatch, 0, \"R1 expected pointer to ctx, but got scalar\"),\n+\tTC_FAIL(kfunc_call_test_spin_lock_unsafe, 0, \"function calls are not allowed while holding a lock\"),\n \n \t/ success cases /\n+\tTC_TEST(kfunc_call_test_spin_lock_safe, 0),\n \tTC_TEST(kfunc_call_test1, 12),\n \tTC_TEST(kfunc_call_test2, 3),\n \tTC_TEST(kfunc_call_test4, -1234),\ndiff --git a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c\nindex 64b6a0b0ab1cc..7e93f7fb13299 100644\n--- a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c\n+++ b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c\n@@ -4,6 +4,18 @@\n #include \u003cbpf/bpf_helpers.h\u003e\n #include \"../test_kmods/bpf_testmod_kfunc.h\"\n \n+static struct bpf_spin_lock kfunc_call_lock SEC(\".data.A\");\n+\n+SEC(\"?tc\")\n+int kfunc_call_test_spin_lock_unsafe(struct __sk_buff skb)\n+{\n+\tbpf_spin_lock(\u0026kfunc_call_lock);\n+\tbpf_kfunc_trigger_ctx_check();\n+\tbpf_spin_unlock(\u0026kfunc_call_lock);\n+\n+\treturn 0;\n+}\n+\n struct syscall_test_args {\n \t__u8 data[16];\n \tsize_t size;\ndiff --git a/tools/testing/selftests/bpf/progs/kfunc_call_test.c b/tools/testing/selftests/bpf/progs/kfunc_call_test.c\nindex 5edc51564f711..8e6560c31e781 100644\n--- a/tools/testing/selftests/bpf/progs/kfunc_call_test.c\n+++ b/tools/testing/selftests/bpf/progs/kfunc_call_test.c\n@@ -5,6 +5,18 @@\n #include \"bpf_misc.h\"\n #include \"../test_kmods/bpf_testmod_kfunc.h\"\n \n+static struct bpf_spin_lock kfunc_call_lock SEC(\".data.A\");\n+\n+SEC(\"tc\")\n+int kfunc_call_test_spin_lock_safe(struct __sk_buff skb)\n+{\n+\tbpf_spin_lock(\u0026kfunc_call_lock);\n+\tbpf_testmod_test_mod_kfunc(42);\n+\tbpf_spin_unlock(\u0026kfunc_call_lock);\n+\n+\treturn 0;\n+}\n+\n SEC(\"tc\")\n int kfunc_call_test5(struct __sk_buff skb)\n {\ndiff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\nindex eb0f9b5e18d85..0585794606ed8 100644\n--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\n+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\n@@ -1384,7 +1384,7 @@ __bpf_kfunc void bpf_kfunc_trigger_ctx_check(void)\n }\n \n BTF_KFUNCS_START(bpf_testmod_check_kfunc_ids)\n-BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc)\n+BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc, KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_kfunc_call_test1)\n BTF_ID_FLAGS(func, bpf_kfunc_call_test2)\n BTF_ID_FLAGS(func, bpf_kfunc_call_test3)\n" }
2/1	2026/08/05 18:31	agent	patch-evaluator	0m Model: best-expensive Args: null Results: { "EnableConfigs": [ "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_check" ], "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 0bd3522879f6b8f926e33564ca73ca8ccdae6386 Author: syz-cluster <triage@syzkaller.com> Date: Wed Aug 5 18:31:38 2026 +0000 syz-cluster: applied patch under review diff --git a/include/linux/btf.h b/include/linux/btf.h index c09b7994de4eb..3f5255d095a27 100644 --- a/include/linux/btf.h +++ b/include/linux/btf.h @@ -79,6 +79,7 @@ #define KF_ARENA_ARG1 (1 << 14) /* kfunc takes an arena pointer as its first argument / #define KF_ARENA_ARG2 (1 << 15) / kfunc takes an arena pointer as its second argument / #define KF_IMPLICIT_ARGS (1 << 16) / kfunc has implicit arguments supplied by the verifier / +#define KF_SPINLOCK_SAFE (1 << 17) / kfunc is allowed inside bpf_spin_lock-ed region / / * Tag marking a kernel function as a kfunc. This is meant to minimize the diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c index 555ee2531ef98..7b6847200b431 100644 --- a/kernel/bpf/arena.c +++ b/kernel/bpf/arena.c @@ -1118,9 +1118,9 @@ __bpf_kfunc int bpf_arena_reserve_pages(void p__map, void ptr__ign, u32 page_c __bpf_kfunc_end_defs(); BTF_KFUNCS_START(arena_kfuncs) -BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET \| KF_ARENA_ARG2) -BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2) -BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2) +BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET \| KF_ARENA_ARG2 \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2 \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2 \| KF_SPINLOCK_SAFE) BTF_KFUNCS_END(arena_kfuncs) static const struct btf_kfunc_id_set common_kfunc_set = { diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 4709a5ad04747..6388b6b23e490 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -4812,30 +4812,32 @@ BTF_ID_FLAGS(func, bpf_obj_drop, KF_RELEASE \| KF_IMPLICIT_ARGS) BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE) BTF_ID_FLAGS(func, bpf_percpu_obj_drop, KF_RELEASE \| KF_IMPLICIT_ARGS) BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE) -BTF_ID_FLAGS(func, bpf_refcount_acquire, KF_ACQUIRE \| KF_RET_NULL \| KF_RCU \| KF_IMPLICIT_ARGS) -BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE \| KF_RET_NULL \| KF_RCU) -BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS) -BTF_ID_FLAGS(func, bpf_list_push_front_impl) -BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS) -BTF_ID_FLAGS(func, bpf_list_push_back_impl) -BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS) -BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE \| KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE \| KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE \| KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_list_is_first) -BTF_ID_FLAGS(func, bpf_list_is_last) -BTF_ID_FLAGS(func, bpf_list_empty) +BTF_ID_FLAGS(func, bpf_refcount_acquire, + KF_ACQUIRE \| KF_RET_NULL \| KF_RCU \| KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, + KF_ACQUIRE \| KF_RET_NULL \| KF_RCU \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_push_front_impl, KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_push_back_impl, KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_is_first, KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_is_last, KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_list_empty, KF_SPINLOCK_SAFE) BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE \| KF_RCU \| KF_RET_NULL) BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE) -BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE \| KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS) -BTF_ID_FLAGS(func, bpf_rbtree_add_impl) -BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL) +BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE \| KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_rbtree_add_impl, KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL \| KF_SPINLOCK_SAFE) #ifdef CONFIG_CGROUPS BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE \| KF_RCU \| KF_RET_NULL) @@ -4885,9 +4887,9 @@ BTF_ID_FLAGS(func, bpf_rcu_read_lock) BTF_ID_FLAGS(func, bpf_rcu_read_unlock) BTF_ID_FLAGS(func, bpf_dynptr_slice, KF_RET_NULL) BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW) -BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT \| KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY) +BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT \| KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY \| KF_SPINLOCK_SAFE) BTF_ID_FLAGS(func, bpf_iter_task_vma_new, KF_ITER_NEW \| KF_RCU) BTF_ID_FLAGS(func, bpf_iter_task_vma_next, KF_ITER_NEXT \| KF_RET_NULL) BTF_ID_FLAGS(func, bpf_iter_task_vma_destroy, KF_ITER_DESTROY) @@ -4962,8 +4964,8 @@ BTF_ID_FLAGS(func, bpf_strncasestr); #if defined(CONFIG_BPF_LSM) && defined(CONFIG_CGROUPS) BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU) #endif -BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS) -BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS) +BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS \| KF_SPINLOCK_SAFE) BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS) BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS) BTF_ID_FLAGS(func, bpf_dynptr_from_file) diff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c index e4e338cdb437c..e527cb425cf45 100644 --- a/kernel/bpf/rqspinlock.c +++ b/kernel/bpf/rqspinlock.c @@ -744,10 +744,10 @@ __bpf_kfunc void bpf_res_spin_unlock_irqrestore(struct bpf_res_spin_lock lock, __bpf_kfunc_end_defs(); BTF_KFUNCS_START(rqspinlock_kfunc_ids) -BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_res_spin_unlock) -BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL) -BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore) +BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_res_spin_unlock, KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL \| KF_SPINLOCK_SAFE) +BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore, KF_SPINLOCK_SAFE) BTF_KFUNCS_END(rqspinlock_kfunc_ids) static const struct btf_kfunc_id_set rqspinlock_kfunc_set = { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index b274004fccfd9..7c1edcae293a8 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11797,20 +11797,6 @@ static bool is_bpf_rbtree_api_kfunc(u32 btf_id) btf_id == special_kfunc_list[KF_bpf_rbtree_right]; } -static bool is_bpf_iter_num_api_kfunc(u32 btf_id) -{ - return btf_id == special_kfunc_list[KF_bpf_iter_num_new] \|\| - btf_id == special_kfunc_list[KF_bpf_iter_num_next] \|\| - btf_id == special_kfunc_list[KF_bpf_iter_num_destroy]; -} - -static bool is_bpf_graph_api_kfunc(u32 btf_id) -{ - return is_bpf_list_api_kfunc(btf_id) \|\| - is_bpf_rbtree_api_kfunc(btf_id) \|\| - is_bpf_refcount_acquire_kfunc(btf_id); -} - static bool is_bpf_res_spin_lock_kfunc(u32 btf_id) { return btf_id == special_kfunc_list[KF_bpf_res_spin_lock] \|\| @@ -11819,24 +11805,16 @@ static bool is_bpf_res_spin_lock_kfunc(u32 btf_id) btf_id == special_kfunc_list[KF_bpf_res_spin_unlock_irqrestore]; } -static bool is_bpf_arena_kfunc(u32 btf_id) +static bool kfunc_spin_allowed(struct bpf_verifier_env env, s32 func_id, s16 offset) { - return btf_id == special_kfunc_list[KF_bpf_arena_alloc_pages] \|\| - btf_id == special_kfunc_list[KF_bpf_arena_free_pages] \|\| - btf_id == special_kfunc_list[KF_bpf_arena_reserve_pages]; -} + struct bpf_kfunc_meta kfunc; + int err; -static bool is_bpf_stream_kfunc(u32 btf_id) -{ - return btf_id == special_kfunc_list[KF_bpf_stream_vprintk] \|\| - btf_id == special_kfunc_list[KF_bpf_stream_print_stack]; -} + err = fetch_kfunc_meta(env, func_id, offset, &kfunc); + if (err \|\| !kfunc.flags) + return false; -static bool kfunc_spin_allowed(u32 btf_id) -{ - return is_bpf_graph_api_kfunc(btf_id) \|\| is_bpf_iter_num_api_kfunc(btf_id) \|\| - is_bpf_res_spin_lock_kfunc(btf_id) \|\| is_bpf_arena_kfunc(btf_id) \|\| - is_bpf_stream_kfunc(btf_id); + return kfunc.flags & KF_SPINLOCK_SAFE; } static bool is_sync_callback_calling_kfunc(u32 btf_id) @@ -17415,7 +17393,7 @@ static int do_check_insn(struct bpf_verifier_env env, bool do_print_state) insn->imm != BPF_FUNC_spin_unlock && insn->imm != BPF_FUNC_kptr_xchg) \|\| (insn->src_reg == BPF_PSEUDO_KFUNC_CALL && - (insn->off != 0 \|\| !kfunc_spin_allowed(insn->imm)))) { + !kfunc_spin_allowed(env, insn->imm, insn->off))) { verbose(env, "function calls are not allowed while holding a lock\n"); return -EINVAL; diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c index 7af5560f2a08c..2b39cc1b09f9a 100644 --- a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c +++ b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c @@ -71,8 +71,10 @@ static struct kfunc_test_params kfunc_tests[] = { TC_FAIL(kfunc_call_test_get_mem_fail_not_const, 0, "is not a const"), TC_FAIL(kfunc_call_test_mem_acquire_fail, 0, "acquire kernel function does not return PTR_TO_BTF_ID"), TC_FAIL(kfunc_call_test_pointer_arg_type_mismatch, 0, "R1 expected pointer to ctx, but got scalar"), + TC_FAIL(kfunc_call_test_spin_lock_unsafe, 0, "function calls are not allowed while holding a lock"), / success cases / + TC_TEST(kfunc_call_test_spin_lock_safe, 0), TC_TEST(kfunc_call_test1, 12), TC_TEST(kfunc_call_test2, 3), TC_TEST(kfunc_call_test4, -1234), diff --git a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c index 64b6a0b0ab1cc..7e93f7fb13299 100644 --- a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c +++ b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c @@ -4,6 +4,18 @@ #include <bpf/bpf_helpers.h> #include "../test_kmods/bpf_testmod_kfunc.h" +static struct bpf_spin_lock kfunc_call_lock SEC(".data.A"); + +SEC("?tc") +int kfunc_call_test_spin_lock_unsafe(struct __sk_buff skb) +{ + bpf_spin_lock(&kfunc_call_lock); + bpf_kfunc_trigger_ctx_check(); + bpf_spin_unlock(&kfunc_call_lock); + + return 0; +} + struct syscall_test_args { __u8 data[16]; size_t size; diff --git a/tools/testing/selftests/bpf/progs/kfunc_call_test.c b/tools/testing/selftests/bpf/progs/kfunc_call_test.c index 5edc51564f711..8e6560c31e781 100644 --- a/tools/testing/selftests/bpf/progs/kfunc_call_test.c +++ b/tools/testing/selftests/bpf/progs/kfunc_call_test.c @@ -5,6 +5,18 @@ #include "bpf_misc.h" #include "../test_kmods/bpf_testmod_kfunc.h" +static struct bpf_spin_lock kfunc_call_lock SEC(".data.A"); + +SEC("tc") +int kfunc_call_test_spin_lock_safe(struct __sk_buff skb) +{ + bpf_spin_lock(&kfunc_call_lock); + bpf_testmod_test_mod_kfunc(42); + bpf_spin_unlock(&kfunc_call_lock); + + return 0; +} + SEC("tc") int kfunc_call_test5(struct __sk_buff skb) { diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c index eb0f9b5e18d85..0585794606ed8 100644 --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c @@ -1384,7 +1384,7 @@ __bpf_kfunc void bpf_kfunc_trigger_ctx_check(void) } BTF_KFUNCS_START(bpf_testmod_check_kfunc_ids) -BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc) +BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc, KF_SPINLOCK_SAFE) BTF_ID_FLAGS(func, bpf_kfunc_call_test1) BTF_ID_FLAGS(func, bpf_kfunc_call_test2) BTF_ID_FLAGS(func, bpf_kfunc_call_test3)
3/2	2026/08/05 18:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7823 output: 34 thoughts: 682 Thoughts: Analyzing the BPF Verifier Change for Potential Fuzzing Targets Okay, so this patch introduces a `KF_SPINLOCK_SAFE` flag for BPF kfuncs, a new feature that's pretty interesting. The core of the change lies in the BPF verifier, specifically within `kernel/bpf/verifier.c`. My initial thought is, is this worth fuzzing? Absolutely, any modification to the verifier, particularly one that alters the allowed operations within a critical section like a spinlock, demands scrutiny. The fundamental shift is how the verifier now determines whether a kfunc can be used inside a spinlock. Instead of that hardcoded list of `is_bpf_*_kfunc` checks, it now uses this `KF_SPINLOCK_SAFE` flag present in the BTF data for each kfunc. That's a significant refactoring that could introduce subtle behavioral changes, or even allow privileged code to access features by misusing this new flag. It also means that external modules now have the ability to explicitly mark their kfuncs as "spinlock safe," which widens the attack surface. This is a potential new feature/refactoring that deserves fuzzing. My primary focus shifts to `kfunc_spin_allowed`, the function being modified, and its call chain. It's static, which is typical for the verifier, but it's called by `do_check_insn`, which is also static. Following the call graph, `do_check_insn` is called by `do_check`, which is the immediate next function that needs checking. This seems like a reasonable entry point for the fuzzing analysis. I'll need to scrutinize `fetch_kfunc_meta` as well, since that's where the kfunc metadata including the flag is retrieved. The BPF verifier is already heavily fuzzed by syzkaller, which is a good thing, but I want to make sure this specific change is covered.
4/2	2026/08/05 18:31	tool	grepper	0m Args: { "Expression": "fetch_kfunc_meta", "PathPrefix": "kernel/bpf/verifier.c" } Results: { "Output": "kernel/bpf/verifier.c=2634=static const struct btf_type find_kfunc_impl_proto(struct bpf_verifier_log log,\n--\nkernel/bpf/verifier.c-2660-\nkernel/bpf/verifier.c:2661:static int fetch_kfunc_meta(struct bpf_verifier_env env,\nkernel/bpf/verifier.c-2662-\t\t\t s32 func_id,\n--\nkernel/bpf/verifier.c=2727=int bpf_add_kfunc_call(struct bpf_verifier_env env, u32 func_id, u16 offset)\n--\nkernel/bpf/verifier.c-2794-\nkernel/bpf/verifier.c:2795:\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\nkernel/bpf/verifier.c-2796-\tif (err)\n--\nkernel/bpf/verifier.c=11808=static bool kfunc_spin_allowed(struct bpf_verifier_env env, s32 func_id, s16 offset)\n--\nkernel/bpf/verifier.c-11812-\nkernel/bpf/verifier.c:11813:\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\nkernel/bpf/verifier.c-11814-\tif (err \|\| !kfunc.flags)\n--\nkernel/bpf/verifier.c=12615=int bpf_fetch_kfunc_arg_meta(struct bpf_verifier_env env,\n--\nkernel/bpf/verifier.c-12624-\nkernel/bpf/verifier.c:12625:\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\nkernel/bpf/verifier.c-12626-\tif (err)\n" }
5/2	2026/08/05 18:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9462 output: 35 thoughts: 75 Thoughts: Diving into BPF Verification Okay, so `kfunc_spin_allowed` is being called from `do_check_insn`. My immediate thought is to zero in on the functions that aren't static; those are the ones we need to analyze more closely. That usually points to the core functionality. I know `bpf_check` is the main entry point for the verifier, so I'll start with that. The next logical step is to examine `kernel/bpf/verifier.c` and see which functions are exported or, if not exported, are non-static, which would indicate their likely importance in this context. I need to understand the interaction and flow.
6/2	2026/08/05 18:31	tool	grepper	0m Args: { "Expression": "^int bpf_check\\(", "PathPrefix": "kernel/bpf/verifier.c" } Results: { "Output": "kernel/bpf/verifier.c=20020=static int bpf_prog_verify_signature(struct bpf_verifier_env env,\n--\nkernel/bpf/verifier.c-20136-\nkernel/bpf/verifier.c:20137:int bpf_check(struct bpf_prog prog, union bpf_attr attr, bpfptr_t uattr,\nkernel/bpf/verifier.c-20138-\t struct bpf_log_attr *attr_log)\n" }
7/2	2026/08/05 18:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9863 output: 59 thoughts: 228 Thoughts: Analyzing the BPF Patch Okay, so this patch seems focused. I like that they're zeroing in on `bpf_check`; that seems like the right area to start. My initial thought is to examine the impact on `do_check` as well, since that one is static and might be directly related. I should also make sure no other functions are indirectly affected. Looking deeper, the patch mentions modifications to functions like `bpf_arena_alloc_pages`, `bpf_arena_free_pages`, and so on, but it only changes their BTF flags, not the core logic. The meat of the change appears to be within `kfunc_spin_allowed`, which is also static. This reinforces my initial assessment that investigating `bpf_check` is the most direct path. Now, let's nail down the configuration dependencies. I know BPF is enabled via `CONFIG_BPF_SYSCALL`, but I need to ensure there aren't any other crucial configuration options at play here. This means I'll be looking at the related configuration options, specifically ones used by the modified files. The patch touches files in `kernel/bpf/arena.c`, `kernel/bpf/helpers.c`, `kernel/bpf/rqspinlock.c`, and `kernel/bpf/verifier.c`. To understand the configuration dependencies, I'll examine the `kernel/bpf/Makefile`. This should list the specific configuration options that control the compilation of those files, providing a comprehensive view of any prerequisites for these changes to take effect.
8/2	2026/08/05 18:32	tool	grepper	0m Args: { "Expression": "arena\\.o", "PathPrefix": "kernel/bpf/Makefile" } Results: { "Output": "kernel/bpf/Makefile=19=ifeq ($(CONFIG_MMU)$(CONFIG_64BIT),yy)\nkernel/bpf/Makefile:20:obj-$(CONFIG_BPF_SYSCALL) += arena.o range_tree.o\nkernel/bpf/Makefile-21-endif\n" }
9/2	2026/08/05 18:32	tool	grepper	0m Args: { "Expression": "rqspinlock\\.o", "PathPrefix": "kernel/bpf/Makefile" } Results: { "Output": "kernel/bpf/Makefile=17=obj-$(CONFIG_BPF_JIT) += trampoline.o\nkernel/bpf/Makefile:18:obj-$(CONFIG_BPF_SYSCALL) += btf.o memalloc.o rqspinlock.o stream.o\nkernel/bpf/Makefile-19-ifeq ($(CONFIG_MMU)$(CONFIG_64BIT),yy)\n--\nkernel/bpf/Makefile=75=CFLAGS_REMOVE_ringbuf.o = $(CC_FLAGS_FTRACE)\nkernel/bpf/Makefile:76:CFLAGS_REMOVE_rqspinlock.o = $(CC_FLAGS_FTRACE)\n" }
10/2	2026/08/05 18:32	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10731 output: 29 thoughts: 85 Thoughts: Okay, let's break this down. Analyzing the BPF System Call Configuration Alright, my focus is zeroing in on this `CONFIG_BPF_SYSCALL` option. That's the primary flag I need to track. Hold on a second, though, because `arena.o` has dependencies on both `CONFIG_MMU` and `CONFIG_64BIT`. That impacts how this will ultimately play out. But I think the real meat of the modification resides in `verifier.c`, and that's compiled with `CONFIG_BPF_SYSCALL`, right? Okay, so that's the key file. I should really check the `kernel/bpf/Makefile` to confirm where `verifier.o` is being built. I need to understand that build process better.
11/2	2026/08/05 18:32	tool	grepper	0m Args: { "Expression": "verifier\\.o", "PathPrefix": "kernel/bpf/Makefile" } Results: { "Output": "kernel/bpf/Makefile=7=CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)\nkernel/bpf/Makefile-8-\nkernel/bpf/Makefile:9:obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o cnum.o log.o token.o liveness.o const_fold.o\nkernel/bpf/Makefile-10-obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o\n" }
12/2	2026/08/05 18:32	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11180 output: 126 thoughts: 161 Thoughts: My Assessment of the BPF Verifier Patch Okay, so it looks like `CONFIG_BPF_SYSCALL` is the only config I need to keep in mind here. This patch is changing how the BPF verifier handles spinlock safety with kfuncs. Instead of a rigid, hardcoded list, it's leveraging a BTF flag, `KF_SPINLOCK_SAFE`, which is a much more elegant and flexible approach. This is definitely a functional change in the verifier's safety logic; it's significant because it lets external modules mark their kfuncs as spinlock-safe, opening up new possibilities for BPF program functionality and integration. The main point of focus here is the `bpf_check` symbol, obviously, since that's the main entry point for the verifier itself. So `bpf_check` is where I'll need to set the results and look for potential issues. The overall change seems sound, but given its impact on security and what's at stake, this definitely needs some serious fuzzing to make sure it's robust.
13/2	2026/08/05 18:32	tool	set-results	0m Args: { "EnableConfigs": [ "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_check" ], "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_check" ], "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.", "WorthFuzzing": true }

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_check"
  ],
  "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 0bd3522879f6b8f926e33564ca73ca8ccdae6386\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Aug 5 18:31:38 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/btf.h b/include/linux/btf.h\nindex c09b7994de4eb..3f5255d095a27 100644\n--- a/include/linux/btf.h\n+++ b/include/linux/btf.h\n@@ -79,6 +79,7 @@\n #define KF_ARENA_ARG1   (1 \u003c\u003c 14) /* kfunc takes an arena pointer as its first argument */\n #define KF_ARENA_ARG2   (1 \u003c\u003c 15) /* kfunc takes an arena pointer as its second argument */\n #define KF_IMPLICIT_ARGS (1 \u003c\u003c 16) /* kfunc has implicit arguments supplied by the verifier */\n+#define KF_SPINLOCK_SAFE (1 \u003c\u003c 17) /* kfunc is allowed inside bpf_spin_lock-ed region */\n \n /*\n  * Tag marking a kernel function as a kfunc. This is meant to minimize the\ndiff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c\nindex 555ee2531ef98..7b6847200b431 100644\n--- a/kernel/bpf/arena.c\n+++ b/kernel/bpf/arena.c\n@@ -1118,9 +1118,9 @@ __bpf_kfunc int bpf_arena_reserve_pages(void *p__map, void *ptr__ign, u32 page_c\n __bpf_kfunc_end_defs();\n \n BTF_KFUNCS_START(arena_kfuncs)\n-BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET | KF_ARENA_ARG2)\n-BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2)\n-BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2)\n+BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET | KF_ARENA_ARG2 | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2 | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2 | KF_SPINLOCK_SAFE)\n BTF_KFUNCS_END(arena_kfuncs)\n \n static const struct btf_kfunc_id_set common_kfunc_set = {\ndiff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c\nindex 4709a5ad04747..6388b6b23e490 100644\n--- a/kernel/bpf/helpers.c\n+++ b/kernel/bpf/helpers.c\n@@ -4812,30 +4812,32 @@ BTF_ID_FLAGS(func, bpf_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)\n BTF_ID_FLAGS(func, bpf_percpu_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE)\n-BTF_ID_FLAGS(func, bpf_refcount_acquire, KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL | KF_RCU)\n-BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_list_push_front_impl)\n-BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_list_push_back_impl)\n-BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE | KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE | KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_list_is_first)\n-BTF_ID_FLAGS(func, bpf_list_is_last)\n-BTF_ID_FLAGS(func, bpf_list_empty)\n+BTF_ID_FLAGS(func, bpf_refcount_acquire,\n+\t     KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_refcount_acquire_impl,\n+\t     KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_front_impl, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_push_back_impl, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_is_first, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_is_last, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_list_empty, KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)\n BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE)\n-BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE | KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_rbtree_add_impl)\n-BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL)\n+BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_add_impl, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL | KF_SPINLOCK_SAFE)\n \n #ifdef CONFIG_CGROUPS\n BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)\n@@ -4885,9 +4887,9 @@ BTF_ID_FLAGS(func, bpf_rcu_read_lock)\n BTF_ID_FLAGS(func, bpf_rcu_read_unlock)\n BTF_ID_FLAGS(func, bpf_dynptr_slice, KF_RET_NULL)\n BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW)\n-BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY)\n+BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY | KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_iter_task_vma_new, KF_ITER_NEW | KF_RCU)\n BTF_ID_FLAGS(func, bpf_iter_task_vma_next, KF_ITER_NEXT | KF_RET_NULL)\n BTF_ID_FLAGS(func, bpf_iter_task_vma_destroy, KF_ITER_DESTROY)\n@@ -4962,8 +4964,8 @@ BTF_ID_FLAGS(func, bpf_strncasestr);\n #if defined(CONFIG_BPF_LSM) \u0026\u0026 defined(CONFIG_CGROUPS)\n BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU)\n #endif\n-BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS)\n-BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS)\n+BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS)\n BTF_ID_FLAGS(func, bpf_dynptr_from_file)\ndiff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c\nindex e4e338cdb437c..e527cb425cf45 100644\n--- a/kernel/bpf/rqspinlock.c\n+++ b/kernel/bpf/rqspinlock.c\n@@ -744,10 +744,10 @@ __bpf_kfunc void bpf_res_spin_unlock_irqrestore(struct bpf_res_spin_lock *lock,\n __bpf_kfunc_end_defs();\n \n BTF_KFUNCS_START(rqspinlock_kfunc_ids)\n-BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_res_spin_unlock)\n-BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL)\n-BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore)\n+BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_res_spin_unlock, KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL | KF_SPINLOCK_SAFE)\n+BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore, KF_SPINLOCK_SAFE)\n BTF_KFUNCS_END(rqspinlock_kfunc_ids)\n \n static const struct btf_kfunc_id_set rqspinlock_kfunc_set = {\ndiff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c\nindex b274004fccfd9..7c1edcae293a8 100644\n--- a/kernel/bpf/verifier.c\n+++ b/kernel/bpf/verifier.c\n@@ -11797,20 +11797,6 @@ static bool is_bpf_rbtree_api_kfunc(u32 btf_id)\n \t       btf_id == special_kfunc_list[KF_bpf_rbtree_right];\n }\n \n-static bool is_bpf_iter_num_api_kfunc(u32 btf_id)\n-{\n-\treturn btf_id == special_kfunc_list[KF_bpf_iter_num_new] ||\n-\t       btf_id == special_kfunc_list[KF_bpf_iter_num_next] ||\n-\t       btf_id == special_kfunc_list[KF_bpf_iter_num_destroy];\n-}\n-\n-static bool is_bpf_graph_api_kfunc(u32 btf_id)\n-{\n-\treturn is_bpf_list_api_kfunc(btf_id) ||\n-\t       is_bpf_rbtree_api_kfunc(btf_id) ||\n-\t       is_bpf_refcount_acquire_kfunc(btf_id);\n-}\n-\n static bool is_bpf_res_spin_lock_kfunc(u32 btf_id)\n {\n \treturn btf_id == special_kfunc_list[KF_bpf_res_spin_lock] ||\n@@ -11819,24 +11805,16 @@ static bool is_bpf_res_spin_lock_kfunc(u32 btf_id)\n \t       btf_id == special_kfunc_list[KF_bpf_res_spin_unlock_irqrestore];\n }\n \n-static bool is_bpf_arena_kfunc(u32 btf_id)\n+static bool kfunc_spin_allowed(struct bpf_verifier_env *env, s32 func_id, s16 offset)\n {\n-\treturn btf_id == special_kfunc_list[KF_bpf_arena_alloc_pages] ||\n-\t       btf_id == special_kfunc_list[KF_bpf_arena_free_pages] ||\n-\t       btf_id == special_kfunc_list[KF_bpf_arena_reserve_pages];\n-}\n+\tstruct bpf_kfunc_meta kfunc;\n+\tint err;\n \n-static bool is_bpf_stream_kfunc(u32 btf_id)\n-{\n-\treturn btf_id == special_kfunc_list[KF_bpf_stream_vprintk] ||\n-\t       btf_id == special_kfunc_list[KF_bpf_stream_print_stack];\n-}\n+\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\n+\tif (err || !kfunc.flags)\n+\t\treturn false;\n \n-static bool kfunc_spin_allowed(u32 btf_id)\n-{\n-\treturn is_bpf_graph_api_kfunc(btf_id) || is_bpf_iter_num_api_kfunc(btf_id) ||\n-\t       is_bpf_res_spin_lock_kfunc(btf_id) || is_bpf_arena_kfunc(btf_id) ||\n-\t       is_bpf_stream_kfunc(btf_id);\n+\treturn *kfunc.flags \u0026 KF_SPINLOCK_SAFE;\n }\n \n static bool is_sync_callback_calling_kfunc(u32 btf_id)\n@@ -17415,7 +17393,7 @@ static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)\n \t\t\t\t     insn-\u003eimm != BPF_FUNC_spin_unlock \u0026\u0026\n \t\t\t\t     insn-\u003eimm != BPF_FUNC_kptr_xchg) ||\n \t\t\t\t    (insn-\u003esrc_reg == BPF_PSEUDO_KFUNC_CALL \u0026\u0026\n-\t\t\t\t     (insn-\u003eoff != 0 || !kfunc_spin_allowed(insn-\u003eimm)))) {\n+\t\t\t\t     !kfunc_spin_allowed(env, insn-\u003eimm, insn-\u003eoff))) {\n \t\t\t\t\tverbose(env,\n \t\t\t\t\t\t\"function calls are not allowed while holding a lock\\n\");\n \t\t\t\t\treturn -EINVAL;\ndiff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c\nindex 7af5560f2a08c..2b39cc1b09f9a 100644\n--- a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c\n+++ b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c\n@@ -71,8 +71,10 @@ static struct kfunc_test_params kfunc_tests[] = {\n \tTC_FAIL(kfunc_call_test_get_mem_fail_not_const, 0, \"is not a const\"),\n \tTC_FAIL(kfunc_call_test_mem_acquire_fail, 0, \"acquire kernel function does not return PTR_TO_BTF_ID\"),\n \tTC_FAIL(kfunc_call_test_pointer_arg_type_mismatch, 0, \"R1 expected pointer to ctx, but got scalar\"),\n+\tTC_FAIL(kfunc_call_test_spin_lock_unsafe, 0, \"function calls are not allowed while holding a lock\"),\n \n \t/* success cases */\n+\tTC_TEST(kfunc_call_test_spin_lock_safe, 0),\n \tTC_TEST(kfunc_call_test1, 12),\n \tTC_TEST(kfunc_call_test2, 3),\n \tTC_TEST(kfunc_call_test4, -1234),\ndiff --git a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c\nindex 64b6a0b0ab1cc..7e93f7fb13299 100644\n--- a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c\n+++ b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c\n@@ -4,6 +4,18 @@\n #include \u003cbpf/bpf_helpers.h\u003e\n #include \"../test_kmods/bpf_testmod_kfunc.h\"\n \n+static struct bpf_spin_lock kfunc_call_lock SEC(\".data.A\");\n+\n+SEC(\"?tc\")\n+int kfunc_call_test_spin_lock_unsafe(struct __sk_buff *skb)\n+{\n+\tbpf_spin_lock(\u0026kfunc_call_lock);\n+\tbpf_kfunc_trigger_ctx_check();\n+\tbpf_spin_unlock(\u0026kfunc_call_lock);\n+\n+\treturn 0;\n+}\n+\n struct syscall_test_args {\n \t__u8 data[16];\n \tsize_t size;\ndiff --git a/tools/testing/selftests/bpf/progs/kfunc_call_test.c b/tools/testing/selftests/bpf/progs/kfunc_call_test.c\nindex 5edc51564f711..8e6560c31e781 100644\n--- a/tools/testing/selftests/bpf/progs/kfunc_call_test.c\n+++ b/tools/testing/selftests/bpf/progs/kfunc_call_test.c\n@@ -5,6 +5,18 @@\n #include \"bpf_misc.h\"\n #include \"../test_kmods/bpf_testmod_kfunc.h\"\n \n+static struct bpf_spin_lock kfunc_call_lock SEC(\".data.A\");\n+\n+SEC(\"tc\")\n+int kfunc_call_test_spin_lock_safe(struct __sk_buff *skb)\n+{\n+\tbpf_spin_lock(\u0026kfunc_call_lock);\n+\tbpf_testmod_test_mod_kfunc(42);\n+\tbpf_spin_unlock(\u0026kfunc_call_lock);\n+\n+\treturn 0;\n+}\n+\n SEC(\"tc\")\n int kfunc_call_test5(struct __sk_buff *skb)\n {\ndiff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\nindex eb0f9b5e18d85..0585794606ed8 100644\n--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\n+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\n@@ -1384,7 +1384,7 @@ __bpf_kfunc void bpf_kfunc_trigger_ctx_check(void)\n }\n \n BTF_KFUNCS_START(bpf_testmod_check_kfunc_ids)\n-BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc)\n+BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc, KF_SPINLOCK_SAFE)\n BTF_ID_FLAGS(func, bpf_kfunc_call_test1)\n BTF_ID_FLAGS(func, bpf_kfunc_call_test2)\n BTF_ID_FLAGS(func, bpf_kfunc_call_test3)\n"
}

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_check"
  ],
  "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 0bd3522879f6b8f926e33564ca73ca8ccdae6386
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Aug 5 18:31:38 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/btf.h b/include/linux/btf.h
index c09b7994de4eb..3f5255d095a27 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -79,6 +79,7 @@
 #define KF_ARENA_ARG1   (1 << 14) /* kfunc takes an arena pointer as its first argument */
 #define KF_ARENA_ARG2   (1 << 15) /* kfunc takes an arena pointer as its second argument */
 #define KF_IMPLICIT_ARGS (1 << 16) /* kfunc has implicit arguments supplied by the verifier */
+#define KF_SPINLOCK_SAFE (1 << 17) /* kfunc is allowed inside bpf_spin_lock-ed region */
 
 /*
  * Tag marking a kernel function as a kfunc. This is meant to minimize the
diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
index 555ee2531ef98..7b6847200b431 100644
--- a/kernel/bpf/arena.c
+++ b/kernel/bpf/arena.c
@@ -1118,9 +1118,9 @@ __bpf_kfunc int bpf_arena_reserve_pages(void *p__map, void *ptr__ign, u32 page_c
 __bpf_kfunc_end_defs();
 
 BTF_KFUNCS_START(arena_kfuncs)
-BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET | KF_ARENA_ARG2)
-BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2)
-BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2)
+BTF_ID_FLAGS(func, bpf_arena_alloc_pages, KF_ARENA_RET | KF_ARENA_ARG2 | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_arena_free_pages, KF_ARENA_ARG2 | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_arena_reserve_pages, KF_ARENA_ARG2 | KF_SPINLOCK_SAFE)
 BTF_KFUNCS_END(arena_kfuncs)
 
 static const struct btf_kfunc_id_set common_kfunc_set = {
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 4709a5ad04747..6388b6b23e490 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -4812,30 +4812,32 @@ BTF_ID_FLAGS(func, bpf_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)
 BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)
 BTF_ID_FLAGS(func, bpf_percpu_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)
 BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE)
-BTF_ID_FLAGS(func, bpf_refcount_acquire, KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_IMPLICIT_ARGS)
-BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL | KF_RCU)
-BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS)
-BTF_ID_FLAGS(func, bpf_list_push_front_impl)
-BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS)
-BTF_ID_FLAGS(func, bpf_list_push_back_impl)
-BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS)
-BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE | KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE | KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_list_is_first)
-BTF_ID_FLAGS(func, bpf_list_is_last)
-BTF_ID_FLAGS(func, bpf_list_empty)
+BTF_ID_FLAGS(func, bpf_refcount_acquire,
+	     KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_refcount_acquire_impl,
+	     KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_push_front_impl, KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_push_back_impl, KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_add, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_del, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_is_first, KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_is_last, KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_list_empty, KF_SPINLOCK_SAFE)
 BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE)
-BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE | KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS)
-BTF_ID_FLAGS(func, bpf_rbtree_add_impl)
-BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL)
+BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE | KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_rbtree_add_impl, KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL | KF_SPINLOCK_SAFE)
 
 #ifdef CONFIG_CGROUPS
 BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
@@ -4885,9 +4887,9 @@ BTF_ID_FLAGS(func, bpf_rcu_read_lock)
 BTF_ID_FLAGS(func, bpf_rcu_read_unlock)
 BTF_ID_FLAGS(func, bpf_dynptr_slice, KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW)
-BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY)
+BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY | KF_SPINLOCK_SAFE)
 BTF_ID_FLAGS(func, bpf_iter_task_vma_new, KF_ITER_NEW | KF_RCU)
 BTF_ID_FLAGS(func, bpf_iter_task_vma_next, KF_ITER_NEXT | KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_iter_task_vma_destroy, KF_ITER_DESTROY)
@@ -4962,8 +4964,8 @@ BTF_ID_FLAGS(func, bpf_strncasestr);
 #if defined(CONFIG_BPF_LSM) && defined(CONFIG_CGROUPS)
 BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU)
 #endif
-BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS)
-BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS)
+BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
 BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS)
 BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS)
 BTF_ID_FLAGS(func, bpf_dynptr_from_file)
diff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c
index e4e338cdb437c..e527cb425cf45 100644
--- a/kernel/bpf/rqspinlock.c
+++ b/kernel/bpf/rqspinlock.c
@@ -744,10 +744,10 @@ __bpf_kfunc void bpf_res_spin_unlock_irqrestore(struct bpf_res_spin_lock *lock,
 __bpf_kfunc_end_defs();
 
 BTF_KFUNCS_START(rqspinlock_kfunc_ids)
-BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_res_spin_unlock)
-BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL)
-BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore)
+BTF_ID_FLAGS(func, bpf_res_spin_lock, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_res_spin_unlock, KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_res_spin_lock_irqsave, KF_RET_NULL | KF_SPINLOCK_SAFE)
+BTF_ID_FLAGS(func, bpf_res_spin_unlock_irqrestore, KF_SPINLOCK_SAFE)
 BTF_KFUNCS_END(rqspinlock_kfunc_ids)
 
 static const struct btf_kfunc_id_set rqspinlock_kfunc_set = {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index b274004fccfd9..7c1edcae293a8 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11797,20 +11797,6 @@ static bool is_bpf_rbtree_api_kfunc(u32 btf_id)
 	       btf_id == special_kfunc_list[KF_bpf_rbtree_right];
 }
 
-static bool is_bpf_iter_num_api_kfunc(u32 btf_id)
-{
-	return btf_id == special_kfunc_list[KF_bpf_iter_num_new] ||
-	       btf_id == special_kfunc_list[KF_bpf_iter_num_next] ||
-	       btf_id == special_kfunc_list[KF_bpf_iter_num_destroy];
-}
-
-static bool is_bpf_graph_api_kfunc(u32 btf_id)
-{
-	return is_bpf_list_api_kfunc(btf_id) ||
-	       is_bpf_rbtree_api_kfunc(btf_id) ||
-	       is_bpf_refcount_acquire_kfunc(btf_id);
-}
-
 static bool is_bpf_res_spin_lock_kfunc(u32 btf_id)
 {
 	return btf_id == special_kfunc_list[KF_bpf_res_spin_lock] ||
@@ -11819,24 +11805,16 @@ static bool is_bpf_res_spin_lock_kfunc(u32 btf_id)
 	       btf_id == special_kfunc_list[KF_bpf_res_spin_unlock_irqrestore];
 }
 
-static bool is_bpf_arena_kfunc(u32 btf_id)
+static bool kfunc_spin_allowed(struct bpf_verifier_env *env, s32 func_id, s16 offset)
 {
-	return btf_id == special_kfunc_list[KF_bpf_arena_alloc_pages] ||
-	       btf_id == special_kfunc_list[KF_bpf_arena_free_pages] ||
-	       btf_id == special_kfunc_list[KF_bpf_arena_reserve_pages];
-}
+	struct bpf_kfunc_meta kfunc;
+	int err;
 
-static bool is_bpf_stream_kfunc(u32 btf_id)
-{
-	return btf_id == special_kfunc_list[KF_bpf_stream_vprintk] ||
-	       btf_id == special_kfunc_list[KF_bpf_stream_print_stack];
-}
+	err = fetch_kfunc_meta(env, func_id, offset, &kfunc);
+	if (err || !kfunc.flags)
+		return false;
 
-static bool kfunc_spin_allowed(u32 btf_id)
-{
-	return is_bpf_graph_api_kfunc(btf_id) || is_bpf_iter_num_api_kfunc(btf_id) ||
-	       is_bpf_res_spin_lock_kfunc(btf_id) || is_bpf_arena_kfunc(btf_id) ||
-	       is_bpf_stream_kfunc(btf_id);
+	return *kfunc.flags & KF_SPINLOCK_SAFE;
 }
 
 static bool is_sync_callback_calling_kfunc(u32 btf_id)
@@ -17415,7 +17393,7 @@ static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)
 				     insn->imm != BPF_FUNC_spin_unlock &&
 				     insn->imm != BPF_FUNC_kptr_xchg) ||
 				    (insn->src_reg == BPF_PSEUDO_KFUNC_CALL &&
-				     (insn->off != 0 || !kfunc_spin_allowed(insn->imm)))) {
+				     !kfunc_spin_allowed(env, insn->imm, insn->off))) {
 					verbose(env,
 						"function calls are not allowed while holding a lock\n");
 					return -EINVAL;
diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c
index 7af5560f2a08c..2b39cc1b09f9a 100644
--- a/tools/testing/selftests/bpf/prog_tests/kfunc_call.c
+++ b/tools/testing/selftests/bpf/prog_tests/kfunc_call.c
@@ -71,8 +71,10 @@ static struct kfunc_test_params kfunc_tests[] = {
 	TC_FAIL(kfunc_call_test_get_mem_fail_not_const, 0, "is not a const"),
 	TC_FAIL(kfunc_call_test_mem_acquire_fail, 0, "acquire kernel function does not return PTR_TO_BTF_ID"),
 	TC_FAIL(kfunc_call_test_pointer_arg_type_mismatch, 0, "R1 expected pointer to ctx, but got scalar"),
+	TC_FAIL(kfunc_call_test_spin_lock_unsafe, 0, "function calls are not allowed while holding a lock"),
 
 	/* success cases */
+	TC_TEST(kfunc_call_test_spin_lock_safe, 0),
 	TC_TEST(kfunc_call_test1, 12),
 	TC_TEST(kfunc_call_test2, 3),
 	TC_TEST(kfunc_call_test4, -1234),
diff --git a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c
index 64b6a0b0ab1cc..7e93f7fb13299 100644
--- a/tools/testing/selftests/bpf/progs/kfunc_call_fail.c
+++ b/tools/testing/selftests/bpf/progs/kfunc_call_fail.c
@@ -4,6 +4,18 @@
 #include <bpf/bpf_helpers.h>
 #include "../test_kmods/bpf_testmod_kfunc.h"
 
+static struct bpf_spin_lock kfunc_call_lock SEC(".data.A");
+
+SEC("?tc")
+int kfunc_call_test_spin_lock_unsafe(struct __sk_buff *skb)
+{
+	bpf_spin_lock(&kfunc_call_lock);
+	bpf_kfunc_trigger_ctx_check();
+	bpf_spin_unlock(&kfunc_call_lock);
+
+	return 0;
+}
+
 struct syscall_test_args {
 	__u8 data[16];
 	size_t size;
diff --git a/tools/testing/selftests/bpf/progs/kfunc_call_test.c b/tools/testing/selftests/bpf/progs/kfunc_call_test.c
index 5edc51564f711..8e6560c31e781 100644
--- a/tools/testing/selftests/bpf/progs/kfunc_call_test.c
+++ b/tools/testing/selftests/bpf/progs/kfunc_call_test.c
@@ -5,6 +5,18 @@
 #include "bpf_misc.h"
 #include "../test_kmods/bpf_testmod_kfunc.h"
 
+static struct bpf_spin_lock kfunc_call_lock SEC(".data.A");
+
+SEC("tc")
+int kfunc_call_test_spin_lock_safe(struct __sk_buff *skb)
+{
+	bpf_spin_lock(&kfunc_call_lock);
+	bpf_testmod_test_mod_kfunc(42);
+	bpf_spin_unlock(&kfunc_call_lock);
+
+	return 0;
+}
+
 SEC("tc")
 int kfunc_call_test5(struct __sk_buff *skb)
 {
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index eb0f9b5e18d85..0585794606ed8 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -1384,7 +1384,7 @@ __bpf_kfunc void bpf_kfunc_trigger_ctx_check(void)
 }
 
 BTF_KFUNCS_START(bpf_testmod_check_kfunc_ids)
-BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc)
+BTF_ID_FLAGS(func, bpf_testmod_test_mod_kfunc, KF_SPINLOCK_SAFE)
 BTF_ID_FLAGS(func, bpf_kfunc_call_test1)
 BTF_ID_FLAGS(func, bpf_kfunc_call_test2)
 BTF_ID_FLAGS(func, bpf_kfunc_call_test3)

gemini-3.1-pro-preview

							input: 7823
							output: 34
							thoughts: 682

**Analyzing the BPF Verifier Change for Potential Fuzzing Targets**

Okay, so this patch introduces a `KF_SPINLOCK_SAFE` flag for BPF kfuncs, a new feature that's pretty interesting. The core of the change lies in the BPF verifier, specifically within `kernel/bpf/verifier.c`. My initial thought is, *is this worth fuzzing?* Absolutely, any modification to the verifier, particularly one that alters the allowed operations within a critical section like a spinlock, demands scrutiny.

The fundamental shift is how the verifier now determines whether a kfunc can be used inside a spinlock. Instead of that hardcoded list of `is_bpf_*_kfunc` checks, it now uses this `KF_SPINLOCK_SAFE` flag present in the BTF data for each kfunc. That's a significant refactoring that could introduce subtle behavioral changes, or even allow privileged code to access features by misusing this new flag. It also means that external modules now have the ability to explicitly mark their kfuncs as "spinlock safe," which widens the attack surface. This is a potential new feature/refactoring that deserves fuzzing.

My primary focus shifts to `kfunc_spin_allowed`, the function being modified, and its call chain. It's static, which is typical for the verifier, but it's called by `do_check_insn`, which is also static. Following the call graph, `do_check_insn` is called by `do_check`, which is the immediate next function that needs checking. This seems like a reasonable entry point for the fuzzing analysis. I'll need to scrutinize `fetch_kfunc_meta` as well, since that's where the kfunc metadata including the flag is retrieved. The BPF verifier is already heavily fuzzed by syzkaller, which is a good thing, but I want to make sure this specific change is covered.

{
  "Expression": "fetch_kfunc_meta",
  "PathPrefix": "kernel/bpf/verifier.c"
}

{
  "Output": "kernel/bpf/verifier.c=2634=static const struct btf_type *find_kfunc_impl_proto(struct bpf_verifier_log *log,\n--\nkernel/bpf/verifier.c-2660-\nkernel/bpf/verifier.c:2661:static int fetch_kfunc_meta(struct bpf_verifier_env *env,\nkernel/bpf/verifier.c-2662-\t\t\t    s32 func_id,\n--\nkernel/bpf/verifier.c=2727=int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset)\n--\nkernel/bpf/verifier.c-2794-\nkernel/bpf/verifier.c:2795:\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\nkernel/bpf/verifier.c-2796-\tif (err)\n--\nkernel/bpf/verifier.c=11808=static bool kfunc_spin_allowed(struct bpf_verifier_env *env, s32 func_id, s16 offset)\n--\nkernel/bpf/verifier.c-11812-\nkernel/bpf/verifier.c:11813:\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\nkernel/bpf/verifier.c-11814-\tif (err || !kfunc.flags)\n--\nkernel/bpf/verifier.c=12615=int bpf_fetch_kfunc_arg_meta(struct bpf_verifier_env *env,\n--\nkernel/bpf/verifier.c-12624-\nkernel/bpf/verifier.c:12625:\terr = fetch_kfunc_meta(env, func_id, offset, \u0026kfunc);\nkernel/bpf/verifier.c-12626-\tif (err)\n"
}

gemini-3.1-pro-preview

							input: 9462
							output: 35
							thoughts: 75

**Diving into BPF Verification**

Okay, so `kfunc_spin_allowed` is being called from `do_check_insn`. My immediate thought is to zero in on the functions that aren't static; those are the ones we need to analyze more closely. That usually points to the core functionality. I know `bpf_check` is the main entry point for the verifier, so I'll start with that. The next logical step is to examine `kernel/bpf/verifier.c` and see which functions are exported or, if not exported, are *non-static*, which would indicate their likely importance in this context. I need to understand the interaction and flow.

{
  "Expression": "^int bpf_check\\(",
  "PathPrefix": "kernel/bpf/verifier.c"
}

{
  "Output": "kernel/bpf/verifier.c=20020=static int bpf_prog_verify_signature(struct bpf_verifier_env *env,\n--\nkernel/bpf/verifier.c-20136-\nkernel/bpf/verifier.c:20137:int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,\nkernel/bpf/verifier.c-20138-\t      struct bpf_log_attr *attr_log)\n"
}

gemini-3.1-pro-preview

							input: 9863
							output: 59
							thoughts: 228

**Analyzing the BPF Patch**

Okay, so this patch seems focused. I like that they're zeroing in on `bpf_check`; that seems like the right area to start. My initial thought is to examine the impact on `do_check` as well, since that one is static and might be directly related. I should also make sure no other functions are indirectly affected.

Looking deeper, the patch mentions modifications to functions like `bpf_arena_alloc_pages`, `bpf_arena_free_pages`, and so on, but it only changes their BTF flags, not the core logic. The meat of the change appears to be within `kfunc_spin_allowed`, which is also static. This reinforces my initial assessment that investigating `bpf_check` is the most direct path.

Now, let's nail down the configuration dependencies. I know BPF is enabled via `CONFIG_BPF_SYSCALL`, but I need to ensure there aren't any other crucial configuration options at play here. This means I'll be looking at the related configuration options, specifically ones used by the modified files.

The patch touches files in `kernel/bpf/arena.c`, `kernel/bpf/helpers.c`, `kernel/bpf/rqspinlock.c`, and `kernel/bpf/verifier.c`. To understand the configuration dependencies, I'll examine the `kernel/bpf/Makefile`. This should list the specific configuration options that control the compilation of those files, providing a comprehensive view of any prerequisites for these changes to take effect.

{
  "Expression": "arena\\.o",
  "PathPrefix": "kernel/bpf/Makefile"
}

{
  "Output": "kernel/bpf/Makefile=19=ifeq ($(CONFIG_MMU)$(CONFIG_64BIT),yy)\nkernel/bpf/Makefile:20:obj-$(CONFIG_BPF_SYSCALL) += arena.o range_tree.o\nkernel/bpf/Makefile-21-endif\n"
}

{
  "Expression": "rqspinlock\\.o",
  "PathPrefix": "kernel/bpf/Makefile"
}

{
  "Output": "kernel/bpf/Makefile=17=obj-$(CONFIG_BPF_JIT) += trampoline.o\nkernel/bpf/Makefile:18:obj-$(CONFIG_BPF_SYSCALL) += btf.o memalloc.o rqspinlock.o stream.o\nkernel/bpf/Makefile-19-ifeq ($(CONFIG_MMU)$(CONFIG_64BIT),yy)\n--\nkernel/bpf/Makefile=75=CFLAGS_REMOVE_ringbuf.o = $(CC_FLAGS_FTRACE)\nkernel/bpf/Makefile:76:CFLAGS_REMOVE_rqspinlock.o = $(CC_FLAGS_FTRACE)\n"
}

gemini-3.1-pro-preview

							input: 10731
							output: 29
							thoughts: 85

Okay, let's break this down.

**Analyzing the BPF System Call Configuration**

Alright, my focus is zeroing in on this `CONFIG_BPF_SYSCALL` option. That's the primary flag I need to track. Hold on a second, though, because `arena.o` has dependencies on both `CONFIG_MMU` and `CONFIG_64BIT`. That impacts how this will ultimately play out. But I think the real meat of the modification resides in `verifier.c`, and that's compiled with `CONFIG_BPF_SYSCALL`, right? Okay, so that's the key file. I should really check the `kernel/bpf/Makefile` to confirm where `verifier.o` is being built. I need to understand that build process better.

{
  "Expression": "verifier\\.o",
  "PathPrefix": "kernel/bpf/Makefile"
}

{
  "Output": "kernel/bpf/Makefile=7=CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)\nkernel/bpf/Makefile-8-\nkernel/bpf/Makefile:9:obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o cnum.o log.o token.o liveness.o const_fold.o\nkernel/bpf/Makefile-10-obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o\n"
}

gemini-3.1-pro-preview

							input: 11180
							output: 126
							thoughts: 161

**My Assessment of the BPF Verifier Patch**

Okay, so it looks like `CONFIG_BPF_SYSCALL` is the only config I need to keep in mind here. This patch is changing how the BPF verifier handles spinlock safety with kfuncs. Instead of a rigid, hardcoded list, it's leveraging a BTF flag, `KF_SPINLOCK_SAFE`, which is a much more elegant and flexible approach. This is definitely a functional change in the verifier's safety logic; it's significant because it lets external modules mark their kfuncs as spinlock-safe, opening up new possibilities for BPF program functionality and integration.

The main point of focus here is the `bpf_check` symbol, obviously, since that's the main entry point for the verifier itself. So `bpf_check` is where I'll need to set the results and look for potential issues. The overall change seems sound, but given its impact on security and what's at stake, this definitely needs some serious fuzzing to make sure it's robust.

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_check"
  ],
  "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_check"
  ],
  "Reasoning": "The patch modifies the BPF verifier to use a BTF flag (KF_SPINLOCK_SAFE) to determine if a kfunc can be called while holding a BPF spinlock, replacing a hardcoded list. This is a functional change in the verifier's safety checks and allows external modules to mark their kfuncs as spinlock-safe. It should be fuzzed.",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)