AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only modifies user-space unit tests and test framework files within tools/testing/memblock/ (adding test cases for memblock_alloc_low). It does not alter the Linux kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 1b67e70d48cbbfe10f9cd0c26bdcceacee552a96\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Sep 10 00:26:57 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/memblock/Makefile b/tools/testing/memblock/Makefile\nindex d80982ccdc209..20524fcbe3c72 100644\n--- a/tools/testing/memblock/Makefile\n+++ b/tools/testing/memblock/Makefile\n@@ -7,7 +7,8 @@ CFLAGS += -I. -I../../include -Wall -O2 -fsanitize=address \\\n LDFLAGS += -fsanitize=address -fsanitize=undefined\n TARGETS = main\n TEST_OFILES = tests/alloc_nid_api.o tests/alloc_helpers_api.o tests/alloc_api.o \\\n-\t\t  tests/basic_api.o tests/common.o tests/alloc_exact_nid_api.o\n+\t\t  tests/basic_api.o tests/common.o tests/alloc_exact_nid_api.o \\\n+\t\t  tests/alloc_low_api.o\n DEP_OFILES = memblock.o lib/slab.o mmzone.o slab.o cmdline.o\n OFILES = main.o $(DEP_OFILES) $(TEST_OFILES)\n EXTR_SRC = ../../../mm/memblock.c\ndiff --git a/tools/testing/memblock/README b/tools/testing/memblock/README\nindex b435f48d8a700..4ea2932095487 100644\n--- a/tools/testing/memblock/README\n+++ b/tools/testing/memblock/README\n@@ -67,13 +67,13 @@ memblock\n |-- tests\n |    |-- alloc_api.(c|h)         -- memblock_alloc tests\n |    |-- alloc_helpers_api.(c|h) -- memblock_alloc_from tests\n+|    |-- alloc_low_api.(c|h)     -- memblock_alloc_low tests\n |    |-- alloc_nid_api.(c|h)     -- memblock_alloc_try_nid tests\n |    |-- basic_api.(c|h)         -- memblock_add/memblock_reserve/... tests\n |    |-- common.(c|h)            -- helper functions for resetting memblock;\n |-- main.c        --------------.   dummy physical memory definition\n |-- Makefile                     `- test runner\n |-- README\n-|-- TODO\n |-- .gitignore\n \n Simulating physical memory\n@@ -101,12 +101,10 @@ There's no need to explicitly free the dummy memory from memblock via\n memblock_free() call. The entry will be erased by reset_memblock_regions(),\n called at the beginning of each test.\n \n-Known issues\n-============\n-\n-1. Tests for memblock_alloc_low() can't be easily implemented. The function uses\n-   ARCH_LOW_ADDRESS_LIMIT marco, which can't be changed to point at the low\n-   memory of the memory_block.\n+The simulator defines ARCH_LOW_ADDRESS_LIMIT in asm/dma.h using the midpoint\n+of the MEM_SIZE range registered by setup_memblock(). This leaves registered\n+memory both below and above the limit. The limit is the first address an\n+allocation must not use; an allocation's base plus its size may equal the limit.\n \n References\n ==========\ndiff --git a/tools/testing/memblock/TODO b/tools/testing/memblock/TODO\ndeleted file mode 100644\nindex c13ad0dae7763..0000000000000\n--- a/tools/testing/memblock/TODO\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-TODO\n-=====\n-\n-1. Add tests for memblock_alloc_low() once the simulator can model\n-   ARCH_LOW_ADDRESS_LIMIT against the low memory in memory_block\ndiff --git a/tools/testing/memblock/asm/dma.h b/tools/testing/memblock/asm/dma.h\nindex 13ff8e5d22ef6..6607408dcf25d 100644\n--- a/tools/testing/memblock/asm/dma.h\n+++ b/tools/testing/memblock/asm/dma.h\n@@ -2,4 +2,10 @@\n #ifndef _TOOLS_DMA_H\n #define _TOOLS_DMA_H\n \n+#include \u003clinux/types.h\u003e\n+\n+phys_addr_t dummy_physical_memory_low_limit(void);\n+\n+#define ARCH_LOW_ADDRESS_LIMIT dummy_physical_memory_low_limit()\n+\n #endif\ndiff --git a/tools/testing/memblock/main.c b/tools/testing/memblock/main.c\nindex 278f9dec50087..9a96e178551b8 100644\n--- a/tools/testing/memblock/main.c\n+++ b/tools/testing/memblock/main.c\n@@ -4,6 +4,7 @@\n #include \"tests/alloc_helpers_api.h\"\n #include \"tests/alloc_nid_api.h\"\n #include \"tests/alloc_exact_nid_api.h\"\n+#include \"tests/alloc_low_api.h\"\n #include \"tests/common.h\"\n \n int main(int argc, char **argv)\n@@ -12,6 +13,7 @@ int main(int argc, char **argv)\n \tmemblock_basic_checks();\n \tmemblock_alloc_checks();\n \tmemblock_alloc_helpers_checks();\n+\tmemblock_alloc_low_checks();\n \tmemblock_alloc_nid_checks();\n \tmemblock_alloc_exact_nid_checks();\n \ndiff --git a/tools/testing/memblock/tests/alloc_low_api.c b/tools/testing/memblock/tests/alloc_low_api.c\nnew file mode 100644\nindex 0000000000000..a117431f1f715\n--- /dev/null\n+++ b/tools/testing/memblock/tests/alloc_low_api.c\n@@ -0,0 +1,148 @@\n+// SPDX-License-Identifier: GPL-2.0-or-later\n+#include \"alloc_low_api.h\"\n+#include \u003clinux/align.h\u003e\n+\n+/* Allocate at the first or last aligned address below the low limit. */\n+static int alloc_low_simple_check(void)\n+{\n+\tstruct memblock_region *rgn = \u0026memblock.reserved.regions[0];\n+\tphys_addr_t size = SZ_64;\n+\tphys_addr_t expected;\n+\tvoid *allocated_ptr;\n+\n+\tPREFIX_PUSH();\n+\tsetup_memblock();\n+\n+\t/* Simulated physical RAM is not necessarily SMP_CACHE_BYTES aligned. */\n+\tif (memblock_bottom_up())\n+\t\texpected = ALIGN(memblock_start_of_DRAM(), SMP_CACHE_BYTES);\n+\telse\n+\t\texpected = ALIGN_DOWN(ARCH_LOW_ADDRESS_LIMIT - size,\n+\t\t\t\t      SMP_CACHE_BYTES);\n+\n+\tallocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);\n+\n+\tASSERT_NE(allocated_ptr, NULL);\n+\tASSERT_EQ((phys_addr_t)(uintptr_t)allocated_ptr, expected);\n+\tASSERT_MEM_EQ(allocated_ptr, 0, size);\n+\tASSERT_EQ(rgn-\u003ebase, expected);\n+\tASSERT_EQ(rgn-\u003esize, size);\n+\tASSERT_LE(region_end(rgn), ARCH_LOW_ADDRESS_LIMIT);\n+\tASSERT_EQ(memblock.reserved.cnt, 1);\n+\tASSERT_EQ(memblock.reserved.total_size, size);\n+\n+\ttest_pass_pop();\n+\treturn 0;\n+}\n+\n+/* The last byte of the allocation is immediately below the low limit. */\n+static int alloc_low_exact_limit_check(void)\n+{\n+\tphys_addr_t limit = ARCH_LOW_ADDRESS_LIMIT;\n+\tphys_addr_t base = ALIGN_DOWN(limit - SZ_64, SMP_CACHE_BYTES);\n+\tphys_addr_t size = limit - base;\n+\tvoid *allocated_ptr;\n+\n+\tPREFIX_PUSH();\n+\tsetup_memblock();\n+\tASSERT_EQ(memblock_remove(memblock_start_of_DRAM(),\n+\t\t\t\t  base - memblock_start_of_DRAM()), 0);\n+\n+\tallocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);\n+\n+\tASSERT_NE(allocated_ptr, NULL);\n+\tASSERT_EQ((phys_addr_t)(uintptr_t)allocated_ptr, base);\n+\tASSERT_MEM_EQ(allocated_ptr, 0, size);\n+\tASSERT_EQ(memblock.reserved.regions[0].base, base);\n+\tASSERT_EQ(region_end(\u0026memblock.reserved.regions[0]), limit);\n+\tASSERT_EQ(memblock.reserved.cnt, 1);\n+\tASSERT_EQ(memblock.reserved.total_size, size);\n+\n+\ttest_pass_pop();\n+\treturn 0;\n+}\n+\n+/*\n+ * There are size bytes below the limit, but aligning the start makes the\n+ * allocation cross it. Memory above the limit must not satisfy the request.\n+ */\n+static int alloc_low_alignment_crosses_limit_check(void)\n+{\n+\tphys_addr_t limit = ARCH_LOW_ADDRESS_LIMIT;\n+\tphys_addr_t base = ALIGN_DOWN(limit, SMP_CACHE_BYTES) - 1;\n+\tphys_addr_t size = limit - base;\n+\tvoid *allocated_ptr;\n+\n+\tPREFIX_PUSH();\n+\tsetup_memblock();\n+\tASSERT_EQ(memblock_remove(memblock_start_of_DRAM(),\n+\t\t\t\t  base - memblock_start_of_DRAM()), 0);\n+\n+\tallocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);\n+\n+\tASSERT_EQ(allocated_ptr, NULL);\n+\tASSERT_EQ(memblock.reserved.cnt, 0);\n+\tASSERT_EQ(memblock.reserved.total_size, 0);\n+\tASSERT_MEM_EQ((void *)(uintptr_t)base, 1, memblock_end_of_DRAM() - base);\n+\n+\ttest_pass_pop();\n+\treturn 0;\n+}\n+\n+/* Allocation must fail after reserving all low memory, with high memory free. */\n+static int alloc_low_reserved_check(void)\n+{\n+\tphys_addr_t limit = ARCH_LOW_ADDRESS_LIMIT;\n+\tphys_addr_t base = dummy_physical_memory_base();\n+\tphys_addr_t size = SZ_64;\n+\tvoid *allocated_ptr;\n+\n+\tPREFIX_PUSH();\n+\tsetup_memblock();\n+\tASSERT_EQ(memblock_reserve(base, limit - base), 0);\n+\n+\tallocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);\n+\n+\tASSERT_EQ(allocated_ptr, NULL);\n+\tASSERT_EQ(memblock.reserved.cnt, 1);\n+\tASSERT_EQ(memblock.reserved.regions[0].base, base);\n+\tASSERT_EQ(memblock.reserved.regions[0].size, limit - base);\n+\tASSERT_EQ(memblock.reserved.total_size, limit - base);\n+\tASSERT_MEM_EQ((void *)(uintptr_t)base, 1, MEM_SIZE);\n+\n+\tallocated_ptr = memblock_alloc(size, SMP_CACHE_BYTES);\n+\tASSERT_NE(allocated_ptr, NULL);\n+\tASSERT_LE(limit, (phys_addr_t)(uintptr_t)allocated_ptr);\n+\tASSERT_MEM_EQ(allocated_ptr, 0, size);\n+\n+\ttest_pass_pop();\n+\treturn 0;\n+}\n+\n+static int alloc_low_checks(void)\n+{\n+\talloc_low_simple_check();\n+\talloc_low_exact_limit_check();\n+\talloc_low_alignment_crosses_limit_check();\n+\talloc_low_reserved_check();\n+\n+\treturn 0;\n+}\n+\n+int memblock_alloc_low_checks(void)\n+{\n+\tprefix_reset();\n+\tprefix_push(\"memblock_alloc_low\");\n+\ttest_print(\"Running memblock_alloc_low tests...\\n\");\n+\n+\treset_memblock_attributes();\n+\tdummy_physical_memory_init();\n+\n+\trun_top_down(alloc_low_checks);\n+\trun_bottom_up(alloc_low_checks);\n+\n+\tdummy_physical_memory_cleanup();\n+\tprefix_pop();\n+\n+\treturn 0;\n+}\ndiff --git a/tools/testing/memblock/tests/alloc_low_api.h b/tools/testing/memblock/tests/alloc_low_api.h\nnew file mode 100644\nindex 0000000000000..2e3cbe336f5da\n--- /dev/null\n+++ b/tools/testing/memblock/tests/alloc_low_api.h\n@@ -0,0 +1,9 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+#ifndef _MEMBLOCK_ALLOC_LOW_H\n+#define _MEMBLOCK_ALLOC_LOW_H\n+\n+#include \"common.h\"\n+\n+int memblock_alloc_low_checks(void);\n+\n+#endif\ndiff --git a/tools/testing/memblock/tests/common.c b/tools/testing/memblock/tests/common.c\nindex 3250c8e5124b3..ac032610a56ec 100644\n--- a/tools/testing/memblock/tests/common.c\n+++ b/tools/testing/memblock/tests/common.c\n@@ -118,6 +118,12 @@ phys_addr_t dummy_physical_memory_base(void)\n \treturn (phys_addr_t)memory_block.base;\n }\n \n+phys_addr_t dummy_physical_memory_low_limit(void)\n+{\n+\t/* The low limit is halfway through memory registered by setup_memblock(). */\n+\treturn dummy_physical_memory_base() + MEM_SIZE / 2;\n+}\n+\n static void usage(const char *prog)\n {\n \tBUILD_BUG_ON(ARRAY_SIZE(help_opts) != ARRAY_SIZE(long_opts) - 1);\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space unit tests and test framework files within tools/testing/memblock/ (adding test cases for memblock_alloc_low). It does not alter the Linux kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 1b67e70d48cbbfe10f9cd0c26bdcceacee552a96
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 10 00:26:57 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/memblock/Makefile b/tools/testing/memblock/Makefile
index d80982ccdc209..20524fcbe3c72 100644
--- a/tools/testing/memblock/Makefile
+++ b/tools/testing/memblock/Makefile
@@ -7,7 +7,8 @@ CFLAGS += -I. -I../../include -Wall -O2 -fsanitize=address \
 LDFLAGS += -fsanitize=address -fsanitize=undefined
 TARGETS = main
 TEST_OFILES = tests/alloc_nid_api.o tests/alloc_helpers_api.o tests/alloc_api.o \
-		  tests/basic_api.o tests/common.o tests/alloc_exact_nid_api.o
+		  tests/basic_api.o tests/common.o tests/alloc_exact_nid_api.o \
+		  tests/alloc_low_api.o
 DEP_OFILES = memblock.o lib/slab.o mmzone.o slab.o cmdline.o
 OFILES = main.o $(DEP_OFILES) $(TEST_OFILES)
 EXTR_SRC = ../../../mm/memblock.c
diff --git a/tools/testing/memblock/README b/tools/testing/memblock/README
index b435f48d8a700..4ea2932095487 100644
--- a/tools/testing/memblock/README
+++ b/tools/testing/memblock/README
@@ -67,13 +67,13 @@ memblock
 |-- tests
 |    |-- alloc_api.(c|h)         -- memblock_alloc tests
 |    |-- alloc_helpers_api.(c|h) -- memblock_alloc_from tests
+|    |-- alloc_low_api.(c|h)     -- memblock_alloc_low tests
 |    |-- alloc_nid_api.(c|h)     -- memblock_alloc_try_nid tests
 |    |-- basic_api.(c|h)         -- memblock_add/memblock_reserve/... tests
 |    |-- common.(c|h)            -- helper functions for resetting memblock;
 |-- main.c        --------------.   dummy physical memory definition
 |-- Makefile                     `- test runner
 |-- README
-|-- TODO
 |-- .gitignore
 
 Simulating physical memory
@@ -101,12 +101,10 @@ There's no need to explicitly free the dummy memory from memblock via
 memblock_free() call. The entry will be erased by reset_memblock_regions(),
 called at the beginning of each test.
 
-Known issues
-============
-
-1. Tests for memblock_alloc_low() can't be easily implemented. The function uses
-   ARCH_LOW_ADDRESS_LIMIT marco, which can't be changed to point at the low
-   memory of the memory_block.
+The simulator defines ARCH_LOW_ADDRESS_LIMIT in asm/dma.h using the midpoint
+of the MEM_SIZE range registered by setup_memblock(). This leaves registered
+memory both below and above the limit. The limit is the first address an
+allocation must not use; an allocation's base plus its size may equal the limit.
 
 References
 ==========
diff --git a/tools/testing/memblock/TODO b/tools/testing/memblock/TODO
deleted file mode 100644
index c13ad0dae7763..0000000000000
--- a/tools/testing/memblock/TODO
+++ /dev/null
@@ -1,5 +0,0 @@
-TODO
-=====
-
-1. Add tests for memblock_alloc_low() once the simulator can model
-   ARCH_LOW_ADDRESS_LIMIT against the low memory in memory_block
diff --git a/tools/testing/memblock/asm/dma.h b/tools/testing/memblock/asm/dma.h
index 13ff8e5d22ef6..6607408dcf25d 100644
--- a/tools/testing/memblock/asm/dma.h
+++ b/tools/testing/memblock/asm/dma.h
@@ -2,4 +2,10 @@
 #ifndef _TOOLS_DMA_H
 #define _TOOLS_DMA_H
 
+#include <linux/types.h>
+
+phys_addr_t dummy_physical_memory_low_limit(void);
+
+#define ARCH_LOW_ADDRESS_LIMIT dummy_physical_memory_low_limit()
+
 #endif
diff --git a/tools/testing/memblock/main.c b/tools/testing/memblock/main.c
index 278f9dec50087..9a96e178551b8 100644
--- a/tools/testing/memblock/main.c
+++ b/tools/testing/memblock/main.c
@@ -4,6 +4,7 @@
 #include "tests/alloc_helpers_api.h"
 #include "tests/alloc_nid_api.h"
 #include "tests/alloc_exact_nid_api.h"
+#include "tests/alloc_low_api.h"
 #include "tests/common.h"
 
 int main(int argc, char **argv)
@@ -12,6 +13,7 @@ int main(int argc, char **argv)
 	memblock_basic_checks();
 	memblock_alloc_checks();
 	memblock_alloc_helpers_checks();
+	memblock_alloc_low_checks();
 	memblock_alloc_nid_checks();
 	memblock_alloc_exact_nid_checks();
 
diff --git a/tools/testing/memblock/tests/alloc_low_api.c b/tools/testing/memblock/tests/alloc_low_api.c
new file mode 100644
index 0000000000000..a117431f1f715
--- /dev/null
+++ b/tools/testing/memblock/tests/alloc_low_api.c
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#include "alloc_low_api.h"
+#include <linux/align.h>
+
+/* Allocate at the first or last aligned address below the low limit. */
+static int alloc_low_simple_check(void)
+{
+	struct memblock_region *rgn = &memblock.reserved.regions[0];
+	phys_addr_t size = SZ_64;
+	phys_addr_t expected;
+	void *allocated_ptr;
+
+	PREFIX_PUSH();
+	setup_memblock();
+
+	/* Simulated physical RAM is not necessarily SMP_CACHE_BYTES aligned. */
+	if (memblock_bottom_up())
+		expected = ALIGN(memblock_start_of_DRAM(), SMP_CACHE_BYTES);
+	else
+		expected = ALIGN_DOWN(ARCH_LOW_ADDRESS_LIMIT - size,
+				      SMP_CACHE_BYTES);
+
+	allocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);
+
+	ASSERT_NE(allocated_ptr, NULL);
+	ASSERT_EQ((phys_addr_t)(uintptr_t)allocated_ptr, expected);
+	ASSERT_MEM_EQ(allocated_ptr, 0, size);
+	ASSERT_EQ(rgn->base, expected);
+	ASSERT_EQ(rgn->size, size);
+	ASSERT_LE(region_end(rgn), ARCH_LOW_ADDRESS_LIMIT);
+	ASSERT_EQ(memblock.reserved.cnt, 1);
+	ASSERT_EQ(memblock.reserved.total_size, size);
+
+	test_pass_pop();
+	return 0;
+}
+
+/* The last byte of the allocation is immediately below the low limit. */
+static int alloc_low_exact_limit_check(void)
+{
+	phys_addr_t limit = ARCH_LOW_ADDRESS_LIMIT;
+	phys_addr_t base = ALIGN_DOWN(limit - SZ_64, SMP_CACHE_BYTES);
+	phys_addr_t size = limit - base;
+	void *allocated_ptr;
+
+	PREFIX_PUSH();
+	setup_memblock();
+	ASSERT_EQ(memblock_remove(memblock_start_of_DRAM(),
+				  base - memblock_start_of_DRAM()), 0);
+
+	allocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);
+
+	ASSERT_NE(allocated_ptr, NULL);
+	ASSERT_EQ((phys_addr_t)(uintptr_t)allocated_ptr, base);
+	ASSERT_MEM_EQ(allocated_ptr, 0, size);
+	ASSERT_EQ(memblock.reserved.regions[0].base, base);
+	ASSERT_EQ(region_end(&memblock.reserved.regions[0]), limit);
+	ASSERT_EQ(memblock.reserved.cnt, 1);
+	ASSERT_EQ(memblock.reserved.total_size, size);
+
+	test_pass_pop();
+	return 0;
+}
+
+/*
+ * There are size bytes below the limit, but aligning the start makes the
+ * allocation cross it. Memory above the limit must not satisfy the request.
+ */
+static int alloc_low_alignment_crosses_limit_check(void)
+{
+	phys_addr_t limit = ARCH_LOW_ADDRESS_LIMIT;
+	phys_addr_t base = ALIGN_DOWN(limit, SMP_CACHE_BYTES) - 1;
+	phys_addr_t size = limit - base;
+	void *allocated_ptr;
+
+	PREFIX_PUSH();
+	setup_memblock();
+	ASSERT_EQ(memblock_remove(memblock_start_of_DRAM(),
+				  base - memblock_start_of_DRAM()), 0);
+
+	allocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);
+
+	ASSERT_EQ(allocated_ptr, NULL);
+	ASSERT_EQ(memblock.reserved.cnt, 0);
+	ASSERT_EQ(memblock.reserved.total_size, 0);
+	ASSERT_MEM_EQ((void *)(uintptr_t)base, 1, memblock_end_of_DRAM() - base);
+
+	test_pass_pop();
+	return 0;
+}
+
+/* Allocation must fail after reserving all low memory, with high memory free. */
+static int alloc_low_reserved_check(void)
+{
+	phys_addr_t limit = ARCH_LOW_ADDRESS_LIMIT;
+	phys_addr_t base = dummy_physical_memory_base();
+	phys_addr_t size = SZ_64;
+	void *allocated_ptr;
+
+	PREFIX_PUSH();
+	setup_memblock();
+	ASSERT_EQ(memblock_reserve(base, limit - base), 0);
+
+	allocated_ptr = memblock_alloc_low(size, SMP_CACHE_BYTES);
+
+	ASSERT_EQ(allocated_ptr, NULL);
+	ASSERT_EQ(memblock.reserved.cnt, 1);
+	ASSERT_EQ(memblock.reserved.regions[0].base, base);
+	ASSERT_EQ(memblock.reserved.regions[0].size, limit - base);
+	ASSERT_EQ(memblock.reserved.total_size, limit - base);
+	ASSERT_MEM_EQ((void *)(uintptr_t)base, 1, MEM_SIZE);
+
+	allocated_ptr = memblock_alloc(size, SMP_CACHE_BYTES);
+	ASSERT_NE(allocated_ptr, NULL);
+	ASSERT_LE(limit, (phys_addr_t)(uintptr_t)allocated_ptr);
+	ASSERT_MEM_EQ(allocated_ptr, 0, size);
+
+	test_pass_pop();
+	return 0;
+}
+
+static int alloc_low_checks(void)
+{
+	alloc_low_simple_check();
+	alloc_low_exact_limit_check();
+	alloc_low_alignment_crosses_limit_check();
+	alloc_low_reserved_check();
+
+	return 0;
+}
+
+int memblock_alloc_low_checks(void)
+{
+	prefix_reset();
+	prefix_push("memblock_alloc_low");
+	test_print("Running memblock_alloc_low tests...\n");
+
+	reset_memblock_attributes();
+	dummy_physical_memory_init();
+
+	run_top_down(alloc_low_checks);
+	run_bottom_up(alloc_low_checks);
+
+	dummy_physical_memory_cleanup();
+	prefix_pop();
+
+	return 0;
+}
diff --git a/tools/testing/memblock/tests/alloc_low_api.h b/tools/testing/memblock/tests/alloc_low_api.h
new file mode 100644
index 0000000000000..2e3cbe336f5da
--- /dev/null
+++ b/tools/testing/memblock/tests/alloc_low_api.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef _MEMBLOCK_ALLOC_LOW_H
+#define _MEMBLOCK_ALLOC_LOW_H
+
+#include "common.h"
+
+int memblock_alloc_low_checks(void);
+
+#endif
diff --git a/tools/testing/memblock/tests/common.c b/tools/testing/memblock/tests/common.c
index 3250c8e5124b3..ac032610a56ec 100644
--- a/tools/testing/memblock/tests/common.c
+++ b/tools/testing/memblock/tests/common.c
@@ -118,6 +118,12 @@ phys_addr_t dummy_physical_memory_base(void)
 	return (phys_addr_t)memory_block.base;
 }
 
+phys_addr_t dummy_physical_memory_low_limit(void)
+{
+	/* The low limit is halfway through memory registered by setup_memblock(). */
+	return dummy_physical_memory_base() + MEM_SIZE / 2;
+}
+
 static void usage(const char *prog)
 {
 	BUILD_BUG_ON(ARRAY_SIZE(help_opts) != ARRAY_SIZE(long_opts) - 1);

gemini-3.7-flash

null

null

							input: 6297
							output: 81
							thoughts: 684
						

**Analysis of the Patch: WorthFuzzing = False**

Okay, let's break this down. First, I need to analyze the patch diff. It looks like the changes are all confined to the `tools/testing/memblock/` directory. Specifically, I see modifications to the `Makefile`, `README`, `TODO`, and several C and header files within that directory: `asm/dma.h`, `main.c`, `tests/alloc_low_api.c`, `tests/alloc_low_api.h`, and `tests/common.c`.

Now, according to the guidelines in section 2, I need to determine if these changes warrant fuzzing. The key here is: *Does the modified code affect the compiled kernel image (vmlinux) or kernel modules?*

Looking at the context, this is a userspace test harness or unit tests for the `memblock` functionality. It compiles a userspace binary `main`, presumably using compiler flags like `-fsanitize=address`, which further supports that this isn't kernel-level code. And, it's pretty clear that these changes are isolated to the `tools/` directory.

Just to be absolutely sure, I'll quickly double-check that no other files outside of `tools/testing/memblock/` are touched by the patch. Yep, the diff confirms it: all the listed files are strictly within that directory.

Therefore, under those guidelines, I'm confident that `WorthFuzzing` should be `false`. The patch modifies exclusively userspace test code.

Now, to prepare the `set-results` call, I'll need to confirm the correct format: `EnableConfigs` needs to be `[]` or `null`, `FocusSymbols` is also `[]`, and I'll need a clear `Reasoning`.

I'll phrase the reasoning this way: "The patch exclusively touches userspace unit tests in `tools/testing/memblock/` to add tests for `memblock_alloc_low()`. It does not modify the kernel source code, compiled kernel image (vmlinux), or kernel modules. Therefore, this code is not part of the kernel and is not targetable/reachable by syzkaller kernel fuzzing." That's concise and explains *why* it's not worth fuzzing.

Alright, with the reasoning formulated, I'm ready to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space unit tests and test framework files within tools/testing/memblock/ (adding test cases for memblock_alloc_low). It does not alter the Linux kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space unit tests and test framework files within tools/testing/memblock/ (adding test cases for memblock_alloc_low). It does not alter the Linux kernel image (vmlinux) or kernel modules.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null