AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies userspace files only (tools/lib/bpf/linker.c and BPF selftests in tools/testing/selftests/bpf). It does not alter the compiled Linux kernel image (vmlinux) or kernel modules, and is therefore unreachable by kernel fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit e87038ab9be2b21edfc5adec8cae79336ffb07c7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Sep 27 17:11:51 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c\nindex 53f64a1a1f25a..0eaf98b093f0a 100644\n--- a/tools/lib/bpf/linker.c\n+++ b/tools/lib/bpf/linker.c\n@@ -2159,7 +2159,10 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,\n \tdst_sym-\u003est_name = name_off;\n \tdst_sym-\u003est_info = sym-\u003est_info;\n \tdst_sym-\u003est_other = sym-\u003est_other;\n-\tdst_sym-\u003est_shndx = dst_sec ? dst_sec-\u003esec_idx : sym-\u003est_shndx;\n+\tif (sym_is_extern)\n+\t\tdst_sym-\u003est_shndx = SHN_UNDEF;\n+\telse\n+\t\tdst_sym-\u003est_shndx = dst_sec ? dst_sec-\u003esec_idx : sym-\u003est_shndx;\n \tdst_sym-\u003est_value = (src_sec ? src_sec-\u003edst_off : 0) + sym-\u003est_value;\n \tdst_sym-\u003est_size = sym-\u003est_size;\n \n@@ -2592,6 +2595,10 @@ static int linker_append_btf(struct bpf_linker *linker, struct src_obj *obj)\n \t\t\t\t\tcontinue;\n \n \t\t\t\tdst_var = \u0026dst_sec-\u003esec_vars[glob_sym-\u003evar_idx];\n+\t\t\t\tif (!glob_sym-\u003eis_extern) {\n+\t\t\t\t\tElf64_Sym *sym = get_sym_by_idx(linker, glob_sym-\u003esym_idx);\n+\t\t\t\t\tdst_var-\u003eoffset = sym-\u003est_value;\n+\t\t\t\t}\n \t\t\t\t/* Because underlying BTF type might have\n \t\t\t\t * changed, so might its size have changed, so\n \t\t\t\t * re-calculate and update it in sec_var.\ndiff --git a/tools/testing/selftests/bpf/Makefile.skel b/tools/testing/selftests/bpf/Makefile.skel\nindex 3d92cdca62ed8..2e22bb901bf3b 100644\n--- a/tools/testing/selftests/bpf/Makefile.skel\n+++ b/tools/testing/selftests/bpf/Makefile.skel\n@@ -23,7 +23,7 @@ BPF_OBJS := $(patsubst %.c,$(RDIR)/%.bpf.o,$(BPF_SRCS))\n SKEL_BLACKLIST := btf__% test_pinning_invalid.c test_sk_assign.c\n \n LINKED_SKELS := test_static_linked.skel.h linked_funcs.skel.h\t\t\\\n-\t\tlinked_vars.skel.h linked_maps.skel.h \t\t\t\\\n+\t\tlinked_vars.skel.h linked_maps.skel.h linked_arena.skel.h \\\n \t\ttest_subskeleton.skel.h test_subskeleton_lib.skel.h\t\\\n \t\ttest_usdt.skel.h tracing_multi.skel.h\t\t\t\\\n \t\ttracing_multi_module.skel.h\t\t\t\t\\\n@@ -46,6 +46,7 @@ test_static_linked.skel.h-deps := test_static_linked1.bpf.o test_static_linked2.\n linked_funcs.skel.h-deps := linked_funcs1.bpf.o linked_funcs2.bpf.o\n linked_vars.skel.h-deps := linked_vars1.bpf.o linked_vars2.bpf.o\n linked_maps.skel.h-deps := linked_maps1.bpf.o linked_maps2.bpf.o\n+linked_arena.skel.h-deps := linked_arena1.bpf.o linked_arena2.bpf.o\n # In the subskeleton case, we want the test_subskeleton_lib.subskel.h file\n # but that's created as a side-effect of the skel.h generation.\n test_subskeleton.skel.h-deps := test_subskeleton_lib2.bpf.o test_subskeleton_lib.bpf.o test_subskeleton.bpf.o\ndiff --git a/tools/testing/selftests/bpf/prog_tests/linked_externs.c b/tools/testing/selftests/bpf/prog_tests/linked_externs.c\nnew file mode 100644\nindex 0000000000000..29358c82dc356\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/linked_externs.c\n@@ -0,0 +1,109 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */\n+#include \u003ctest_progs.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+#include \"linked_arena.skel.h\"\n+\n+static void test_skel(void)\n+{\n+\tLIBBPF_OPTS(bpf_test_run_opts, opts);\n+\tstruct linked_arena *skel;\n+\tint err;\n+\n+\tskel = linked_arena__open_and_load();\n+\tif (!ASSERT_OK_PTR(skel, \"skel_open_and_load\"))\n+\t\treturn;\n+\n+\tASSERT_EQ(skel-\u003earena-\u003ea_val, 1, \"a_val_init\");\n+\tASSERT_EQ(skel-\u003earena-\u003eb_val, 2, \"b_val_init\");\n+\n+\terr = bpf_prog_test_run_opts(bpf_program__fd(skel-\u003eprogs.sum1), \u0026opts);\n+\tASSERT_OK(err, \"sum1_run\");\n+\tASSERT_EQ(opts.retval, 1 + 2, \"sum1_retval\");\n+\n+\terr = bpf_prog_test_run_opts(bpf_program__fd(skel-\u003eprogs.bump2), \u0026opts);\n+\tASSERT_OK(err, \"bump2_run\");\n+\tASSERT_EQ(opts.retval, 11 + 22, \"bump2_retval\");\n+\n+\tASSERT_EQ(skel-\u003earena-\u003ea_val, 11, \"a_val\");\n+\tASSERT_EQ(skel-\u003earena-\u003eb_val, 22, \"b_val\");\n+\n+\tlinked_arena__destroy(skel);\n+}\n+\n+static int link_objs(const char *out, const char *in1, const char *in2)\n+{\n+\tstruct bpf_linker *linker;\n+\tint err;\n+\n+\tlinker = bpf_linker__new(out, NULL);\n+\tif (!ASSERT_OK_PTR(linker, \"linker_new\"))\n+\t\treturn -EINVAL;\n+\n+\terr = bpf_linker__add_file(linker, in1, NULL);\n+\tif (!ASSERT_OK(err, in1))\n+\t\tgoto cleanup;\n+\tif (in2) {\n+\t\terr = bpf_linker__add_file(linker, in2, NULL);\n+\t\tif (!ASSERT_OK(err, in2))\n+\t\t\tgoto cleanup;\n+\t}\n+\terr = bpf_linker__finalize(linker);\n+\tASSERT_OK(err, \"finalize\");\n+\n+cleanup:\n+\tbpf_linker__free(linker);\n+\treturn err;\n+}\n+\n+/* link in1 on its own first, then link the result with in2 */\n+static void test_relink(const char *in1, const char *in2, const char *sec_name)\n+{\n+\tchar out1[] = \"/tmp/linked_externs.XXXXXX\", out2[] = \"/tmp/linked_externs.XXXXXX\";\n+\tconst struct btf_var_secinfo *vi;\n+\tstruct bpf_object *obj = NULL;\n+\tconst struct btf_type *t;\n+\tstruct btf *btf;\n+\tint i, id, n;\n+\n+\tclose(mkstemp(out1));\n+\tclose(mkstemp(out2));\n+\n+\tif (!ASSERT_OK(link_objs(out1, in1, NULL), \"link_stage1\") ||\n+\t    !ASSERT_OK(link_objs(out2, out1, in2), \"link_stage2\"))\n+\t\tgoto cleanup;\n+\n+\tobj = bpf_object__open_file(out2, NULL);\n+\tif (!ASSERT_OK_PTR(obj, \"obj_open\"))\n+\t\tgoto cleanup;\n+\n+\tbtf = bpf_object__btf(obj);\n+\tid = btf__find_by_name_kind(btf, sec_name, BTF_KIND_DATASEC);\n+\tif (!ASSERT_GT(id, 0, \"find_datasec\"))\n+\t\tgoto cleanup;\n+\n+\tt = btf__type_by_id(btf, id);\n+\tvi = btf_var_secinfos(t);\n+\tn = btf_vlen(t);\n+\tfor (i = 0; i \u003c n; i++) {\n+\t\tt = btf__type_by_id(btf, vi[i].type);\n+\t\tASSERT_NEQ(btf_var(t)-\u003elinkage, BTF_VAR_GLOBAL_EXTERN, \"var_resolved\");\n+\t}\n+\n+\tASSERT_OK(bpf_object__load(obj), \"obj_load\");\n+\n+cleanup:\n+\tbpf_object__close(obj);\n+\tunlink(out1);\n+\tunlink(out2);\n+}\n+\n+void test_linked_externs(void)\n+{\n+\tif (test__start_subtest(\"skel_arena\"))\n+\t\ttest_skel();\n+\tif (test__start_subtest(\"relink_arena\"))\n+\t\ttest_relink(\"linked_arena1.bpf.o\", \"linked_arena2.bpf.o\", \".addr_space.1\");\n+\tif (test__start_subtest(\"relink_maps\"))\n+\t\ttest_relink(\"linked_maps1.bpf.o\", \"linked_maps2.bpf.o\", \".maps\");\n+}\ndiff --git a/tools/testing/selftests/bpf/progs/linked_arena1.c b/tools/testing/selftests/bpf/progs/linked_arena1.c\nnew file mode 100644\nindex 0000000000000..3e8788dec1d96\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/linked_arena1.c\n@@ -0,0 +1,22 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */\n+#include \u003cvmlinux.h\u003e\n+#include \u003cbpf/bpf_helpers.h\u003e\n+#include \"bpf_arena_common.h\"\n+\n+struct {\n+\t__uint(type, BPF_MAP_TYPE_ARENA);\n+\t__uint(map_flags, BPF_F_MMAPABLE);\n+\t__uint(max_entries, 1); /* number of pages */\n+} arena SEC(\".maps\");\n+\n+long __arena a_val = 1;\n+extern long __arena b_val; /* defined in linked_arena2.c */\n+\n+SEC(\"syscall\")\n+int sum1(void *ctx)\n+{\n+\treturn a_val + b_val;\n+}\n+\n+char _license[] SEC(\"license\") = \"GPL\";\ndiff --git a/tools/testing/selftests/bpf/progs/linked_arena2.c b/tools/testing/selftests/bpf/progs/linked_arena2.c\nnew file mode 100644\nindex 0000000000000..d0bcdf18a4b69\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/linked_arena2.c\n@@ -0,0 +1,18 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */\n+#include \u003cvmlinux.h\u003e\n+#include \u003cbpf/bpf_helpers.h\u003e\n+#include \"bpf_arena_common.h\"\n+\n+long __arena b_val = 2;\n+extern long __arena a_val; /* defined in linked_arena1.c */\n+\n+SEC(\"syscall\")\n+int bump2(void *ctx)\n+{\n+\ta_val += 10;\n+\tb_val += 20;\n+\treturn a_val + b_val;\n+}\n+\n+char _license[] SEC(\"license\") = \"GPL\";\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies userspace files only (tools/lib/bpf/linker.c and BPF selftests in tools/testing/selftests/bpf). It does not alter the compiled Linux kernel image (vmlinux) or kernel modules, and is therefore unreachable by kernel fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit e87038ab9be2b21edfc5adec8cae79336ffb07c7
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 27 17:11:51 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index 53f64a1a1f25a..0eaf98b093f0a 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c
@@ -2159,7 +2159,10 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,
 	dst_sym->st_name = name_off;
 	dst_sym->st_info = sym->st_info;
 	dst_sym->st_other = sym->st_other;
-	dst_sym->st_shndx = dst_sec ? dst_sec->sec_idx : sym->st_shndx;
+	if (sym_is_extern)
+		dst_sym->st_shndx = SHN_UNDEF;
+	else
+		dst_sym->st_shndx = dst_sec ? dst_sec->sec_idx : sym->st_shndx;
 	dst_sym->st_value = (src_sec ? src_sec->dst_off : 0) + sym->st_value;
 	dst_sym->st_size = sym->st_size;
 
@@ -2592,6 +2595,10 @@ static int linker_append_btf(struct bpf_linker *linker, struct src_obj *obj)
 					continue;
 
 				dst_var = &dst_sec->sec_vars[glob_sym->var_idx];
+				if (!glob_sym->is_extern) {
+					Elf64_Sym *sym = get_sym_by_idx(linker, glob_sym->sym_idx);
+					dst_var->offset = sym->st_value;
+				}
 				/* Because underlying BTF type might have
 				 * changed, so might its size have changed, so
 				 * re-calculate and update it in sec_var.
diff --git a/tools/testing/selftests/bpf/Makefile.skel b/tools/testing/selftests/bpf/Makefile.skel
index 3d92cdca62ed8..2e22bb901bf3b 100644
--- a/tools/testing/selftests/bpf/Makefile.skel
+++ b/tools/testing/selftests/bpf/Makefile.skel
@@ -23,7 +23,7 @@ BPF_OBJS := $(patsubst %.c,$(RDIR)/%.bpf.o,$(BPF_SRCS))
 SKEL_BLACKLIST := btf__% test_pinning_invalid.c test_sk_assign.c
 
 LINKED_SKELS := test_static_linked.skel.h linked_funcs.skel.h		\
-		linked_vars.skel.h linked_maps.skel.h 			\
+		linked_vars.skel.h linked_maps.skel.h linked_arena.skel.h \
 		test_subskeleton.skel.h test_subskeleton_lib.skel.h	\
 		test_usdt.skel.h tracing_multi.skel.h			\
 		tracing_multi_module.skel.h				\
@@ -46,6 +46,7 @@ test_static_linked.skel.h-deps := test_static_linked1.bpf.o test_static_linked2.
 linked_funcs.skel.h-deps := linked_funcs1.bpf.o linked_funcs2.bpf.o
 linked_vars.skel.h-deps := linked_vars1.bpf.o linked_vars2.bpf.o
 linked_maps.skel.h-deps := linked_maps1.bpf.o linked_maps2.bpf.o
+linked_arena.skel.h-deps := linked_arena1.bpf.o linked_arena2.bpf.o
 # In the subskeleton case, we want the test_subskeleton_lib.subskel.h file
 # but that's created as a side-effect of the skel.h generation.
 test_subskeleton.skel.h-deps := test_subskeleton_lib2.bpf.o test_subskeleton_lib.bpf.o test_subskeleton.bpf.o
diff --git a/tools/testing/selftests/bpf/prog_tests/linked_externs.c b/tools/testing/selftests/bpf/prog_tests/linked_externs.c
new file mode 100644
index 0000000000000..29358c82dc356
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/linked_externs.c
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
+#include <test_progs.h>
+#include <bpf/btf.h>
+#include "linked_arena.skel.h"
+
+static void test_skel(void)
+{
+	LIBBPF_OPTS(bpf_test_run_opts, opts);
+	struct linked_arena *skel;
+	int err;
+
+	skel = linked_arena__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel_open_and_load"))
+		return;
+
+	ASSERT_EQ(skel->arena->a_val, 1, "a_val_init");
+	ASSERT_EQ(skel->arena->b_val, 2, "b_val_init");
+
+	err = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.sum1), &opts);
+	ASSERT_OK(err, "sum1_run");
+	ASSERT_EQ(opts.retval, 1 + 2, "sum1_retval");
+
+	err = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.bump2), &opts);
+	ASSERT_OK(err, "bump2_run");
+	ASSERT_EQ(opts.retval, 11 + 22, "bump2_retval");
+
+	ASSERT_EQ(skel->arena->a_val, 11, "a_val");
+	ASSERT_EQ(skel->arena->b_val, 22, "b_val");
+
+	linked_arena__destroy(skel);
+}
+
+static int link_objs(const char *out, const char *in1, const char *in2)
+{
+	struct bpf_linker *linker;
+	int err;
+
+	linker = bpf_linker__new(out, NULL);
+	if (!ASSERT_OK_PTR(linker, "linker_new"))
+		return -EINVAL;
+
+	err = bpf_linker__add_file(linker, in1, NULL);
+	if (!ASSERT_OK(err, in1))
+		goto cleanup;
+	if (in2) {
+		err = bpf_linker__add_file(linker, in2, NULL);
+		if (!ASSERT_OK(err, in2))
+			goto cleanup;
+	}
+	err = bpf_linker__finalize(linker);
+	ASSERT_OK(err, "finalize");
+
+cleanup:
+	bpf_linker__free(linker);
+	return err;
+}
+
+/* link in1 on its own first, then link the result with in2 */
+static void test_relink(const char *in1, const char *in2, const char *sec_name)
+{
+	char out1[] = "/tmp/linked_externs.XXXXXX", out2[] = "/tmp/linked_externs.XXXXXX";
+	const struct btf_var_secinfo *vi;
+	struct bpf_object *obj = NULL;
+	const struct btf_type *t;
+	struct btf *btf;
+	int i, id, n;
+
+	close(mkstemp(out1));
+	close(mkstemp(out2));
+
+	if (!ASSERT_OK(link_objs(out1, in1, NULL), "link_stage1") ||
+	    !ASSERT_OK(link_objs(out2, out1, in2), "link_stage2"))
+		goto cleanup;
+
+	obj = bpf_object__open_file(out2, NULL);
+	if (!ASSERT_OK_PTR(obj, "obj_open"))
+		goto cleanup;
+
+	btf = bpf_object__btf(obj);
+	id = btf__find_by_name_kind(btf, sec_name, BTF_KIND_DATASEC);
+	if (!ASSERT_GT(id, 0, "find_datasec"))
+		goto cleanup;
+
+	t = btf__type_by_id(btf, id);
+	vi = btf_var_secinfos(t);
+	n = btf_vlen(t);
+	for (i = 0; i < n; i++) {
+		t = btf__type_by_id(btf, vi[i].type);
+		ASSERT_NEQ(btf_var(t)->linkage, BTF_VAR_GLOBAL_EXTERN, "var_resolved");
+	}
+
+	ASSERT_OK(bpf_object__load(obj), "obj_load");
+
+cleanup:
+	bpf_object__close(obj);
+	unlink(out1);
+	unlink(out2);
+}
+
+void test_linked_externs(void)
+{
+	if (test__start_subtest("skel_arena"))
+		test_skel();
+	if (test__start_subtest("relink_arena"))
+		test_relink("linked_arena1.bpf.o", "linked_arena2.bpf.o", ".addr_space.1");
+	if (test__start_subtest("relink_maps"))
+		test_relink("linked_maps1.bpf.o", "linked_maps2.bpf.o", ".maps");
+}
diff --git a/tools/testing/selftests/bpf/progs/linked_arena1.c b/tools/testing/selftests/bpf/progs/linked_arena1.c
new file mode 100644
index 0000000000000..3e8788dec1d96
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/linked_arena1.c
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_arena_common.h"
+
+struct {
+	__uint(type, BPF_MAP_TYPE_ARENA);
+	__uint(map_flags, BPF_F_MMAPABLE);
+	__uint(max_entries, 1); /* number of pages */
+} arena SEC(".maps");
+
+long __arena a_val = 1;
+extern long __arena b_val; /* defined in linked_arena2.c */
+
+SEC("syscall")
+int sum1(void *ctx)
+{
+	return a_val + b_val;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/progs/linked_arena2.c b/tools/testing/selftests/bpf/progs/linked_arena2.c
new file mode 100644
index 0000000000000..d0bcdf18a4b69
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/linked_arena2.c
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_arena_common.h"
+
+long __arena b_val = 2;
+extern long __arena a_val; /* defined in linked_arena1.c */
+
+SEC("syscall")
+int bump2(void *ctx)
+{
+	a_val += 10;
+	b_val += 20;
+	return a_val + b_val;
+}
+
+char _license[] SEC("license") = "GPL";

gemini-3.8-flash

null

null

							input: 5904
							output: 29
							thoughts: 429
						

**WorthFuzzing Analysis - Initial Assessment**

Okay, so I've got this patch to analyze and need to determine if it's worth fuzzing with syzkaller. The first step is always a meticulous examination of the diff. Let's see... the modified files are: `tools/lib/bpf/linker.c`, `tools/testing/selftests/bpf/Makefile.skel`, `tools/testing/selftests/bpf/prog_tests/linked_externs.c`, `tools/testing/selftests/bpf/progs/linked_arena1.c`, and `tools/testing/selftests/bpf/progs/linked_arena2.c`. Hmm, a quick scan reveals that *all* of these files reside within the `tools/` directory.

Now, my initial reaction is leaning toward "not worth fuzzing," but I need to be absolutely certain. Let's refer back to those triage guidelines, specifically the negative criteria. The guidelines explicitly state that modifications falling strictly into "User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)" that *don't* affect the compiled kernel image are a no-go for fuzzing. `tools/lib/bpf/linker.c` is userspace libbpf code and the rest are selftests, so this looks promising for a quick negative assessment.

However, I can't just jump to a conclusion. I need to be 100% sure. Just because all the files *in the diff* are in `tools/` doesn't mean the commit itself didn't touch something else. I'll need to do a thorough check of the HEAD commit using `git log` or `git diff`. I'll verify if there are any kernel files outside `tools/` that were modified in this HEAD commit. That's the key to confirming whether this deserves more investigation or if it's a straightforward "WorthFuzzing=false".

{
  "Expression": "linker_append_elf_sym",
  "PathPrefix": "tools/"
}

{
  "Output": "tools/lib/bpf/linker.c=179=static int linker_append_sec_data(struct bpf_linker *linker, struct src_obj *obj);\ntools/lib/bpf/linker.c:180:static int linker_append_elf_syms(struct bpf_linker *linker, struct src_obj *obj);\ntools/lib/bpf/linker.c:181:static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,\ntools/lib/bpf/linker.c-182-\t\t\t\t Elf64_Sym *sym, const char *sym_name, int src_sym_idx);\n--\ntools/lib/bpf/linker.c=490=static int bpf_linker_add_file(struct bpf_linker *linker, int fd,\n--\ntools/lib/bpf/linker.c-500-\terr = err ?: linker_append_sec_data(linker, \u0026obj);\ntools/lib/bpf/linker.c:501:\terr = err ?: linker_append_elf_syms(linker, \u0026obj);\ntools/lib/bpf/linker.c-502-\terr = err ?: linker_append_elf_relos(linker, \u0026obj);\n--\ntools/lib/bpf/linker.c=1353=static int linker_append_sec_data(struct bpf_linker *linker, struct src_obj *obj)\n--\ntools/lib/bpf/linker.c-1404-\ntools/lib/bpf/linker.c:1405:static int linker_append_elf_syms(struct bpf_linker *linker, struct src_obj *obj)\ntools/lib/bpf/linker.c-1406-{\n--\ntools/lib/bpf/linker.c-1429-\ntools/lib/bpf/linker.c:1430:\t\terr = linker_append_elf_sym(linker, obj, sym, sym_name, i);\ntools/lib/bpf/linker.c-1431-\t\tif (err)\n--\ntools/lib/bpf/linker.c=1986=static void sym_update_visibility(Elf64_Sym *sym, int sym_vis)\n--\ntools/lib/bpf/linker.c-1994-\ntools/lib/bpf/linker.c:1995:static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,\ntools/lib/bpf/linker.c-1996-\t\t\t\t Elf64_Sym *sym, const char *sym_name, int src_sym_idx)\n--\ntools/lib/bpf/linker.c=2433=static int linker_append_btf(struct bpf_linker *linker, struct src_obj *obj)\n--\ntools/lib/bpf/linker.c-2469-\ntools/lib/bpf/linker.c:2470:\t\t\t/* linker_append_elf_sym() might have requested\ntools/lib/bpf/linker.c-2471-\t\t\t * updating underlying type ID, if extern was resolved\n"
}

gemini-3.8-flash

null

null

							input: 7587
							output: 94
							thoughts: 539
						

**My Assessment of the Patch's Fuzzing Suitability**

Okay, let's break this down. The changes are strictly confined to `tools/lib/bpf/linker.c` and within the BPF selftests directory (`tools/testing/selftests/bpf/...`). The key question is whether these modifications, residing in the `tools/` directory, have any impact on the compiled kernel image (`vmlinux`) or kernel modules. And the answer is a resounding *no*. `libbpf` is explicitly a userspace library, and the `tools/` directory is, as the name suggests, where userspace tools and supporting code reside. The kernel's BPF implementation is within `kernel/bpf/`, a completely separate entity.

Specifically, the documentation's Section 2 clearly states that changes to userspace directories, self-tests, and scripts (like those found in `tools/`) are excluded if they *don't* affect the kernel image or modules. This patch series falls squarely into that "negative criteria".

To be absolutely certain, let's verify that the scope is limited. Examining the commit (e87038ab9be2b21edfc5adec8cae79336ffb07c7), all modified files are indeed within the `tools/` directory: the linker itself, along with relevant Makefiles and test programs.

Therefore, my conclusion is definitive: `WorthFuzzing` is `false`.

My `set-results` parameters are as follows:

*   `EnableConfigs`: `[]` (empty)
*   `FocusSymbols`: `[]` (empty)
*   `Reasoning`: "The patch modifies user-space code in tools/lib/bpf and BPF selftests in tools/testing/selftests/bpf. None of these changes affect the compiled kernel image (vmlinux) or kernel modules, so they are not reachable by syzkaller fuzzing."
*   `WorthFuzzing`: `false`

I'm ready to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies userspace files only (tools/lib/bpf/linker.c and BPF selftests in tools/testing/selftests/bpf). It does not alter the compiled Linux kernel image (vmlinux) or kernel modules, and is therefore unreachable by kernel fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies userspace files only (tools/lib/bpf/linker.c and BPF selftests in tools/testing/selftests/bpf). It does not alter the compiled Linux kernel image (vmlinux) or kernel modules, and is therefore unreachable by kernel fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null