AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/06/28 14:18 flow patch-triage
1m Args: 
null

Results: 
{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_indirect_jump"
  ],
  "Reasoning": "The patch adds bounds checking for indirect jumps (gotox) in the BPF verifier to prevent jumping outside the current subprogram. This is a functional change in core BPF verification logic and should be fuzzed.",
  "WorthFuzzing": true
}
1/1 2026/06/28 14:18 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit 9cc5522804f710090961b3703e9bc3f767de5a8d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Jun 28 14:18:34 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c\nindex eb46a81a8c51ac..05a996a5ecdd25 100644\n--- a/kernel/bpf/verifier.c\n+++ b/kernel/bpf/verifier.c\n@@ -17145,9 +17145,11 @@ static int indirect_jump_min_max_index(struct bpf_verifier_env *env,\n static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn)\n {\n \tstruct bpf_verifier_state *other_branch;\n+\tstruct bpf_subprog_info *subprog;\n \tstruct bpf_reg_state *dst_reg;\n \tstruct bpf_map *map;\n \tu32 min_index, max_index;\n+\tint subprog_start, subprog_end;\n \tint err = 0;\n \tint n;\n \tint i;\n@@ -17188,6 +17190,23 @@ static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *in\n \t\treturn -EINVAL;\n \t}\n \n+\tsubprog = bpf_find_containing_subprog(env, env-\u003einsn_idx);\n+\tif (verifier_bug_if(!subprog, env,\n+\t\t\t    \"gotox insn %d is outside subprog bounds\\n\",\n+\t\t\t    env-\u003einsn_idx))\n+\t\treturn -EFAULT;\n+\tsubprog_start = subprog-\u003estart;\n+\tsubprog_end = (subprog + 1)-\u003estart;\n+\n+\tfor (i = 0; i \u003c n; i++) {\n+\t\tu32 target = env-\u003egotox_tmp_buf-\u003eitems[i];\n+\n+\t\tif (target \u003c subprog_start || target \u003e= subprog_end) {\n+\t\t\tverbose(env, \"gotox target %u outside subprog\\n\", target);\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\t}\n+\n \tfor (i = 0; i \u003c n - 1; i++) {\n \t\tmark_indirect_target(env, env-\u003egotox_tmp_buf-\u003eitems[i]);\n \t\tother_branch = push_stack(env, env-\u003egotox_tmp_buf-\u003eitems[i],\ndiff --git a/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c b/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c\nindex 73dc63882b7d55..997724c61c8b60 100644\n--- a/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c\n+++ b/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c\n@@ -255,6 +255,30 @@ static int create_jt_map(__u32 max_entries)\n \t\t\t      key_size, value_size, max_entries, NULL);\n }\n \n+static int create_jt_map_with_target(__u32 target)\n+{\n+\tstruct bpf_insn_array_value val = { .orig_off = target };\n+\t__u32 key = 0;\n+\tint map_fd;\n+\n+\tmap_fd = create_jt_map(1);\n+\tif (!ASSERT_GE(map_fd, 0, \"create_jt_map\"))\n+\t\treturn -1;\n+\n+\tif (!ASSERT_EQ(bpf_map_update_elem(map_fd, \u0026key, \u0026val, 0),\n+\t\t       0, \"bpf_map_update_elem\")) {\n+\t\tclose(map_fd);\n+\t\treturn -1;\n+\t}\n+\n+\tif (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, \"bpf_map_freeze\")) {\n+\t\tclose(map_fd);\n+\t\treturn -1;\n+\t}\n+\n+\treturn map_fd;\n+}\n+\n static int prog_load(struct bpf_insn *insns, __u32 insn_cnt)\n {\n \treturn bpf_prog_load(BPF_PROG_TYPE_RAW_TRACEPOINT, NULL, \"GPL\", insns, insn_cnt, NULL);\n@@ -393,6 +417,52 @@ reject_offsets(struct bpf_insn *insns, __u32 insn_cnt, int off1, int off2, int o\n \t\tclose(prog_fd);\n }\n \n+static void\n+check_cross_subprog_gotox_target(void)\n+{\n+\tstruct bpf_insn insns[] = {\n+\t\t/* main subprog [0,14) */\n+\t\tBPF_MOV64_REG(BPF_REG_6, BPF_REG_1),\n+\t\tBPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_CALL, 0, 12),\n+\t\tBPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, 0),\n+\t\tBPF_JMP_IMM(BPF_JEQ, BPF_REG_7, 0, 4),\n+\t\tBPF_LD_IMM64_RAW(BPF_REG_2, BPF_PSEUDO_MAP_VALUE, 0),\n+\t\tBPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, 0),\n+\t\tBPF_JMP_A(3),\n+\t\tBPF_LD_IMM64_RAW(BPF_REG_2, BPF_PSEUDO_MAP_VALUE, 0),\n+\t\tBPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, 0),\n+\t\tBPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_2, 0, 0, 0),\n+\t\tBPF_MOV64_IMM(BPF_REG_0, 1),\n+\t\tBPF_EXIT_INSN(),\n+\n+\t\t/* static subprog [14,16) */\n+\t\tBPF_MOV64_IMM(BPF_REG_0, 42),\n+\t\tBPF_EXIT_INSN(),\n+\t};\n+\tint good_fd, bad_fd, prog_fd;\n+\n+\tgood_fd = create_jt_map_with_target(12);\n+\tif (!ASSERT_GE(good_fd, 0, \"create_good_jt_map\"))\n+\t\treturn;\n+\n+\tbad_fd = create_jt_map_with_target(14);\n+\tif (!ASSERT_GE(bad_fd, 0, \"create_bad_jt_map\")) {\n+\t\tclose(good_fd);\n+\t\treturn;\n+\t}\n+\n+\tinsns[4].imm = bad_fd;\n+\tinsns[8].imm = good_fd;\n+\n+\tprog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, \"GPL\",\n+\t\t\t\tinsns, ARRAY_SIZE(insns), NULL);\n+\tif (!ASSERT_EQ(prog_fd, -EINVAL, \"cross_subprog_gotox_prog_load\"))\n+\t\tclose(prog_fd);\n+\n+\tclose(bad_fd);\n+\tclose(good_fd);\n+}\n+\n /*\n  * Verify a bit more complex programs which include indirect jumps\n  * and with jump tables loaded with a non-zero offset\n@@ -541,5 +611,8 @@ void test_bpf_gotox(void)\n \tif (test__start_subtest(\"check-ldimm64-off-gotox-llvm\"))\n \t\t__subtest(skel, check_ldimm64_off_gotox_llvm);\n \n+\tif (test__start_subtest(\"check-cross-subprog-gotox-target\"))\n+\t\tcheck_cross_subprog_gotox_target();\n+\n \tbpf_gotox__destroy(skel);\n }\n"
}
2/1 2026/06/28 14:18 agent patch-evaluator
1m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_indirect_jump"
  ],
  "Reasoning": "The patch adds bounds checking for indirect jumps (gotox) in the BPF verifier to prevent jumping outside the current subprogram. This is a functional change in core BPF verification logic and should be fuzzed.",
  "WorthFuzzing": true
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit 9cc5522804f710090961b3703e9bc3f767de5a8d
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Jun 28 14:18:34 2026 +0000

    syz-cluster: applied patch under review

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index eb46a81a8c51ac..05a996a5ecdd25 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -17145,9 +17145,11 @@ static int indirect_jump_min_max_index(struct bpf_verifier_env *env,
 static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn)
 {
 	struct bpf_verifier_state *other_branch;
+	struct bpf_subprog_info *subprog;
 	struct bpf_reg_state *dst_reg;
 	struct bpf_map *map;
 	u32 min_index, max_index;
+	int subprog_start, subprog_end;
 	int err = 0;
 	int n;
 	int i;
@@ -17188,6 +17190,23 @@ static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *in
 		return -EINVAL;
 	}
 
+	subprog = bpf_find_containing_subprog(env, env->insn_idx);
+	if (verifier_bug_if(!subprog, env,
+			    "gotox insn %d is outside subprog bounds\n",
+			    env->insn_idx))
+		return -EFAULT;
+	subprog_start = subprog->start;
+	subprog_end = (subprog + 1)->start;
+
+	for (i = 0; i < n; i++) {
+		u32 target = env->gotox_tmp_buf->items[i];
+
+		if (target < subprog_start || target >= subprog_end) {
+			verbose(env, "gotox target %u outside subprog\n", target);
+			return -EINVAL;
+		}
+	}
+
 	for (i = 0; i < n - 1; i++) {
 		mark_indirect_target(env, env->gotox_tmp_buf->items[i]);
 		other_branch = push_stack(env, env->gotox_tmp_buf->items[i],
diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c b/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c
index 73dc63882b7d55..997724c61c8b60 100644
--- a/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_gotox.c
@@ -255,6 +255,30 @@ static int create_jt_map(__u32 max_entries)
 			      key_size, value_size, max_entries, NULL);
 }
 
+static int create_jt_map_with_target(__u32 target)
+{
+	struct bpf_insn_array_value val = { .orig_off = target };
+	__u32 key = 0;
+	int map_fd;
+
+	map_fd = create_jt_map(1);
+	if (!ASSERT_GE(map_fd, 0, "create_jt_map"))
+		return -1;
+
+	if (!ASSERT_EQ(bpf_map_update_elem(map_fd, &key, &val, 0),
+		       0, "bpf_map_update_elem")) {
+		close(map_fd);
+		return -1;
+	}
+
+	if (!ASSERT_EQ(bpf_map_freeze(map_fd), 0, "bpf_map_freeze")) {
+		close(map_fd);
+		return -1;
+	}
+
+	return map_fd;
+}
+
 static int prog_load(struct bpf_insn *insns, __u32 insn_cnt)
 {
 	return bpf_prog_load(BPF_PROG_TYPE_RAW_TRACEPOINT, NULL, "GPL", insns, insn_cnt, NULL);
@@ -393,6 +417,52 @@ reject_offsets(struct bpf_insn *insns, __u32 insn_cnt, int off1, int off2, int o
 		close(prog_fd);
 }
 
+static void
+check_cross_subprog_gotox_target(void)
+{
+	struct bpf_insn insns[] = {
+		/* main subprog [0,14) */
+		BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_CALL, 0, 12),
+		BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, 0),
+		BPF_JMP_IMM(BPF_JEQ, BPF_REG_7, 0, 4),
+		BPF_LD_IMM64_RAW(BPF_REG_2, BPF_PSEUDO_MAP_VALUE, 0),
+		BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, 0),
+		BPF_JMP_A(3),
+		BPF_LD_IMM64_RAW(BPF_REG_2, BPF_PSEUDO_MAP_VALUE, 0),
+		BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, 0),
+		BPF_RAW_INSN(BPF_JMP | BPF_JA | BPF_X, BPF_REG_2, 0, 0, 0),
+		BPF_MOV64_IMM(BPF_REG_0, 1),
+		BPF_EXIT_INSN(),
+
+		/* static subprog [14,16) */
+		BPF_MOV64_IMM(BPF_REG_0, 42),
+		BPF_EXIT_INSN(),
+	};
+	int good_fd, bad_fd, prog_fd;
+
+	good_fd = create_jt_map_with_target(12);
+	if (!ASSERT_GE(good_fd, 0, "create_good_jt_map"))
+		return;
+
+	bad_fd = create_jt_map_with_target(14);
+	if (!ASSERT_GE(bad_fd, 0, "create_bad_jt_map")) {
+		close(good_fd);
+		return;
+	}
+
+	insns[4].imm = bad_fd;
+	insns[8].imm = good_fd;
+
+	prog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL",
+				insns, ARRAY_SIZE(insns), NULL);
+	if (!ASSERT_EQ(prog_fd, -EINVAL, "cross_subprog_gotox_prog_load"))
+		close(prog_fd);
+
+	close(bad_fd);
+	close(good_fd);
+}
+
 /*
  * Verify a bit more complex programs which include indirect jumps
  * and with jump tables loaded with a non-zero offset
@@ -541,5 +611,8 @@ void test_bpf_gotox(void)
 	if (test__start_subtest("check-ldimm64-off-gotox-llvm"))
 		__subtest(skel, check_ldimm64_off_gotox_llvm);
 
+	if (test__start_subtest("check-cross-subprog-gotox-target"))
+		check_cross_subprog_gotox_target();
+
 	bpf_gotox__destroy(skel);
 }

3/2 2026/06/28 14:18 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 3699
							output: 19
							thoughts: 430

Thoughts: 
**Analyzing the BPF Verifier Patch**

Okay, so I'm looking at this patch that tweaks `kernel/bpf/verifier.c`. My initial read tells me this is a functional change. It seems they've added a check within the `check_indirect_jump` function. The goal is to ensure that a `gotox` instruction, or indirect jump, isn't targeting an instruction outside the current subprogram's bounds. This is a solid safety measure; we don't want programs jumping all over the place. Preventing `gotox` from jumping into other subprograms is definitely a desirable outcome.

Let's dive into the code snippet itself:

```c
+	subprog = bpf_find_containing_subprog(env, env->insn_idx);
+	if (verifier_bug_if(!subprog, env,
+			    "gotox insn %d is outside subprog bounds\n",
+			    env->insn_idx))
+		return -EFAULT;
+	subprog_start = subprog->start;
+	subprog_end = (subprog + 1)->start;
+
+	for (i = 0; i < n; i++) {
+		u32 target = env->gotox_tmp_buf->items[i];
+
+		if (target < subprog_start || target >= subprog_end) {
+			verbose(env, "gotox target %u outside subprog\n", target);
+			return -EINVAL;
+		}
+	}
```

Yep, it's doing exactly what I thought. It finds the subprogram that the current instruction resides in, checks if it's gotox, then iterates through all potential targets to make sure they're within the confines of that subprogram. If they're not, it flags an error and returns `-EINVAL`. This is definitely a significant functional change in the BPF verifier.

From a fuzzing perspective, I'd say this is definitely something to target. I'll mark `WorthFuzzing=true`.

For focus symbols, `check_indirect_jump` is the key function to focus on. `bpf_find_containing_subprog` *might* be relevant, but it's an existing function, so let's stick with the core of the change: `check_indirect_jump`.

As for configuration, BPF is generally enabled by default, but I'll make sure to verify the context of `CONFIG_BPF_SYSCALL` – it's the primary config to check. Let's make sure the dependencies are as we expect.

4/2 2026/06/28 14:19 tool grepper
0m Args: 
{
  "Expression": "check_indirect_jump"
}

Results: 
{
  "Output": "kernel/bpf/verifier.c=17111=static int indirect_jump_min_max_index(struct bpf_verifier_env *env,\n--\nkernel/bpf/verifier.c-17144-/* gotox *dst_reg */\nkernel/bpf/verifier.c:17145:static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn)\nkernel/bpf/verifier.c-17146-{\n--\nkernel/bpf/verifier.c=17222=static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)\n--\nkernel/bpf/verifier.c-17294-\t\t\tif (BPF_SRC(insn-\u003ecode) == BPF_X)\nkernel/bpf/verifier.c:17295:\t\t\t\treturn check_indirect_jump(env, insn);\nkernel/bpf/verifier.c-17296-\n"
}
5/2 2026/06/28 14:19 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 4998
							output: 22
							thoughts: 68

Thoughts: 
Here's my summary, as the expert:

**Fuzzing the `check_indirect_jump` Function**

Okay, so `check_indirect_jump` is triggered within `do_check_insn` whenever a BPF instruction uses `BPF_X` as its source operand. That screams "indirect jump," and that means it's a critical part of the BPF verifier—it *has* to be reachable during normal operation. This makes it a prime candidate for fuzzing. We need to really test its boundaries.

Given its crucial role, it's worth checking the relevant configurations and their implications for this function's behaviour. I need to understand what environmental factors could influence its execution paths and potential vulnerabilities. I'll make sure to get those covered.

6/2 2026/06/28 14:19 tool grepper
0m Args: 
{
  "Expression": "CONFIG_BPF_SYSCALL"
}

Results: 
{
  "Output": "\nFull output is too long, showing 500 out of 1124 lines.\nUse more precise expression if possible.\n\nDocumentation/scheduler/sched-ext.rst=35=options should be enabled to use sched_ext:\n--\nDocumentation/scheduler/sched-ext.rst-40-    CONFIG_SCHED_CLASS_EXT=y\nDocumentation/scheduler/sched-ext.rst:41:    CONFIG_BPF_SYSCALL=y\nDocumentation/scheduler/sched-ext.rst-42-    CONFIG_BPF_JIT=y\n--\nDocumentation/trace/fprobetrace.rst=84=parameters by its name instead of ``$argN``. This feature is available if the\nDocumentation/trace/fprobetrace.rst:85:kernel is configured with CONFIG_BPF_SYSCALL and CONFIG_DEBUG_INFO_BTF.\nDocumentation/trace/fprobetrace.rst-86-If user only specify the BTF argument, the event's argument name is also\n--\narch/arm/configs/aspeed_g4_defconfig=4=CONFIG_HIGH_RES_TIMERS=y\narch/arm/configs/aspeed_g4_defconfig:5:CONFIG_BPF_SYSCALL=y\narch/arm/configs/aspeed_g4_defconfig-6-CONFIG_IKCONFIG=y\n--\narch/arm/configs/aspeed_g5_defconfig=4=CONFIG_HIGH_RES_TIMERS=y\narch/arm/configs/aspeed_g5_defconfig:5:CONFIG_BPF_SYSCALL=y\narch/arm/configs/aspeed_g5_defconfig-6-CONFIG_IKCONFIG=y\n--\narch/arm/configs/imx_v6_v7_defconfig=3=CONFIG_HIGH_RES_TIMERS=y\narch/arm/configs/imx_v6_v7_defconfig:4:CONFIG_BPF_SYSCALL=y\narch/arm/configs/imx_v6_v7_defconfig-5-CONFIG_PREEMPT_VOLUNTARY=y\n--\narch/arm/configs/imxrt_defconfig-1-# CONFIG_LOCALVERSION_AUTO is not set\narch/arm/configs/imxrt_defconfig:2:CONFIG_BPF_SYSCALL=y\narch/arm/configs/imxrt_defconfig-3-CONFIG_SCHED_AUTOGROUP=y\n--\narch/arm/kernel/spectre.c=8=static bool _unprivileged_ebpf_enabled(void)\narch/arm/kernel/spectre.c-9-{\narch/arm/kernel/spectre.c:10:#ifdef CONFIG_BPF_SYSCALL\narch/arm/kernel/spectre.c-11-\treturn !sysctl_unprivileged_bpf_disabled;\n--\narch/arm64/configs/defconfig=5=CONFIG_HIGH_RES_TIMERS=y\narch/arm64/configs/defconfig:6:CONFIG_BPF_SYSCALL=y\narch/arm64/configs/defconfig-7-CONFIG_BPF_JIT=y\n--\narch/arm64/kernel/proton-pack.c=110=static bool _unprivileged_ebpf_enabled(void)\narch/arm64/kernel/proton-pack.c-111-{\narch/arm64/kernel/proton-pack.c:112:#ifdef CONFIG_BPF_SYSCALL\narch/arm64/kernel/proton-pack.c-113-\treturn !sysctl_unprivileged_bpf_disabled;\n--\narch/arm64/kernel/proton-pack.c=1167=void __init spectre_bhb_patch_clearbhb(struct alt_instr *alt,\n--\narch/arm64/kernel/proton-pack.c-1178-\narch/arm64/kernel/proton-pack.c:1179:#ifdef CONFIG_BPF_SYSCALL\narch/arm64/kernel/proton-pack.c-1180-#define EBPF_WARN \"Unprivileged eBPF is enabled, data leaks possible via Spectre v2 BHB attacks!\\n\"\n--\narch/loongarch/configs/loongson32_defconfig=6=CONFIG_HIGH_RES_TIMERS=y\narch/loongarch/configs/loongson32_defconfig:7:CONFIG_BPF_SYSCALL=y\narch/loongarch/configs/loongson32_defconfig-8-CONFIG_PREEMPT=y\n--\narch/loongarch/configs/loongson64_defconfig=6=CONFIG_HIGH_RES_TIMERS=y\narch/loongarch/configs/loongson64_defconfig:7:CONFIG_BPF_SYSCALL=y\narch/loongarch/configs/loongson64_defconfig-8-CONFIG_BPF_JIT=y\n--\narch/mips/configs/decstation_64_defconfig=7=CONFIG_EXPERT=y\n--\narch/mips/configs/decstation_64_defconfig-9-# CONFIG_SYSFS_SYSCALL is not set\narch/mips/configs/decstation_64_defconfig:10:CONFIG_BPF_SYSCALL=y\narch/mips/configs/decstation_64_defconfig-11-# CONFIG_COMPAT_BRK is not set\n--\narch/mips/configs/decstation_defconfig=7=CONFIG_EXPERT=y\n--\narch/mips/configs/decstation_defconfig-9-# CONFIG_SYSFS_SYSCALL is not set\narch/mips/configs/decstation_defconfig:10:CONFIG_BPF_SYSCALL=y\narch/mips/configs/decstation_defconfig-11-# CONFIG_COMPAT_BRK is not set\n--\narch/mips/configs/decstation_r4k_defconfig=7=CONFIG_EXPERT=y\n--\narch/mips/configs/decstation_r4k_defconfig-9-# CONFIG_SYSFS_SYSCALL is not set\narch/mips/configs/decstation_r4k_defconfig:10:CONFIG_BPF_SYSCALL=y\narch/mips/configs/decstation_r4k_defconfig-11-# CONFIG_COMPAT_BRK is not set\n--\narch/mips/configs/eyeq5_defconfig=3=CONFIG_HIGH_RES_TIMERS=y\narch/mips/configs/eyeq5_defconfig:4:CONFIG_BPF_SYSCALL=y\narch/mips/configs/eyeq5_defconfig-5-CONFIG_TASKSTATS=y\n--\narch/mips/configs/eyeq6_defconfig=3=CONFIG_HIGH_RES_TIMERS=y\narch/mips/configs/eyeq6_defconfig:4:CONFIG_BPF_SYSCALL=y\narch/mips/configs/eyeq6_defconfig-5-CONFIG_TASKSTATS=y\n--\narch/mips/configs/eyeq6lplus_defconfig=3=CONFIG_HIGH_RES_TIMERS=y\narch/mips/configs/eyeq6lplus_defconfig:4:CONFIG_BPF_SYSCALL=y\narch/mips/configs/eyeq6lplus_defconfig-5-CONFIG_TASKSTATS=y\n--\narch/mips/configs/generic_defconfig=16=CONFIG_BLK_DEV_INITRD=y\narch/mips/configs/generic_defconfig:17:CONFIG_BPF_SYSCALL=y\narch/mips/configs/generic_defconfig-18-CONFIG_USERFAULTFD=y\n--\narch/mips/configs/loongson3_defconfig=7=CONFIG_HIGH_RES_TIMERS=y\narch/mips/configs/loongson3_defconfig:8:CONFIG_BPF_SYSCALL=y\narch/mips/configs/loongson3_defconfig-9-CONFIG_BPF_JIT=y\n--\narch/powerpc/configs/44x/fsp2_defconfig=16=CONFIG_KALLSYMS_ALL=y\narch/powerpc/configs/44x/fsp2_defconfig:17:CONFIG_BPF_SYSCALL=y\narch/powerpc/configs/44x/fsp2_defconfig-18-CONFIG_EXPERT=y\n--\narch/powerpc/configs/powernv_defconfig=28=CONFIG_BLK_DEV_INITRD=y\narch/powerpc/configs/powernv_defconfig:29:CONFIG_BPF_SYSCALL=y\narch/powerpc/configs/powernv_defconfig-30-# CONFIG_COMPAT_BRK is not set\n--\narch/powerpc/configs/ppc64_defconfig=6=CONFIG_HIGH_RES_TIMERS=y\narch/powerpc/configs/ppc64_defconfig:7:CONFIG_BPF_SYSCALL=y\narch/powerpc/configs/ppc64_defconfig-8-CONFIG_BPF_JIT=y\n--\narch/riscv/configs/defconfig=4=CONFIG_HIGH_RES_TIMERS=y\narch/riscv/configs/defconfig:5:CONFIG_BPF_SYSCALL=y\narch/riscv/configs/defconfig-6-CONFIG_IKCONFIG=y\n--\narch/s390/configs/debug_defconfig=8=CONFIG_POSIX_AUX_CLOCKS=y\narch/s390/configs/debug_defconfig:9:CONFIG_BPF_SYSCALL=y\narch/s390/configs/debug_defconfig-10-CONFIG_BPF_JIT=y\n--\narch/s390/configs/defconfig=7=CONFIG_POSIX_AUX_CLOCKS=y\narch/s390/configs/defconfig:8:CONFIG_BPF_SYSCALL=y\narch/s390/configs/defconfig-9-CONFIG_BPF_JIT=y\n--\narch/s390/configs/zfcpdump_defconfig=3=CONFIG_POSIX_AUX_CLOCKS=y\narch/s390/configs/zfcpdump_defconfig:4:CONFIG_BPF_SYSCALL=y\narch/s390/configs/zfcpdump_defconfig-5-# CONFIG_CPU_ISOLATION is not set\n--\narch/s390/kernel/Makefile=80=obj-$(CONFIG_TRACEPOINTS)\t+= trace.o\narch/s390/kernel/Makefile-81-\narch/s390/kernel/Makefile:82:obj-$(CONFIG_BPF_SYSCALL)\t+= bpf.o\narch/s390/kernel/Makefile-83-\n--\narch/x86/kernel/cpu/bugs.c=1655=static inline const char *spectre_v2_module_string(void) { return \"\"; }\n--\narch/x86/kernel/cpu/bugs.c-1662-\narch/x86/kernel/cpu/bugs.c:1663:#ifdef CONFIG_BPF_SYSCALL\narch/x86/kernel/cpu/bugs.c-1664-void unpriv_ebpf_notify(int new_state)\n--\ncrypto/Makefile=24=obj-$(CONFIG_CRYPTO_SKCIPHER2) += crypto_skcipher.o\ncrypto/Makefile:25:ifeq ($(CONFIG_BPF_SYSCALL),y)\ncrypto/Makefile-26-obj-$(CONFIG_CRYPTO_SKCIPHER2) += bpf_crypto_skcipher.o\n--\ndrivers/base/power/power.h=165=static inline void device_pm_init(struct device *dev)\n--\ndrivers/base/power/power.h-171-\ndrivers/base/power/power.h:172:#ifdef CONFIG_BPF_SYSCALL\ndrivers/base/power/power.h-173-struct bpf_ws_lock { };\n--\ndrivers/base/power/wakeup.c=1163=static const struct file_operations wakeup_sources_stats_fops = {\n--\ndrivers/base/power/wakeup.c-1170-\ndrivers/base/power/wakeup.c:1171:#ifdef CONFIG_BPF_SYSCALL\ndrivers/base/power/wakeup.c-1172-#include \u003clinux/btf.h\u003e\n--\ndrivers/base/power/wakeup.c=1233=static inline void wakeup_sources_bpf_init(void) {}\ndrivers/base/power/wakeup.c:1234:#endif /* CONFIG_BPF_SYSCALL */\ndrivers/base/power/wakeup.c-1235-\n--\ndrivers/net/ethernet/netronome/nfp/Makefile=64=endif\ndrivers/net/ethernet/netronome/nfp/Makefile-65-\ndrivers/net/ethernet/netronome/nfp/Makefile:66:ifeq ($(CONFIG_BPF_SYSCALL),y)\ndrivers/net/ethernet/netronome/nfp/Makefile-67-nfp-objs += \\\n--\ndrivers/net/ethernet/netronome/nfp/nfp_app.c=18=static const struct nfp_app_type *apps[] = {\ndrivers/net/ethernet/netronome/nfp/nfp_app.c-19-\t[NFP_APP_CORE_NIC]\t= \u0026app_nic,\ndrivers/net/ethernet/netronome/nfp/nfp_app.c:20:#ifdef CONFIG_BPF_SYSCALL\ndrivers/net/ethernet/netronome/nfp/nfp_app.c-21-\t[NFP_APP_BPF_NIC]\t= \u0026app_bpf,\n--\ndrivers/net/netdevsim/Makefile=5=netdevsim-objs := \\\n--\ndrivers/net/netdevsim/Makefile-7-\ndrivers/net/netdevsim/Makefile:8:ifeq ($(CONFIG_BPF_SYSCALL),y)\ndrivers/net/netdevsim/Makefile-9-netdevsim-objs += \\\n--\ndrivers/net/netdevsim/netdevsim.h=178=void nsim_udp_tunnels_info_destroy(struct net_device *dev);\ndrivers/net/netdevsim/netdevsim.h-179-\ndrivers/net/netdevsim/netdevsim.h:180:#ifdef CONFIG_BPF_SYSCALL\ndrivers/net/netdevsim/netdevsim.h-181-int nsim_bpf_dev_init(struct nsim_dev *nsim_dev);\n--\nfs/verity/fsverity_private.h=103=fsverity_msg(const struct inode *inode, const char *level,\n--\nfs/verity/fsverity_private.h-112-\nfs/verity/fsverity_private.h:113:#ifdef CONFIG_BPF_SYSCALL\nfs/verity/fsverity_private.h-114-void __init fsverity_init_bpf(void);\n--\nfs/verity/measure.c=105=EXPORT_SYMBOL_GPL(fsverity_get_digest);\nfs/verity/measure.c-106-\nfs/verity/measure.c:107:#ifdef CONFIG_BPF_SYSCALL\nfs/verity/measure.c-108-\n--\nfs/verity/measure.c=183=void __init fsverity_init_bpf(void)\n--\nfs/verity/measure.c-187-\nfs/verity/measure.c:188:#endif /* CONFIG_BPF_SYSCALL */\n--\ninclude/linux/bpf.h=2190=static inline bool is_tracing_multi(enum bpf_attach_type type)\n--\ninclude/linux/bpf.h-2195-\ninclude/linux/bpf.h:2196:#if defined(CONFIG_BPF_JIT) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/linux/bpf.h-2197-/* This macro helps developer to register a struct_ops type and generate\n--\ninclude/linux/bpf.h=2547=static inline struct bpf_run_ctx *bpf_set_run_ctx(struct bpf_run_ctx *new_ctx)\n--\ninclude/linux/bpf.h-2550-\ninclude/linux/bpf.h:2551:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf.h-2552-\told_ctx = current-\u003ebpf_ctx;\n--\ninclude/linux/bpf.h=2558=static inline void bpf_reset_run_ctx(struct bpf_run_ctx *old_ctx)\ninclude/linux/bpf.h-2559-{\ninclude/linux/bpf.h:2560:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf.h-2561-\tcurrent-\u003ebpf_ctx = old_ctx;\n--\ninclude/linux/bpf.h=2651=bool bpf_jit_bypass_spec_v4(void);\n--\ninclude/linux/bpf.h-2655-\ninclude/linux/bpf.h:2656:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf.h-2657-DECLARE_PER_CPU(int, bpf_prog_active);\n--\ninclude/linux/bpf.h=3217=bpf_prog_run_array_sleepable(const struct bpf_prog_array *array,\n--\ninclude/linux/bpf.h-3265-\ninclude/linux/bpf.h:3266:#else /* !CONFIG_BPF_SYSCALL */\ninclude/linux/bpf.h-3267-static inline struct bpf_prog *bpf_prog_get(u32 ufd)\n--\ninclude/linux/bpf.h=3559=static inline void bpf_prog_report_arena_violation(bool write, unsigned long addr,\n--\ninclude/linux/bpf.h-3562-}\ninclude/linux/bpf.h:3563:#endif /* CONFIG_BPF_SYSCALL */\ninclude/linux/bpf.h-3564-\n--\ninclude/linux/bpf.h=3621=void unpriv_ebpf_notify(int new_state);\ninclude/linux/bpf.h-3622-\ninclude/linux/bpf.h:3623:#if defined(CONFIG_NET) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/linux/bpf.h-3624-int bpf_dev_bound_kfunc_check(struct bpf_verifier_log *log,\n--\ninclude/linux/bpf.h=3728=static inline int bpf_prog_test_run_syscall(struct bpf_prog *prog,\n--\ninclude/linux/bpf.h-3734-\ninclude/linux/bpf.h:3735:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf.h-3736-static inline int sock_map_get_from_fd(const union bpf_attr *attr,\n--\ninclude/linux/bpf.h=3760=static inline int sock_map_link_create(const union bpf_attr *attr, struct bpf_prog *prog)\n--\ninclude/linux/bpf.h-3763-}\ninclude/linux/bpf.h:3764:#endif /* CONFIG_BPF_SYSCALL */\ninclude/linux/bpf.h:3765:#endif /* CONFIG_NET \u0026\u0026 CONFIG_BPF_SYSCALL */\ninclude/linux/bpf.h-3766-\n--\ninclude/linux/bpf.h=3768=bpf_prog_inc_misses_counters(const struct bpf_prog_array *array)\n--\ninclude/linux/bpf.h-3782-\ninclude/linux/bpf.h:3783:#if defined(CONFIG_INET) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/linux/bpf.h-3784-void bpf_sk_reuseport_detach(struct sock *sk);\n--\ninclude/linux/bpf.h=3790=static inline void bpf_sk_reuseport_detach(struct sock *sk)\n--\ninclude/linux/bpf.h-3793-\ninclude/linux/bpf.h:3794:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf.h-3795-static inline int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map,\n--\ninclude/linux/bpf.h=3801=static inline int bpf_fd_reuseport_array_update_elem(struct bpf_map *map,\n--\ninclude/linux/bpf.h-3806-}\ninclude/linux/bpf.h:3807:#endif /* CONFIG_BPF_SYSCALL */\ninclude/linux/bpf.h:3808:#endif /* defined(CONFIG_INET) \u0026\u0026 defined(CONFIG_BPF_SYSCALL) */\ninclude/linux/bpf.h-3809-\n--\ninclude/linux/bpf.h=3811=struct bpf_key {\n--\ninclude/linux/bpf.h-3816-\ninclude/linux/bpf.h:3817:#if defined(CONFIG_KEYS) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/linux/bpf.h-3818-struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags);\n--\ninclude/linux/bpf.h=3851=static inline s32 bpf_key_serial(const struct bpf_key *key)\n--\ninclude/linux/bpf.h-3854-}\ninclude/linux/bpf.h:3855:#endif /* defined(CONFIG_KEYS) \u0026\u0026 defined(CONFIG_BPF_SYSCALL) */\ninclude/linux/bpf.h-3856-\n--\ninclude/linux/bpf.h=4158=void bpf_insn_array_adjust_after_remove(struct bpf_map *map, u32 off, u32 len);\ninclude/linux/bpf.h-4159-\ninclude/linux/bpf.h:4160:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf.h-4161-void bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image);\n--\ninclude/linux/bpf_defs.h-8-\ninclude/linux/bpf_defs.h:9:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/bpf_defs.h-10-bool bpf_arena_handle_page_fault(unsigned long addr, bool is_write, unsigned long fault_ip);\n--\ninclude/linux/btf.h=532=struct bpf_verifier_log;\ninclude/linux/btf.h-533-\ninclude/linux/btf.h:534:#if defined(CONFIG_BPF_JIT) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/linux/btf.h-535-struct bpf_struct_ops;\n--\ninclude/linux/btf.h=560=struct btf_field_iter {\n--\ninclude/linux/btf.h-567-\ninclude/linux/btf.h:568:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/btf.h-569-const struct btf_type *btf_type_by_id(const struct btf *btf, u32 type_id);\n--\ninclude/linux/cgroup-defs.h=474=struct cgroup {\n--\ninclude/linux/cgroup-defs.h-628-\ninclude/linux/cgroup-defs.h:629:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/cgroup-defs.h-630-\tstruct bpf_local_storage __rcu  *bpf_cgrp_storage;\n--\ninclude/linux/filter.h=885=static inline void bpf_net_ctx_get_all_used_flush_lists(struct list_head **lh_map,\n--\ninclude/linux/filter.h-894-\ninclude/linux/filter.h:895:\tif (!IS_ENABLED(CONFIG_BPF_SYSCALL))\ninclude/linux/filter.h-896-\t\treturn;\n--\ninclude/linux/filter.h=1207=struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,\n--\ninclude/linux/filter.h-1209-\ninclude/linux/filter.h:1210:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/filter.h-1211-struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 off,\n--\ninclude/linux/filter.h=1228=static inline void bpf_restore_insn_aux_data(struct bpf_verifier_env *env,\n--\ninclude/linux/filter.h-1231-}\ninclude/linux/filter.h:1232:#endif /* CONFIG_BPF_SYSCALL */\ninclude/linux/filter.h-1233-\n--\ninclude/linux/lsm_hook_defs.h=437=LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule)\n--\ninclude/linux/lsm_hook_defs.h-439-\ninclude/linux/lsm_hook_defs.h:440:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/lsm_hook_defs.h-441-LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)\n--\ninclude/linux/lsm_hook_defs.h=454=LSM_HOOK(int, 0, bpf_token_capable, const struct bpf_token *token, int cap)\ninclude/linux/lsm_hook_defs.h:455:#endif /* CONFIG_BPF_SYSCALL */\ninclude/linux/lsm_hook_defs.h-456-\n--\ninclude/linux/mm.h=3187=extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,\n--\ninclude/linux/mm.h-3189-\ninclude/linux/mm.h:3190:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/mm.h-3191-extern int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr,\n--\ninclude/linux/sched.h=820=struct task_struct {\n--\ninclude/linux/sched.h-1583-#endif\ninclude/linux/sched.h:1584:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/sched.h-1585-\t/* Used by BPF task local storage */\n--\ninclude/linux/sched/user.h=14=struct user_struct {\n--\ninclude/linux/sched/user.h-25-\ninclude/linux/sched/user.h:26:#if defined(CONFIG_PERF_EVENTS) || defined(CONFIG_BPF_SYSCALL) || \\\ninclude/linux/sched/user.h-27-\tdefined(CONFIG_NET) || defined(CONFIG_IO_URING) || \\\n--\ninclude/linux/security.h=2289=static inline void securityfs_remove(struct dentry *dentry)\n--\ninclude/linux/security.h-2293-\ninclude/linux/security.h:2294:#ifdef CONFIG_BPF_SYSCALL\ninclude/linux/security.h-2295-union bpf_attr;\n--\ninclude/linux/security.h=2363=static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)\n--\ninclude/linux/security.h-2367-#endif /* CONFIG_SECURITY */\ninclude/linux/security.h:2368:#endif /* CONFIG_BPF_SYSCALL */\ninclude/linux/security.h-2369-\n--\ninclude/net/af_vsock.h=261=extern struct proto vsock_proto;\ninclude/net/af_vsock.h:262:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/af_vsock.h-263-int vsock_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);\n--\ninclude/net/bpf_sk_storage.h=29=struct nlattr;\ninclude/net/bpf_sk_storage.h-30-\ninclude/net/bpf_sk_storage.h:31:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/bpf_sk_storage.h-32-int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk);\n--\ninclude/net/flow_dissector.h=476=flow_dissector_init_keys(struct flow_dissector_key_control *key_control,\n--\ninclude/net/flow_dissector.h-482-\ninclude/net/flow_dissector.h:483:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/flow_dissector.h-484-int flow_dissector_bpf_prog_attach_check(struct net *net,\ninclude/net/flow_dissector.h-485-\t\t\t\t\t struct bpf_prog *prog);\ninclude/net/flow_dissector.h:486:#endif /* CONFIG_BPF_SYSCALL */\ninclude/net/flow_dissector.h-487-\n--\ninclude/net/ip6_fib.h=630=void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,\n--\ninclude/net/ip6_fib.h-632-\ninclude/net/ip6_fib.h:633:#if IS_ENABLED(CONFIG_IPV6) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/net/ip6_fib.h-634-struct bpf_iter__ipv6_route {\n--\ninclude/net/mptcp.h=327=static inline void mptcpv6_handle_mapped(struct sock *sk, bool mapped) { }\n--\ninclude/net/mptcp.h-329-\ninclude/net/mptcp.h:330:#if defined(CONFIG_MPTCP) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/net/mptcp.h-331-struct mptcp_sock *bpf_mptcp_sock_from_subflow(struct sock *sk);\n--\ninclude/net/sock.h=365=struct sock {\n--\ninclude/net/sock.h-586-\tstruct sock_reuseport __rcu\t*sk_reuseport_cb;\ninclude/net/sock.h:587:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/sock.h-588-\tstruct bpf_local_storage __rcu\t*sk_bpf_storage;\n--\ninclude/net/sock.h=1291=struct proto {\n--\ninclude/net/sock.h-1343-\tvoid\t\t\t(*put_port)(struct sock *sk);\ninclude/net/sock.h:1344:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/sock.h-1345-\tint\t\t\t(*psock_update_sk_prot)(struct sock *sk,\n--\ninclude/net/tcp.h=2853=struct sk_psock;\ninclude/net/tcp.h-2854-\ninclude/net/tcp.h:2855:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/tcp.h-2856-int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);\n--\ninclude/net/tcp.h=2860=int tcp_bpf_strp_read_sock(struct strparser *strp, read_descriptor_t *desc,\n--\ninclude/net/tcp.h-2862-#endif /* CONFIG_BPF_STREAM_PARSER */\ninclude/net/tcp.h:2863:#endif /* CONFIG_BPF_SYSCALL */\ninclude/net/tcp.h-2864-\n--\ninclude/net/tcp.h=2873=int tcp_bpf_sendmsg_redir(struct sock *sk, bool ingress,\n--\ninclude/net/tcp.h-2876-\ninclude/net/tcp.h:2877:#if !defined(CONFIG_BPF_SYSCALL) || !defined(CONFIG_NET_SOCK_MSG)\ninclude/net/tcp.h-2878-static inline void tcp_bpf_clone(const struct sock *sk, struct sock *newsk)\n--\ninclude/net/tcx.h=145=static inline enum tcx_action_base tcx_action_code(struct sk_buff *skb,\n--\ninclude/net/tcx.h-161-\ninclude/net/tcx.h:162:#if defined(CONFIG_NET_XGRESS) \u0026\u0026 defined(CONFIG_BPF_SYSCALL)\ninclude/net/tcx.h-163-int tcx_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog);\n--\ninclude/net/tcx.h=202=static inline void dev_tcx_uninstall(struct net_device *dev)\n--\ninclude/net/tcx.h-204-}\ninclude/net/tcx.h:205:#endif /* CONFIG_NET_XGRESS \u0026\u0026 CONFIG_BPF_SYSCALL */\ninclude/net/tcx.h-206-#endif /* __NET_TCX_H */\n--\ninclude/net/udp.h=632=static inline void udp_post_segment_fix_csum(struct sk_buff *skb)\n--\ninclude/net/udp.h-650-\ninclude/net/udp.h:651:#ifdef CONFIG_BPF_SYSCALL\ninclude/net/udp.h-652-struct sk_psock;\n--\ninclude/trace/events/xdp.h=150=DEFINE_EVENT(xdp_redirect_template, xdp_redirect_err,\n--\ninclude/trace/events/xdp.h-170-\ninclude/trace/events/xdp.h:171:#ifdef CONFIG_BPF_SYSCALL\ninclude/trace/events/xdp.h-172-TRACE_EVENT(xdp_cpumap_kthread,\n--\ninclude/trace/events/xdp.h=250=TRACE_EVENT(xdp_devmap_xmit,\n--\ninclude/trace/events/xdp.h-284-);\ninclude/trace/events/xdp.h:285:#endif /* CONFIG_BPF_SYSCALL */\ninclude/trace/events/xdp.h-286-\n--\nkernel/bpf/Makefile=7=CFLAGS_core.o += -Wno-override-init $(cflags-nogcse-yy)\nkernel/bpf/Makefile-8-\nkernel/bpf/Makefile:9:obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o cnum.o log.o token.o liveness.o const_fold.o\nkernel/bpf/Makefile:10:obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o\nkernel/bpf/Makefile:11:obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o bloom_filter.o\nkernel/bpf/Makefile:12:obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o bpf_insn_array.o\nkernel/bpf/Makefile:13:obj-$(CONFIG_BPF_SYSCALL) += bpf_local_storage.o bpf_task_storage.o\nkernel/bpf/Makefile:14:obj-$(CONFIG_BPF_SYSCALL) += fixups.o cfg.o states.o backtrack.o check_btf.o\nkernel/bpf/Makefile-15-obj-${CONFIG_BPF_LSM}\t  += bpf_inode_storage.o\nkernel/bpf/Makefile:16:obj-$(CONFIG_BPF_SYSCALL) += disasm.o mprog.o\nkernel/bpf/Makefile-17-obj-$(CONFIG_BPF_JIT) += trampoline.o\nkernel/bpf/Makefile:18:obj-$(CONFIG_BPF_SYSCALL) += btf.o memalloc.o rqspinlock.o stream.o\nkernel/bpf/Makefile-19-ifeq ($(CONFIG_MMU)$(CONFIG_64BIT),yy)\nkernel/bpf/Makefile:20:obj-$(CONFIG_BPF_SYSCALL) += arena.o range_tree.o\nkernel/bpf/Makefile-21-endif\n--\nkernel/bpf/Makefile=23=ifeq ($(CONFIG_NET),y)\nkernel/bpf/Makefile:24:obj-$(CONFIG_BPF_SYSCALL) += devmap.o\nkernel/bpf/Makefile:25:obj-$(CONFIG_BPF_SYSCALL) += cpumap.o\nkernel/bpf/Makefile:26:obj-$(CONFIG_BPF_SYSCALL) += offload.o\nkernel/bpf/Makefile:27:obj-$(CONFIG_BPF_SYSCALL) += net_namespace.o\nkernel/bpf/Makefile:28:obj-$(CONFIG_BPF_SYSCALL) += tcx.o\nkernel/bpf/Makefile-29-endif\nkernel/bpf/Makefile=30=ifeq ($(CONFIG_PERF_EVENTS),y)\nkernel/bpf/Makefile:31:obj-$(CONFIG_BPF_SYSCALL) += stackmap.o\nkernel/bpf/Makefile-32-endif\nkernel/bpf/Makefile=33=ifeq ($(CONFIG_CGROUPS),y)\nkernel/bpf/Makefile:34:obj-$(CONFIG_BPF_SYSCALL) += cgroup_iter.o bpf_cgrp_storage.o\nkernel/bpf/Makefile-35-endif\n--\nkernel/bpf/Makefile=37=ifeq ($(CONFIG_INET),y)\nkernel/bpf/Makefile:38:obj-$(CONFIG_BPF_SYSCALL) += reuseport_array.o\nkernel/bpf/Makefile-39-endif\n--\nkernel/bpf/Makefile=43=ifeq ($(CONFIG_BPF_JIT),y)\nkernel/bpf/Makefile:44:obj-$(CONFIG_BPF_SYSCALL) += bpf_struct_ops.o\nkernel/bpf/Makefile:45:obj-$(CONFIG_BPF_SYSCALL) += cpumask.o\nkernel/bpf/Makefile-46-# bpf_lsm_proto.o must precede bpf_lsm.o. The current pahole logic\n--\nkernel/bpf/Makefile=58=ifneq ($(CONFIG_CRYPTO),)\nkernel/bpf/Makefile:59:obj-$(CONFIG_BPF_SYSCALL) += crypto.o\nkernel/bpf/Makefile-60-endif\nkernel/bpf/Makefile=61=obj-$(CONFIG_BPF_PRELOAD) += preload/\nkernel/bpf/Makefile-62-\nkernel/bpf/Makefile:63:obj-$(CONFIG_BPF_SYSCALL) += relo_core.o\nkernel/bpf/Makefile:64:obj-$(CONFIG_BPF_SYSCALL) += btf_iter.o\nkernel/bpf/Makefile:65:obj-$(CONFIG_BPF_SYSCALL) += btf_relocate.o\nkernel/bpf/Makefile:66:obj-$(CONFIG_BPF_SYSCALL) += kmem_cache_iter.o\nkernel/bpf/Makefile-67-ifeq ($(CONFIG_DMA_SHARED_BUFFER),y)\nkernel/bpf/Makefile:68:obj-$(CONFIG_BPF_SYSCALL) += dmabuf_iter.o\nkernel/bpf/Makefile-69-endif\n--\nkernel/bpf/core.c=99=struct bpf_prog *bpf_prog_alloc_no_stats(unsigned int size, gfp_t gfp_extra_flags)\n--\nkernel/bpf/core.c-141-\n\n"
}
7/2 2026/06/28 14:19 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 15418
							output: 91
							thoughts: 434

Thoughts: 
**My Analysis of the BPF Verifier Patch**

Okay, so this patch introduces a change to the BPF verifier, specifically around indirect jumps, or `gotox`. My initial thought is that the primary configuration option to enable the relevant code is `CONFIG_BPF_SYSCALL`, as the verifier itself is only compiled when that's set. I should double-check, though, to ensure I haven't missed any other dependencies.

Looking at the code modifications, the patch touches `kernel/bpf/verifier.c` and a self-test, `tools/testing/selftests/bpf/prog_tests/bpf_gotox.c`. The test uses `BPF_PROG_TYPE_SOCKET_FILTER`, which suggests `CONFIG_NET` *might* be relevant, but `CONFIG_BPF_SYSCALL` is likely the key one. Let's confirm that `CONFIG_BPF_SYSCALL` alone is sufficient to trigger the compilation of `kernel/bpf/verifier.c`. Yes, it appears so.

Now, let's zero in on the core of the change. `check_indirect_jump` is the function that was modified; that's the focal point. While `bpf_find_containing_subprog` is also called, it's an existing function. `check_indirect_jump` is the key function to fuzz.

Is `check_indirect_jump` static? Yes, it is: `static int check_indirect_jump(struct bpf_verifier_env *env, struct bpf_insn *insn)`. It resides within `kernel/bpf/verifier.c`.

I've confirmed that `check_indirect_jump` in `kernel/bpf/verifier.c` is the only function modified. So, my reasoning is as follows: The patch is functionally significant because it introduces bounds checking for indirect jumps (gotox) in the BPF verifier. This change directly impacts the core BPF verification process, aiming to prevent jumps outside of the current subprogram. Therefore, I'll flag this as worth fuzzing, focusing on the `check_indirect_jump` function and requiring `CONFIG_BPF_SYSCALL` to be enabled.

My configuration will be:

*   **WorthFuzzing: true**
*   **FocusSymbols: \["check\_indirect\_jump"]**
*   **EnableConfigs: \["BPF\_SYSCALL"]**
*   **Reasoning: "The patch adds bounds checking for indirect jumps (gotox) in the BPF verifier to prevent jumping outside the current subprogram. This is a functional change in core BPF verification logic and should be fuzzed."**

8/2 2026/06/28 14:20 tool set-results
0m Args: 
{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_indirect_jump"
  ],
  "Reasoning": "The patch adds bounds checking for indirect jumps (gotox) in the BPF verifier to prevent jumping outside the current subprogram. This is a functional change in core BPF verification logic and should be fuzzed.",
  "WorthFuzzing": true
}

Results: 
{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_indirect_jump"
  ],
  "Reasoning": "The patch adds bounds checking for indirect jumps (gotox) in the BPF verifier to prevent jumping outside the current subprogram. This is a functional change in core BPF verification logic and should be fuzzed.",
  "WorthFuzzing": true
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)