| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/04 00:59 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies only selftest scripts and test configuration files under tools/testing/selftests/net/mptcp/. No kernel C source code or headers affecting the compiled kernel image (vmlinux/modules) are changed.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/04 00:59 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 5c4ccbf70b5165f2f33d15d828d349f785d9b81f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Sep 4 00:59:57 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config\nindex 59051ee2a9860..0d0a744c4ca89 100644\n--- a/tools/testing/selftests/net/mptcp/config\n+++ b/tools/testing/selftests/net/mptcp/config\n@@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m\n CONFIG_NF_TABLES=m\n CONFIG_NF_TABLES_INET=y\n CONFIG_NFT_COMPAT=m\n+CONFIG_NFT_NUMGEN=y\n+CONFIG_NFT_REJECT=m\n+CONFIG_NFT_REJECT_IPV4=m\n CONFIG_NFT_SOCKET=m\n CONFIG_NFT_TPROXY=m\n CONFIG_SYN_COOKIES=y\ndiff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh\nindex 18ce7136a2b0e..7c56680cc4221 100755\n--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh\n+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh\n@@ -26,8 +26,6 @@ capout=\"\"\n cappid=\"\"\n ns1=\"\"\n ns2=\"\"\n-iptables=\"iptables\"\n-ip6tables=\"ip6tables\"\n timeout_poll=30\n timeout_test=$((timeout_poll * 2 + 1))\n capture=false\n@@ -50,6 +48,7 @@ declare -A failed_tests\n MPTCP_LIB_TEST_FORMAT=\"%03u %s\\n\"\n TEST_NAME=\"\"\n nr_blank=6\n+nft_handle=\"\"\n \n # These var are used only in some tests, make sure they are not already set\n unset FAILING_LINKS\n@@ -99,42 +98,6 @@ unset add_addr_tx_nr\n unset add_addr_echo_tx_nr\n unset add_addr_drop_tx_nr\n \n-# generated using \"nfbpf_compile '(ip \u0026\u0026 (ip[54] \u0026 0xf0) == 0x30) ||\n-#\t\t\t\t (ip6 \u0026\u0026 (ip6[74] \u0026 0xf0) == 0x30)'\"\n-CBPF_MPTCP_SUBOPTION_ADD_ADDR=\"14,\n-\t\t\t 48 0 0 0,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 0 3 64,\n-\t\t\t 48 0 0 54,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 6 7 48,\n-\t\t\t 48 0 0 0,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 0 4 96,\n-\t\t\t 48 0 0 74,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 0 1 48,\n-\t\t\t 6 0 0 65535,\n-\t\t\t 6 0 0 0\"\n-\n-# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption\n-# generated using \"nfbpf_compile '(ip[32] \u0026 0xf0) == 0xc0 \u0026\u0026 ip[53] == 0x0c \u0026\u0026\n-#\t\t\t\t (ip[66] \u0026 0xf0) == 0x40'\"\n-CBPF_MPTCP_SUBOPTION_RM_ADDR=\"13,\n-\t\t\t 48 0 0 0,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 0 9 64,\n-\t\t\t 48 0 0 32,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 0 6 192,\n-\t\t\t 48 0 0 53,\n-\t\t\t 21 0 4 12,\n-\t\t\t 48 0 0 66,\n-\t\t\t 84 0 0 240,\n-\t\t\t 21 0 1 64,\n-\t\t\t 6 0 0 65535,\n-\t\t\t 6 0 0 0\"\n-\n init_partial()\n {\n \tcapout=$(mktemp)\n@@ -147,6 +110,18 @@ init_partial()\n \t\tif $checksum; then\n \t\t\tip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1\n \t\tfi\n+\n+\t\tfor t in ip ip6; do\n+\t\t\tip netns exec \"$netns\" nft add table \"$t\" filter\n+\t\t\tip netns exec \"$netns\" nft add chain \"$t\" filter INPUT \\\n+\t\t\t\t'{ type filter hook input priority filter; policy accept; }'\n+\t\t\tip netns exec \"$netns\" nft add chain \"$t\" filter OUTPUT \\\n+\t\t\t\t'{ type filter hook output priority filter; policy accept; }'\n+\n+\t\t\tip netns exec \"$netns\" nft add table \"$t\" mangle\n+\t\t\tip netns exec \"$netns\" nft add chain \"$t\" mangle OUTPUT \\\n+\t\t\t\t'{ type route hook output priority mangle; policy accept; }'\n+\t\tdone\n \tdone\n \n \tcheck_invert=0\n@@ -196,7 +171,7 @@ init() {\n \n \tmptcp_lib_check_mptcp\n \tmptcp_lib_check_kallsyms\n-\tmptcp_lib_check_tools ip tc ss \"${iptables}\" \"${ip6tables}\"\n+\tmptcp_lib_check_tools ip tc ss nft\n \n \tsin=$(mktemp)\n \tsout=$(mktemp)\n@@ -380,24 +355,18 @@ reset_with_cookies()\n # $1: test name\n reset_with_add_addr_timeout()\n {\n-\tlocal ip=\"${2:-4}\"\n-\tlocal tables\n+\tlocal ip=\"${2:-}\"\n \n \treset \"${1}\" || return 1\n \n-\ttables=\"${iptables}\"\n-\tif [ $ip -eq 6 ]; then\n-\t\ttables=\"${ip6tables}\"\n-\tfi\n-\n \t# set a maximum, to avoid too long timeout with exponential backoff\n \tip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1\n \n-\tif ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \\\n-\t\t\t-m tcp --tcp-option 30 \\\n-\t\t\t-m bpf --bytecode \\\n-\t\t\t\"$CBPF_MPTCP_SUBOPTION_ADD_ADDR\" \\\n-\t\t\t-j DROP; then\n+\tnft_handle=$(ip netns exec \"$ns2\" nft -e --handle add rule \\\n+\t\tip\"$ip\" filter OUTPUT meta l4proto tcp \\\n+\t\ttcp option mptcp subtype add-addr \\\n+\t\tdrop | head -n1 | awk '{print $NF}')\n+\tif [ -z \"$nft_handle\" ]; then\n \t\tmark_as_skipped \"unable to set the 'add addr' rule\"\n \t\treturn 1\n \tfi\n@@ -449,23 +418,17 @@ setup_fail_rules()\n \tcheck_invert=1\n \tvalidate_checksum=true\n \tlocal i=\"$1\"\n-\tlocal ip=\"${2:-4}\"\n-\tlocal tables\n+\tlocal ip=\"${2:-}\"\n \n-\ttables=\"${iptables}\"\n-\tif [ $ip -eq 6 ]; then\n-\t\ttables=\"${ip6tables}\"\n+\tnft_handle=$(ip netns exec \"$ns2\" nft -e --handle add rule \\\n+\t\tip\"$ip\" mangle OUTPUT oifname ns2eth$i \\\n+\t\tmeta l4proto tcp \\\n+\t\tmeta length 150-9999 numgen inc mod 99999 1 \\\n+\t\tmeta mark set 42 | head -n1 | awk '{print $NF}')\n+\tif [ -z \"$nft_handle\" ]; then\n+\t\treturn ${KSFT_SKIP}\n \tfi\n \n-\tip netns exec $ns2 $tables \\\n-\t\t-t mangle \\\n-\t\t-A OUTPUT \\\n-\t\t-o ns2eth$i \\\n-\t\t-p tcp \\\n-\t\t-m length --length 150:9999 \\\n-\t\t-m statistic --mode nth --packet 1 --every 99999 \\\n-\t\t-j MARK --set-mark 42 || return ${KSFT_SKIP}\n-\n \ttc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP}\n \ttc -n $ns2 filter add dev ns2eth$i egress \\\n \t\tprotocol ip prio 1000 \\\n@@ -515,11 +478,10 @@ reset_with_tcp_filter()\n \tlocal target=\"${3}\"\n \tlocal chain=\"${4:-INPUT}\"\n \n-\tif ! ip netns exec \"${ns}\" ${iptables} \\\n-\t\t\t-A \"${chain}\" \\\n-\t\t\t-s \"${src}\" \\\n-\t\t\t-p tcp \\\n-\t\t\t-j \"${target}\"; then\n+\tnft_handle=$(ip netns exec \"$ns\" nft -e --handle add rule \\\n+\t\tip filter \"${chain}\" ip saddr \"{ ${src} }\" \\\n+\t\tmeta l4proto tcp \"${target,,}\" | head -n1 | awk '{print $NF}')\n+\tif [ -z \"$nft_handle\" ]; then\n \t\tmark_as_skipped \"unable to set the filter rules\"\n \t\treturn 1\n \tfi\n@@ -4315,10 +4277,12 @@ userspace_tests()\n \n \t\t# force quick loss\n \t\tip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1\n-\t\tif ip netns exec \"${ns1}\" ${iptables} -A INPUT -s \"10.0.1.2\" \\\n-\t\t -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset \u0026\u0026\n-\t\t ip netns exec \"${ns2}\" ${iptables} -A INPUT -d \"10.0.1.2\" \\\n-\t\t -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then\n+\t\tif ip netns exec \"${ns1}\" nft add rule ip filter INPUT \\\n+\t\t\tip saddr \"10.0.1.2\" meta l4proto tcp \\\n+\t\t\ttcp option mptcp exists reject with tcp reset \u0026\u0026\n+\t\t ip netns exec \"${ns2}\" nft add rule ip filter INPUT \\\n+\t\t\tip daddr \"10.0.1.2\" meta l4proto tcp \\\n+\t\t\ttcp option mptcp exists reject with tcp reset; then\n \t\t\twait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1\n \t\t\twait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1\n \t\t\tchk_subflows_total 1 1\n@@ -4393,7 +4357,7 @@ endpoint_tests()\n \t\tchk_subflow_nr \"after new reject\" 2\n \t\tchk_mptcp_info subflows 1 subflows 1\n \n-\t\tip netns exec \"${ns2}\" ${iptables} -D OUTPUT -s \"10.0.3.2\" -p tcp -j REJECT\n+\t\tip netns exec \"${ns2}\" nft delete rule ip filter OUTPUT handle \"$nft_handle\"\n \t\tpm_nl_del_endpoint $ns2 3 10.0.3.2\n \t\tpm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow\n \t\twait_mpj 3\n@@ -4402,12 +4366,10 @@ endpoint_tests()\n \n \t\t# To make sure RM_ADDR are sent over a different subflow, but\n \t\t# allow the rest to quickly and cleanly close the subflow\n-\t\tlocal ipt=1\n-\t\tip netns exec \"${ns2}\" ${iptables} -I OUTPUT -s \"10.0.1.2\" \\\n-\t\t\t-p tcp -m tcp --tcp-option 30 \\\n-\t\t\t-m bpf --bytecode \\\n-\t\t\t\"$CBPF_MPTCP_SUBOPTION_RM_ADDR\" \\\n-\t\t\t-j DROP || ipt=0\n+\t\tnft_handle=$(ip netns exec \"${ns2}\" nft -e --handle insert rule \\\n+\t\t\tip filter OUTPUT ip saddr 10.0.1.2 meta l4proto tcp \\\n+\t\t\ttcp option mptcp subtype remove-addr \\\n+\t\t\tdrop | head -n1 | awk '{print $NF}')\n \t\tlocal i\n \t\tfor i in $(seq 3); do\n \t\t\tpm_nl_del_endpoint $ns2 1 10.0.1.2\n@@ -4420,7 +4382,8 @@ endpoint_tests()\n \t\t\tchk_subflow_nr \"after re-add id 0 ($i)\" 3\n \t\t\tchk_mptcp_info subflows 3 subflows 3\n \t\tdone\n-\t\t[ ${ipt} = 1 ] \u0026\u0026 ip netns exec \"${ns2}\" ${iptables} -D OUTPUT 1\n+\t\t[ -n \"${nft_handle}\" ] \u0026\u0026 ip netns exec \"${ns2}\" nft delete rule \\\n+\t\t\tip filter OUTPUT handle \"${nft_handle}\"\n \n \t\tmptcp_lib_kill_group_wait $tests_pid\n \n@@ -4482,18 +4445,17 @@ endpoint_tests()\n \n \t\t# To make sure RM_ADDR are sent over a different subflow, but\n \t\t# allow the rest to quickly and cleanly close the subflow\n-\t\tlocal ipt=1\n-\t\tip netns exec \"${ns1}\" ${iptables} -I OUTPUT -s \"10.0.1.1\" \\\n-\t\t\t-p tcp -m tcp --tcp-option 30 \\\n-\t\t\t-m bpf --bytecode \\\n-\t\t\t\"$CBPF_MPTCP_SUBOPTION_RM_ADDR\" \\\n-\t\t\t-j DROP || ipt=0\n+\t\tnft_handle=$(ip netns exec \"${ns1}\" nft -e --handle insert rule \\\n+\t\t\tip filter OUTPUT ip saddr 10.0.1.1 meta l4proto tcp \\\n+\t\t\ttcp option mptcp subtype remove-addr \\\n+\t\t\tdrop | head -n1 | awk '{print $NF}')\n \t\tpm_nl_del_endpoint $ns1 42 10.0.1.1\n \t\tsleep 0.5\n \t\tchk_subflow_nr \"after delete ID 0\" 2\n \t\tchk_mptcp_info subflows 2 subflows 2\n \t\tchk_mptcp_info add_addr_signal 2 add_addr_accepted 2\n-\t\t[ ${ipt} = 1 ] \u0026\u0026 ip netns exec \"${ns1}\" ${iptables} -D OUTPUT 1\n+\t\t[ -n \"${nft_handle}\" ] \u0026\u0026 ip netns exec \"${ns1}\" nft delete rule \\\n+\t\t\tip filter OUTPUT handle \"${nft_handle}\"\n \n \t\tpm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal\n \t\twait_mpj 4\n@@ -4555,7 +4517,7 @@ endpoint_tests()\n \t\tpm_nl_flush_endpoint $ns2\n \t\tpm_nl_flush_endpoint $ns1\n \t\twait_rm_addr $ns2 0\n-\t\tip netns exec \"${ns2}\" ${iptables} -D OUTPUT -s \"10.0.3.2\" -p tcp -j REJECT\n+\t\tip netns exec \"${ns2}\" nft delete rule ip filter OUTPUT handle \"$nft_handle\"\n \t\tpm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow\n \t\twait_mpj 1\n \t\tpm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal\ndiff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh\nindex 5ef6033775c86..eba6903233ccf 100644\n--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh\n+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh\n@@ -524,7 +524,7 @@ mptcp_lib_check_tools() {\n \t\t\t\texit ${KSFT_SKIP}\n \t\t\tfi\n \t\t\t;;\n-\t\t\"iptables\"* | \"ip6tables\"*)\n+\t\t\"iptables\"* | \"ip6tables\"* | \"nft\"*)\n \t\t\tif ! \"${tool}\" -V \u0026\u003e /dev/null; then\n \t\t\t\tmptcp_lib_pr_skip \"Could not run all tests without ${tool}\"\n \t\t\t\texit ${KSFT_SKIP}\ndiff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh\nindex e850a87429b61..a2c20483986dc 100755\n--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh\n+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh\n@@ -15,8 +15,6 @@ cin=\"\"\n cout=\"\"\n timeout_poll=30\n timeout_test=$((timeout_poll * 2 + 1))\n-iptables=\"iptables\"\n-ip6tables=\"ip6tables\"\n \n ns1=\"\"\n ns2=\"\"\n@@ -50,15 +48,25 @@ add_mark_rules()\n \tlocal m=$2\n \n \tlocal t\n-\tfor t in ${iptables} ${ip6tables}; do\n+\tfor t in ip ip6; do\n+\t\tip netns exec \"$ns\" nft add table \"$t\" filter\n+\t\tip netns exec \"$ns\" nft add chain \"$t\" filter OUTPUT \\\n+\t\t\t'{ type filter hook output priority 0; policy accept; }'\n+\n \t\t# just to debug: check we have multiple subflows connection requests\n-\t\tip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT\n+\t\tip netns exec \"$ns\" nft add rule \"$t\" filter OUTPUT \\\n+\t\t\ttcp flags \\\u0026 \\(fin \\| syn \\| rst \\| ack\\) == syn \\\n+\t\t\tmeta mark \"$m\" accept\n \n \t\t# RST packets might be handled by a internal dummy socket\n-\t\tip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT\n+\t\tip netns exec \"$ns\" nft add rule \"$t\" filter OUTPUT \\\n+\t\t\ttcp flags \\\u0026 rst == rst meta mark 0x0 accept\n+\n+\t\tip netns exec \"$ns\" nft add rule \"$t\" filter OUTPUT \\\n+\t\t\tmeta l4proto tcp meta mark \"$m\" accept\n+\t\tip netns exec \"$ns\" nft add rule \"$t\" filter OUTPUT \\\n+\t\t\tmeta l4proto tcp meta mark 0 counter drop\n \n-\t\tip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT\n-\t\tip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP\n \tdone\n }\n \n@@ -105,32 +113,29 @@ cleanup()\n \n mptcp_lib_check_mptcp\n mptcp_lib_check_kallsyms\n-mptcp_lib_check_tools ip \"${iptables}\" \"${ip6tables}\"\n+mptcp_lib_check_tools ip nft\n \n check_mark()\n {\n \tlocal ns=$1\n \tlocal af=$2\n \n-\tlocal tables=${iptables}\n+\tlocal tables=\"ip\"\n \n \tif [ $af -eq 6 ];then\n-\t\ttables=${ip6tables}\n+\t\ttables=\"ip6\"\n \tfi\n \n-\tlocal counters values\n-\tcounters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP)\n-\tvalues=${counters%DROP*}\n-\n-\tlocal v\n-\tfor v in $values; do\n-\t\tif [ $v -ne 0 ]; then\n-\t\t\tmptcp_lib_pr_fail \"got $tables $values in ns $ns,\" \\\n-\t\t\t\t\t \"not 0 - not all expected packets marked\"\n-\t\t\tret=${KSFT_FAIL}\n-\t\t\treturn 1\n-\t\tfi\n-\tdone\n+\tlocal values\n+\tvalues=$(ip netns exec \"$ns\" nft list table \"$tables\" filter | \\\n+\t\tgrep -o \"packets.*drop\" | awk '{print $2}')\n+\n+\tif [[ ! \"$values\" =~ ^[0-9]+$ ]] || [ \"$values\" -ne 0 ]; then\n+\t\tmptcp_lib_pr_fail \"got $tables $values in ns $ns,\" \\\n+\t\t\t\t \"not 0 - not all expected packets marked\"\n+\t\tret=${KSFT_FAIL}\n+\t\treturn 1\n+\tfi\n \n \treturn 0\n }\n"
} |
| 2/1 | 2026/09/04 00:59 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies only selftest scripts and test configuration files under tools/testing/selftests/net/mptcp/. No kernel C source code or headers affecting the compiled kernel image (vmlinux/modules) are changed.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 5c4ccbf70b5165f2f33d15d828d349f785d9b81f
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Sep 4 00:59:57 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
index 59051ee2a9860..0d0a744c4ca89 100644
--- a/tools/testing/selftests/net/mptcp/config
+++ b/tools/testing/selftests/net/mptcp/config
@@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=y
CONFIG_NFT_COMPAT=m
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_REJECT_IPV4=m
CONFIG_NFT_SOCKET=m
CONFIG_NFT_TPROXY=m
CONFIG_SYN_COOKIES=y
diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index 18ce7136a2b0e..7c56680cc4221 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -26,8 +26,6 @@ capout=""
cappid=""
ns1=""
ns2=""
-iptables="iptables"
-ip6tables="ip6tables"
timeout_poll=30
timeout_test=$((timeout_poll * 2 + 1))
capture=false
@@ -50,6 +48,7 @@ declare -A failed_tests
MPTCP_LIB_TEST_FORMAT="%03u %s\n"
TEST_NAME=""
nr_blank=6
+nft_handle=""
# These var are used only in some tests, make sure they are not already set
unset FAILING_LINKS
@@ -99,42 +98,6 @@ unset add_addr_tx_nr
unset add_addr_echo_tx_nr
unset add_addr_drop_tx_nr
-# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) == 0x30) ||
-# (ip6 && (ip6[74] & 0xf0) == 0x30)'"
-CBPF_MPTCP_SUBOPTION_ADD_ADDR="14,
- 48 0 0 0,
- 84 0 0 240,
- 21 0 3 64,
- 48 0 0 54,
- 84 0 0 240,
- 21 6 7 48,
- 48 0 0 0,
- 84 0 0 240,
- 21 0 4 96,
- 48 0 0 74,
- 84 0 0 240,
- 21 0 1 48,
- 6 0 0 65535,
- 6 0 0 0"
-
-# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption
-# generated using "nfbpf_compile '(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c &&
-# (ip[66] & 0xf0) == 0x40'"
-CBPF_MPTCP_SUBOPTION_RM_ADDR="13,
- 48 0 0 0,
- 84 0 0 240,
- 21 0 9 64,
- 48 0 0 32,
- 84 0 0 240,
- 21 0 6 192,
- 48 0 0 53,
- 21 0 4 12,
- 48 0 0 66,
- 84 0 0 240,
- 21 0 1 64,
- 6 0 0 65535,
- 6 0 0 0"
-
init_partial()
{
capout=$(mktemp)
@@ -147,6 +110,18 @@ init_partial()
if $checksum; then
ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
fi
+
+ for t in ip ip6; do
+ ip netns exec "$netns" nft add table "$t" filter
+ ip netns exec "$netns" nft add chain "$t" filter INPUT \
+ '{ type filter hook input priority filter; policy accept; }'
+ ip netns exec "$netns" nft add chain "$t" filter OUTPUT \
+ '{ type filter hook output priority filter; policy accept; }'
+
+ ip netns exec "$netns" nft add table "$t" mangle
+ ip netns exec "$netns" nft add chain "$t" mangle OUTPUT \
+ '{ type route hook output priority mangle; policy accept; }'
+ done
done
check_invert=0
@@ -196,7 +171,7 @@ init() {
mptcp_lib_check_mptcp
mptcp_lib_check_kallsyms
- mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}"
+ mptcp_lib_check_tools ip tc ss nft
sin=$(mktemp)
sout=$(mktemp)
@@ -380,24 +355,18 @@ reset_with_cookies()
# $1: test name
reset_with_add_addr_timeout()
{
- local ip="${2:-4}"
- local tables
+ local ip="${2:-}"
reset "${1}" || return 1
- tables="${iptables}"
- if [ $ip -eq 6 ]; then
- tables="${ip6tables}"
- fi
-
# set a maximum, to avoid too long timeout with exponential backoff
ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
- if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \
- -m tcp --tcp-option 30 \
- -m bpf --bytecode \
- "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \
- -j DROP; then
+ nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
+ ip"$ip" filter OUTPUT meta l4proto tcp \
+ tcp option mptcp subtype add-addr \
+ drop | head -n1 | awk '{print $NF}')
+ if [ -z "$nft_handle" ]; then
mark_as_skipped "unable to set the 'add addr' rule"
return 1
fi
@@ -449,23 +418,17 @@ setup_fail_rules()
check_invert=1
validate_checksum=true
local i="$1"
- local ip="${2:-4}"
- local tables
+ local ip="${2:-}"
- tables="${iptables}"
- if [ $ip -eq 6 ]; then
- tables="${ip6tables}"
+ nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
+ ip"$ip" mangle OUTPUT oifname ns2eth$i \
+ meta l4proto tcp \
+ meta length 150-9999 numgen inc mod 99999 1 \
+ meta mark set 42 | head -n1 | awk '{print $NF}')
+ if [ -z "$nft_handle" ]; then
+ return ${KSFT_SKIP}
fi
- ip netns exec $ns2 $tables \
- -t mangle \
- -A OUTPUT \
- -o ns2eth$i \
- -p tcp \
- -m length --length 150:9999 \
- -m statistic --mode nth --packet 1 --every 99999 \
- -j MARK --set-mark 42 || return ${KSFT_SKIP}
-
tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP}
tc -n $ns2 filter add dev ns2eth$i egress \
protocol ip prio 1000 \
@@ -515,11 +478,10 @@ reset_with_tcp_filter()
local target="${3}"
local chain="${4:-INPUT}"
- if ! ip netns exec "${ns}" ${iptables} \
- -A "${chain}" \
- -s "${src}" \
- -p tcp \
- -j "${target}"; then
+ nft_handle=$(ip netns exec "$ns" nft -e --handle add rule \
+ ip filter "${chain}" ip saddr "{ ${src} }" \
+ meta l4proto tcp "${target,,}" | head -n1 | awk '{print $NF}')
+ if [ -z "$nft_handle" ]; then
mark_as_skipped "unable to set the filter rules"
return 1
fi
@@ -4315,10 +4277,12 @@ userspace_tests()
# force quick loss
ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1
- if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \
- -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset &&
- ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \
- -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then
+ if ip netns exec "${ns1}" nft add rule ip filter INPUT \
+ ip saddr "10.0.1.2" meta l4proto tcp \
+ tcp option mptcp exists reject with tcp reset &&
+ ip netns exec "${ns2}" nft add rule ip filter INPUT \
+ ip daddr "10.0.1.2" meta l4proto tcp \
+ tcp option mptcp exists reject with tcp reset; then
wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1
wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1
chk_subflows_total 1 1
@@ -4393,7 +4357,7 @@ endpoint_tests()
chk_subflow_nr "after new reject" 2
chk_mptcp_info subflows 1 subflows 1
- ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+ ip netns exec "${ns2}" nft delete rule ip filter OUTPUT handle "$nft_handle"
pm_nl_del_endpoint $ns2 3 10.0.3.2
pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
wait_mpj 3
@@ -4402,12 +4366,10 @@ endpoint_tests()
# To make sure RM_ADDR are sent over a different subflow, but
# allow the rest to quickly and cleanly close the subflow
- local ipt=1
- ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \
- -p tcp -m tcp --tcp-option 30 \
- -m bpf --bytecode \
- "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \
- -j DROP || ipt=0
+ nft_handle=$(ip netns exec "${ns2}" nft -e --handle insert rule \
+ ip filter OUTPUT ip saddr 10.0.1.2 meta l4proto tcp \
+ tcp option mptcp subtype remove-addr \
+ drop | head -n1 | awk '{print $NF}')
local i
for i in $(seq 3); do
pm_nl_del_endpoint $ns2 1 10.0.1.2
@@ -4420,7 +4382,8 @@ endpoint_tests()
chk_subflow_nr "after re-add id 0 ($i)" 3
chk_mptcp_info subflows 3 subflows 3
done
- [ ${ipt} = 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1
+ [ -n "${nft_handle}" ] && ip netns exec "${ns2}" nft delete rule \
+ ip filter OUTPUT handle "${nft_handle}"
mptcp_lib_kill_group_wait $tests_pid
@@ -4482,18 +4445,17 @@ endpoint_tests()
# To make sure RM_ADDR are sent over a different subflow, but
# allow the rest to quickly and cleanly close the subflow
- local ipt=1
- ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \
- -p tcp -m tcp --tcp-option 30 \
- -m bpf --bytecode \
- "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \
- -j DROP || ipt=0
+ nft_handle=$(ip netns exec "${ns1}" nft -e --handle insert rule \
+ ip filter OUTPUT ip saddr 10.0.1.1 meta l4proto tcp \
+ tcp option mptcp subtype remove-addr \
+ drop | head -n1 | awk '{print $NF}')
pm_nl_del_endpoint $ns1 42 10.0.1.1
sleep 0.5
chk_subflow_nr "after delete ID 0" 2
chk_mptcp_info subflows 2 subflows 2
chk_mptcp_info add_addr_signal 2 add_addr_accepted 2
- [ ${ipt} = 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1
+ [ -n "${nft_handle}" ] && ip netns exec "${ns1}" nft delete rule \
+ ip filter OUTPUT handle "${nft_handle}"
pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal
wait_mpj 4
@@ -4555,7 +4517,7 @@ endpoint_tests()
pm_nl_flush_endpoint $ns2
pm_nl_flush_endpoint $ns1
wait_rm_addr $ns2 0
- ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+ ip netns exec "${ns2}" nft delete rule ip filter OUTPUT handle "$nft_handle"
pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
wait_mpj 1
pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal
diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
index 5ef6033775c86..eba6903233ccf 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -524,7 +524,7 @@ mptcp_lib_check_tools() {
exit ${KSFT_SKIP}
fi
;;
- "iptables"* | "ip6tables"*)
+ "iptables"* | "ip6tables"* | "nft"*)
if ! "${tool}" -V &> /dev/null; then
mptcp_lib_pr_skip "Could not run all tests without ${tool}"
exit ${KSFT_SKIP}
diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index e850a87429b61..a2c20483986dc 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -15,8 +15,6 @@ cin=""
cout=""
timeout_poll=30
timeout_test=$((timeout_poll * 2 + 1))
-iptables="iptables"
-ip6tables="ip6tables"
ns1=""
ns2=""
@@ -50,15 +48,25 @@ add_mark_rules()
local m=$2
local t
- for t in ${iptables} ${ip6tables}; do
+ for t in ip ip6; do
+ ip netns exec "$ns" nft add table "$t" filter
+ ip netns exec "$ns" nft add chain "$t" filter OUTPUT \
+ '{ type filter hook output priority 0; policy accept; }'
+
# just to debug: check we have multiple subflows connection requests
- ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
+ ip netns exec "$ns" nft add rule "$t" filter OUTPUT \
+ tcp flags \& \(fin \| syn \| rst \| ack\) == syn \
+ meta mark "$m" accept
# RST packets might be handled by a internal dummy socket
- ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT
+ ip netns exec "$ns" nft add rule "$t" filter OUTPUT \
+ tcp flags \& rst == rst meta mark 0x0 accept
+
+ ip netns exec "$ns" nft add rule "$t" filter OUTPUT \
+ meta l4proto tcp meta mark "$m" accept
+ ip netns exec "$ns" nft add rule "$t" filter OUTPUT \
+ meta l4proto tcp meta mark 0 counter drop
- ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT
- ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP
done
}
@@ -105,32 +113,29 @@ cleanup()
mptcp_lib_check_mptcp
mptcp_lib_check_kallsyms
-mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
+mptcp_lib_check_tools ip nft
check_mark()
{
local ns=$1
local af=$2
- local tables=${iptables}
+ local tables="ip"
if [ $af -eq 6 ];then
- tables=${ip6tables}
+ tables="ip6"
fi
- local counters values
- counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP)
- values=${counters%DROP*}
-
- local v
- for v in $values; do
- if [ $v -ne 0 ]; then
- mptcp_lib_pr_fail "got $tables $values in ns $ns," \
- "not 0 - not all expected packets marked"
- ret=${KSFT_FAIL}
- return 1
- fi
- done
+ local values
+ values=$(ip netns exec "$ns" nft list table "$tables" filter | \
+ grep -o "packets.*drop" | awk '{print $2}')
+
+ if [[ ! "$values" =~ ^[0-9]+$ ]] || [ "$values" -ne 0 ]; then
+ mptcp_lib_pr_fail "got $tables $values in ns $ns," \
+ "not 0 - not all expected packets marked"
+ ret=${KSFT_FAIL}
+ return 1
+ fi
return 0
}
|
| 3/2 | 2026/09/04 00:59 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 7992 output: 79 thoughts: 409 Thoughts: **Analyzing the Patch for Fuzzing Eligibility** Okay, let's break down this patch and the associated diff. First, I see the changes are all confined to the `tools/testing/selftests/net/mptcp/` directory. Specifically, we're looking at modifications to `config`, `mptcp_join.sh`, `mptcp_lib.sh`, and `mptcp_sockopt.sh`. All very clearly within the realm of self-tests and related scripts. Now, let's apply Section 2 of the fuzzing eligibility rules. The key question is, "Does this touch any code that *really* matters for fuzzing the kernel?" Looking at the criteria for returning `WorthFuzzing=false`, it's pretty clear this falls squarely into the "user-space directories, self-tests, samples, or scripts that do not affect the compiled kernel image" category. We're talking bash scripts and a configuration file, nothing that's going to influence the compiled kernel image or kernel modules. No C code, no core kernel data structures, nothing. Therefore, given the nature of the modifications, it's a straightforward determination: `WorthFuzzing` is definitively `false`. Because we are dealing with scripts, there is no need for `FocusSymbols` or `EnableConfigs`. These are irrelevant in this case. Time to execute `set-results` with the appropriate parameters. |
| 4/2 | 2026/09/04 01:00 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies only selftest scripts and test configuration files under tools/testing/selftests/net/mptcp/. No kernel C source code or headers affecting the compiled kernel image (vmlinux/modules) are changed.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies only selftest scripts and test configuration files under tools/testing/selftests/net/mptcp/. No kernel C source code or headers affecting the compiled kernel image (vmlinux/modules) are changed.",
"WorthFuzzing": false
} |
| 5/1 | 2026/09/04 01:00 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|