| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/11 22:20 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies MIPS micro-assembler routines and MIPS BPF JIT compiler implementations (under arch/mips/). Because the target architecture is amd64, these code paths are exclusive to MIPS and structurally unreachable during fuzzing on amd64.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/11 22:20 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit cf6d743fbd65b2ccdaeb2323a19f607e19d886dc\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Sep 11 22:20:43 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h\nindex b43bfd4452521..adea35df0f8dc 100644\n--- a/arch/mips/include/asm/uasm.h\n+++ b/arch/mips/include/asm/uasm.h\n@@ -85,15 +85,20 @@ Ip_u1u2(_ctc1);\n Ip_u2u1(_ctcmsa);\n Ip_u2u1s3(_daddiu);\n Ip_u3u1u2(_daddu);\n+Ip_u1u2(_ddiv);\n+Ip_u3u1u2(_ddiv_r6);\n Ip_u1u2(_ddivu);\n Ip_u3u1u2(_ddivu_r6);\n Ip_u1(_di);\n Ip_u2u1msbu3(_dins);\n Ip_u2u1msbu3(_dinsm);\n Ip_u2u1msbu3(_dinsu);\n+Ip_u1u2(_div);\n+Ip_u3u1u2(_div_r6);\n Ip_u1u2(_divu);\n Ip_u3u1u2(_divu_r6);\n Ip_u1u2u3(_dmfc0);\n+Ip_u3u1u2(_dmod);\n Ip_u3u1u2(_dmodu);\n Ip_u1u2u3(_dmtc0);\n Ip_u1u2(_dmultu);\n@@ -135,6 +140,7 @@ Ip_u1u2u3(_mfc0);\n Ip_u1u2u3(_mfhc0);\n Ip_u1(_mfhi);\n Ip_u1(_mflo);\n+Ip_u3u1u2(_mod);\n Ip_u3u1u2(_modu);\n Ip_u3u1u2(_movn);\n Ip_u3u1u2(_movz);\n@@ -156,6 +162,8 @@ Ip_u2s3u1(_sb);\n Ip_u2s3u1(_sc);\n Ip_u2s3u1(_scd);\n Ip_u2s3u1(_sd);\n+Ip_u2u1(_seb);\n+Ip_u2u1(_seh);\n Ip_u3u1u2(_seleqz);\n Ip_u3u1u2(_selnez);\n Ip_u2s3u1(_sh);\ndiff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c\nindex e15c6700cd088..2d1668b58ddde 100644\n--- a/arch/mips/mm/uasm-mips.c\n+++ b/arch/mips/mm/uasm-mips.c\n@@ -75,6 +75,9 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_ctcmsa]\t= {M(msa_op, 0, msa_ctc_op, 0, 0, msa_elm_op), RD | RE},\n \t[insn_daddiu]\t= {M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM},\n \t[insn_daddu]\t= {M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD},\n+\t[insn_ddiv]\t= {M(spec_op, 0, 0, 0, 0, ddiv_op), RS | RT},\n+\t[insn_ddiv_r6]\t= {M(spec_op, 0, 0, 0, ddiv_ddiv6_op, ddiv_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_ddivu]\t= {M(spec_op, 0, 0, 0, 0, ddivu_op), RS | RT},\n \t[insn_ddivu_r6]\t= {M(spec_op, 0, 0, 0, ddivu_ddivu6_op, ddivu_op),\n \t\t\t\tRS | RT | RD},\n@@ -82,10 +85,15 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_dins]\t= {M(spec3_op, 0, 0, 0, 0, dins_op), RS | RT | RD | RE},\n \t[insn_dinsm]\t= {M(spec3_op, 0, 0, 0, 0, dinsm_op), RS | RT | RD | RE},\n \t[insn_dinsu]\t= {M(spec3_op, 0, 0, 0, 0, dinsu_op), RS | RT | RD | RE},\n+\t[insn_div]\t= {M(spec_op, 0, 0, 0, 0, div_op), RS | RT},\n+\t[insn_div_r6]\t= {M(spec_op, 0, 0, 0, div_div6_op, div_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_divu]\t= {M(spec_op, 0, 0, 0, 0, divu_op), RS | RT},\n \t[insn_divu_r6]\t= {M(spec_op, 0, 0, 0, divu_divu6_op, divu_op),\n \t\t\t\tRS | RT | RD},\n \t[insn_dmfc0]\t= {M(cop0_op, dmfc_op, 0, 0, 0, 0), RT | RD | SET},\n+\t[insn_dmod]\t= {M(spec_op, 0, 0, 0, ddiv_dmod_op, ddiv_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_dmodu]\t= {M(spec_op, 0, 0, 0, ddivu_dmodu_op, ddivu_op),\n \t\t\t\tRS | RT | RD},\n \t[insn_dmtc0]\t= {M(cop0_op, dmtc_op, 0, 0, 0, 0), RT | RD | SET},\n@@ -140,6 +148,8 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_mfhc0]\t= {M(cop0_op, mfhc0_op, 0, 0, 0, 0), RT | RD | SET},\n \t[insn_mfhi]\t= {M(spec_op, 0, 0, 0, 0, mfhi_op), RD},\n \t[insn_mflo]\t= {M(spec_op, 0, 0, 0, 0, mflo_op), RD},\n+\t[insn_mod]\t= {M(spec_op, 0, 0, 0, div_mod_op, div_op),\n+\t\t\t\tRS | RT | RD},\n \t[insn_modu]\t= {M(spec_op, 0, 0, 0, divu_modu_op, divu_op),\n \t\t\t\tRS | RT | RD},\n \t[insn_movn]\t= {M(spec_op, 0, 0, 0, 0, movn_op), RS | RT | RD},\n@@ -177,6 +187,8 @@ static const struct insn insn_table[insn_invalid] = {\n \t[insn_scd]\t= {M6(spec3_op, 0, 0, 0, scd6_op), RS | RT | SIMM9},\n #endif\n \t[insn_sd]\t= {M(sd_op, 0, 0, 0, 0, 0), RS | RT | SIMM},\n+\t[insn_seb]\t= {M(spec3_op, 0, 0, 0, seb_op, bshfl_op), RT | RD},\n+\t[insn_seh]\t= {M(spec3_op, 0, 0, 0, seh_op, bshfl_op), RT | RD},\n \t[insn_seleqz]\t= {M(spec_op, 0, 0, 0, 0, seleqz_op), RS | RT | RD},\n \t[insn_selnez]\t= {M(spec_op, 0, 0, 0, 0, selnez_op), RS | RT | RD},\n \t[insn_sh]\t= {M(sh_op, 0, 0, 0, 0, 0), RS | RT | SIMM},\ndiff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c\nindex 125140979d62c..139afb0e14cdf 100644\n--- a/arch/mips/mm/uasm.c\n+++ b/arch/mips/mm/uasm.c\n@@ -49,19 +49,21 @@ enum opcode {\n \tinsn_addiu, insn_addu, insn_and, insn_andi, insn_bbit0, insn_bbit1,\n \tinsn_beq, insn_beql, insn_bgez, insn_bgezl, insn_bgtz, insn_blez,\n \tinsn_bltz, insn_bltzl, insn_bne, insn_break, insn_cache, insn_cfc1,\n-\tinsn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddivu,\n-\tinsn_ddivu_r6, insn_di, insn_dins, insn_dinsm, insn_dinsu, insn_divu,\n-\tinsn_divu_r6, insn_dmfc0, insn_dmodu, insn_dmtc0, insn_dmultu,\n+\tinsn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddiv,\n+\tinsn_ddiv_r6, insn_ddivu, insn_ddivu_r6, insn_di, insn_dins, insn_dinsm,\n+\tinsn_dinsu, insn_div, insn_div_r6, insn_divu, insn_divu_r6, insn_dmfc0,\n+\tinsn_dmod, insn_dmodu, insn_dmtc0, insn_dmultu,\n \tinsn_dmulu, insn_drotr, insn_drotr32, insn_dsbh, insn_dshd, insn_dsll,\n \tinsn_dsll32, insn_dsllv, insn_dsra, insn_dsra32, insn_dsrav, insn_dsrl,\n \tinsn_dsrl32, insn_dsrlv, insn_dsubu, insn_eret, insn_ext, insn_ins,\n \tinsn_j, insn_jal, insn_jalr, insn_jr, insn_lb, insn_lbu, insn_ld,\n \tinsn_lddir, insn_ldpte, insn_ldx, insn_lh, insn_lhu, insn_ll, insn_lld,\n \tinsn_lui, insn_lw, insn_lwu, insn_lwx, insn_mfc0, insn_mfhc0, insn_mfhi,\n-\tinsn_mflo, insn_modu, insn_movn, insn_movz, insn_mtc0, insn_mthc0,\n-\tinsn_mthi, insn_mtlo, insn_mul, insn_multu, insn_mulu, insn_muhu, insn_nor,\n-\tinsn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sb, insn_sc,\n-\tinsn_scd, insn_seleqz, insn_selnez, insn_sd, insn_sh, insn_sll,\n+\tinsn_mflo, insn_mod, insn_modu, insn_movn, insn_movz, insn_mtc0,\n+\tinsn_mthc0, insn_mthi, insn_mtlo, insn_mul, insn_multu, insn_mulu,\n+\tinsn_muhu, insn_nor, insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr,\n+\tinsn_sb, insn_sc, insn_scd, insn_seb, insn_seh,\n+\tinsn_seleqz, insn_selnez, insn_sd, insn_sh, insn_sll,\n \tinsn_sllv, insn_slt, insn_slti, insn_sltiu, insn_sltu, insn_sra,\n \tinsn_srav, insn_srl, insn_srlv, insn_subu, insn_sw, insn_sync,\n \tinsn_syscall, insn_tlbp, insn_tlbr, insn_tlbwi, insn_tlbwr, insn_wait,\n@@ -287,9 +289,12 @@ I_u1u2(_cfc1)\n I_u2u1(_cfcmsa)\n I_u1u2(_ctc1)\n I_u2u1(_ctcmsa)\n+I_u1u2(_ddiv)\n+I_u3u1u2(_ddiv_r6)\n I_u1u2(_ddivu)\n I_u3u1u2(_ddivu_r6)\n I_u1u2u3(_dmfc0)\n+I_u3u1u2(_dmod)\n I_u3u1u2(_dmodu)\n I_u1u2u3(_dmtc0)\n I_u1u2(_dmultu)\n@@ -297,6 +302,8 @@ I_u3u1u2(_dmulu)\n I_u2u1s3(_daddiu)\n I_u3u1u2(_daddu)\n I_u1(_di);\n+I_u1u2(_div)\n+I_u3u1u2(_div_r6)\n I_u1u2(_divu)\n I_u3u1u2(_divu_r6)\n I_u2u1(_dsbh);\n@@ -332,6 +339,7 @@ I_u2s3u1(_lw)\n I_u2s3u1(_lwu)\n I_u1u2u3(_mfc0)\n I_u1u2u3(_mfhc0)\n+I_u3u1u2(_mod)\n I_u3u1u2(_modu)\n I_u3u1u2(_movn)\n I_u3u1u2(_movz)\n@@ -353,6 +361,8 @@ I_u2s3u1(_sb)\n I_u2s3u1(_sc)\n I_u2s3u1(_scd)\n I_u2s3u1(_sd)\n+I_u2u1(_seb)\n+I_u2u1(_seh)\n I_u3u1u2(_seleqz)\n I_u3u1u2(_selnez)\n I_u2s3u1(_sh)\ndiff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c\nindex 6ee4abe6a1f70..f14de6d731221 100644\n--- a/arch/mips/net/bpf_jit_comp.c\n+++ b/arch/mips/net/bpf_jit_comp.c\n@@ -208,7 +208,7 @@ void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src)\n }\n \n /* Validate ALU immediate range */\n-bool valid_alu_i(u8 op, s32 imm)\n+bool valid_alu_i(u8 op, s32 imm, s16 off)\n {\n \tswitch (BPF_OP(op)) {\n \tcase BPF_NEG:\n@@ -237,6 +237,9 @@ bool valid_alu_i(u8 op, s32 imm)\n \t\treturn imm == 0 || (imm \u003e 0 \u0026\u0026 is_power_of_2(imm));\n \tcase BPF_DIV:\n \tcase BPF_MOD:\n+\t\t/* Do not use unsigned shift/mask rewrites for signed div/mod. */\n+\t\tif (off == 1)\n+\t\t\treturn false;\n \t\t/* imm must be an 17-bit power of two */\n \t\treturn (u32)imm \u003c= 0x10000 \u0026\u0026 is_power_of_2((u32)imm);\n \t}\n@@ -338,8 +341,42 @@ void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n \tclobber_reg(ctx, dst);\n }\n \n+/* ALU division operation (32-bit) */\n+static void emit_div(struct jit_context *ctx, u8 dst, u8 src, s16 off)\n+{\n+\tif (cpu_has_mips32r6) {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, div_r6, dst, dst, src);\n+\t\telse\n+\t\t\temit(ctx, divu_r6, dst, dst, src);\n+\t} else {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, div, dst, src);\n+\t\telse\n+\t\t\temit(ctx, divu, dst, src);\n+\t\temit(ctx, mflo, dst);\n+\t}\n+}\n+\n+/* ALU modulo operation (32-bit) */\n+static void emit_mod(struct jit_context *ctx, u8 dst, u8 src, s16 off)\n+{\n+\tif (cpu_has_mips32r6) {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, mod, dst, dst, src);\n+\t\telse\n+\t\t\temit(ctx, modu, dst, dst, src);\n+\t} else {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, div, dst, src);\n+\t\telse\n+\t\t\temit(ctx, divu, dst, src);\n+\t\temit(ctx, mfhi, dst);\n+\t}\n+}\n+\n /* ALU register operation (32-bit) */\n-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, s16 off)\n {\n \tswitch (BPF_OP(op)) {\n \t/* dst = dst \u0026 src */\n@@ -385,21 +422,11 @@ void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n \t\tbreak;\n \t/* dst = dst / src */\n \tcase BPF_DIV:\n-\t\tif (cpu_has_mips32r6) {\n-\t\t\temit(ctx, divu_r6, dst, dst, src);\n-\t\t} else {\n-\t\t\temit(ctx, divu, dst, src);\n-\t\t\temit(ctx, mflo, dst);\n-\t\t}\n+\t\temit_div(ctx, dst, src, off);\n \t\tbreak;\n \t/* dst = dst % src */\n \tcase BPF_MOD:\n-\t\tif (cpu_has_mips32r6) {\n-\t\t\temit(ctx, modu, dst, dst, src);\n-\t\t} else {\n-\t\t\temit(ctx, divu, dst, src);\n-\t\t\temit(ctx, mfhi, dst);\n-\t\t}\n+\t\temit_mod(ctx, dst, src, off);\n \t\tbreak;\n \t}\n \tclobber_reg(ctx, dst);\ndiff --git a/arch/mips/net/bpf_jit_comp.h b/arch/mips/net/bpf_jit_comp.h\nindex a37fe20818eb9..0ddedb733dd19 100644\n--- a/arch/mips/net/bpf_jit_comp.h\n+++ b/arch/mips/net/bpf_jit_comp.h\n@@ -163,7 +163,7 @@ void emit_mov_i(struct jit_context *ctx, u8 dst, s32 imm);\n void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src);\n \n /* Validate ALU/ALU64 immediate range */\n-bool valid_alu_i(u8 op, s32 imm);\n+bool valid_alu_i(u8 op, s32 imm, s16 off);\n \n /* Rewrite ALU/ALU64 immediate operation */\n bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);\n@@ -172,7 +172,7 @@ bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);\n void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op);\n \n /* ALU register operation (32-bit) */\n-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op);\n+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, s16 off);\n \n /* Atomic read-modify-write (32-bit) */\n void emit_atomic_r(struct jit_context *ctx, u8 dst, u8 src, s16 off, u8 code);\ndiff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c\nindex 40a878b672f5d..6619182b5ef33 100644\n--- a/arch/mips/net/bpf_jit_comp32.c\n+++ b/arch/mips/net/bpf_jit_comp32.c\n@@ -512,7 +512,7 @@ static void emit_mul_r64(struct jit_context *ctx,\n \tclobber_reg64(ctx, dst);\n }\n \n-/* Helper function for 64-bit modulo */\n+/* Helper function for unsigned 64-bit modulo */\n static u64 jit_mod64(u64 a, u64 b)\n {\n \tu64 rem;\n@@ -521,13 +521,22 @@ static u64 jit_mod64(u64 a, u64 b)\n \treturn rem;\n }\n \n+/* Helper function for signed 64-bit modulo */\n+static s64 jit_smod64(s64 a, s64 b)\n+{\n+\ts64 quot = div64_s64(a, b);\n+\n+\treturn a - quot * b;\n+}\n+\n /* ALU div/mod register (64-bit) */\n-static void emit_divmod_r64(struct jit_context *ctx,\n-\t\t\t const u8 dst[], const u8 src[], u8 op)\n+static void emit_divmod_r64(struct jit_context *ctx, const u8 dst[],\n+\t\t\t const u8 src[], u8 op, s16 off)\n {\n \tconst u8 *r0 = bpf2mips32[BPF_REG_0]; /* Mapped to v0-v1 */\n \tconst u8 *r1 = bpf2mips32[BPF_REG_1]; /* Mapped to a0-a1 */\n \tconst u8 *r2 = bpf2mips32[BPF_REG_2]; /* Mapped to a2-a3 */\n+\tbool is_signed = off == 1;\n \tint exclude, k;\n \tu32 addr = 0;\n \n@@ -546,11 +555,11 @@ static void emit_divmod_r64(struct jit_context *ctx,\n \tswitch (BPF_OP(op)) {\n \t/* dst = dst / src */\n \tcase BPF_DIV:\n-\t\taddr = (u32)\u0026div64_u64;\n+\t\taddr = is_signed ? (u32)\u0026div64_s64 : (u32)\u0026div64_u64;\n \t\tbreak;\n \t/* dst = dst % src */\n \tcase BPF_MOD:\n-\t\taddr = (u32)\u0026jit_mod64;\n+\t\taddr = is_signed ? (u32)\u0026jit_smod64 : (u32)\u0026jit_mod64;\n \t\tbreak;\n \t}\n \temit_mov_i(ctx, MIPS_R_T9, addr);\n@@ -1516,9 +1525,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MUL | BPF_K:\n \tcase BPF_ALU | BPF_DIV | BPF_K:\n \tcase BPF_ALU | BPF_MOD | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off)) {\n \t\t\temit_mov_i(ctx, MIPS_R_T6, imm);\n-\t\t\temit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code));\n+\t\t\temit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code), off);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_alu_i(ctx, lo(dst), val, alu);\n \t\t}\n@@ -1546,7 +1555,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MUL | BPF_X:\n \tcase BPF_ALU | BPF_DIV | BPF_X:\n \tcase BPF_ALU | BPF_MOD | BPF_X:\n-\t\temit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code));\n+\t\temit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code), off);\n \t\temit_zext_ver(ctx, dst);\n \t\tbreak;\n \t/* dst = imm (64-bit) */\n@@ -1599,7 +1608,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \t\t * and then do the operation on this register.\n \t\t */\n \t\temit_mov_se_i64(ctx, tmp, imm);\n-\t\temit_divmod_r64(ctx, dst, tmp, BPF_OP(code));\n+\t\temit_divmod_r64(ctx, dst, tmp, BPF_OP(code), off);\n \t\tbreak;\n \t/* dst = dst \u0026 src (64-bit) */\n \t/* dst = dst | src (64-bit) */\n@@ -1629,7 +1638,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \t/* dst = dst % src (64-bit) */\n \tcase BPF_ALU64 | BPF_DIV | BPF_X:\n \tcase BPF_ALU64 | BPF_MOD | BPF_X:\n-\t\temit_divmod_r64(ctx, dst, src, BPF_OP(code));\n+\t\temit_divmod_r64(ctx, dst, src, BPF_OP(code), off);\n \t\tbreak;\n \t/* dst = htole(dst) */\n \t/* dst = htobe(dst) */\ndiff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c\nindex fa7e9aa37f498..db027c2d92212 100644\n--- a/arch/mips/net/bpf_jit_comp64.c\n+++ b/arch/mips/net/bpf_jit_comp64.c\n@@ -197,8 +197,43 @@ static void emit_alu_i64(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n \tclobber_reg(ctx, dst);\n }\n \n+/* ALU division operation (64-bit) */\n+static void emit_div64(struct jit_context *ctx, u8 dst, u8 src, s16 off)\n+{\n+\tif (cpu_has_mips64r6) {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, ddiv_r6, dst, dst, src);\n+\t\telse\n+\t\t\temit(ctx, ddivu_r6, dst, dst, src);\n+\t} else {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, ddiv, dst, src);\n+\t\telse\n+\t\t\temit(ctx, ddivu, dst, src);\n+\t\temit(ctx, mflo, dst);\n+\t}\n+}\n+\n+/* ALU modulo operation (64-bit) */\n+static void emit_mod64(struct jit_context *ctx, u8 dst, u8 src, s16 off)\n+{\n+\tif (cpu_has_mips64r6) {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, dmod, dst, dst, src);\n+\t\telse\n+\t\t\temit(ctx, dmodu, dst, dst, src);\n+\t} else {\n+\t\tif (off == 1)\n+\t\t\temit(ctx, ddiv, dst, src);\n+\t\telse\n+\t\t\temit(ctx, ddivu, dst, src);\n+\t\temit(ctx, mfhi, dst);\n+\t}\n+}\n+\n /* ALU register operation (64-bit) */\n-static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n+static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op,\n+\t\t\t s16 off)\n {\n \tswitch (BPF_OP(op)) {\n \t/* dst = dst \u003c\u003c src */\n@@ -235,25 +270,15 @@ static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)\n \t\tbreak;\n \t/* dst = dst / src */\n \tcase BPF_DIV:\n-\t\tif (cpu_has_mips64r6) {\n-\t\t\temit(ctx, ddivu_r6, dst, dst, src);\n-\t\t} else {\n-\t\t\temit(ctx, ddivu, dst, src);\n-\t\t\temit(ctx, mflo, dst);\n-\t\t}\n+\t\temit_div64(ctx, dst, src, off);\n \t\tbreak;\n \t/* dst = dst % src */\n \tcase BPF_MOD:\n-\t\tif (cpu_has_mips64r6) {\n-\t\t\temit(ctx, dmodu, dst, dst, src);\n-\t\t} else {\n-\t\t\temit(ctx, ddivu, dst, src);\n-\t\t\temit(ctx, mfhi, dst);\n-\t\t}\n+\t\temit_mod64(ctx, dst, src, off);\n \t\tbreak;\n \tdefault:\n \t\t/* Width-generic operations */\n-\t\temit_alu_r(ctx, dst, src, op);\n+\t\temit_alu_r(ctx, dst, src, op, off);\n \t}\n \tclobber_reg(ctx, dst);\n }\n@@ -674,9 +699,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_AND | BPF_K:\n \tcase BPF_ALU | BPF_XOR | BPF_K:\n \tcase BPF_ALU | BPF_LSH | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off)) {\n \t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\n-\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_alu_i(ctx, dst, val, alu);\n \t\t}\n@@ -696,10 +721,10 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MUL | BPF_K:\n \tcase BPF_ALU | BPF_DIV | BPF_K:\n \tcase BPF_ALU | BPF_MOD | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off)) {\n \t\t\temit_sext(ctx, dst, dst);\n \t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\n-\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_sext(ctx, dst, dst);\n \t\t\temit_alu_i(ctx, dst, val, alu);\n@@ -714,7 +739,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_OR | BPF_X:\n \tcase BPF_ALU | BPF_XOR | BPF_X:\n \tcase BPF_ALU | BPF_LSH | BPF_X:\n-\t\temit_alu_r(ctx, dst, src, BPF_OP(code));\n+\t\temit_alu_r(ctx, dst, src, BPF_OP(code), off);\n \t\temit_zext_ver(ctx, dst);\n \t\tbreak;\n \t/* dst = dst \u003e\u003e src */\n@@ -733,7 +758,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU | BPF_MOD | BPF_X:\n \t\temit_sext(ctx, dst, dst);\n \t\temit_sext(ctx, MIPS_R_T4, src);\n-\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\temit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off);\n \t\temit_zext_ver(ctx, dst);\n \t\tbreak;\n \t/* dst = imm (64-bit) */\n@@ -770,9 +795,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU64 | BPF_MUL | BPF_K:\n \tcase BPF_ALU64 | BPF_DIV | BPF_K:\n \tcase BPF_ALU64 | BPF_MOD | BPF_K:\n-\t\tif (!valid_alu_i(BPF_OP(code), imm)) {\n+\t\tif (!valid_alu_i(BPF_OP(code), imm, off)) {\n \t\t\temit_mov_i(ctx, MIPS_R_T4, imm);\n-\t\t\temit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code));\n+\t\t\temit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code), off);\n \t\t} else if (rewrite_alu_i(BPF_OP(code), imm, \u0026alu, \u0026val)) {\n \t\t\temit_alu_i64(ctx, dst, val, alu);\n \t\t}\n@@ -799,7 +824,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)\n \tcase BPF_ALU64 | BPF_MUL | BPF_X:\n \tcase BPF_ALU64 | BPF_DIV | BPF_X:\n \tcase BPF_ALU64 | BPF_MOD | BPF_X:\n-\t\temit_alu_r64(ctx, dst, src, BPF_OP(code));\n+\t\temit_alu_r64(ctx, dst, src, BPF_OP(code), off);\n \t\tbreak;\n \t/* dst = htole(dst) */\n \t/* dst = htobe(dst) */\n"
} |
| 2/1 | 2026/09/11 22:20 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies MIPS micro-assembler routines and MIPS BPF JIT compiler implementations (under arch/mips/). Because the target architecture is amd64, these code paths are exclusive to MIPS and structurally unreachable during fuzzing on amd64.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit cf6d743fbd65b2ccdaeb2323a19f607e19d886dc
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Sep 11 22:20:43 2026 +0000
syz-cluster: applied patch under review
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index b43bfd4452521..adea35df0f8dc 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -85,15 +85,20 @@ Ip_u1u2(_ctc1);
Ip_u2u1(_ctcmsa);
Ip_u2u1s3(_daddiu);
Ip_u3u1u2(_daddu);
+Ip_u1u2(_ddiv);
+Ip_u3u1u2(_ddiv_r6);
Ip_u1u2(_ddivu);
Ip_u3u1u2(_ddivu_r6);
Ip_u1(_di);
Ip_u2u1msbu3(_dins);
Ip_u2u1msbu3(_dinsm);
Ip_u2u1msbu3(_dinsu);
+Ip_u1u2(_div);
+Ip_u3u1u2(_div_r6);
Ip_u1u2(_divu);
Ip_u3u1u2(_divu_r6);
Ip_u1u2u3(_dmfc0);
+Ip_u3u1u2(_dmod);
Ip_u3u1u2(_dmodu);
Ip_u1u2u3(_dmtc0);
Ip_u1u2(_dmultu);
@@ -135,6 +140,7 @@ Ip_u1u2u3(_mfc0);
Ip_u1u2u3(_mfhc0);
Ip_u1(_mfhi);
Ip_u1(_mflo);
+Ip_u3u1u2(_mod);
Ip_u3u1u2(_modu);
Ip_u3u1u2(_movn);
Ip_u3u1u2(_movz);
@@ -156,6 +162,8 @@ Ip_u2s3u1(_sb);
Ip_u2s3u1(_sc);
Ip_u2s3u1(_scd);
Ip_u2s3u1(_sd);
+Ip_u2u1(_seb);
+Ip_u2u1(_seh);
Ip_u3u1u2(_seleqz);
Ip_u3u1u2(_selnez);
Ip_u2s3u1(_sh);
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index e15c6700cd088..2d1668b58ddde 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -75,6 +75,9 @@ static const struct insn insn_table[insn_invalid] = {
[insn_ctcmsa] = {M(msa_op, 0, msa_ctc_op, 0, 0, msa_elm_op), RD | RE},
[insn_daddiu] = {M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM},
[insn_daddu] = {M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD},
+ [insn_ddiv] = {M(spec_op, 0, 0, 0, 0, ddiv_op), RS | RT},
+ [insn_ddiv_r6] = {M(spec_op, 0, 0, 0, ddiv_ddiv6_op, ddiv_op),
+ RS | RT | RD},
[insn_ddivu] = {M(spec_op, 0, 0, 0, 0, ddivu_op), RS | RT},
[insn_ddivu_r6] = {M(spec_op, 0, 0, 0, ddivu_ddivu6_op, ddivu_op),
RS | RT | RD},
@@ -82,10 +85,15 @@ static const struct insn insn_table[insn_invalid] = {
[insn_dins] = {M(spec3_op, 0, 0, 0, 0, dins_op), RS | RT | RD | RE},
[insn_dinsm] = {M(spec3_op, 0, 0, 0, 0, dinsm_op), RS | RT | RD | RE},
[insn_dinsu] = {M(spec3_op, 0, 0, 0, 0, dinsu_op), RS | RT | RD | RE},
+ [insn_div] = {M(spec_op, 0, 0, 0, 0, div_op), RS | RT},
+ [insn_div_r6] = {M(spec_op, 0, 0, 0, div_div6_op, div_op),
+ RS | RT | RD},
[insn_divu] = {M(spec_op, 0, 0, 0, 0, divu_op), RS | RT},
[insn_divu_r6] = {M(spec_op, 0, 0, 0, divu_divu6_op, divu_op),
RS | RT | RD},
[insn_dmfc0] = {M(cop0_op, dmfc_op, 0, 0, 0, 0), RT | RD | SET},
+ [insn_dmod] = {M(spec_op, 0, 0, 0, ddiv_dmod_op, ddiv_op),
+ RS | RT | RD},
[insn_dmodu] = {M(spec_op, 0, 0, 0, ddivu_dmodu_op, ddivu_op),
RS | RT | RD},
[insn_dmtc0] = {M(cop0_op, dmtc_op, 0, 0, 0, 0), RT | RD | SET},
@@ -140,6 +148,8 @@ static const struct insn insn_table[insn_invalid] = {
[insn_mfhc0] = {M(cop0_op, mfhc0_op, 0, 0, 0, 0), RT | RD | SET},
[insn_mfhi] = {M(spec_op, 0, 0, 0, 0, mfhi_op), RD},
[insn_mflo] = {M(spec_op, 0, 0, 0, 0, mflo_op), RD},
+ [insn_mod] = {M(spec_op, 0, 0, 0, div_mod_op, div_op),
+ RS | RT | RD},
[insn_modu] = {M(spec_op, 0, 0, 0, divu_modu_op, divu_op),
RS | RT | RD},
[insn_movn] = {M(spec_op, 0, 0, 0, 0, movn_op), RS | RT | RD},
@@ -177,6 +187,8 @@ static const struct insn insn_table[insn_invalid] = {
[insn_scd] = {M6(spec3_op, 0, 0, 0, scd6_op), RS | RT | SIMM9},
#endif
[insn_sd] = {M(sd_op, 0, 0, 0, 0, 0), RS | RT | SIMM},
+ [insn_seb] = {M(spec3_op, 0, 0, 0, seb_op, bshfl_op), RT | RD},
+ [insn_seh] = {M(spec3_op, 0, 0, 0, seh_op, bshfl_op), RT | RD},
[insn_seleqz] = {M(spec_op, 0, 0, 0, 0, seleqz_op), RS | RT | RD},
[insn_selnez] = {M(spec_op, 0, 0, 0, 0, selnez_op), RS | RT | RD},
[insn_sh] = {M(sh_op, 0, 0, 0, 0, 0), RS | RT | SIMM},
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index 125140979d62c..139afb0e14cdf 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -49,19 +49,21 @@ enum opcode {
insn_addiu, insn_addu, insn_and, insn_andi, insn_bbit0, insn_bbit1,
insn_beq, insn_beql, insn_bgez, insn_bgezl, insn_bgtz, insn_blez,
insn_bltz, insn_bltzl, insn_bne, insn_break, insn_cache, insn_cfc1,
- insn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddivu,
- insn_ddivu_r6, insn_di, insn_dins, insn_dinsm, insn_dinsu, insn_divu,
- insn_divu_r6, insn_dmfc0, insn_dmodu, insn_dmtc0, insn_dmultu,
+ insn_cfcmsa, insn_ctc1, insn_ctcmsa, insn_daddiu, insn_daddu, insn_ddiv,
+ insn_ddiv_r6, insn_ddivu, insn_ddivu_r6, insn_di, insn_dins, insn_dinsm,
+ insn_dinsu, insn_div, insn_div_r6, insn_divu, insn_divu_r6, insn_dmfc0,
+ insn_dmod, insn_dmodu, insn_dmtc0, insn_dmultu,
insn_dmulu, insn_drotr, insn_drotr32, insn_dsbh, insn_dshd, insn_dsll,
insn_dsll32, insn_dsllv, insn_dsra, insn_dsra32, insn_dsrav, insn_dsrl,
insn_dsrl32, insn_dsrlv, insn_dsubu, insn_eret, insn_ext, insn_ins,
insn_j, insn_jal, insn_jalr, insn_jr, insn_lb, insn_lbu, insn_ld,
insn_lddir, insn_ldpte, insn_ldx, insn_lh, insn_lhu, insn_ll, insn_lld,
insn_lui, insn_lw, insn_lwu, insn_lwx, insn_mfc0, insn_mfhc0, insn_mfhi,
- insn_mflo, insn_modu, insn_movn, insn_movz, insn_mtc0, insn_mthc0,
- insn_mthi, insn_mtlo, insn_mul, insn_multu, insn_mulu, insn_muhu, insn_nor,
- insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sb, insn_sc,
- insn_scd, insn_seleqz, insn_selnez, insn_sd, insn_sh, insn_sll,
+ insn_mflo, insn_mod, insn_modu, insn_movn, insn_movz, insn_mtc0,
+ insn_mthc0, insn_mthi, insn_mtlo, insn_mul, insn_multu, insn_mulu,
+ insn_muhu, insn_nor, insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr,
+ insn_sb, insn_sc, insn_scd, insn_seb, insn_seh,
+ insn_seleqz, insn_selnez, insn_sd, insn_sh, insn_sll,
insn_sllv, insn_slt, insn_slti, insn_sltiu, insn_sltu, insn_sra,
insn_srav, insn_srl, insn_srlv, insn_subu, insn_sw, insn_sync,
insn_syscall, insn_tlbp, insn_tlbr, insn_tlbwi, insn_tlbwr, insn_wait,
@@ -287,9 +289,12 @@ I_u1u2(_cfc1)
I_u2u1(_cfcmsa)
I_u1u2(_ctc1)
I_u2u1(_ctcmsa)
+I_u1u2(_ddiv)
+I_u3u1u2(_ddiv_r6)
I_u1u2(_ddivu)
I_u3u1u2(_ddivu_r6)
I_u1u2u3(_dmfc0)
+I_u3u1u2(_dmod)
I_u3u1u2(_dmodu)
I_u1u2u3(_dmtc0)
I_u1u2(_dmultu)
@@ -297,6 +302,8 @@ I_u3u1u2(_dmulu)
I_u2u1s3(_daddiu)
I_u3u1u2(_daddu)
I_u1(_di);
+I_u1u2(_div)
+I_u3u1u2(_div_r6)
I_u1u2(_divu)
I_u3u1u2(_divu_r6)
I_u2u1(_dsbh);
@@ -332,6 +339,7 @@ I_u2s3u1(_lw)
I_u2s3u1(_lwu)
I_u1u2u3(_mfc0)
I_u1u2u3(_mfhc0)
+I_u3u1u2(_mod)
I_u3u1u2(_modu)
I_u3u1u2(_movn)
I_u3u1u2(_movz)
@@ -353,6 +361,8 @@ I_u2s3u1(_sb)
I_u2s3u1(_sc)
I_u2s3u1(_scd)
I_u2s3u1(_sd)
+I_u2u1(_seb)
+I_u2u1(_seh)
I_u3u1u2(_seleqz)
I_u3u1u2(_selnez)
I_u2s3u1(_sh)
diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c
index 6ee4abe6a1f70..f14de6d731221 100644
--- a/arch/mips/net/bpf_jit_comp.c
+++ b/arch/mips/net/bpf_jit_comp.c
@@ -208,7 +208,7 @@ void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src)
}
/* Validate ALU immediate range */
-bool valid_alu_i(u8 op, s32 imm)
+bool valid_alu_i(u8 op, s32 imm, s16 off)
{
switch (BPF_OP(op)) {
case BPF_NEG:
@@ -237,6 +237,9 @@ bool valid_alu_i(u8 op, s32 imm)
return imm == 0 || (imm > 0 && is_power_of_2(imm));
case BPF_DIV:
case BPF_MOD:
+ /* Do not use unsigned shift/mask rewrites for signed div/mod. */
+ if (off == 1)
+ return false;
/* imm must be an 17-bit power of two */
return (u32)imm <= 0x10000 && is_power_of_2((u32)imm);
}
@@ -338,8 +341,42 @@ void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op)
clobber_reg(ctx, dst);
}
+/* ALU division operation (32-bit) */
+static void emit_div(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+ if (cpu_has_mips32r6) {
+ if (off == 1)
+ emit(ctx, div_r6, dst, dst, src);
+ else
+ emit(ctx, divu_r6, dst, dst, src);
+ } else {
+ if (off == 1)
+ emit(ctx, div, dst, src);
+ else
+ emit(ctx, divu, dst, src);
+ emit(ctx, mflo, dst);
+ }
+}
+
+/* ALU modulo operation (32-bit) */
+static void emit_mod(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+ if (cpu_has_mips32r6) {
+ if (off == 1)
+ emit(ctx, mod, dst, dst, src);
+ else
+ emit(ctx, modu, dst, dst, src);
+ } else {
+ if (off == 1)
+ emit(ctx, div, dst, src);
+ else
+ emit(ctx, divu, dst, src);
+ emit(ctx, mfhi, dst);
+ }
+}
+
/* ALU register operation (32-bit) */
-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)
+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, s16 off)
{
switch (BPF_OP(op)) {
/* dst = dst & src */
@@ -385,21 +422,11 @@ void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)
break;
/* dst = dst / src */
case BPF_DIV:
- if (cpu_has_mips32r6) {
- emit(ctx, divu_r6, dst, dst, src);
- } else {
- emit(ctx, divu, dst, src);
- emit(ctx, mflo, dst);
- }
+ emit_div(ctx, dst, src, off);
break;
/* dst = dst % src */
case BPF_MOD:
- if (cpu_has_mips32r6) {
- emit(ctx, modu, dst, dst, src);
- } else {
- emit(ctx, divu, dst, src);
- emit(ctx, mfhi, dst);
- }
+ emit_mod(ctx, dst, src, off);
break;
}
clobber_reg(ctx, dst);
diff --git a/arch/mips/net/bpf_jit_comp.h b/arch/mips/net/bpf_jit_comp.h
index a37fe20818eb9..0ddedb733dd19 100644
--- a/arch/mips/net/bpf_jit_comp.h
+++ b/arch/mips/net/bpf_jit_comp.h
@@ -163,7 +163,7 @@ void emit_mov_i(struct jit_context *ctx, u8 dst, s32 imm);
void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src);
/* Validate ALU/ALU64 immediate range */
-bool valid_alu_i(u8 op, s32 imm);
+bool valid_alu_i(u8 op, s32 imm, s16 off);
/* Rewrite ALU/ALU64 immediate operation */
bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);
@@ -172,7 +172,7 @@ bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);
void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op);
/* ALU register operation (32-bit) */
-void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op);
+void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op, s16 off);
/* Atomic read-modify-write (32-bit) */
void emit_atomic_r(struct jit_context *ctx, u8 dst, u8 src, s16 off, u8 code);
diff --git a/arch/mips/net/bpf_jit_comp32.c b/arch/mips/net/bpf_jit_comp32.c
index 40a878b672f5d..6619182b5ef33 100644
--- a/arch/mips/net/bpf_jit_comp32.c
+++ b/arch/mips/net/bpf_jit_comp32.c
@@ -512,7 +512,7 @@ static void emit_mul_r64(struct jit_context *ctx,
clobber_reg64(ctx, dst);
}
-/* Helper function for 64-bit modulo */
+/* Helper function for unsigned 64-bit modulo */
static u64 jit_mod64(u64 a, u64 b)
{
u64 rem;
@@ -521,13 +521,22 @@ static u64 jit_mod64(u64 a, u64 b)
return rem;
}
+/* Helper function for signed 64-bit modulo */
+static s64 jit_smod64(s64 a, s64 b)
+{
+ s64 quot = div64_s64(a, b);
+
+ return a - quot * b;
+}
+
/* ALU div/mod register (64-bit) */
-static void emit_divmod_r64(struct jit_context *ctx,
- const u8 dst[], const u8 src[], u8 op)
+static void emit_divmod_r64(struct jit_context *ctx, const u8 dst[],
+ const u8 src[], u8 op, s16 off)
{
const u8 *r0 = bpf2mips32[BPF_REG_0]; /* Mapped to v0-v1 */
const u8 *r1 = bpf2mips32[BPF_REG_1]; /* Mapped to a0-a1 */
const u8 *r2 = bpf2mips32[BPF_REG_2]; /* Mapped to a2-a3 */
+ bool is_signed = off == 1;
int exclude, k;
u32 addr = 0;
@@ -546,11 +555,11 @@ static void emit_divmod_r64(struct jit_context *ctx,
switch (BPF_OP(op)) {
/* dst = dst / src */
case BPF_DIV:
- addr = (u32)&div64_u64;
+ addr = is_signed ? (u32)&div64_s64 : (u32)&div64_u64;
break;
/* dst = dst % src */
case BPF_MOD:
- addr = (u32)&jit_mod64;
+ addr = is_signed ? (u32)&jit_smod64 : (u32)&jit_mod64;
break;
}
emit_mov_i(ctx, MIPS_R_T9, addr);
@@ -1516,9 +1525,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU | BPF_MUL | BPF_K:
case BPF_ALU | BPF_DIV | BPF_K:
case BPF_ALU | BPF_MOD | BPF_K:
- if (!valid_alu_i(BPF_OP(code), imm)) {
+ if (!valid_alu_i(BPF_OP(code), imm, off)) {
emit_mov_i(ctx, MIPS_R_T6, imm);
- emit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code));
+ emit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code), off);
} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
emit_alu_i(ctx, lo(dst), val, alu);
}
@@ -1546,7 +1555,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU | BPF_MUL | BPF_X:
case BPF_ALU | BPF_DIV | BPF_X:
case BPF_ALU | BPF_MOD | BPF_X:
- emit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code));
+ emit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code), off);
emit_zext_ver(ctx, dst);
break;
/* dst = imm (64-bit) */
@@ -1599,7 +1608,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
* and then do the operation on this register.
*/
emit_mov_se_i64(ctx, tmp, imm);
- emit_divmod_r64(ctx, dst, tmp, BPF_OP(code));
+ emit_divmod_r64(ctx, dst, tmp, BPF_OP(code), off);
break;
/* dst = dst & src (64-bit) */
/* dst = dst | src (64-bit) */
@@ -1629,7 +1638,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
/* dst = dst % src (64-bit) */
case BPF_ALU64 | BPF_DIV | BPF_X:
case BPF_ALU64 | BPF_MOD | BPF_X:
- emit_divmod_r64(ctx, dst, src, BPF_OP(code));
+ emit_divmod_r64(ctx, dst, src, BPF_OP(code), off);
break;
/* dst = htole(dst) */
/* dst = htobe(dst) */
diff --git a/arch/mips/net/bpf_jit_comp64.c b/arch/mips/net/bpf_jit_comp64.c
index fa7e9aa37f498..db027c2d92212 100644
--- a/arch/mips/net/bpf_jit_comp64.c
+++ b/arch/mips/net/bpf_jit_comp64.c
@@ -197,8 +197,43 @@ static void emit_alu_i64(struct jit_context *ctx, u8 dst, s32 imm, u8 op)
clobber_reg(ctx, dst);
}
+/* ALU division operation (64-bit) */
+static void emit_div64(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+ if (cpu_has_mips64r6) {
+ if (off == 1)
+ emit(ctx, ddiv_r6, dst, dst, src);
+ else
+ emit(ctx, ddivu_r6, dst, dst, src);
+ } else {
+ if (off == 1)
+ emit(ctx, ddiv, dst, src);
+ else
+ emit(ctx, ddivu, dst, src);
+ emit(ctx, mflo, dst);
+ }
+}
+
+/* ALU modulo operation (64-bit) */
+static void emit_mod64(struct jit_context *ctx, u8 dst, u8 src, s16 off)
+{
+ if (cpu_has_mips64r6) {
+ if (off == 1)
+ emit(ctx, dmod, dst, dst, src);
+ else
+ emit(ctx, dmodu, dst, dst, src);
+ } else {
+ if (off == 1)
+ emit(ctx, ddiv, dst, src);
+ else
+ emit(ctx, ddivu, dst, src);
+ emit(ctx, mfhi, dst);
+ }
+}
+
/* ALU register operation (64-bit) */
-static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)
+static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op,
+ s16 off)
{
switch (BPF_OP(op)) {
/* dst = dst << src */
@@ -235,25 +270,15 @@ static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op)
break;
/* dst = dst / src */
case BPF_DIV:
- if (cpu_has_mips64r6) {
- emit(ctx, ddivu_r6, dst, dst, src);
- } else {
- emit(ctx, ddivu, dst, src);
- emit(ctx, mflo, dst);
- }
+ emit_div64(ctx, dst, src, off);
break;
/* dst = dst % src */
case BPF_MOD:
- if (cpu_has_mips64r6) {
- emit(ctx, dmodu, dst, dst, src);
- } else {
- emit(ctx, ddivu, dst, src);
- emit(ctx, mfhi, dst);
- }
+ emit_mod64(ctx, dst, src, off);
break;
default:
/* Width-generic operations */
- emit_alu_r(ctx, dst, src, op);
+ emit_alu_r(ctx, dst, src, op, off);
}
clobber_reg(ctx, dst);
}
@@ -674,9 +699,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU | BPF_AND | BPF_K:
case BPF_ALU | BPF_XOR | BPF_K:
case BPF_ALU | BPF_LSH | BPF_K:
- if (!valid_alu_i(BPF_OP(code), imm)) {
+ if (!valid_alu_i(BPF_OP(code), imm, off)) {
emit_mov_i(ctx, MIPS_R_T4, imm);
- emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));
+ emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off);
} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
emit_alu_i(ctx, dst, val, alu);
}
@@ -696,10 +721,10 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU | BPF_MUL | BPF_K:
case BPF_ALU | BPF_DIV | BPF_K:
case BPF_ALU | BPF_MOD | BPF_K:
- if (!valid_alu_i(BPF_OP(code), imm)) {
+ if (!valid_alu_i(BPF_OP(code), imm, off)) {
emit_sext(ctx, dst, dst);
emit_mov_i(ctx, MIPS_R_T4, imm);
- emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));
+ emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off);
} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
emit_sext(ctx, dst, dst);
emit_alu_i(ctx, dst, val, alu);
@@ -714,7 +739,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU | BPF_OR | BPF_X:
case BPF_ALU | BPF_XOR | BPF_X:
case BPF_ALU | BPF_LSH | BPF_X:
- emit_alu_r(ctx, dst, src, BPF_OP(code));
+ emit_alu_r(ctx, dst, src, BPF_OP(code), off);
emit_zext_ver(ctx, dst);
break;
/* dst = dst >> src */
@@ -733,7 +758,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU | BPF_MOD | BPF_X:
emit_sext(ctx, dst, dst);
emit_sext(ctx, MIPS_R_T4, src);
- emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code));
+ emit_alu_r(ctx, dst, MIPS_R_T4, BPF_OP(code), off);
emit_zext_ver(ctx, dst);
break;
/* dst = imm (64-bit) */
@@ -770,9 +795,9 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU64 | BPF_MUL | BPF_K:
case BPF_ALU64 | BPF_DIV | BPF_K:
case BPF_ALU64 | BPF_MOD | BPF_K:
- if (!valid_alu_i(BPF_OP(code), imm)) {
+ if (!valid_alu_i(BPF_OP(code), imm, off)) {
emit_mov_i(ctx, MIPS_R_T4, imm);
- emit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code));
+ emit_alu_r64(ctx, dst, MIPS_R_T4, BPF_OP(code), off);
} else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
emit_alu_i64(ctx, dst, val, alu);
}
@@ -799,7 +824,7 @@ int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
case BPF_ALU64 | BPF_MUL | BPF_X:
case BPF_ALU64 | BPF_DIV | BPF_X:
case BPF_ALU64 | BPF_MOD | BPF_X:
- emit_alu_r64(ctx, dst, src, BPF_OP(code));
+ emit_alu_r64(ctx, dst, src, BPF_OP(code), off);
break;
/* dst = htole(dst) */
/* dst = htobe(dst) */
|
| 3/2 | 2026/09/11 22:20 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 12374 output: 19 thoughts: 990 Thoughts: **Fuzzing Evaluation: A Straightforward Negative** Okay, let's break this down. We've got a patch series, and the question is whether it justifies fuzzing with syzkaller, given that the target architecture is amd64. This is a pretty standard kernel review, a quick triage to see if the changes warrant further attention. The changes are benign in terms of severity, thankfully. First, I need to see what's being modified. The diff targets files exclusively within `arch/mips/`. Specifically, we are looking at changes related to the MIPS BPF JIT and uasm. Now, let's consult the criteria. Section 2 of the guidelines gives us the negative criteria – conditions that *exclude* the need for fuzzing. One of the key exclusions is, and this jumps out immediately: "Code paths exclusive to architectures other than the target architecture." Bingo. Everything modified is nestled under `arch/mips/`. MIPS code is inherently architecture-specific. Since the target architecture is amd64, this code will be completely unreachable in the target environment. Just to be absolutely sure, I'll quickly double-check that this is indeed the case. The provided diff confirms this. Everything is within the `arch/mips/` directory. No cross-architecture modifications here. To be extra thorough, I'll run a quick `grepper` scan (or equivalent) just to make absolutely certain, even though the diff strongly suggests this is the case. Even a quick search on some keywords confirms this. Therefore, applying Section 2: "Code paths exclusive to architectures other than the target architecture." We are looking at a clear-cut case of `WorthFuzzing = false`. No fuzzing is warranted here. |
| 4/2 | 2026/09/11 22:20 | tool | grepper |
0mArgs:{
"Expression": "emit_div64"
}Results: {
"Output": "arch/mips/net/bpf_jit_comp64.c=158=static void emit_alu_i64(struct jit_context *ctx, u8 dst, s32 imm, u8 op)\n--\narch/mips/net/bpf_jit_comp64.c-200-/* ALU division operation (64-bit) */\narch/mips/net/bpf_jit_comp64.c:201:static void emit_div64(struct jit_context *ctx, u8 dst, u8 src, s16 off)\narch/mips/net/bpf_jit_comp64.c-202-{\n--\narch/mips/net/bpf_jit_comp64.c=235=static void emit_alu_r64(struct jit_context *ctx, u8 dst, u8 src, u8 op,\n--\narch/mips/net/bpf_jit_comp64.c-272-\tcase BPF_DIV:\narch/mips/net/bpf_jit_comp64.c:273:\t\temit_div64(ctx, dst, src, off);\narch/mips/net/bpf_jit_comp64.c-274-\t\tbreak;\n"
} |
| 5/2 | 2026/09/11 22:21 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14081 output: 85 thoughts: 241 Thoughts: **My Triage Assessment: MIPS-Specific Code on an AMD64 Target** Okay, here's the deal. This patch I'm looking at is strictly confined to the `arch/mips/` directory. That's immediately a red flag given that the target architecture for this fuzzing effort is AMD64. Time to apply the triage philosophy. Specifically, Section 2 is what's relevant here. It's pretty clear cut: I need to determine if all modified code falls into a specific set of categories, and if so, WorthFuzzing gets a firm "false." The section points out that unreachable code paths are a valid reason to set "WorthFuzzing" to false. I immediately look for code paths that are architecture-specific, and that is what I see. The patch modifies the MIPS micro-assembler (`arch/mips/mm/uasm*`, `arch/mips/include/asm/uasm.h`) and MIPS BPF JIT compiler (`arch/mips/net/bpf_jit_comp*`) code. Since the build configuration is targeting amd64 and no cross-compilation is present, these code paths are, by definition, structurally unreachable on amd64. There's no way they'll be executed. Given this, I have to conclude: * WorthFuzzing: `false` * FocusSymbols: `[]` * EnableConfigs: `[]` * Reasoning: MIPS-specific code on an AMD64 target means it's unreachable. Okay, that's my call. Now, let's go ahead and `set-results`. |
| 6/2 | 2026/09/11 22:21 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies MIPS micro-assembler routines and MIPS BPF JIT compiler implementations (under arch/mips/). Because the target architecture is amd64, these code paths are exclusive to MIPS and structurally unreachable during fuzzing on amd64.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies MIPS micro-assembler routines and MIPS BPF JIT compiler implementations (under arch/mips/). Because the target architecture is amd64, these code paths are exclusive to MIPS and structurally unreachable during fuzzing on amd64.",
"WorthFuzzing": false
} |
| 7/1 | 2026/09/11 22:21 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|