AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies early boot code (`__init` functions) that parses the `hugetlb_cma` kernel command line parameter and reserves memory. This code is executed only once during system boot and cannot be reached or triggered from user-space via syscalls, making it impossible to fuzz with syzkaller.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 1e8ae102c51fab9d69a21879173209eedcf9ad9a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Jun 26 12:36:27 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt\nindex 5a05b48d1684eb..846940ce2858a8 100644\n--- a/Documentation/admin-guide/kernel-parameters.txt\n+++ b/Documentation/admin-guide/kernel-parameters.txt\n@@ -2064,8 +2064,11 @@ Kernel parameters\n \thugetlb_cma=\t[HW,CMA,EARLY] The size of a CMA area used for allocation\n \t\t\tof gigantic hugepages. Or using node format, the size\n \t\t\tof a CMA area per node can be specified.\n-\t\t\tFormat: nn[KMGTPE] or (node format)\n-\t\t\t\t\u003cnode\u003e:nn[KMGTPE][,\u003cnode\u003e:nn[KMGTPE]]\n+\t\t\tThe size can be an absolute value (e.g., 2G) or a\n+\t\t\tpercentage of the total memory or node memory (e.g., 20%).\n+\t\t\tFormat: nn[KMGTPE] or nn% or (node format)\n+\t\t\t\t\u003cnode\u003e:nn[KMGTPE][,\u003cnode\u003e:nn[KMGTPE]] or\n+\t\t\t\t\u003cnode\u003e:nn%[,\u003cnode\u003e:nn%]\n \n \t\t\tReserve a CMA area of given size and allocate gigantic\n \t\t\thugepages using the CMA allocator. If enabled, the\ndiff --git a/mm/hugetlb_cma.c b/mm/hugetlb_cma.c\nindex 7693ccefd0c64f..b4f8bbe4c62dc4 100644\n--- a/mm/hugetlb_cma.c\n+++ b/mm/hugetlb_cma.c\n@@ -9,6 +9,8 @@\n #include \u003casm/setup.h\u003e\n \n #include \u003clinux/hugetlb.h\u003e\n+#include \u003clinux/memblock.h\u003e\n+#include \u003clinux/math.h\u003e\n #include \"internal.h\"\n #include \"hugetlb_cma.h\"\n \n@@ -18,6 +20,28 @@ static unsigned long hugetlb_cma_size_in_node[MAX_NUMNODES] __initdata;\n static bool hugetlb_cma_only __ro_after_init;\n static unsigned long hugetlb_cma_size __ro_after_init;\n \n+static unsigned int hugetlb_cma_percent __initdata;\n+static unsigned int hugetlb_cma_percent_in_node[MAX_NUMNODES] __initdata;\n+\n+#ifdef CONFIG_NUMA\n+static unsigned long __init memblock_node_memory_size(int nid)\n+{\n+\tstruct memblock_region *reg;\n+\tunsigned long size = 0;\n+\n+\tfor_each_mem_region(reg) {\n+\t\tif (reg-\u003enid == nid)\n+\t\t\tsize += reg-\u003esize;\n+\t}\n+\treturn size;\n+}\n+#else\n+static unsigned long __init memblock_node_memory_size(int nid)\n+{\n+\treturn memblock_phys_mem_size();\n+}\n+#endif\n+\n void hugetlb_cma_free_frozen_folio(struct folio *folio)\n {\n \tWARN_ON_ONCE(!cma_release_frozen(hugetlb_cma[folio_nid(folio)],\n@@ -100,14 +124,27 @@ static int __init cmdline_parse_hugetlb_cma(char *p)\n \t\t\tbreak;\n \n \t\tif (s[count] == ':') {\n+\t\t\tchar *next;\n+\n \t\t\tif (tmp \u003e= MAX_NUMNODES)\n \t\t\t\tbreak;\n \t\t\tnid = array_index_nospec(tmp, MAX_NUMNODES);\n \n \t\t\ts += count + 1;\n-\t\t\ttmp = memparse(s, \u0026s);\n-\t\t\thugetlb_cma_size_in_node[nid] = tmp;\n-\t\t\thugetlb_cma_size += tmp;\n+\t\t\ttmp = memparse(s, \u0026next);\n+\t\t\tif (*next == '%') {\n+\t\t\t\tif (tmp \u003e 100) {\n+\t\t\t\t\tpr_warn(\"hugetlb_cma: invalid percentage %lu for node %d\\n\",\n+\t\t\t\t\t\ttmp, nid);\n+\t\t\t\t\tbreak;\n+\t\t\t\t}\n+\t\t\t\thugetlb_cma_percent_in_node[nid] = tmp;\n+\t\t\t\ts = next + 1;\n+\t\t\t} else {\n+\t\t\t\thugetlb_cma_size_in_node[nid] = tmp;\n+\t\t\t\thugetlb_cma_size += tmp;\n+\t\t\t\ts = next;\n+\t\t\t}\n \n \t\t\t/*\n \t\t\t * Skip the separator if have one, otherwise\n@@ -118,7 +155,17 @@ static int __init cmdline_parse_hugetlb_cma(char *p)\n \t\t\telse\n \t\t\t\tbreak;\n \t\t} else {\n-\t\t\thugetlb_cma_size = memparse(p, \u0026p);\n+\t\t\tchar *next;\n+\n+\t\t\ttmp = memparse(p, \u0026next);\n+\t\t\tif (*next == '%') {\n+\t\t\t\tif (tmp \u003e 100)\n+\t\t\t\t\tpr_warn(\"hugetlb_cma: invalid percentage %lu\\n\", tmp);\n+\t\t\t\telse\n+\t\t\t\t\thugetlb_cma_percent = tmp;\n+\t\t\t} else {\n+\t\t\t\thugetlb_cma_size = tmp;\n+\t\t\t}\n \t\t\tbreak;\n \t\t}\n \t}\n@@ -144,8 +191,34 @@ void __init hugetlb_cma_reserve(void)\n {\n \tunsigned long size, reserved, per_node, order;\n \tbool node_specific_cma_alloc = false;\n+\tbool has_node_specific_param = false;\n \tint nid;\n \n+\tfor (nid = 0; nid \u003c MAX_NUMNODES; nid++) {\n+\t\tif (hugetlb_cma_size_in_node[nid] || hugetlb_cma_percent_in_node[nid]) {\n+\t\t\thas_node_specific_param = true;\n+\t\t\tbreak;\n+\t\t}\n+\t}\n+\n+\tif (has_node_specific_param) {\n+\t\tfor (nid = 0; nid \u003c MAX_NUMNODES; nid++) {\n+\t\t\tif (hugetlb_cma_percent_in_node[nid]) {\n+\t\t\t\tunsigned long node_gfp_mem = memblock_node_memory_size(nid);\n+\t\t\t\tunsigned long s;\n+\n+\t\t\t\ts = mult_frac(node_gfp_mem,\n+\t\t\t\t\t      hugetlb_cma_percent_in_node[nid],\n+\t\t\t\t\t      100);\n+\n+\t\t\t\thugetlb_cma_size_in_node[nid] = s;\n+\t\t\t\thugetlb_cma_size += s;\n+\t\t\t}\n+\t\t}\n+\t} else if (hugetlb_cma_percent) {\n+\t\thugetlb_cma_size = mult_frac(memblock_phys_mem_size(), hugetlb_cma_percent, 100);\n+\t}\n+\n \tif (!hugetlb_cma_size)\n \t\treturn;\n \n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies early boot code (`__init` functions) that parses the `hugetlb_cma` kernel command line parameter and reserves memory. This code is executed only once during system boot and cannot be reached or triggered from user-space via syscalls, making it impossible to fuzz with syzkaller.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 1e8ae102c51fab9d69a21879173209eedcf9ad9a
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Jun 26 12:36:27 2026 +0000

    syz-cluster: applied patch under review

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 5a05b48d1684eb..846940ce2858a8 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2064,8 +2064,11 @@ Kernel parameters
 	hugetlb_cma=	[HW,CMA,EARLY] The size of a CMA area used for allocation
 			of gigantic hugepages. Or using node format, the size
 			of a CMA area per node can be specified.
-			Format: nn[KMGTPE] or (node format)
-				<node>:nn[KMGTPE][,<node>:nn[KMGTPE]]
+			The size can be an absolute value (e.g., 2G) or a
+			percentage of the total memory or node memory (e.g., 20%).
+			Format: nn[KMGTPE] or nn% or (node format)
+				<node>:nn[KMGTPE][,<node>:nn[KMGTPE]] or
+				<node>:nn%[,<node>:nn%]
 
 			Reserve a CMA area of given size and allocate gigantic
 			hugepages using the CMA allocator. If enabled, the
diff --git a/mm/hugetlb_cma.c b/mm/hugetlb_cma.c
index 7693ccefd0c64f..b4f8bbe4c62dc4 100644
--- a/mm/hugetlb_cma.c
+++ b/mm/hugetlb_cma.c
@@ -9,6 +9,8 @@
 #include <asm/setup.h>
 
 #include <linux/hugetlb.h>
+#include <linux/memblock.h>
+#include <linux/math.h>
 #include "internal.h"
 #include "hugetlb_cma.h"
 
@@ -18,6 +20,28 @@ static unsigned long hugetlb_cma_size_in_node[MAX_NUMNODES] __initdata;
 static bool hugetlb_cma_only __ro_after_init;
 static unsigned long hugetlb_cma_size __ro_after_init;
 
+static unsigned int hugetlb_cma_percent __initdata;
+static unsigned int hugetlb_cma_percent_in_node[MAX_NUMNODES] __initdata;
+
+#ifdef CONFIG_NUMA
+static unsigned long __init memblock_node_memory_size(int nid)
+{
+	struct memblock_region *reg;
+	unsigned long size = 0;
+
+	for_each_mem_region(reg) {
+		if (reg->nid == nid)
+			size += reg->size;
+	}
+	return size;
+}
+#else
+static unsigned long __init memblock_node_memory_size(int nid)
+{
+	return memblock_phys_mem_size();
+}
+#endif
+
 void hugetlb_cma_free_frozen_folio(struct folio *folio)
 {
 	WARN_ON_ONCE(!cma_release_frozen(hugetlb_cma[folio_nid(folio)],
@@ -100,14 +124,27 @@ static int __init cmdline_parse_hugetlb_cma(char *p)
 			break;
 
 		if (s[count] == ':') {
+			char *next;
+
 			if (tmp >= MAX_NUMNODES)
 				break;
 			nid = array_index_nospec(tmp, MAX_NUMNODES);
 
 			s += count + 1;
-			tmp = memparse(s, &s);
-			hugetlb_cma_size_in_node[nid] = tmp;
-			hugetlb_cma_size += tmp;
+			tmp = memparse(s, &next);
+			if (*next == '%') {
+				if (tmp > 100) {
+					pr_warn("hugetlb_cma: invalid percentage %lu for node %d\n",
+						tmp, nid);
+					break;
+				}
+				hugetlb_cma_percent_in_node[nid] = tmp;
+				s = next + 1;
+			} else {
+				hugetlb_cma_size_in_node[nid] = tmp;
+				hugetlb_cma_size += tmp;
+				s = next;
+			}
 
 			/*
 			 * Skip the separator if have one, otherwise
@@ -118,7 +155,17 @@ static int __init cmdline_parse_hugetlb_cma(char *p)
 			else
 				break;
 		} else {
-			hugetlb_cma_size = memparse(p, &p);
+			char *next;
+
+			tmp = memparse(p, &next);
+			if (*next == '%') {
+				if (tmp > 100)
+					pr_warn("hugetlb_cma: invalid percentage %lu\n", tmp);
+				else
+					hugetlb_cma_percent = tmp;
+			} else {
+				hugetlb_cma_size = tmp;
+			}
 			break;
 		}
 	}
@@ -144,8 +191,34 @@ void __init hugetlb_cma_reserve(void)
 {
 	unsigned long size, reserved, per_node, order;
 	bool node_specific_cma_alloc = false;
+	bool has_node_specific_param = false;
 	int nid;
 
+	for (nid = 0; nid < MAX_NUMNODES; nid++) {
+		if (hugetlb_cma_size_in_node[nid] || hugetlb_cma_percent_in_node[nid]) {
+			has_node_specific_param = true;
+			break;
+		}
+	}
+
+	if (has_node_specific_param) {
+		for (nid = 0; nid < MAX_NUMNODES; nid++) {
+			if (hugetlb_cma_percent_in_node[nid]) {
+				unsigned long node_gfp_mem = memblock_node_memory_size(nid);
+				unsigned long s;
+
+				s = mult_frac(node_gfp_mem,
+					      hugetlb_cma_percent_in_node[nid],
+					      100);
+
+				hugetlb_cma_size_in_node[nid] = s;
+				hugetlb_cma_size += s;
+			}
+		}
+	} else if (hugetlb_cma_percent) {
+		hugetlb_cma_size = mult_frac(memblock_phys_mem_size(), hugetlb_cma_percent, 100);
+	}
+
 	if (!hugetlb_cma_size)
 		return;
 

gemini-3.1-pro-preview

null

null

							input: 3409
							output: 25
							thoughts: 276
						

**Analyzing the `hugetlb_cma` Patch for Fuzzing Vulnerabilities**

Okay, so I'm looking at this patch that tweaks `mm/hugetlb_cma.c`. It looks like it's adding the ability to specify the `hugetlb_cma` kernel parameter as a percentage, which is interesting. The code modifications focus on `cmdline_parse_hugetlb_cma` and `hugetlb_cma_reserve`. I notice these functions are marked as `__init` and `__initdata`, which immediately sets off a red flag in my mind regarding fuzzing.

My primary concern, of course, is whether Syzkaller, my go-to fuzzing tool, can actually reach this code. Since these functions are involved in parsing the kernel command line parameters and reserving memory during early boot, I can immediately see a potential issue. Syzkaller primarily operates by sending syscalls from user-space, which isn't going to interact with the early boot process. Thus, it is unlikely to directly trigger any potential issues through this code path.

But, I need to be thorough. I'm wondering if there's any other way this code could be reached from user-space. I need to know if the function is registered somewhere other than through `early_param`. I'll confirm that `cmdline_parse_hugetlb_cma` is indeed registered using `early_param` based on its naming convention. Let me just double-check that in `mm/hugetlb_cma.c` to be certain.

{
  "Expression": "cmdline_parse_hugetlb_cma"
}

{
  "Output": "mm/hugetlb_cma.c=84=hugetlb_cma_alloc_bootmem(struct hstate *h, int *nid, bool node_exact)\n--\nmm/hugetlb_cma.c-115-\nmm/hugetlb_cma.c:116:static int __init cmdline_parse_hugetlb_cma(char *p)\nmm/hugetlb_cma.c-117-{\n--\nmm/hugetlb_cma.c-175-\nmm/hugetlb_cma.c:176:early_param(\"hugetlb_cma\", cmdline_parse_hugetlb_cma);\nmm/hugetlb_cma.c-177-\nmm/hugetlb_cma.c:178:static int __init cmdline_parse_hugetlb_cma_only(char *p)\nmm/hugetlb_cma.c-179-{\n--\nmm/hugetlb_cma.c-182-\nmm/hugetlb_cma.c:183:early_param(\"hugetlb_cma_only\", cmdline_parse_hugetlb_cma_only);\nmm/hugetlb_cma.c-184-\n"
}

gemini-3.1-pro-preview

null

null

							input: 4376
							output: 95
							thoughts: 149
						

**My Assessment of the Patch's Fuzzability**

Okay, so we're looking at `early_param`, which immediately flags this as a potential non-starter. This is *strictly* early boot code, and that's a key point. Syzkaller, my go-to fuzzing tool, isn't designed to touch that. It can't fuzz early boot code or, crucially, kernel command line parameters. Since this patch revolves around `hugetlb_cma` which is a kernel command-line parameter, it's pretty clear it's not a good fit for fuzzing.

Let me just double-check, though. Always good to be thorough. Is there *any* other possible path to trigger this code? Nope. It's all `__init` and `__initdata`, making it only executable during initial bootup. The patch's impact is in modifying this initial parsing and memory reservation behavior which occurs only once. User-space interaction via syscalls is out of the question.

Therefore, given these constraints, the value of this patch is definitely not worth fuzzing.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies early boot code (`__init` functions) that parses the `hugetlb_cma` kernel command line parameter and reserves memory. This code is executed only once during system boot and cannot be reached or triggered from user-space via syscalls, making it impossible to fuzz with syzkaller.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies early boot code (`__init` functions) that parses the `hugetlb_cma` kernel command line parameter and reserves memory. This code is executed only once during system boot and cannot be reached or triggered from user-space via syscalls, making it impossible to fuzz with syzkaller.",
  "WorthFuzzing": false
}