AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/06/29 10:58 flow patch-triage
0m Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space selftests (tools/testing/selftests/mm/*) and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}
1/1 2026/06/29 10:58 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit bcbcf7709a5aa198cb91a96fc476bde58aa263aa\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jun 29 10:58:37 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/mm/pkey-helpers.h b/tools/testing/selftests/mm/pkey-helpers.h\nindex 2c377f4e9df1d3..46a8a1878dc1fd 100644\n--- a/tools/testing/selftests/mm/pkey-helpers.h\n+++ b/tools/testing/selftests/mm/pkey-helpers.h\n@@ -68,7 +68,9 @@ static inline void sigsafe_printf(const char *format, ...)\n #define dprintf3(args...) dprintf_level(3, args)\n #define dprintf4(args...) dprintf_level(4, args)\n \n-extern void abort_hooks(void);\n+void tracing_on(void);\n+void tracing_off(void);\n+void abort_hooks(void);\n #define pkey_assert(condition) do {\t\t\\\n \tif (!(condition)) {\t\t\t\\\n \t\tdprintf0(\"# assert() at %s::%d test_nr: %d iteration: %d\\n\", \\\ndiff --git a/tools/testing/selftests/mm/pkey-powerpc.h b/tools/testing/selftests/mm/pkey-powerpc.h\nindex 17bf2d1b0192e0..2ce85580b40487 100644\n--- a/tools/testing/selftests/mm/pkey-powerpc.h\n+++ b/tools/testing/selftests/mm/pkey-powerpc.h\n@@ -126,7 +126,7 @@ static inline void *malloc_pkey_with_mprotect_subpage(long size, int prot, u16 p\n \t\t\tsize, prot, pkey);\n \tpkey_assert(pkey \u003c NR_PKEYS);\n \tptr = mmap(NULL, size, prot, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);\n-\tpkey_assert(ptr != (void *)-1);\n+\tpkey_assert(ptr != MAP_FAILED);\n \n \tret = syscall(__NR_subpage_prot, ptr, size, NULL);\n \tif (ret) {\ndiff --git a/tools/testing/selftests/mm/pkey_sighandler_tests.c b/tools/testing/selftests/mm/pkey_sighandler_tests.c\nindex 302fef54049c87..f30c9965a561d9 100644\n--- a/tools/testing/selftests/mm/pkey_sighandler_tests.c\n+++ b/tools/testing/selftests/mm/pkey_sighandler_tests.c\n@@ -19,7 +19,6 @@\n #include \u003cstdint.h\u003e\n #include \u003cstdbool.h\u003e\n #include \u003csignal.h\u003e\n-#include \u003cassert.h\u003e\n #include \u003cstdlib.h\u003e\n #include \u003csys/mman.h\u003e\n #include \u003csys/types.h\u003e\n@@ -36,6 +35,10 @@ static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;\n static pthread_cond_t cond = PTHREAD_COND_INITIALIZER;\n static siginfo_t siginfo = {0};\n \n+int iteration_nr = 1;\n+int test_nr;\n+int dprint_in_signal;\n+\n /*\n  * We need to use inline assembly instead of glibc's syscall because glibc's\n  * syscall will attempt to access the PLT in order to call a library function\n@@ -207,22 +210,22 @@ static void test_sigsegv_handler_with_pkey0_disabled(void)\n \tstruct sigaction sa;\n \tpthread_attr_t attr;\n \tpthread_t thr;\n+\tint ret;\n \n \tsa.sa_flags = SA_SIGINFO;\n \n \tsa.sa_sigaction = sigsegv_handler;\n \tsigemptyset(\u0026sa.sa_mask);\n-\tif (sigaction(SIGSEGV, \u0026sa, NULL) == -1) {\n-\t\tperror(\"sigaction\");\n-\t\texit(EXIT_FAILURE);\n-\t}\n+\tret = sigaction(SIGSEGV, \u0026sa, NULL);\n+\tpkey_assert(ret == 0);\n \n \tmemset(\u0026siginfo, 0, sizeof(siginfo));\n \n \tpthread_attr_init(\u0026attr);\n \tpthread_attr_setdetachstate(\u0026attr, PTHREAD_CREATE_DETACHED);\n \n-\tpthread_create(\u0026thr, \u0026attr, thread_segv_with_pkey0_disabled, NULL);\n+\tret = pthread_create(\u0026thr, \u0026attr, thread_segv_with_pkey0_disabled, NULL);\n+\tpkey_assert(ret == 0);\n \n \tpthread_mutex_lock(\u0026mutex);\n \twhile (siginfo.si_signo == 0)\n@@ -247,22 +250,22 @@ static void test_sigsegv_handler_cannot_access_stack(void)\n \tstruct sigaction sa;\n \tpthread_attr_t attr;\n \tpthread_t thr;\n+\tint ret;\n \n \tsa.sa_flags = SA_SIGINFO;\n \n \tsa.sa_sigaction = sigsegv_handler;\n \tsigemptyset(\u0026sa.sa_mask);\n-\tif (sigaction(SIGSEGV, \u0026sa, NULL) == -1) {\n-\t\tperror(\"sigaction\");\n-\t\texit(EXIT_FAILURE);\n-\t}\n+\tret = sigaction(SIGSEGV, \u0026sa, NULL);\n+\tpkey_assert(ret == 0);\n \n \tmemset(\u0026siginfo, 0, sizeof(siginfo));\n \n \tpthread_attr_init(\u0026attr);\n \tpthread_attr_setdetachstate(\u0026attr, PTHREAD_CREATE_DETACHED);\n \n-\tpthread_create(\u0026thr, \u0026attr, thread_segv_pkuerr_stack, NULL);\n+\tret = pthread_create(\u0026thr, \u0026attr, thread_segv_pkuerr_stack, NULL);\n+\tpkey_assert(ret == 0);\n \n \tpthread_mutex_lock(\u0026mutex);\n \twhile (siginfo.si_signo == 0)\n@@ -288,21 +291,20 @@ static void test_sigsegv_handler_with_different_pkey_for_stack(void)\n \tint parent_pid = 0;\n \tint child_pid = 0;\n \tu64 pkey_reg;\n+\tlong ret;\n \n \tsa.sa_flags = SA_SIGINFO | SA_ONSTACK;\n \n \tsa.sa_sigaction = sigsegv_handler;\n \n \tsigemptyset(\u0026sa.sa_mask);\n-\tif (sigaction(SIGSEGV, \u0026sa, NULL) == -1) {\n-\t\tperror(\"sigaction\");\n-\t\texit(EXIT_FAILURE);\n-\t}\n+\tret = sigaction(SIGSEGV, \u0026sa, NULL);\n+\tpkey_assert(ret == 0);\n \n \tstack = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,\n \t\t     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);\n \n-\tassert(stack != MAP_FAILED);\n+\tpkey_assert(stack != MAP_FAILED);\n \n \t/* Allow access to MPK 0 and MPK 1 */\n \tpkey_reg = pkey_reg_restrictive_default();\n@@ -317,13 +319,14 @@ static void test_sigsegv_handler_with_different_pkey_for_stack(void)\n \t/* Set up alternate signal stack that will use the default MPK */\n \tsigstack.ss_sp = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,\n \t\t\t      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);\n+\tpkey_assert(sigstack.ss_sp != MAP_FAILED);\n \tsigstack.ss_flags = 0;\n \tsigstack.ss_size = STACK_SIZE;\n \n \tmemset(\u0026siginfo, 0, sizeof(siginfo));\n \n \t/* Use clone to avoid newer glibcs using rseq on new threads */\n-\tlong ret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |\n+\tret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |\n \t\t\t     CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM |\n \t\t\t     CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID |\n \t\t\t     CLONE_DETACHED,\n@@ -333,7 +336,7 @@ static void test_sigsegv_handler_with_different_pkey_for_stack(void)\n \n \tif (ret \u003c 0) {\n \t\terrno = -ret;\n-\t\tperror(\"clone\");\n+\t\tpkey_assert(0);\n \t} else if (ret == 0) {\n \t\tthread_segv_maperr_ptr(\u0026sigstack);\n \t\tsyscall_raw(SYS_exit, 0, 0, 0, 0, 0, 0);\n@@ -358,6 +361,7 @@ static void test_pkru_preserved_after_sigusr1(void)\n {\n \tstruct sigaction sa;\n \tu64 pkey_reg;\n+\tint ret;\n \n \t/* Allow access to MPK 0 and an arbitrary set of keys */\n \tpkey_reg = pkey_reg_restrictive_default();\n@@ -369,10 +373,8 @@ static void test_pkru_preserved_after_sigusr1(void)\n \n \tsa.sa_sigaction = sigusr1_handler;\n \tsigemptyset(\u0026sa.sa_mask);\n-\tif (sigaction(SIGUSR1, \u0026sa, NULL) == -1) {\n-\t\tperror(\"sigaction\");\n-\t\texit(EXIT_FAILURE);\n-\t}\n+\tret = sigaction(SIGUSR1, \u0026sa, NULL);\n+\tpkey_assert(ret == 0);\n \n \tmemset(\u0026siginfo, 0, sizeof(siginfo));\n \n@@ -444,6 +446,13 @@ static void test_pkru_sigreturn(void)\n \tint parent_pid = 0;\n \tint child_pid = 0;\n \tu64 pkey_reg;\n+\tlong ret;\n+\n+\t/*\n+\t * SIGSEGV handler is reset to SIG_DFL below; turn tracing off first\n+\t * so a crash does not leave ftrace enabled.\n+\t */\n+\ttracing_off();\n \n \tsa.sa_handler = SIG_DFL;\n \tsa.sa_flags = 0;\n@@ -453,24 +462,20 @@ static void test_pkru_sigreturn(void)\n \t * For this testcase, we do not want to handle SIGSEGV. Reset handler\n \t * to default so that the application can crash if it receives SIGSEGV.\n \t */\n-\tif (sigaction(SIGSEGV, \u0026sa, NULL) == -1) {\n-\t\tperror(\"sigaction\");\n-\t\texit(EXIT_FAILURE);\n-\t}\n+\tret = sigaction(SIGSEGV, \u0026sa, NULL);\n+\tpkey_assert(ret == 0);\n \n \tsa.sa_flags = SA_SIGINFO | SA_ONSTACK;\n \tsa.sa_sigaction = sigusr2_handler;\n \tsigemptyset(\u0026sa.sa_mask);\n \n-\tif (sigaction(SIGUSR2, \u0026sa, NULL) == -1) {\n-\t\tperror(\"sigaction\");\n-\t\texit(EXIT_FAILURE);\n-\t}\n+\tret = sigaction(SIGUSR2, \u0026sa, NULL);\n+\tpkey_assert(ret == 0);\n \n \tstack = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,\n \t\t     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);\n \n-\tassert(stack != MAP_FAILED);\n+\tpkey_assert(stack != MAP_FAILED);\n \n \t/*\n \t * Allow access to MPK 0 and MPK 2. The child thread (to be created\n@@ -490,11 +495,12 @@ static void test_pkru_sigreturn(void)\n \t/* Set up alternate signal stack that will use the default MPK */\n \tsigstack.ss_sp = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,\n \t\t\t      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);\n+\tpkey_assert(sigstack.ss_sp != MAP_FAILED);\n \tsigstack.ss_flags = 0;\n \tsigstack.ss_size = STACK_SIZE;\n \n \t/* Use clone to avoid newer glibcs using rseq on new threads */\n-\tlong ret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |\n+\tret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |\n \t\t\t     CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM |\n \t\t\t     CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID |\n \t\t\t     CLONE_DETACHED,\n@@ -504,7 +510,7 @@ static void test_pkru_sigreturn(void)\n \n \tif (ret \u003c 0) {\n \t\terrno = -ret;\n-\t\tperror(\"clone\");\n+\t\tpkey_assert(0);\n \t}  else if (ret == 0) {\n \t\tthread_sigusr2_self(\u0026sigstack);\n \t\tsyscall_raw(SYS_exit, 0, 0, 0, 0, 0, 0);\n@@ -530,16 +536,17 @@ static void (*pkey_tests[])(void) = {\n \n int main(int argc, char *argv[])\n {\n-\tint i;\n-\n \tksft_print_header();\n \tksft_set_plan(ARRAY_SIZE(pkey_tests));\n \n \tif (!is_pkeys_supported())\n \t\tksft_exit_skip(\"pkeys not supported\\n\");\n \n-\tfor (i = 0; i \u003c ARRAY_SIZE(pkey_tests); i++)\n-\t\t(*pkey_tests[i])();\n+\tfor (test_nr = 0; test_nr \u003c ARRAY_SIZE(pkey_tests); test_nr++) {\n+\t\ttracing_on();\n+\t\t(*pkey_tests[test_nr])();\n+\t\ttracing_off();\n+\t}\n \n \tksft_finished();\n \treturn 0;\ndiff --git a/tools/testing/selftests/mm/pkey_util.c b/tools/testing/selftests/mm/pkey_util.c\nindex 255b332f7a08b2..abf708d6575ec1 100644\n--- a/tools/testing/selftests/mm/pkey_util.c\n+++ b/tools/testing/selftests/mm/pkey_util.c\n@@ -2,9 +2,95 @@\n #define __SANE_USERSPACE_TYPES__\n #include \u003csys/syscall.h\u003e\n #include \u003cunistd.h\u003e\n+#include \u003cfcntl.h\u003e\n+#include \u003cstdio.h\u003e\n+#include \u003cstring.h\u003e\n \n #include \"pkey-helpers.h\"\n \n+#if CONTROL_TRACING \u003e 0\n+static void cat_into_file(char *str, char *file)\n+{\n+\tint fd = open(file, O_RDWR);\n+\tint ret;\n+\n+\tdprintf2(\"%s(): writing '%s' to '%s'\\n\", __func__, str, file);\n+\t/*\n+\t * these need to be raw because they are called under\n+\t * pkey_assert()\n+\t */\n+\tif (fd \u003c 0) {\n+\t\tfprintf(stderr, \"error opening '%s'\\n\", str);\n+\t\tperror(\"error: \");\n+\t\texit(__LINE__);\n+\t}\n+\n+\tret = write(fd, str, strlen(str));\n+\tif (ret != strlen(str)) {\n+\t\tperror(\"write to file failed\");\n+\t\tfprintf(stderr, \"filename: '%s' str: '%s'\\n\", file, str);\n+\t\texit(__LINE__);\n+\t}\n+\tclose(fd);\n+}\n+\n+static int warned_tracing;\n+static int tracing_root_ok(void)\n+{\n+\tif (geteuid() != 0) {\n+\t\tif (!warned_tracing)\n+\t\t\tfprintf(stderr, \"WARNING: not run as root, \"\n+\t\t\t\t\t\"can not do tracing control\\n\");\n+\t\twarned_tracing = 1;\n+\t\treturn 0;\n+\t}\n+\treturn 1;\n+}\n+#endif\n+\n+void tracing_on(void)\n+{\n+#if CONTROL_TRACING \u003e 0\n+#define TRACEDIR \"/sys/kernel/tracing\"\n+\tchar pidstr[32];\n+\n+\tif (!tracing_root_ok())\n+\t\treturn;\n+\n+\tsprintf(pidstr, \"%d\", getpid());\n+\tcat_into_file(\"0\", TRACEDIR \"/tracing_on\");\n+\tcat_into_file(\"\\n\", TRACEDIR \"/trace\");\n+\tif (1) {\n+\t\tcat_into_file(\"function_graph\", TRACEDIR \"/current_tracer\");\n+\t\tcat_into_file(\"1\", TRACEDIR \"/options/funcgraph-proc\");\n+\t} else {\n+\t\tcat_into_file(\"nop\", TRACEDIR \"/current_tracer\");\n+\t}\n+\tcat_into_file(pidstr, TRACEDIR \"/set_ftrace_pid\");\n+\tcat_into_file(\"1\", TRACEDIR \"/tracing_on\");\n+\tdprintf1(\"enabled tracing\\n\");\n+#endif\n+}\n+\n+void tracing_off(void)\n+{\n+#if CONTROL_TRACING \u003e 0\n+\tif (!tracing_root_ok())\n+\t\treturn;\n+\tcat_into_file(\"0\", \"/sys/kernel/tracing/tracing_on\");\n+#endif\n+}\n+\n+void abort_hooks(void)\n+{\n+\tfflush(stdout);\n+\tfprintf(stderr, \"running %s()...\\n\", __func__);\n+\ttracing_off();\n+#ifdef SLEEP_ON_ABORT\n+\tsleep(SLEEP_ON_ABORT);\n+#endif\n+}\n+\n int sys_pkey_alloc(unsigned long flags, unsigned long init_val)\n {\n \tint ret = syscall(SYS_pkey_alloc, flags, init_val);\ndiff --git a/tools/testing/selftests/mm/protection_keys.c b/tools/testing/selftests/mm/protection_keys.c\nindex 9a6d954ee37126..96a4eb26f32603 100644\n--- a/tools/testing/selftests/mm/protection_keys.c\n+++ b/tools/testing/selftests/mm/protection_keys.c\n@@ -62,89 +62,6 @@ noinline int read_ptr(int *ptr)\n \treturn *ptr;\n }\n \n-#if CONTROL_TRACING \u003e 0\n-static void cat_into_file(char *str, char *file)\n-{\n-\tint fd = open(file, O_RDWR);\n-\tint ret;\n-\n-\tdprintf2(\"%s(): writing '%s' to '%s'\\n\", __func__, str, file);\n-\t/*\n-\t * these need to be raw because they are called under\n-\t * pkey_assert()\n-\t */\n-\tif (fd \u003c 0) {\n-\t\tfprintf(stderr, \"error opening '%s'\\n\", str);\n-\t\tperror(\"error: \");\n-\t\texit(__LINE__);\n-\t}\n-\n-\tret = write(fd, str, strlen(str));\n-\tif (ret != strlen(str)) {\n-\t\tperror(\"write to file failed\");\n-\t\tfprintf(stderr, \"filename: '%s' str: '%s'\\n\", file, str);\n-\t\texit(__LINE__);\n-\t}\n-\tclose(fd);\n-}\n-\n-static int warned_tracing;\n-static int tracing_root_ok(void)\n-{\n-\tif (geteuid() != 0) {\n-\t\tif (!warned_tracing)\n-\t\t\tfprintf(stderr, \"WARNING: not run as root, \"\n-\t\t\t\t\t\"can not do tracing control\\n\");\n-\t\twarned_tracing = 1;\n-\t\treturn 0;\n-\t}\n-\treturn 1;\n-}\n-#endif\n-\n-static void tracing_on(void)\n-{\n-#if CONTROL_TRACING \u003e 0\n-#define TRACEDIR \"/sys/kernel/tracing\"\n-\tchar pidstr[32];\n-\n-\tif (!tracing_root_ok())\n-\t\treturn;\n-\n-\tsprintf(pidstr, \"%d\", getpid());\n-\tcat_into_file(\"0\", TRACEDIR \"/tracing_on\");\n-\tcat_into_file(\"\\n\", TRACEDIR \"/trace\");\n-\tif (1) {\n-\t\tcat_into_file(\"function_graph\", TRACEDIR \"/current_tracer\");\n-\t\tcat_into_file(\"1\", TRACEDIR \"/options/funcgraph-proc\");\n-\t} else {\n-\t\tcat_into_file(\"nop\", TRACEDIR \"/current_tracer\");\n-\t}\n-\tcat_into_file(pidstr, TRACEDIR \"/set_ftrace_pid\");\n-\tcat_into_file(\"1\", TRACEDIR \"/tracing_on\");\n-\tdprintf1(\"enabled tracing\\n\");\n-#endif\n-}\n-\n-static void tracing_off(void)\n-{\n-#if CONTROL_TRACING \u003e 0\n-\tif (!tracing_root_ok())\n-\t\treturn;\n-\tcat_into_file(\"0\", \"/sys/kernel/tracing/tracing_on\");\n-#endif\n-}\n-\n-void abort_hooks(void)\n-{\n-\tfflush(stdout);\n-\tfprintf(stderr, \"running %s()...\\n\", __func__);\n-\ttracing_off();\n-#ifdef SLEEP_ON_ABORT\n-\tsleep(SLEEP_ON_ABORT);\n-#endif\n-}\n-\n /*\n  * This attempts to have roughly a page of instructions followed by a few\n  * instructions that do a write, and another page of instructions.  That\n@@ -669,7 +586,7 @@ static void *malloc_pkey_with_mprotect(long size, int prot, u16 pkey)\n \t\t\tsize, prot, pkey);\n \tpkey_assert(pkey \u003c NR_PKEYS);\n \tptr = mmap(NULL, size, prot, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);\n-\tpkey_assert(ptr != (void *)-1);\n+\tpkey_assert(ptr != MAP_FAILED);\n \tret = mprotect_pkey((void *)ptr, PAGE_SIZE, prot, pkey);\n \tpkey_assert(!ret);\n \trecord_pkey_malloc(ptr, size, prot);\n@@ -692,7 +609,7 @@ static void *malloc_pkey_anon_huge(long size, int prot, u16 pkey)\n \t */\n \tsize = ALIGN_UP(size, HPAGE_SIZE * 2);\n \tptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);\n-\tpkey_assert(ptr != (void *)-1);\n+\tpkey_assert(ptr != MAP_FAILED);\n \trecord_pkey_malloc(ptr, size, prot);\n \tmprotect_pkey(ptr, size, prot, pkey);\n \n@@ -750,7 +667,7 @@ static void *malloc_pkey_hugetlb(long size, int prot, u16 pkey)\n \tsize = ALIGN_UP(size, HPAGE_SIZE * 2);\n \tpkey_assert(pkey \u003c NR_PKEYS);\n \tptr = mmap(NULL, size, PROT_NONE, flags, -1, 0);\n-\tpkey_assert(ptr != (void *)-1);\n+\tpkey_assert(ptr != MAP_FAILED);\n \tmprotect_pkey(ptr, size, prot, pkey);\n \n \trecord_pkey_malloc(ptr, size, prot);\n@@ -779,7 +696,7 @@ static void *malloc_pkey(long size, int prot, u16 pkey)\n \t\tpkey_assert(malloc_type \u003c nr_malloc_types);\n \n \t\tret = pkey_malloc[malloc_type](size, prot, pkey);\n-\t\tpkey_assert(ret != (void *)-1);\n+\t\tpkey_assert(ret != MAP_FAILED);\n \n \t\tmalloc_type++;\n \t\tif (malloc_type \u003e= nr_malloc_types)\n@@ -1197,6 +1114,7 @@ static void arch_force_pkey_reg_init(void)\n \t * doing the XSAVE size enumeration dance.\n \t */\n \tbuf = mmap(NULL, 1*MB, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);\n+\tpkey_assert(buf != MAP_FAILED);\n \n \t/* These __builtins require compiling with -mxsave */\n \n@@ -1763,7 +1681,8 @@ int main(void)\n \t\tksft_print_msg(\"running PKEY tests for unsupported CPU/OS\\n\");\n \n \t\tptr  = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);\n-\t\tassert(ptr != (void *)-1);\n+\t\tif (ptr == MAP_FAILED)\n+\t\t\tksft_exit_fail_perror(\"mmap\");\n \t\ttest_mprotect_pkey_on_unsupported_cpu(ptr, 1);\n \t\tksft_test_result_pass(\"pkey on unsupported CPU/OS\\n\");\n \t\tksft_finished();\n"
}
2/1 2026/06/29 10:58 agent patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space selftests (tools/testing/selftests/mm/*) and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit bcbcf7709a5aa198cb91a96fc476bde58aa263aa
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jun 29 10:58:37 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/mm/pkey-helpers.h b/tools/testing/selftests/mm/pkey-helpers.h
index 2c377f4e9df1d3..46a8a1878dc1fd 100644
--- a/tools/testing/selftests/mm/pkey-helpers.h
+++ b/tools/testing/selftests/mm/pkey-helpers.h
@@ -68,7 +68,9 @@ static inline void sigsafe_printf(const char *format, ...)
 #define dprintf3(args...) dprintf_level(3, args)
 #define dprintf4(args...) dprintf_level(4, args)
 
-extern void abort_hooks(void);
+void tracing_on(void);
+void tracing_off(void);
+void abort_hooks(void);
 #define pkey_assert(condition) do {		\
 	if (!(condition)) {			\
 		dprintf0("# assert() at %s::%d test_nr: %d iteration: %d\n", \
diff --git a/tools/testing/selftests/mm/pkey-powerpc.h b/tools/testing/selftests/mm/pkey-powerpc.h
index 17bf2d1b0192e0..2ce85580b40487 100644
--- a/tools/testing/selftests/mm/pkey-powerpc.h
+++ b/tools/testing/selftests/mm/pkey-powerpc.h
@@ -126,7 +126,7 @@ static inline void *malloc_pkey_with_mprotect_subpage(long size, int prot, u16 p
 			size, prot, pkey);
 	pkey_assert(pkey < NR_PKEYS);
 	ptr = mmap(NULL, size, prot, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
-	pkey_assert(ptr != (void *)-1);
+	pkey_assert(ptr != MAP_FAILED);
 
 	ret = syscall(__NR_subpage_prot, ptr, size, NULL);
 	if (ret) {
diff --git a/tools/testing/selftests/mm/pkey_sighandler_tests.c b/tools/testing/selftests/mm/pkey_sighandler_tests.c
index 302fef54049c87..f30c9965a561d9 100644
--- a/tools/testing/selftests/mm/pkey_sighandler_tests.c
+++ b/tools/testing/selftests/mm/pkey_sighandler_tests.c
@@ -19,7 +19,6 @@
 #include <stdint.h>
 #include <stdbool.h>
 #include <signal.h>
-#include <assert.h>
 #include <stdlib.h>
 #include <sys/mman.h>
 #include <sys/types.h>
@@ -36,6 +35,10 @@ static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_cond_t cond = PTHREAD_COND_INITIALIZER;
 static siginfo_t siginfo = {0};
 
+int iteration_nr = 1;
+int test_nr;
+int dprint_in_signal;
+
 /*
  * We need to use inline assembly instead of glibc's syscall because glibc's
  * syscall will attempt to access the PLT in order to call a library function
@@ -207,22 +210,22 @@ static void test_sigsegv_handler_with_pkey0_disabled(void)
 	struct sigaction sa;
 	pthread_attr_t attr;
 	pthread_t thr;
+	int ret;
 
 	sa.sa_flags = SA_SIGINFO;
 
 	sa.sa_sigaction = sigsegv_handler;
 	sigemptyset(&sa.sa_mask);
-	if (sigaction(SIGSEGV, &sa, NULL) == -1) {
-		perror("sigaction");
-		exit(EXIT_FAILURE);
-	}
+	ret = sigaction(SIGSEGV, &sa, NULL);
+	pkey_assert(ret == 0);
 
 	memset(&siginfo, 0, sizeof(siginfo));
 
 	pthread_attr_init(&attr);
 	pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
 
-	pthread_create(&thr, &attr, thread_segv_with_pkey0_disabled, NULL);
+	ret = pthread_create(&thr, &attr, thread_segv_with_pkey0_disabled, NULL);
+	pkey_assert(ret == 0);
 
 	pthread_mutex_lock(&mutex);
 	while (siginfo.si_signo == 0)
@@ -247,22 +250,22 @@ static void test_sigsegv_handler_cannot_access_stack(void)
 	struct sigaction sa;
 	pthread_attr_t attr;
 	pthread_t thr;
+	int ret;
 
 	sa.sa_flags = SA_SIGINFO;
 
 	sa.sa_sigaction = sigsegv_handler;
 	sigemptyset(&sa.sa_mask);
-	if (sigaction(SIGSEGV, &sa, NULL) == -1) {
-		perror("sigaction");
-		exit(EXIT_FAILURE);
-	}
+	ret = sigaction(SIGSEGV, &sa, NULL);
+	pkey_assert(ret == 0);
 
 	memset(&siginfo, 0, sizeof(siginfo));
 
 	pthread_attr_init(&attr);
 	pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
 
-	pthread_create(&thr, &attr, thread_segv_pkuerr_stack, NULL);
+	ret = pthread_create(&thr, &attr, thread_segv_pkuerr_stack, NULL);
+	pkey_assert(ret == 0);
 
 	pthread_mutex_lock(&mutex);
 	while (siginfo.si_signo == 0)
@@ -288,21 +291,20 @@ static void test_sigsegv_handler_with_different_pkey_for_stack(void)
 	int parent_pid = 0;
 	int child_pid = 0;
 	u64 pkey_reg;
+	long ret;
 
 	sa.sa_flags = SA_SIGINFO | SA_ONSTACK;
 
 	sa.sa_sigaction = sigsegv_handler;
 
 	sigemptyset(&sa.sa_mask);
-	if (sigaction(SIGSEGV, &sa, NULL) == -1) {
-		perror("sigaction");
-		exit(EXIT_FAILURE);
-	}
+	ret = sigaction(SIGSEGV, &sa, NULL);
+	pkey_assert(ret == 0);
 
 	stack = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,
 		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 
-	assert(stack != MAP_FAILED);
+	pkey_assert(stack != MAP_FAILED);
 
 	/* Allow access to MPK 0 and MPK 1 */
 	pkey_reg = pkey_reg_restrictive_default();
@@ -317,13 +319,14 @@ static void test_sigsegv_handler_with_different_pkey_for_stack(void)
 	/* Set up alternate signal stack that will use the default MPK */
 	sigstack.ss_sp = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,
 			      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	pkey_assert(sigstack.ss_sp != MAP_FAILED);
 	sigstack.ss_flags = 0;
 	sigstack.ss_size = STACK_SIZE;
 
 	memset(&siginfo, 0, sizeof(siginfo));
 
 	/* Use clone to avoid newer glibcs using rseq on new threads */
-	long ret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |
+	ret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |
 			     CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM |
 			     CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID |
 			     CLONE_DETACHED,
@@ -333,7 +336,7 @@ static void test_sigsegv_handler_with_different_pkey_for_stack(void)
 
 	if (ret < 0) {
 		errno = -ret;
-		perror("clone");
+		pkey_assert(0);
 	} else if (ret == 0) {
 		thread_segv_maperr_ptr(&sigstack);
 		syscall_raw(SYS_exit, 0, 0, 0, 0, 0, 0);
@@ -358,6 +361,7 @@ static void test_pkru_preserved_after_sigusr1(void)
 {
 	struct sigaction sa;
 	u64 pkey_reg;
+	int ret;
 
 	/* Allow access to MPK 0 and an arbitrary set of keys */
 	pkey_reg = pkey_reg_restrictive_default();
@@ -369,10 +373,8 @@ static void test_pkru_preserved_after_sigusr1(void)
 
 	sa.sa_sigaction = sigusr1_handler;
 	sigemptyset(&sa.sa_mask);
-	if (sigaction(SIGUSR1, &sa, NULL) == -1) {
-		perror("sigaction");
-		exit(EXIT_FAILURE);
-	}
+	ret = sigaction(SIGUSR1, &sa, NULL);
+	pkey_assert(ret == 0);
 
 	memset(&siginfo, 0, sizeof(siginfo));
 
@@ -444,6 +446,13 @@ static void test_pkru_sigreturn(void)
 	int parent_pid = 0;
 	int child_pid = 0;
 	u64 pkey_reg;
+	long ret;
+
+	/*
+	 * SIGSEGV handler is reset to SIG_DFL below; turn tracing off first
+	 * so a crash does not leave ftrace enabled.
+	 */
+	tracing_off();
 
 	sa.sa_handler = SIG_DFL;
 	sa.sa_flags = 0;
@@ -453,24 +462,20 @@ static void test_pkru_sigreturn(void)
 	 * For this testcase, we do not want to handle SIGSEGV. Reset handler
 	 * to default so that the application can crash if it receives SIGSEGV.
 	 */
-	if (sigaction(SIGSEGV, &sa, NULL) == -1) {
-		perror("sigaction");
-		exit(EXIT_FAILURE);
-	}
+	ret = sigaction(SIGSEGV, &sa, NULL);
+	pkey_assert(ret == 0);
 
 	sa.sa_flags = SA_SIGINFO | SA_ONSTACK;
 	sa.sa_sigaction = sigusr2_handler;
 	sigemptyset(&sa.sa_mask);
 
-	if (sigaction(SIGUSR2, &sa, NULL) == -1) {
-		perror("sigaction");
-		exit(EXIT_FAILURE);
-	}
+	ret = sigaction(SIGUSR2, &sa, NULL);
+	pkey_assert(ret == 0);
 
 	stack = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,
 		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 
-	assert(stack != MAP_FAILED);
+	pkey_assert(stack != MAP_FAILED);
 
 	/*
 	 * Allow access to MPK 0 and MPK 2. The child thread (to be created
@@ -490,11 +495,12 @@ static void test_pkru_sigreturn(void)
 	/* Set up alternate signal stack that will use the default MPK */
 	sigstack.ss_sp = mmap(0, STACK_SIZE, PROT_READ | PROT_WRITE,
 			      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	pkey_assert(sigstack.ss_sp != MAP_FAILED);
 	sigstack.ss_flags = 0;
 	sigstack.ss_size = STACK_SIZE;
 
 	/* Use clone to avoid newer glibcs using rseq on new threads */
-	long ret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |
+	ret = clone_raw(CLONE_VM | CLONE_FS | CLONE_FILES |
 			     CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM |
 			     CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID |
 			     CLONE_DETACHED,
@@ -504,7 +510,7 @@ static void test_pkru_sigreturn(void)
 
 	if (ret < 0) {
 		errno = -ret;
-		perror("clone");
+		pkey_assert(0);
 	}  else if (ret == 0) {
 		thread_sigusr2_self(&sigstack);
 		syscall_raw(SYS_exit, 0, 0, 0, 0, 0, 0);
@@ -530,16 +536,17 @@ static void (*pkey_tests[])(void) = {
 
 int main(int argc, char *argv[])
 {
-	int i;
-
 	ksft_print_header();
 	ksft_set_plan(ARRAY_SIZE(pkey_tests));
 
 	if (!is_pkeys_supported())
 		ksft_exit_skip("pkeys not supported\n");
 
-	for (i = 0; i < ARRAY_SIZE(pkey_tests); i++)
-		(*pkey_tests[i])();
+	for (test_nr = 0; test_nr < ARRAY_SIZE(pkey_tests); test_nr++) {
+		tracing_on();
+		(*pkey_tests[test_nr])();
+		tracing_off();
+	}
 
 	ksft_finished();
 	return 0;
diff --git a/tools/testing/selftests/mm/pkey_util.c b/tools/testing/selftests/mm/pkey_util.c
index 255b332f7a08b2..abf708d6575ec1 100644
--- a/tools/testing/selftests/mm/pkey_util.c
+++ b/tools/testing/selftests/mm/pkey_util.c
@@ -2,9 +2,95 @@
 #define __SANE_USERSPACE_TYPES__
 #include <sys/syscall.h>
 #include <unistd.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
 
 #include "pkey-helpers.h"
 
+#if CONTROL_TRACING > 0
+static void cat_into_file(char *str, char *file)
+{
+	int fd = open(file, O_RDWR);
+	int ret;
+
+	dprintf2("%s(): writing '%s' to '%s'\n", __func__, str, file);
+	/*
+	 * these need to be raw because they are called under
+	 * pkey_assert()
+	 */
+	if (fd < 0) {
+		fprintf(stderr, "error opening '%s'\n", str);
+		perror("error: ");
+		exit(__LINE__);
+	}
+
+	ret = write(fd, str, strlen(str));
+	if (ret != strlen(str)) {
+		perror("write to file failed");
+		fprintf(stderr, "filename: '%s' str: '%s'\n", file, str);
+		exit(__LINE__);
+	}
+	close(fd);
+}
+
+static int warned_tracing;
+static int tracing_root_ok(void)
+{
+	if (geteuid() != 0) {
+		if (!warned_tracing)
+			fprintf(stderr, "WARNING: not run as root, "
+					"can not do tracing control\n");
+		warned_tracing = 1;
+		return 0;
+	}
+	return 1;
+}
+#endif
+
+void tracing_on(void)
+{
+#if CONTROL_TRACING > 0
+#define TRACEDIR "/sys/kernel/tracing"
+	char pidstr[32];
+
+	if (!tracing_root_ok())
+		return;
+
+	sprintf(pidstr, "%d", getpid());
+	cat_into_file("0", TRACEDIR "/tracing_on");
+	cat_into_file("\n", TRACEDIR "/trace");
+	if (1) {
+		cat_into_file("function_graph", TRACEDIR "/current_tracer");
+		cat_into_file("1", TRACEDIR "/options/funcgraph-proc");
+	} else {
+		cat_into_file("nop", TRACEDIR "/current_tracer");
+	}
+	cat_into_file(pidstr, TRACEDIR "/set_ftrace_pid");
+	cat_into_file("1", TRACEDIR "/tracing_on");
+	dprintf1("enabled tracing\n");
+#endif
+}
+
+void tracing_off(void)
+{
+#if CONTROL_TRACING > 0
+	if (!tracing_root_ok())
+		return;
+	cat_into_file("0", "/sys/kernel/tracing/tracing_on");
+#endif
+}
+
+void abort_hooks(void)
+{
+	fflush(stdout);
+	fprintf(stderr, "running %s()...\n", __func__);
+	tracing_off();
+#ifdef SLEEP_ON_ABORT
+	sleep(SLEEP_ON_ABORT);
+#endif
+}
+
 int sys_pkey_alloc(unsigned long flags, unsigned long init_val)
 {
 	int ret = syscall(SYS_pkey_alloc, flags, init_val);
diff --git a/tools/testing/selftests/mm/protection_keys.c b/tools/testing/selftests/mm/protection_keys.c
index 9a6d954ee37126..96a4eb26f32603 100644
--- a/tools/testing/selftests/mm/protection_keys.c
+++ b/tools/testing/selftests/mm/protection_keys.c
@@ -62,89 +62,6 @@ noinline int read_ptr(int *ptr)
 	return *ptr;
 }
 
-#if CONTROL_TRACING > 0
-static void cat_into_file(char *str, char *file)
-{
-	int fd = open(file, O_RDWR);
-	int ret;
-
-	dprintf2("%s(): writing '%s' to '%s'\n", __func__, str, file);
-	/*
-	 * these need to be raw because they are called under
-	 * pkey_assert()
-	 */
-	if (fd < 0) {
-		fprintf(stderr, "error opening '%s'\n", str);
-		perror("error: ");
-		exit(__LINE__);
-	}
-
-	ret = write(fd, str, strlen(str));
-	if (ret != strlen(str)) {
-		perror("write to file failed");
-		fprintf(stderr, "filename: '%s' str: '%s'\n", file, str);
-		exit(__LINE__);
-	}
-	close(fd);
-}
-
-static int warned_tracing;
-static int tracing_root_ok(void)
-{
-	if (geteuid() != 0) {
-		if (!warned_tracing)
-			fprintf(stderr, "WARNING: not run as root, "
-					"can not do tracing control\n");
-		warned_tracing = 1;
-		return 0;
-	}
-	return 1;
-}
-#endif
-
-static void tracing_on(void)
-{
-#if CONTROL_TRACING > 0
-#define TRACEDIR "/sys/kernel/tracing"
-	char pidstr[32];
-
-	if (!tracing_root_ok())
-		return;
-
-	sprintf(pidstr, "%d", getpid());
-	cat_into_file("0", TRACEDIR "/tracing_on");
-	cat_into_file("\n", TRACEDIR "/trace");
-	if (1) {
-		cat_into_file("function_graph", TRACEDIR "/current_tracer");
-		cat_into_file("1", TRACEDIR "/options/funcgraph-proc");
-	} else {
-		cat_into_file("nop", TRACEDIR "/current_tracer");
-	}
-	cat_into_file(pidstr, TRACEDIR "/set_ftrace_pid");
-	cat_into_file("1", TRACEDIR "/tracing_on");
-	dprintf1("enabled tracing\n");
-#endif
-}
-
-static void tracing_off(void)
-{
-#if CONTROL_TRACING > 0
-	if (!tracing_root_ok())
-		return;
-	cat_into_file("0", "/sys/kernel/tracing/tracing_on");
-#endif
-}
-
-void abort_hooks(void)
-{
-	fflush(stdout);
-	fprintf(stderr, "running %s()...\n", __func__);
-	tracing_off();
-#ifdef SLEEP_ON_ABORT
-	sleep(SLEEP_ON_ABORT);
-#endif
-}
-
 /*
  * This attempts to have roughly a page of instructions followed by a few
  * instructions that do a write, and another page of instructions.  That
@@ -669,7 +586,7 @@ static void *malloc_pkey_with_mprotect(long size, int prot, u16 pkey)
 			size, prot, pkey);
 	pkey_assert(pkey < NR_PKEYS);
 	ptr = mmap(NULL, size, prot, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
-	pkey_assert(ptr != (void *)-1);
+	pkey_assert(ptr != MAP_FAILED);
 	ret = mprotect_pkey((void *)ptr, PAGE_SIZE, prot, pkey);
 	pkey_assert(!ret);
 	record_pkey_malloc(ptr, size, prot);
@@ -692,7 +609,7 @@ static void *malloc_pkey_anon_huge(long size, int prot, u16 pkey)
 	 */
 	size = ALIGN_UP(size, HPAGE_SIZE * 2);
 	ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
-	pkey_assert(ptr != (void *)-1);
+	pkey_assert(ptr != MAP_FAILED);
 	record_pkey_malloc(ptr, size, prot);
 	mprotect_pkey(ptr, size, prot, pkey);
 
@@ -750,7 +667,7 @@ static void *malloc_pkey_hugetlb(long size, int prot, u16 pkey)
 	size = ALIGN_UP(size, HPAGE_SIZE * 2);
 	pkey_assert(pkey < NR_PKEYS);
 	ptr = mmap(NULL, size, PROT_NONE, flags, -1, 0);
-	pkey_assert(ptr != (void *)-1);
+	pkey_assert(ptr != MAP_FAILED);
 	mprotect_pkey(ptr, size, prot, pkey);
 
 	record_pkey_malloc(ptr, size, prot);
@@ -779,7 +696,7 @@ static void *malloc_pkey(long size, int prot, u16 pkey)
 		pkey_assert(malloc_type < nr_malloc_types);
 
 		ret = pkey_malloc[malloc_type](size, prot, pkey);
-		pkey_assert(ret != (void *)-1);
+		pkey_assert(ret != MAP_FAILED);
 
 		malloc_type++;
 		if (malloc_type >= nr_malloc_types)
@@ -1197,6 +1114,7 @@ static void arch_force_pkey_reg_init(void)
 	 * doing the XSAVE size enumeration dance.
 	 */
 	buf = mmap(NULL, 1*MB, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
+	pkey_assert(buf != MAP_FAILED);
 
 	/* These __builtins require compiling with -mxsave */
 
@@ -1763,7 +1681,8 @@ int main(void)
 		ksft_print_msg("running PKEY tests for unsupported CPU/OS\n");
 
 		ptr  = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
-		assert(ptr != (void *)-1);
+		if (ptr == MAP_FAILED)
+			ksft_exit_fail_perror("mmap");
 		test_mprotect_pkey_on_unsupported_cpu(ptr, 1);
 		ksft_test_result_pass("pkey on unsupported CPU/OS\n");
 		ksft_finished();

3/2 2026/06/29 10:58 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 8120
							output: 66
							thoughts: 620

Thoughts: 
**Analyzing the Patch for Fuzzing Worthiness**

Okay, so this patch is touching files within `tools/testing/selftests/mm/`. My initial thought is, "These are selftests, user-space programs, not kernel code. So, the question is, does this modification functionally alter kernel execution flow?" No, it modifies the *test*, not the kernel. I need to double-check that there are *no* kernel changes.

Let me confirm... Yep, the diff *only* impacts that `tools/testing/selftests/mm/` directory. Therefore, no direct modification of the kernel. This means, according to the instructions, that WorthFuzzing should be false.

Let me re-read the prompt to be absolutely sure. It specifies: "If it modifies reachable core kernel logic, drivers, or architectures...". Since this patch *doesn't* touch core logic, drivers, or architectures, that confirms my initial assessment.

I'm confident in my conclusion. The patch solely impacts user-space selftests; it doesn't introduce any functional alterations to kernel code.

Just to be absolutely sure, let's review the files impacted:
- `tools/testing/selftests/mm/pkey-helpers.h`
- `tools/testing/selftests/mm/pkey-powerpc.h`
- `tools/testing/selftests/mm/pkey_sighandler_tests.c`
- `tools/testing/selftests/mm/pkey_util.c`
- `tools/testing/selftests/mm/protection_keys.c`

Yup, all within the `tools/testing/selftests/mm/` subtree.

Therefore, WorthFuzzing is definitively false. I will set the results accordingly.

4/2 2026/06/29 10:58 tool set-results
0m Args: 
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space selftests (tools/testing/selftests/mm/*) and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies user-space selftests (tools/testing/selftests/mm/*) and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)