AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only contains cosmetic changes to comments (updating kernel-doc format) and removes 'extern' keywords from function declarations in a header file. There are no functional changes to the code.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 637dd43d63aa4e3969d8598d1b02852a47836a52\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 3 21:17:32 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/s390/net/fsm.h b/drivers/s390/net/fsm.h\nindex 16dc071a2973c..6a0b47ca87f0c 100644\n--- a/drivers/s390/net/fsm.h\n+++ b/drivers/s390/net/fsm.h\n@@ -11,18 +11,18 @@\n #include \u003clinux/string.h\u003e\n #include \u003clinux/atomic.h\u003e\n \n-/**\n+/*\n  * Define this to get debugging messages.\n  */\n #define FSM_DEBUG         0\n \n-/**\n+/*\n  * Define this to get debugging massages for\n  * timer handling.\n  */\n #define FSM_TIMER_DEBUG   0\n \n-/**\n+/*\n  * Define these to record a history of\n  * Events/Statechanges and print it if a\n  * action_function is not found.\n@@ -32,12 +32,12 @@\n \n struct fsm_instance_t;\n \n-/**\n+/*\n  * Definition of an action function, called by a FSM\n  */\n typedef void (*fsm_function_t)(struct fsm_instance_t *, int, void *);\n \n-/**\n+/*\n  * Internal jump table for a FSM\n  */\n typedef struct {\n@@ -49,7 +49,7 @@ typedef struct {\n } fsm;\n \n #if FSM_DEBUG_HISTORY\n-/**\n+/*\n  * Element of State/Event history used for debugging.\n  */\n typedef struct {\n@@ -58,7 +58,7 @@ typedef struct {\n } fsm_history;\n #endif\n \n-/**\n+/*\n  * Representation of a FSM\n  */\n typedef struct fsm_instance_t {\n@@ -75,7 +75,7 @@ typedef struct fsm_instance_t {\n #endif\n } fsm_instance;\n \n-/**\n+/*\n  * Description of a state-event combination\n  */\n typedef struct {\n@@ -84,7 +84,7 @@ typedef struct {\n \tfsm_function_t function;\n } fsm_node;\n \n-/**\n+/*\n  * Description of a FSM Timer.\n  */\n typedef struct {\n@@ -95,50 +95,52 @@ typedef struct {\n } fsm_timer;\n \n /**\n- * Creates an FSM\n+ * init_fsm - Creates a finite state machine\n+ * @name: Name of this instance for logging purposes\n+ * @state_names: Array of names for all states for logging purposes\n+ * @event_names: Array of names for all events for logging purposes\n+ * @nr_states: Number of states for this instance\n+ * @nr_events: Number of events for this instance\n+ * @tmpl: Pointer to fsm_node array describing this FSM\n+ * @tmpl_len: Number of entries in the tmpl array\n+ * @order: GFP flags for memory allocation (e.g. GFP_KERNEL)\n  *\n- * @param name        Name of this instance for logging purposes.\n- * @param state_names An array of names for all states for logging purposes.\n- * @param event_names An array of names for all events for logging purposes.\n- * @param nr_states   Number of states for this instance.\n- * @param nr_events   Number of events for this instance.\n- * @param tmpl        An array of fsm_nodes, describing this FSM.\n- * @param tmpl_len    Length of the describing array.\n- * @param order       Parameter for allocation of the FSM data structs.\n+ * Allocates and initializes a finite state machine instance with the\n+ * specified states, events, and transition table.\n+ *\n+ * Return: Pointer to initialized FSM instance, or NULL on failure\n  */\n-extern fsm_instance *\n-init_fsm(char *name, const char **state_names,\n-\t const char **event_names,\n-\t int nr_states, int nr_events, const fsm_node *tmpl,\n-\t int tmpl_len, gfp_t order);\n+fsm_instance *init_fsm(char *name, const char **state_names,\n+\t\t       const char **event_names, int nr_states,\n+\t\t       int nr_events, const fsm_node *tmpl,\n+\t\t       int tmpl_len, gfp_t order);\n \n /**\n- * Releases an FSM\n+ * kfree_fsm - Releases a finite state machine\n+ * @fi: Pointer to FSM instance, previously created with init_fsm()\n  *\n- * @param fi Pointer to an FSM, previously created with init_fsm.\n+ * Frees all memory associated with the FSM instance.\n  */\n-extern void kfree_fsm(fsm_instance *fi);\n+void kfree_fsm(fsm_instance *fi);\n \n #if FSM_DEBUG_HISTORY\n-extern void\n-fsm_print_history(fsm_instance *fi);\n+void fsm_print_history(fsm_instance *fi);\n \n-extern void\n-fsm_record_history(fsm_instance *fi, int state, int event);\n+void fsm_record_history(fsm_instance *fi, int state, int event);\n #endif\n \n /**\n- * Emits an event to a FSM.\n- * If an action function is defined for the current state/event combination,\n- * this function is called.\n+ * fsm_event - Emits an event to a finite state machine\n+ * @fi: Pointer to FSM which should receive the event\n+ * @event: The event to be delivered\n+ * @arg: Generic argument, passed to the action function\n  *\n- * @param fi    Pointer to FSM which should receive the event.\n- * @param event The event do be delivered.\n- * @param arg   A generic argument, handed to the action function.\n+ * If an action function is defined for the current state/event\n+ * combination, that function is called with the provided arguments.\n  *\n- * @return      0  on success,\n- *              1  if current state or event is out of range\n- *              !0 if state and event in range, but no action defined.\n+ * Return:\n+ * * 0 - Success, action function was called\n+ * * 1 - State/event out of range, or no action function defined\n  */\n static inline int\n fsm_event(fsm_instance *fi, int event, void *arg)\n@@ -182,11 +184,12 @@ fsm_event(fsm_instance *fi, int event, void *arg)\n }\n \n /**\n- * Modifies the state of an FSM.\n- * This does \u003cem\u003enot\u003c/em\u003e trigger an event or calls an action function.\n+ * fsm_newstate - Modifies the state of a finite state machine\n+ * @fi: Pointer to FSM\n+ * @newstate: The new state for this FSM\n  *\n- * @param fi    Pointer to FSM\n- * @param state The new state for this FSM.\n+ * This does not trigger an event or call an action function.\n+ * Wakes up any processes waiting on the FSM's wait queue.\n  */\n static inline void\n fsm_newstate(fsm_instance *fi, int newstate)\n@@ -203,11 +206,10 @@ fsm_newstate(fsm_instance *fi, int newstate)\n }\n \n /**\n- * Retrieves the state of an FSM\n- *\n- * @param fi Pointer to FSM\n+ * fsm_getstate - Retrieves the current state of a finite state machine\n+ * @fi: Pointer to FSM\n  *\n- * @return The current state of the FSM.\n+ * Return: Current state number\n  */\n static inline int\n fsm_getstate(fsm_instance *fi)\n@@ -216,51 +218,53 @@ fsm_getstate(fsm_instance *fi)\n }\n \n /**\n- * Retrieves the name of the state of an FSM\n- *\n- * @param fi Pointer to FSM\n+ * fsm_getstate_str - Retrieves the name of the current FSM state\n+ * @fi: Pointer to FSM\n  *\n- * @return The current state of the FSM in a human readable form.\n+ * Return: State name string, or \"Invalid\" if state is out of range\n  */\n-extern const char *fsm_getstate_str(fsm_instance *fi);\n+const char *fsm_getstate_str(fsm_instance *fi);\n \n /**\n- * Initializes a timer for an FSM.\n- * This prepares an fsm_timer for usage with fsm_addtimer.\n+ * fsm_settimer - Initializes a timer for a finite state machine\n+ * @fi: Pointer to FSM\n+ * @this: The timer to be initialized\n  *\n- * @param fi    Pointer to FSM\n- * @param timer The timer to be initialized.\n+ * Prepares an fsm_timer for usage with fsm_addtimer().\n  */\n-extern void fsm_settimer(fsm_instance *fi, fsm_timer *);\n+void fsm_settimer(fsm_instance *fi, fsm_timer *this);\n \n /**\n- * Clears a pending timer of an FSM instance.\n+ * fsm_deltimer - Clears a pending timer of an FSM instance\n+ * @timer: The timer to clear\n  *\n- * @param timer The timer to clear.\n+ * Stops and removes the timer. Safe to call on an inactive timer.\n  */\n-extern void fsm_deltimer(fsm_timer *timer);\n+void fsm_deltimer(fsm_timer *timer);\n \n /**\n- * Adds and starts a timer to an FSM instance.\n+ * fsm_addtimer - Adds and starts a timer for an FSM instance\n+ * @timer: The timer to be added (timer-\u003efi must point to the FSM instance)\n+ * @millisec: Duration in milliseconds after which the timer expires\n+ * @event: Event to trigger when timer expires\n+ * @arg: Generic argument provided to the event handler\n  *\n- * @param timer    The timer to be added. The field fi of that timer\n- *                 must have been set to point to the instance.\n- * @param millisec Duration, after which the timer should expire.\n- * @param event    Event, to trigger if timer expires.\n- * @param arg      Generic argument, provided to expiry function.\n+ * Starts a timer that will trigger the specified event after the given\n+ * duration. The timer must have been initialized with fsm_settimer().\n  *\n- * @return         0 on success, -1 if timer is already active.\n+ * Return: Always returns 0\n  */\n-extern int fsm_addtimer(fsm_timer *timer, int millisec, int event, void *arg);\n+int fsm_addtimer(fsm_timer *timer, int millisec, int event, void *arg);\n \n /**\n- * Modifies a timer of an FSM.\n+ * fsm_modtimer - Modifies a timer of a finite state machine\n+ * @timer: The timer to modify\n+ * @millisec: New duration in milliseconds after which the timer expires\n+ * @event: Event to trigger when timer expires\n+ * @arg: Generic argument provided to the event handler\n  *\n- * @param timer    The timer to modify.\n- * @param millisec Duration, after which the timer should expire.\n- * @param event    Event, to trigger if timer expires.\n- * @param arg      Generic argument, provided to expiry function.\n+ * Stops the existing timer and restarts it with new parameters.\n  */\n-extern void fsm_modtimer(fsm_timer *timer, int millisec, int event, void *arg);\n+void fsm_modtimer(fsm_timer *timer, int millisec, int event, void *arg);\n \n #endif /* _FSM_H_ */\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only contains cosmetic changes to comments (updating kernel-doc format) and removes 'extern' keywords from function declarations in a header file. There are no functional changes to the code.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 637dd43d63aa4e3969d8598d1b02852a47836a52
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 3 21:17:32 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/s390/net/fsm.h b/drivers/s390/net/fsm.h
index 16dc071a2973c..6a0b47ca87f0c 100644
--- a/drivers/s390/net/fsm.h
+++ b/drivers/s390/net/fsm.h
@@ -11,18 +11,18 @@
 #include <linux/string.h>
 #include <linux/atomic.h>
 
-/**
+/*
  * Define this to get debugging messages.
  */
 #define FSM_DEBUG         0
 
-/**
+/*
  * Define this to get debugging massages for
  * timer handling.
  */
 #define FSM_TIMER_DEBUG   0
 
-/**
+/*
  * Define these to record a history of
  * Events/Statechanges and print it if a
  * action_function is not found.
@@ -32,12 +32,12 @@
 
 struct fsm_instance_t;
 
-/**
+/*
  * Definition of an action function, called by a FSM
  */
 typedef void (*fsm_function_t)(struct fsm_instance_t *, int, void *);
 
-/**
+/*
  * Internal jump table for a FSM
  */
 typedef struct {
@@ -49,7 +49,7 @@ typedef struct {
 } fsm;
 
 #if FSM_DEBUG_HISTORY
-/**
+/*
  * Element of State/Event history used for debugging.
  */
 typedef struct {
@@ -58,7 +58,7 @@ typedef struct {
 } fsm_history;
 #endif
 
-/**
+/*
  * Representation of a FSM
  */
 typedef struct fsm_instance_t {
@@ -75,7 +75,7 @@ typedef struct fsm_instance_t {
 #endif
 } fsm_instance;
 
-/**
+/*
  * Description of a state-event combination
  */
 typedef struct {
@@ -84,7 +84,7 @@ typedef struct {
 	fsm_function_t function;
 } fsm_node;
 
-/**
+/*
  * Description of a FSM Timer.
  */
 typedef struct {
@@ -95,50 +95,52 @@ typedef struct {
 } fsm_timer;
 
 /**
- * Creates an FSM
+ * init_fsm - Creates a finite state machine
+ * @name: Name of this instance for logging purposes
+ * @state_names: Array of names for all states for logging purposes
+ * @event_names: Array of names for all events for logging purposes
+ * @nr_states: Number of states for this instance
+ * @nr_events: Number of events for this instance
+ * @tmpl: Pointer to fsm_node array describing this FSM
+ * @tmpl_len: Number of entries in the tmpl array
+ * @order: GFP flags for memory allocation (e.g. GFP_KERNEL)
  *
- * @param name        Name of this instance for logging purposes.
- * @param state_names An array of names for all states for logging purposes.
- * @param event_names An array of names for all events for logging purposes.
- * @param nr_states   Number of states for this instance.
- * @param nr_events   Number of events for this instance.
- * @param tmpl        An array of fsm_nodes, describing this FSM.
- * @param tmpl_len    Length of the describing array.
- * @param order       Parameter for allocation of the FSM data structs.
+ * Allocates and initializes a finite state machine instance with the
+ * specified states, events, and transition table.
+ *
+ * Return: Pointer to initialized FSM instance, or NULL on failure
  */
-extern fsm_instance *
-init_fsm(char *name, const char **state_names,
-	 const char **event_names,
-	 int nr_states, int nr_events, const fsm_node *tmpl,
-	 int tmpl_len, gfp_t order);
+fsm_instance *init_fsm(char *name, const char **state_names,
+		       const char **event_names, int nr_states,
+		       int nr_events, const fsm_node *tmpl,
+		       int tmpl_len, gfp_t order);
 
 /**
- * Releases an FSM
+ * kfree_fsm - Releases a finite state machine
+ * @fi: Pointer to FSM instance, previously created with init_fsm()
  *
- * @param fi Pointer to an FSM, previously created with init_fsm.
+ * Frees all memory associated with the FSM instance.
  */
-extern void kfree_fsm(fsm_instance *fi);
+void kfree_fsm(fsm_instance *fi);
 
 #if FSM_DEBUG_HISTORY
-extern void
-fsm_print_history(fsm_instance *fi);
+void fsm_print_history(fsm_instance *fi);
 
-extern void
-fsm_record_history(fsm_instance *fi, int state, int event);
+void fsm_record_history(fsm_instance *fi, int state, int event);
 #endif
 
 /**
- * Emits an event to a FSM.
- * If an action function is defined for the current state/event combination,
- * this function is called.
+ * fsm_event - Emits an event to a finite state machine
+ * @fi: Pointer to FSM which should receive the event
+ * @event: The event to be delivered
+ * @arg: Generic argument, passed to the action function
  *
- * @param fi    Pointer to FSM which should receive the event.
- * @param event The event do be delivered.
- * @param arg   A generic argument, handed to the action function.
+ * If an action function is defined for the current state/event
+ * combination, that function is called with the provided arguments.
  *
- * @return      0  on success,
- *              1  if current state or event is out of range
- *              !0 if state and event in range, but no action defined.
+ * Return:
+ * * 0 - Success, action function was called
+ * * 1 - State/event out of range, or no action function defined
  */
 static inline int
 fsm_event(fsm_instance *fi, int event, void *arg)
@@ -182,11 +184,12 @@ fsm_event(fsm_instance *fi, int event, void *arg)
 }
 
 /**
- * Modifies the state of an FSM.
- * This does <em>not</em> trigger an event or calls an action function.
+ * fsm_newstate - Modifies the state of a finite state machine
+ * @fi: Pointer to FSM
+ * @newstate: The new state for this FSM
  *
- * @param fi    Pointer to FSM
- * @param state The new state for this FSM.
+ * This does not trigger an event or call an action function.
+ * Wakes up any processes waiting on the FSM's wait queue.
  */
 static inline void
 fsm_newstate(fsm_instance *fi, int newstate)
@@ -203,11 +206,10 @@ fsm_newstate(fsm_instance *fi, int newstate)
 }
 
 /**
- * Retrieves the state of an FSM
- *
- * @param fi Pointer to FSM
+ * fsm_getstate - Retrieves the current state of a finite state machine
+ * @fi: Pointer to FSM
  *
- * @return The current state of the FSM.
+ * Return: Current state number
  */
 static inline int
 fsm_getstate(fsm_instance *fi)
@@ -216,51 +218,53 @@ fsm_getstate(fsm_instance *fi)
 }
 
 /**
- * Retrieves the name of the state of an FSM
- *
- * @param fi Pointer to FSM
+ * fsm_getstate_str - Retrieves the name of the current FSM state
+ * @fi: Pointer to FSM
  *
- * @return The current state of the FSM in a human readable form.
+ * Return: State name string, or "Invalid" if state is out of range
  */
-extern const char *fsm_getstate_str(fsm_instance *fi);
+const char *fsm_getstate_str(fsm_instance *fi);
 
 /**
- * Initializes a timer for an FSM.
- * This prepares an fsm_timer for usage with fsm_addtimer.
+ * fsm_settimer - Initializes a timer for a finite state machine
+ * @fi: Pointer to FSM
+ * @this: The timer to be initialized
  *
- * @param fi    Pointer to FSM
- * @param timer The timer to be initialized.
+ * Prepares an fsm_timer for usage with fsm_addtimer().
  */
-extern void fsm_settimer(fsm_instance *fi, fsm_timer *);
+void fsm_settimer(fsm_instance *fi, fsm_timer *this);
 
 /**
- * Clears a pending timer of an FSM instance.
+ * fsm_deltimer - Clears a pending timer of an FSM instance
+ * @timer: The timer to clear
  *
- * @param timer The timer to clear.
+ * Stops and removes the timer. Safe to call on an inactive timer.
  */
-extern void fsm_deltimer(fsm_timer *timer);
+void fsm_deltimer(fsm_timer *timer);
 
 /**
- * Adds and starts a timer to an FSM instance.
+ * fsm_addtimer - Adds and starts a timer for an FSM instance
+ * @timer: The timer to be added (timer->fi must point to the FSM instance)
+ * @millisec: Duration in milliseconds after which the timer expires
+ * @event: Event to trigger when timer expires
+ * @arg: Generic argument provided to the event handler
  *
- * @param timer    The timer to be added. The field fi of that timer
- *                 must have been set to point to the instance.
- * @param millisec Duration, after which the timer should expire.
- * @param event    Event, to trigger if timer expires.
- * @param arg      Generic argument, provided to expiry function.
+ * Starts a timer that will trigger the specified event after the given
+ * duration. The timer must have been initialized with fsm_settimer().
  *
- * @return         0 on success, -1 if timer is already active.
+ * Return: Always returns 0
  */
-extern int fsm_addtimer(fsm_timer *timer, int millisec, int event, void *arg);
+int fsm_addtimer(fsm_timer *timer, int millisec, int event, void *arg);
 
 /**
- * Modifies a timer of an FSM.
+ * fsm_modtimer - Modifies a timer of a finite state machine
+ * @timer: The timer to modify
+ * @millisec: New duration in milliseconds after which the timer expires
+ * @event: Event to trigger when timer expires
+ * @arg: Generic argument provided to the event handler
  *
- * @param timer    The timer to modify.
- * @param millisec Duration, after which the timer should expire.
- * @param event    Event, to trigger if timer expires.
- * @param arg      Generic argument, provided to expiry function.
+ * Stops the existing timer and restarts it with new parameters.
  */
-extern void fsm_modtimer(fsm_timer *timer, int millisec, int event, void *arg);
+void fsm_modtimer(fsm_timer *timer, int millisec, int event, void *arg);
 
 #endif /* _FSM_H_ */

gemini-3.1-pro-preview

null

null

							input: 4764
							output: 69
							thoughts: 294
						

**Cosmetic Fix in s390 Network Code**

Okay, so I'm looking at this patch and it's touching `drivers/s390/net/fsm.h`. Immediately, I see it's all about cleaning up the code. The main changes involve comment formatting, specifically switching from `/**` style comments to the `/*` style, or updating kernel-doc comments to be proper. It's also removing `extern` keywords from function declarations. Seems like a style guide adherence pass.

I skimmed through, but let's double-check the diff. Ah, there it is... nothing substantial, purely cosmetic. We're talking about a comment style change, and the removal of `extern` on the `init_fsm` function, which is fine to remove in the context of the header file. No changes to the actual logic or functionality of the code are present.

Given that, I can confidently set `WorthFuzzing=false` for this patch. No need to spend cycles on this.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only contains cosmetic changes to comments (updating kernel-doc format) and removes 'extern' keywords from function declarations in a header file. There are no functional changes to the code.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only contains cosmetic changes to comments (updating kernel-doc format) and removes 'extern' keywords from function declarations in a header file. There are no functional changes to the code.",
  "WorthFuzzing": false
}