AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only adds and modifies BPF selftests in tools/testing/selftests/bpf/ and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 5385b7fdf091d2bfb3bbacf86403aa91a3c9f151\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 10 17:37:56 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c b/tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c\nnew file mode 100644\nindex 0000000000000..19500b785ee32\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c\n@@ -0,0 +1,142 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */\n+\n+#include \u003ctest_progs.h\u003e\n+#include \u003cunistd.h\u003e\n+#include \"test_sleepable_tracepoints.skel.h\"\n+#include \"test_sleepable_tracepoints_fail.skel.h\"\n+\n+static void run_test(struct test_sleepable_tracepoints *skel)\n+{\n+\tchar buf[PATH_MAX] = \"/\";\n+\n+\tskel-\u003ebss-\u003etarget_pid = getpid();\n+\tskel-\u003ebss-\u003eprog_triggered = 0;\n+\tskel-\u003ebss-\u003eerr = 0;\n+\tskel-\u003ebss-\u003ecopied_byte = 0;\n+\n+\tsyscall(__NR_getcwd, buf, sizeof(buf));\n+\n+\tASSERT_EQ(skel-\u003ebss-\u003eprog_triggered, 1, \"prog_triggered\");\n+\tASSERT_EQ(skel-\u003ebss-\u003eerr, 0, \"err\");\n+\tASSERT_EQ(skel-\u003ebss-\u003ecopied_byte, '/', \"copied_byte\");\n+}\n+\n+static void run_auto_attach_test(struct bpf_program *prog,\n+\t\t\t\t struct test_sleepable_tracepoints *skel)\n+{\n+\tstruct bpf_link *link;\n+\n+\tlink = bpf_program__attach(prog);\n+\tif (!ASSERT_OK_PTR(link, \"prog_attach\"))\n+\t\treturn;\n+\n+\trun_test(skel);\n+\tbpf_link__destroy(link);\n+}\n+\n+static void test_attach_only(struct bpf_program *prog)\n+{\n+\tstruct bpf_link *link;\n+\n+\tlink = bpf_program__attach(prog);\n+\tif (ASSERT_OK_PTR(link, \"attach\"))\n+\t\tbpf_link__destroy(link);\n+}\n+\n+static void test_attach_reject(struct bpf_program *prog)\n+{\n+\tstruct bpf_link *link;\n+\n+\tlink = bpf_program__attach(prog);\n+\tif (!ASSERT_ERR_PTR(link, \"attach_should_fail\"))\n+\t\tbpf_link__destroy(link);\n+}\n+\n+static void test_raw_tp_bare(struct test_sleepable_tracepoints *skel)\n+{\n+\tstruct bpf_link *link;\n+\n+\tlink = bpf_program__attach_raw_tracepoint(skel-\u003eprogs.handle_raw_tp_bare,\n+\t\t\t\t\t\t  \"sys_enter\");\n+\tif (ASSERT_OK_PTR(link, \"attach\"))\n+\t\tbpf_link__destroy(link);\n+}\n+\n+static void test_tp_bare(struct test_sleepable_tracepoints *skel)\n+{\n+\tstruct bpf_link *link;\n+\n+\tlink = bpf_program__attach_tracepoint(skel-\u003eprogs.handle_tp_bare,\n+\t\t\t\t\t      \"syscalls\", \"sys_enter_getcwd\");\n+\tif (ASSERT_OK_PTR(link, \"attach\"))\n+\t\tbpf_link__destroy(link);\n+}\n+\n+static void test_test_run(struct test_sleepable_tracepoints *skel)\n+{\n+\t__u64 args[2] = {0x1234ULL, 0x5678ULL};\n+\tLIBBPF_OPTS(bpf_test_run_opts, topts,\n+\t\t.ctx_in = args,\n+\t\t.ctx_size_in = sizeof(args),\n+\t);\n+\tint fd, err;\n+\n+\tfd = bpf_program__fd(skel-\u003eprogs.handle_test_run);\n+\terr = bpf_prog_test_run_opts(fd, \u0026topts);\n+\tASSERT_OK(err, \"test_run\");\n+\tASSERT_EQ(topts.retval, args[0] + args[1], \"test_run_retval\");\n+}\n+\n+static void test_test_run_on_cpu_reject(struct test_sleepable_tracepoints *skel)\n+{\n+\t__u64 args[2] = {};\n+\tLIBBPF_OPTS(bpf_test_run_opts, topts,\n+\t\t.ctx_in = args,\n+\t\t.ctx_size_in = sizeof(args),\n+\t\t.flags = BPF_F_TEST_RUN_ON_CPU,\n+\t);\n+\tint fd, err;\n+\n+\tfd = bpf_program__fd(skel-\u003eprogs.handle_test_run);\n+\terr = bpf_prog_test_run_opts(fd, \u0026topts);\n+\tASSERT_ERR(err, \"test_run_on_cpu_reject\");\n+}\n+\n+void test_sleepable_tracepoints(void)\n+{\n+\tstruct test_sleepable_tracepoints *skel;\n+\n+\tskel = test_sleepable_tracepoints__open_and_load();\n+\tif (!ASSERT_OK_PTR(skel, \"open_and_load\"))\n+\t\treturn;\n+\n+\tif (test__start_subtest(\"tp_btf\"))\n+\t\trun_auto_attach_test(skel-\u003eprogs.handle_sys_enter_tp_btf, skel);\n+\tif (test__start_subtest(\"raw_tp\"))\n+\t\trun_auto_attach_test(skel-\u003eprogs.handle_sys_enter_raw_tp, skel);\n+\tif (test__start_subtest(\"tracepoint\"))\n+\t\trun_auto_attach_test(skel-\u003eprogs.handle_sys_enter_tp, skel);\n+\tif (test__start_subtest(\"sys_exit\"))\n+\t\trun_auto_attach_test(skel-\u003eprogs.handle_sys_exit_tp, skel);\n+\tif (test__start_subtest(\"tracepoint_alias\"))\n+\t\ttest_attach_only(skel-\u003eprogs.handle_sys_enter_tp_alias);\n+\tif (test__start_subtest(\"raw_tracepoint_alias\"))\n+\t\ttest_attach_only(skel-\u003eprogs.handle_sys_enter_raw_tp_alias);\n+\tif (test__start_subtest(\"raw_tp_bare\"))\n+\t\ttest_raw_tp_bare(skel);\n+\tif (test__start_subtest(\"tp_bare\"))\n+\t\ttest_tp_bare(skel);\n+\tif (test__start_subtest(\"test_run\"))\n+\t\ttest_test_run(skel);\n+\tif (test__start_subtest(\"test_run_on_cpu_reject\"))\n+\t\ttest_test_run_on_cpu_reject(skel);\n+\tif (test__start_subtest(\"raw_tp_non_faultable\"))\n+\t\ttest_attach_reject(skel-\u003eprogs.handle_raw_tp_non_faultable);\n+\tif (test__start_subtest(\"tp_non_syscall\"))\n+\t\ttest_attach_reject(skel-\u003eprogs.handle_tp_non_syscall);\n+\tif (test__start_subtest(\"tp_btf_non_faultable_reject\"))\n+\t\tRUN_TESTS(test_sleepable_tracepoints_fail);\n+\n+\ttest_sleepable_tracepoints__destroy(skel);\n+}\ndiff --git a/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c\nnew file mode 100644\nindex 0000000000000..254f7fd895d9f\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c\n@@ -0,0 +1,112 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */\n+\n+#include \u003cvmlinux.h\u003e\n+#include \u003casm/unistd.h\u003e\n+#include \u003cbpf/bpf_tracing.h\u003e\n+#include \u003cbpf/bpf_core_read.h\u003e\n+#include \u003cbpf/bpf_helpers.h\u003e\n+\n+char _license[] SEC(\"license\") = \"GPL\";\n+\n+int target_pid;\n+int prog_triggered;\n+long err;\n+char copied_byte;\n+\n+static int copy_getcwd_arg(char *ubuf)\n+{\n+\terr = bpf_copy_from_user(\u0026copied_byte, sizeof(copied_byte), ubuf);\n+\tif (err)\n+\t\treturn err;\n+\n+\tprog_triggered = 1;\n+\treturn 0;\n+}\n+\n+SEC(\"tp_btf.s/sys_enter\")\n+int BPF_PROG(handle_sys_enter_tp_btf, struct pt_regs *regs, long id)\n+{\n+\tif ((bpf_get_current_pid_tgid() \u003e\u003e 32) != target_pid ||\n+\t    id != __NR_getcwd)\n+\t\treturn 0;\n+\n+\treturn copy_getcwd_arg((void *)PT_REGS_PARM1_SYSCALL(regs));\n+}\n+\n+SEC(\"raw_tp.s/sys_enter\")\n+int BPF_PROG(handle_sys_enter_raw_tp, struct pt_regs *regs, long id)\n+{\n+\tif ((bpf_get_current_pid_tgid() \u003e\u003e 32) != target_pid ||\n+\t    id != __NR_getcwd)\n+\t\treturn 0;\n+\n+\treturn copy_getcwd_arg((void *)PT_REGS_PARM1_CORE_SYSCALL(regs));\n+}\n+\n+SEC(\"tp.s/syscalls/sys_enter_getcwd\")\n+int handle_sys_enter_tp(struct syscall_trace_enter *args)\n+{\n+\tif ((bpf_get_current_pid_tgid() \u003e\u003e 32) != target_pid)\n+\t\treturn 0;\n+\n+\treturn copy_getcwd_arg((void *)args-\u003eargs[0]);\n+}\n+\n+SEC(\"tp.s/syscalls/sys_exit_getcwd\")\n+int handle_sys_exit_tp(struct syscall_trace_exit *args)\n+{\n+\tstruct pt_regs *regs;\n+\n+\tif ((bpf_get_current_pid_tgid() \u003e\u003e 32) != target_pid)\n+\t\treturn 0;\n+\n+\tregs = (struct pt_regs *)bpf_task_pt_regs(bpf_get_current_task_btf());\n+\treturn copy_getcwd_arg((void *)PT_REGS_PARM1_CORE_SYSCALL(regs));\n+}\n+\n+SEC(\"raw_tp.s\")\n+int BPF_PROG(handle_raw_tp_bare, struct pt_regs *regs, long id)\n+{\n+\treturn 0;\n+}\n+\n+SEC(\"tp.s\")\n+int handle_tp_bare(void *ctx)\n+{\n+\treturn 0;\n+}\n+\n+SEC(\"tracepoint.s/syscalls/sys_enter_getcwd\")\n+int handle_sys_enter_tp_alias(struct syscall_trace_enter *args)\n+{\n+\treturn 0;\n+}\n+\n+SEC(\"raw_tracepoint.s/sys_enter\")\n+int BPF_PROG(handle_sys_enter_raw_tp_alias, struct pt_regs *regs, long id)\n+{\n+\treturn 0;\n+}\n+\n+SEC(\"raw_tp.s/sys_enter\")\n+int BPF_PROG(handle_test_run, struct pt_regs *regs, long id)\n+{\n+\tif ((__u64)regs == 0x1234ULL \u0026\u0026 (__u64)id == 0x5678ULL)\n+\t\treturn (__u64)regs + (__u64)id;\n+\n+\treturn 0;\n+}\n+\n+SEC(\"raw_tp.s/sched_switch\")\n+int BPF_PROG(handle_raw_tp_non_faultable, bool preempt,\n+\t     struct task_struct *prev, struct task_struct *next)\n+{\n+\treturn 0;\n+}\n+\n+SEC(\"tp.s/sched/sched_switch\")\n+int handle_tp_non_syscall(void *ctx)\n+{\n+\treturn 0;\n+}\ndiff --git a/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c\nnew file mode 100644\nindex 0000000000000..1a0748a9520bb\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c\n@@ -0,0 +1,18 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */\n+\n+#include \u003cvmlinux.h\u003e\n+#include \u003cbpf/bpf_tracing.h\u003e\n+#include \u003cbpf/bpf_helpers.h\u003e\n+#include \"bpf_misc.h\"\n+\n+char _license[] SEC(\"license\") = \"GPL\";\n+\n+/* Sleepable program on a non-faultable tracepoint should fail to load */\n+SEC(\"tp_btf.s/sched_switch\")\n+__failure __msg(\"Sleepable program cannot attach to non-faultable tracepoint\")\n+int BPF_PROG(handle_sched_switch, bool preempt,\n+\t     struct task_struct *prev, struct task_struct *next)\n+{\n+\treturn 0;\n+}\ndiff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c\nindex c2b7f5ebf168c..6dabc55229455 100644\n--- a/tools/testing/selftests/bpf/verifier/sleepable.c\n+++ b/tools/testing/selftests/bpf/verifier/sleepable.c\n@@ -76,7 +76,20 @@\n \t.runs = -1,\n },\n {\n-\t\"sleepable raw tracepoint reject\",\n+\t\"sleepable raw tracepoint accept\",\n+\t.insns = {\n+\tBPF_MOV64_IMM(BPF_REG_0, 0),\n+\tBPF_EXIT_INSN(),\n+\t},\n+\t.prog_type = BPF_PROG_TYPE_TRACING,\n+\t.expected_attach_type = BPF_TRACE_RAW_TP,\n+\t.kfunc = \"sys_enter\",\n+\t.result = ACCEPT,\n+\t.flags = BPF_F_SLEEPABLE,\n+\t.runs = -1,\n+},\n+{\n+\t\"sleepable raw tracepoint reject non-faultable\",\n \t.insns = {\n \tBPF_MOV64_IMM(BPF_REG_0, 0),\n \tBPF_EXIT_INSN(),\n@@ -85,7 +98,7 @@\n \t.expected_attach_type = BPF_TRACE_RAW_TP,\n \t.kfunc = \"sched_switch\",\n \t.result = REJECT,\n-\t.errstr = \"Only fentry/fexit/fsession/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable\",\n+\t.errstr = \"Sleepable program cannot attach to non-faultable tracepoint\",\n \t.flags = BPF_F_SLEEPABLE,\n \t.runs = -1,\n },\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only adds and modifies BPF selftests in tools/testing/selftests/bpf/ and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 5385b7fdf091d2bfb3bbacf86403aa91a3c9f151
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 10 17:37:56 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c b/tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c
new file mode 100644
index 0000000000000..19500b785ee32
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c
@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
+
+#include <test_progs.h>
+#include <unistd.h>
+#include "test_sleepable_tracepoints.skel.h"
+#include "test_sleepable_tracepoints_fail.skel.h"
+
+static void run_test(struct test_sleepable_tracepoints *skel)
+{
+	char buf[PATH_MAX] = "/";
+
+	skel->bss->target_pid = getpid();
+	skel->bss->prog_triggered = 0;
+	skel->bss->err = 0;
+	skel->bss->copied_byte = 0;
+
+	syscall(__NR_getcwd, buf, sizeof(buf));
+
+	ASSERT_EQ(skel->bss->prog_triggered, 1, "prog_triggered");
+	ASSERT_EQ(skel->bss->err, 0, "err");
+	ASSERT_EQ(skel->bss->copied_byte, '/', "copied_byte");
+}
+
+static void run_auto_attach_test(struct bpf_program *prog,
+				 struct test_sleepable_tracepoints *skel)
+{
+	struct bpf_link *link;
+
+	link = bpf_program__attach(prog);
+	if (!ASSERT_OK_PTR(link, "prog_attach"))
+		return;
+
+	run_test(skel);
+	bpf_link__destroy(link);
+}
+
+static void test_attach_only(struct bpf_program *prog)
+{
+	struct bpf_link *link;
+
+	link = bpf_program__attach(prog);
+	if (ASSERT_OK_PTR(link, "attach"))
+		bpf_link__destroy(link);
+}
+
+static void test_attach_reject(struct bpf_program *prog)
+{
+	struct bpf_link *link;
+
+	link = bpf_program__attach(prog);
+	if (!ASSERT_ERR_PTR(link, "attach_should_fail"))
+		bpf_link__destroy(link);
+}
+
+static void test_raw_tp_bare(struct test_sleepable_tracepoints *skel)
+{
+	struct bpf_link *link;
+
+	link = bpf_program__attach_raw_tracepoint(skel->progs.handle_raw_tp_bare,
+						  "sys_enter");
+	if (ASSERT_OK_PTR(link, "attach"))
+		bpf_link__destroy(link);
+}
+
+static void test_tp_bare(struct test_sleepable_tracepoints *skel)
+{
+	struct bpf_link *link;
+
+	link = bpf_program__attach_tracepoint(skel->progs.handle_tp_bare,
+					      "syscalls", "sys_enter_getcwd");
+	if (ASSERT_OK_PTR(link, "attach"))
+		bpf_link__destroy(link);
+}
+
+static void test_test_run(struct test_sleepable_tracepoints *skel)
+{
+	__u64 args[2] = {0x1234ULL, 0x5678ULL};
+	LIBBPF_OPTS(bpf_test_run_opts, topts,
+		.ctx_in = args,
+		.ctx_size_in = sizeof(args),
+	);
+	int fd, err;
+
+	fd = bpf_program__fd(skel->progs.handle_test_run);
+	err = bpf_prog_test_run_opts(fd, &topts);
+	ASSERT_OK(err, "test_run");
+	ASSERT_EQ(topts.retval, args[0] + args[1], "test_run_retval");
+}
+
+static void test_test_run_on_cpu_reject(struct test_sleepable_tracepoints *skel)
+{
+	__u64 args[2] = {};
+	LIBBPF_OPTS(bpf_test_run_opts, topts,
+		.ctx_in = args,
+		.ctx_size_in = sizeof(args),
+		.flags = BPF_F_TEST_RUN_ON_CPU,
+	);
+	int fd, err;
+
+	fd = bpf_program__fd(skel->progs.handle_test_run);
+	err = bpf_prog_test_run_opts(fd, &topts);
+	ASSERT_ERR(err, "test_run_on_cpu_reject");
+}
+
+void test_sleepable_tracepoints(void)
+{
+	struct test_sleepable_tracepoints *skel;
+
+	skel = test_sleepable_tracepoints__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "open_and_load"))
+		return;
+
+	if (test__start_subtest("tp_btf"))
+		run_auto_attach_test(skel->progs.handle_sys_enter_tp_btf, skel);
+	if (test__start_subtest("raw_tp"))
+		run_auto_attach_test(skel->progs.handle_sys_enter_raw_tp, skel);
+	if (test__start_subtest("tracepoint"))
+		run_auto_attach_test(skel->progs.handle_sys_enter_tp, skel);
+	if (test__start_subtest("sys_exit"))
+		run_auto_attach_test(skel->progs.handle_sys_exit_tp, skel);
+	if (test__start_subtest("tracepoint_alias"))
+		test_attach_only(skel->progs.handle_sys_enter_tp_alias);
+	if (test__start_subtest("raw_tracepoint_alias"))
+		test_attach_only(skel->progs.handle_sys_enter_raw_tp_alias);
+	if (test__start_subtest("raw_tp_bare"))
+		test_raw_tp_bare(skel);
+	if (test__start_subtest("tp_bare"))
+		test_tp_bare(skel);
+	if (test__start_subtest("test_run"))
+		test_test_run(skel);
+	if (test__start_subtest("test_run_on_cpu_reject"))
+		test_test_run_on_cpu_reject(skel);
+	if (test__start_subtest("raw_tp_non_faultable"))
+		test_attach_reject(skel->progs.handle_raw_tp_non_faultable);
+	if (test__start_subtest("tp_non_syscall"))
+		test_attach_reject(skel->progs.handle_tp_non_syscall);
+	if (test__start_subtest("tp_btf_non_faultable_reject"))
+		RUN_TESTS(test_sleepable_tracepoints_fail);
+
+	test_sleepable_tracepoints__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c
new file mode 100644
index 0000000000000..254f7fd895d9f
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
+
+#include <vmlinux.h>
+#include <asm/unistd.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include <bpf/bpf_helpers.h>
+
+char _license[] SEC("license") = "GPL";
+
+int target_pid;
+int prog_triggered;
+long err;
+char copied_byte;
+
+static int copy_getcwd_arg(char *ubuf)
+{
+	err = bpf_copy_from_user(&copied_byte, sizeof(copied_byte), ubuf);
+	if (err)
+		return err;
+
+	prog_triggered = 1;
+	return 0;
+}
+
+SEC("tp_btf.s/sys_enter")
+int BPF_PROG(handle_sys_enter_tp_btf, struct pt_regs *regs, long id)
+{
+	if ((bpf_get_current_pid_tgid() >> 32) != target_pid ||
+	    id != __NR_getcwd)
+		return 0;
+
+	return copy_getcwd_arg((void *)PT_REGS_PARM1_SYSCALL(regs));
+}
+
+SEC("raw_tp.s/sys_enter")
+int BPF_PROG(handle_sys_enter_raw_tp, struct pt_regs *regs, long id)
+{
+	if ((bpf_get_current_pid_tgid() >> 32) != target_pid ||
+	    id != __NR_getcwd)
+		return 0;
+
+	return copy_getcwd_arg((void *)PT_REGS_PARM1_CORE_SYSCALL(regs));
+}
+
+SEC("tp.s/syscalls/sys_enter_getcwd")
+int handle_sys_enter_tp(struct syscall_trace_enter *args)
+{
+	if ((bpf_get_current_pid_tgid() >> 32) != target_pid)
+		return 0;
+
+	return copy_getcwd_arg((void *)args->args[0]);
+}
+
+SEC("tp.s/syscalls/sys_exit_getcwd")
+int handle_sys_exit_tp(struct syscall_trace_exit *args)
+{
+	struct pt_regs *regs;
+
+	if ((bpf_get_current_pid_tgid() >> 32) != target_pid)
+		return 0;
+
+	regs = (struct pt_regs *)bpf_task_pt_regs(bpf_get_current_task_btf());
+	return copy_getcwd_arg((void *)PT_REGS_PARM1_CORE_SYSCALL(regs));
+}
+
+SEC("raw_tp.s")
+int BPF_PROG(handle_raw_tp_bare, struct pt_regs *regs, long id)
+{
+	return 0;
+}
+
+SEC("tp.s")
+int handle_tp_bare(void *ctx)
+{
+	return 0;
+}
+
+SEC("tracepoint.s/syscalls/sys_enter_getcwd")
+int handle_sys_enter_tp_alias(struct syscall_trace_enter *args)
+{
+	return 0;
+}
+
+SEC("raw_tracepoint.s/sys_enter")
+int BPF_PROG(handle_sys_enter_raw_tp_alias, struct pt_regs *regs, long id)
+{
+	return 0;
+}
+
+SEC("raw_tp.s/sys_enter")
+int BPF_PROG(handle_test_run, struct pt_regs *regs, long id)
+{
+	if ((__u64)regs == 0x1234ULL && (__u64)id == 0x5678ULL)
+		return (__u64)regs + (__u64)id;
+
+	return 0;
+}
+
+SEC("raw_tp.s/sched_switch")
+int BPF_PROG(handle_raw_tp_non_faultable, bool preempt,
+	     struct task_struct *prev, struct task_struct *next)
+{
+	return 0;
+}
+
+SEC("tp.s/sched/sched_switch")
+int handle_tp_non_syscall(void *ctx)
+{
+	return 0;
+}
diff --git a/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c
new file mode 100644
index 0000000000000..1a0748a9520bb
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */
+
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+/* Sleepable program on a non-faultable tracepoint should fail to load */
+SEC("tp_btf.s/sched_switch")
+__failure __msg("Sleepable program cannot attach to non-faultable tracepoint")
+int BPF_PROG(handle_sched_switch, bool preempt,
+	     struct task_struct *prev, struct task_struct *next)
+{
+	return 0;
+}
diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
index c2b7f5ebf168c..6dabc55229455 100644
--- a/tools/testing/selftests/bpf/verifier/sleepable.c
+++ b/tools/testing/selftests/bpf/verifier/sleepable.c
@@ -76,7 +76,20 @@
 	.runs = -1,
 },
 {
-	"sleepable raw tracepoint reject",
+	"sleepable raw tracepoint accept",
+	.insns = {
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.prog_type = BPF_PROG_TYPE_TRACING,
+	.expected_attach_type = BPF_TRACE_RAW_TP,
+	.kfunc = "sys_enter",
+	.result = ACCEPT,
+	.flags = BPF_F_SLEEPABLE,
+	.runs = -1,
+},
+{
+	"sleepable raw tracepoint reject non-faultable",
 	.insns = {
 	BPF_MOV64_IMM(BPF_REG_0, 0),
 	BPF_EXIT_INSN(),
@@ -85,7 +98,7 @@
 	.expected_attach_type = BPF_TRACE_RAW_TP,
 	.kfunc = "sched_switch",
 	.result = REJECT,
-	.errstr = "Only fentry/fexit/fsession/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
+	.errstr = "Sleepable program cannot attach to non-faultable tracepoint",
 	.flags = BPF_F_SLEEPABLE,
 	.runs = -1,
 },

gemini-3.1-pro-preview

null

null

							input: 5839
							output: 67
							thoughts: 751
						

**Analyzing the Patch for Fuzzing Suitability**

Okay, so I've got this patch adding tests for sleepable tracepoints in BPF. My initial thought is to quickly assess its impact on the kernel's fuzzing suitability. The patch modifies files: `tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c`, `tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c`, `tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c`, and `tools/testing/selftests/bpf/verifier/sleepable.c`.  Immediately, I need to confirm whether any *kernel* code is touched.  A quick review of the diff shows that everything is contained within the `tools/testing/selftests/bpf/` directory.

I need to be certain there are *no* other modified files, outside of the selftests directory. A second look at the diff confirms the earlier check. The patch is solely focused on adding or changing the selftests. This is important to determine if the changes should be fuzzed.

Now, let's consider the context for this.  The prompt explicitly states that patches modifying documentation, Kconfig files, comments, logging, constants, unreachable code, vendor-specific drivers requiring physical hardware, or driver teardown callbacks shouldn't be considered for fuzzing. Crucially, it specifically mentions that *selftests* are *not* functional changes to the kernel. Selftests are userspace tests, even if they touch the BPF subsystem, that do not change the kernel's actual execution flow in a way that fuzzing is likely to find a bug. So, modifying selftests won't change the kernel image.

Finally, I need to explicitly verify the files in the diff. Let's see... the diff starts with `tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c`, followed by the other three files. This reinforces that all changes are within the selftests directory.

Therefore, my conclusion is that this patch is not "WorthFuzzing" because it only contains selftest modifications. I will call `set-results` with `WorthFuzzing=false` and provide the reasoning: "The patch only adds and modifies BPF selftests in tools/testing/selftests/bpf/ and does not make any functional changes to the kernel code itself."

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only adds and modifies BPF selftests in tools/testing/selftests/bpf/ and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only adds and modifies BPF selftests in tools/testing/selftests/bpf/ and does not make any functional changes to the kernel code itself.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null