| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/07 06:34 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies user-space tools (bpftool) under tools/bpf/bpftool and tests under tools/testing/selftests/bpf. It does not touch any kernel-space code or affect the compiled kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
} |
| 1/1 | 2026/09/07 06:34 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 78f76ba74731c3296cfd7d7f769ea2c8736f01f6\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Sep 7 06:34:38 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst\nindex 5daf3de5c7446..23faa67268587 100644\n--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst\n+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst\n@@ -16,7 +16,8 @@ SYNOPSIS\n \n **bpftool** [*OPTIONS*] **map** *COMMAND*\n \n-*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }\n+*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } |\n+{ **-n** | **--nomount** } | { **-r** | **--recursive** } }\n \n *COMMANDS* :=\n { **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |\n@@ -170,6 +171,25 @@ OPTIONS\n Do not automatically attempt to mount any virtual file system (such as\n tracefs or BPF virtual file system) when necessary.\n \n+-r, --recursive\n+ Also dump the inner maps referenced by **array_of_maps** and **hash_of_maps**\n+ entries when running **map dump**. Each map ID is visited once, even if\n+ several entries refer to it. Selected maps are followed by their inner maps.\n+\n+ Plain output includes a header identifying each map. On success, JSON output\n+ is always an array of map objects, each containing an **id** and an\n+ **elements** array, including when only one map is dumped. Outer map entries\n+ retain their **inner_map_id** field, which identifies the corresponding inner\n+ map object.\n+\n+ Inner map IDs are resolved when the maps are visited. The dump is not an\n+ atomic snapshot: concurrent updates can change map contents or remove a\n+ referenced inner map before it is visited. Failure to open a referenced\n+ inner map stops the dump and returns a nonzero exit status. Output may\n+ contain maps or entries printed before the error.\n+\n+ In JSON mode, the enclosing arrays and objects are closed before returning.\n+\n EXAMPLES\n ========\n **# bpftool map show**\ndiff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool\nindex 75cbcb512ebae..45c336d63be0a 100644\n--- a/tools/bpf/bpftool/bash-completion/bpftool\n+++ b/tools/bpf/bpftool/bash-completion/bpftool\n@@ -261,7 +261,7 @@ _bpftool()\n \n # Deal with options\n if [[ ${words[cword]} == -* ]]; then\n- local c='--version --json --pretty --bpffs --mapcompat --debug \\\n+ local c='--version --json --pretty --recursive --bpffs --mapcompat --debug \\\n --use-loader --base-btf --sign -i -k'\n COMPREPLY=( $( compgen -W \"$c\" -- \"$cur\" ) )\n return 0\ndiff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c\nindex c91e1a6e1a1ec..424af4a496a5c 100644\n--- a/tools/bpf/bpftool/main.c\n+++ b/tools/bpf/bpftool/main.c\n@@ -26,6 +26,7 @@ static int (*last_do_help)(int argc, char **argv);\n json_writer_t *json_wtr;\n bool pretty_output;\n bool json_output;\n+bool recursive_dump;\n bool show_pinned;\n bool block_mount;\n bool verifier_logs;\n@@ -452,6 +453,7 @@ int main(int argc, char **argv)\n \t\t{ \"json\",\tno_argument,\tNULL,\t'j' },\n \t\t{ \"help\",\tno_argument,\tNULL,\t'h' },\n \t\t{ \"pretty\",\tno_argument,\tNULL,\t'p' },\n+\t\t{ \"recursive\",\tno_argument,\tNULL,\t'r' },\n \t\t{ \"version\",\tno_argument,\tNULL,\t'V' },\n \t\t{ \"bpffs\",\tno_argument,\tNULL,\t'f' },\n \t\t{ \"mapcompat\",\tno_argument,\tNULL,\t'm' },\n@@ -485,7 +487,7 @@ int main(int argc, char **argv)\n \tbin_name = \"bpftool\";\n \n \topterr = 0;\n-\twhile ((opt = getopt_long(argc, argv, \"VhpjfLmndSi:k:B:l\",\n+\twhile ((opt = getopt_long(argc, argv, \"VhpjrfLmndSi:k:B:l\",\n \t\t\t\t options, NULL)) \u003e= 0) {\n \t\tswitch (opt) {\n \t\tcase 'V':\n@@ -507,6 +509,9 @@ int main(int argc, char **argv)\n \t\t\t}\n \t\t\tjsonw_pretty(json_wtr, pretty_output);\n \t\t\tbreak;\n+\t\tcase 'r':\n+\t\t\trecursive_dump = true;\n+\t\t\tbreak;\n \t\tcase 'f':\n \t\t\tshow_pinned = true;\n \t\t\tbreak;\ndiff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h\nindex 78b6e0ebb85d8..76626642e94cb 100644\n--- a/tools/bpf/bpftool/main.h\n+++ b/tools/bpf/bpftool/main.h\n@@ -83,6 +83,7 @@ extern const char *bin_name;\n \n extern json_writer_t *json_wtr;\n extern bool json_output;\n+extern bool recursive_dump;\n extern bool show_pinned;\n extern bool show_pids;\n extern bool block_mount;\ndiff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c\nindex 684a8fb724146..c400b15f16dd2 100644\n--- a/tools/bpf/bpftool/map.c\n+++ b/tools/bpf/bpftool/map.c\n@@ -17,6 +17,7 @@\n #include \u003cbpf/bpf.h\u003e\n #include \u003cbpf/btf.h\u003e\n #include \u003cbpf/hashmap.h\u003e\n+#include \u003cbpf/libbpf_internal.h\u003e\n \n #include \"json_writer.h\"\n #include \"main.h\"\n@@ -826,12 +827,44 @@ static void free_map_kv_btf(struct btf *btf)\n \t\tbtf__free(btf);\n }\n \n+struct map_dump_ctx {\n+\tstruct hashmap *seen;\n+\t__u32 *pending_ids;\n+\tsize_t pending_cnt;\n+};\n+\n+static int collect_inner_map(struct map_dump_ctx *ctx, __u32 id)\n+{\n+\t__u32 *ids;\n+\tint err;\n+\n+\tif (hashmap__find(ctx-\u003eseen, id, NULL))\n+\t\treturn 0;\n+\n+\tids = libbpf_reallocarray(ctx-\u003epending_ids, ctx-\u003epending_cnt + 1,\n+\t\t\t\t sizeof(*ids));\n+\tif (!ids) {\n+\t\tp_err(\"mem alloc failed\");\n+\t\treturn -1;\n+\t}\n+\tctx-\u003epending_ids = ids;\n+\n+\terr = hashmap__add(ctx-\u003eseen, id, 0);\n+\tif (err) {\n+\t\tp_err(\"failed to record inner map id %u: %s\", id, strerror(-err));\n+\t\treturn -1;\n+\t}\n+\tids[ctx-\u003epending_cnt++] = id;\n+\treturn 0;\n+}\n+\n static int\n map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n-\t bool show_header)\n+\t bool show_header, struct map_dump_ctx *ctx)\n {\n \tvoid *key, *value, *prev_key;\n \tunsigned int num_elems = 0;\n+\tjson_writer_t *plain_btf_wtr = NULL;\n \tstruct btf *btf = NULL;\n \tint err;\n \n@@ -845,6 +878,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \n \tprev_key = NULL;\n \n+\tif (ctx \u0026\u0026 !wtr \u0026\u0026 (info-\u003ebtf_value_type_id ||\n+\t\t\t info-\u003ebtf_vmlinux_value_type_id)) {\n+\t\tplain_btf_wtr = get_btf_writer();\n+\t\tif (plain_btf_wtr) {\n+\t\t\tif (show_header)\n+\t\t\t\tshow_map_header_plain(info);\n+\t\t\tshow_header = false;\n+\t\t\twtr = plain_btf_wtr;\n+\t\t}\n+\t}\n+\n \tif (wtr) {\n \t\terr = get_map_kv_btf(info, \u0026btf);\n \t\tif (err) {\n@@ -874,10 +918,20 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \t\tif (err) {\n \t\t\tif (errno == ENOENT)\n \t\t\t\terr = 0;\n+\t\t\telse if (ctx)\n+\t\t\t\tp_err(\"can't get next key for map id %u: %s\",\n+\t\t\t\t info-\u003eid, strerror(errno));\n \t\t\tbreak;\n \t\t}\n-\t\tif (!dump_map_elem(fd, key, value, info, btf, wtr))\n+\t\terr = dump_map_elem(fd, key, value, info, btf, wtr);\n+\t\tif (!err) {\n \t\t\tnum_elems++;\n+\t\t\tif (ctx \u0026\u0026 map_is_map_of_maps(info-\u003etype)) {\n+\t\t\t\terr = collect_inner_map(ctx, *(__u32 *)value);\n+\t\t\t\tif (err)\n+\t\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n \t\tprev_key = key;\n \t}\n \n@@ -894,18 +948,25 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,\n \tfree(key);\n \tfree(value);\n \tfree_map_kv_btf(btf);\n+\tif (plain_btf_wtr)\n+\t\tjsonw_destroy(\u0026plain_btf_wtr);\n \n \treturn err;\n }\n \n static int do_dump(int argc, char **argv)\n {\n+\tLIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,\n+\t\t .open_flags = BPF_F_RDONLY,\n+\t);\n \tjson_writer_t *wtr = NULL, *btf_wtr = NULL;\n \tstruct bpf_map_info info = {};\n+\tstruct map_dump_ctx ctx = {};\n \tint nb_fds, i = 0;\n \t__u32 len = sizeof(info);\n \tint *fds = NULL;\n \tint err = -1;\n+\tsize_t j;\n \n \tif (argc != 2)\n \t\tusage();\n@@ -919,9 +980,34 @@ static int do_dump(int argc, char **argv)\n \tif (nb_fds \u003c 1)\n \t\tgoto exit_free;\n \n+\tif (recursive_dump) {\n+\t\tctx.seen = hashmap__new(hash_fn_for_key_as_id,\n+\t\t\t\t\tequal_fn_for_key_as_id, NULL);\n+\t\tif (IS_ERR(ctx.seen)) {\n+\t\t\tctx.seen = NULL;\n+\t\t\tp_err(\"failed to create hashmap for recursive dump\");\n+\t\t\tgoto exit_close;\n+\t\t}\n+\t\t/* Record the selected maps before discovering any inner maps. */\n+\t\tfor (i = 0; i \u003c nb_fds; i++) {\n+\t\t\tlen = sizeof(info);\n+\t\t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n+\t\t\t\tp_err(\"can't get map info: %s\", strerror(errno));\n+\t\t\t\terr = -1;\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t\terr = hashmap__add(ctx.seen, info.id, 0);\n+\t\t\tif (err) {\n+\t\t\t\tp_err(\"failed to record map id %u: %s\", info.id,\n+\t\t\t\t strerror(-err));\n+\t\t\t\tgoto exit_close;\n+\t\t\t}\n+\t\t}\n+\t}\n+\n \tif (json_output) {\n \t\twtr = json_wtr;\n-\t} else {\n+\t} else if (!recursive_dump) {\n \t\tint do_plain_btf;\n \n \t\tdo_plain_btf = maps_have_btf(fds, nb_fds);\n@@ -936,7 +1022,7 @@ static int do_dump(int argc, char **argv)\n \t\t}\n \t}\n \n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 || recursive_dump))\n \t\tjsonw_start_array(wtr);\t/* root array */\n \tfor (i = 0; i \u003c nb_fds; i++) {\n \t\tif (bpf_map_get_info_by_fd(fds[i], \u0026info, \u0026len)) {\n@@ -944,22 +1030,50 @@ static int do_dump(int argc, char **argv)\n \t\t\terr = -1;\n \t\t\tbreak;\n \t\t}\n-\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1);\n+\t\terr = map_dump(fds[i], \u0026info, wtr, nb_fds \u003e 1 || recursive_dump,\n+\t\t\t recursive_dump ? \u0026ctx : NULL);\n \t\tif (!wtr \u0026\u0026 i != nb_fds - 1)\n \t\t\tprintf(\"\\n\");\n \n \t\tif (err)\n \t\t\tbreak;\n-\t\tclose(fds[i]);\n+\t\t/* Keep selected maps alive while visiting their inner maps. */\n+\t\tif (!recursive_dump)\n+\t\t\tclose(fds[i]);\n+\t}\n+\tfor (j = 0; !err \u0026\u0026 j \u003c ctx.pending_cnt; j++) {\n+\t\tint fd;\n+\n+\t\tfd = bpf_map_get_fd_by_id_opts(ctx.pending_ids[j], \u0026opts);\n+\t\tif (fd \u003c 0) {\n+\t\t\tp_err(\"can't open inner map id %u: %s\",\n+\t\t\t ctx.pending_ids[j], strerror(errno));\n+\t\t\terr = -1;\n+\t\t\tbreak;\n+\t\t}\n+\t\tlen = sizeof(info);\n+\t\tif (bpf_map_get_info_by_fd(fd, \u0026info, \u0026len)) {\n+\t\t\tp_err(\"can't get map info: %s\", strerror(errno));\n+\t\t\terr = -1;\n+\t\t} else {\n+\t\t\tif (!wtr)\n+\t\t\t\tprintf(\"\\n\");\n+\t\t\terr = map_dump(fd, \u0026info, wtr, true, \u0026ctx);\n+\t\t}\n+\t\tclose(fd);\n \t}\n-\tif (wtr \u0026\u0026 nb_fds \u003e 1)\n+\tif (wtr \u0026\u0026 (nb_fds \u003e 1 || recursive_dump))\n \t\tjsonw_end_array(wtr);\t/* root array */\n \n \tif (btf_wtr)\n \t\tjsonw_destroy(\u0026btf_wtr);\n exit_close:\n+\tif (recursive_dump)\n+\t\ti = 0;\n \tfor (; i \u003c nb_fds; i++)\n \t\tclose(fds[i]);\n+\thashmap__free(ctx.seen);\n+\tfree(ctx.pending_ids);\n exit_free:\n \tfree(fds);\n \tfree_btf_vmlinux();\n@@ -1484,7 +1598,7 @@ static int do_help(int argc, char **argv)\n \t\t\" task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena |\\n\"\n \t\t\" insn_array | rhash }\\n\"\n \t\t\" \" HELP_SPEC_OPTIONS \" |\\n\"\n-\t\t\" {-f|--bpffs} | {-n|--nomount} }\\n\"\n+\t\t\" {-f|--bpffs} | {-n|--nomount} | {-r|--recursive} }\\n\"\n \t\t\"\",\n \t\tbin_name, argv[-2]);\n \ndiff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\nnew file mode 100644\nindex 0000000000000..9c88743a8f842\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c\n@@ -0,0 +1,465 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+#include \u003ctest_progs.h\u003e\n+#include \u003cbpftool_helpers.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+#include \u003csys/resource.h\u003e\n+#include \u003cdirent.h\u003e\n+\n+#define OUTPUT_SIZE 8192\n+\n+static bool dump_map(__u32 id, const char *options, char *output)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\n+\tsnprintf(command, sizeof(command), \"%s map dump id %u\", options, id);\n+\tmemset(output, 0, OUTPUT_SIZE);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),\n+\t\t \"dump_map\"))\n+\t\treturn false;\n+\t/* The helper doesn't terminate or strip the output. */\n+\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\treturn true;\n+}\n+\n+static __u32 map_id(int fd)\n+{\n+\tstruct bpf_map_info info = {};\n+\t__u32 len = sizeof(info);\n+\n+\tif (!ASSERT_OK(bpf_map_get_info_by_fd(fd, \u0026info, \u0026len), \"map_info\"))\n+\t\treturn 0;\n+\treturn info.id;\n+}\n+\n+static int count_token(const char *output, const char *token)\n+{\n+\tint count = 0;\n+\n+\twhile ((output = strstr(output, token))) {\n+\t\tcount++;\n+\t\toutput += strlen(token);\n+\t}\n+\treturn count;\n+}\n+\n+static void check_plain(__u32 root_id, __u32 inner_id, const char *type,\n+\t\t\tint entries, bool typed)\n+{\n+\tchar command[MAX_BPFTOOL_CMD_LEN], header[128];\n+\tchar output[OUTPUT_SIZE] = {};\n+\tconst char *root, *inner;\n+\n+\tsnprintf(command, sizeof(command), \"--recursive map dump id %u\", root_id);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"plain_dump\"))\n+\t\treturn;\n+\tsnprintf(header, sizeof(header), \"%u: %s name dump_outer \", root_id, type);\n+\troot = strstr(output, header);\n+\tif (!ASSERT_OK_PTR(root, \"plain_root_header\"))\n+\t\treturn;\n+\tASSERT_EQ(root - output, 0, \"plain_root_first\");\n+\tASSERT_EQ(count_token(output, \"inner_map_id:\"), entries, \"plain_references\");\n+\tif (entries) {\n+\t\tsnprintf(header, sizeof(header), \"%u: hash name dump_inner \", inner_id);\n+\t\tinner = strstr(output, header);\n+\t\tif (ASSERT_OK_PTR(inner, \"plain_inner_header\"))\n+\t\t\tASSERT_GT(inner - root, 0, \"plain_inner_after_root\");\n+\t\tASSERT_EQ(count_token(output, header), 1, \"plain_inner_once\");\n+\t}\n+\tASSERT_EQ(count_token(output, \"Found \"), entries \u0026\u0026 !typed ? 2 : 1,\n+\t\t \"plain_map_count\");\n+\tif (typed) {\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"key\\\": 0\", \"plain_btf_key\");\n+\t\tASSERT_HAS_SUBSTR(output, \"\\\"value\\\": 16843009\", \"plain_btf_value\");\n+\t}\n+}\n+\n+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,\n+\t\t bool typed)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tLIBBPF_OPTS(bpf_map_create_opts, inner_opts);\n+\tstruct btf *btf = NULL;\n+\tchar outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];\n+\tchar expected[OUTPUT_SIZE * 3], reference[64];\n+\tconst char *type_name = libbpf_bpf_map_type_str(type);\n+\tint inner_fd = -1, outer_fd = -1;\n+\t__u32 root_id, inner_id, key, value = 0x01010101;\n+\n+\tif (typed) {\n+\t\tbtf = btf__new_empty();\n+\t\tif (!ASSERT_OK_PTR(btf, \"create_btf\") ||\n+\t\t !ASSERT_EQ(btf__add_int(btf, \"unsigned int\", 4, 0), 1, \"btf_int\") ||\n+\t\t !ASSERT_OK(btf__load_into_kernel(btf), \"load_btf\"))\n+\t\t\tgoto out;\n+\t\tinner_opts.btf_fd = btf__fd(btf);\n+\t\tinner_opts.btf_key_type_id = 1;\n+\t\tinner_opts.btf_value_type_id = 1;\n+\t}\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", sizeof(key),\n+\t\t\t\t sizeof(value), 2, \u0026inner_opts);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_inner\"))\n+\t\tgoto out;\n+\tkey = 0;\n+\tif (!empty_inner \u0026\u0026\n+\t !ASSERT_OK(bpf_map_update_elem(inner_fd, \u0026key, \u0026value, BPF_ANY),\n+\t\t \"populate_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = inner_fd;\n+\touter_fd = bpf_map_create(type, \"dump_outer\", sizeof(key), sizeof(__u32),\n+\t\t\t\t 3, \u0026opts);\n+\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\"))\n+\t\tgoto out;\n+\t/* The unused third array slot also exercises failed lookups. */\n+\tfor (key = 0; key \u003c entries; key++)\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\troot_id = map_id(outer_fd);\n+\tinner_id = map_id(inner_fd);\n+\tif (!root_id || !inner_id || !dump_map(root_id, \"-j\", outer) ||\n+\t !dump_map(inner_id, \"-j\", inner))\n+\t\tgoto out;\n+\n+\tASSERT_EQ(outer[0], '[', \"default_array\");\n+\tASSERT_EQ(count_token(outer, \"\\\"elements\\\":\"), 0, \"default_no_wrapper\");\n+\tASSERT_EQ(count_token(outer, \"\\\"id\\\":\"), 0, \"default_no_header\");\n+\tsnprintf(reference, sizeof(reference), \"\\\"inner_map_id\\\":%u\", inner_id);\n+\tASSERT_EQ(count_token(outer, reference), entries, \"default_references\");\n+\tif (!entries)\n+\t\tASSERT_STREQ(outer, \"[]\", \"empty_outer_default\");\n+\tif (empty_inner)\n+\t\tASSERT_STREQ(inner, \"[]\", \"empty_inner_default\");\n+\telse if (typed)\n+\t\tASSERT_HAS_SUBSTR(inner, \"\\\"formatted\\\":{\\\"key\\\":0,\\\"value\\\":16843009}\",\n+\t\t\t\t \"typed_inner\");\n+\telse\n+\t\tASSERT_STREQ(inner,\n+\t\t\t \"[{\\\"key\\\":[\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\",\\\"0x00\\\"],\"\n+\t\t\t \"\\\"value\\\":[\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\",\\\"0x01\\\"]}]\",\n+\t\t\t \"ordinary_default\");\n+\n+\t/*\n+\t * Compare the complete JSON document: a flat array with the root first,\n+\t * one copy of the shared inner map, and unchanged entry representations.\n+\t */\n+\tif (entries)\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s},{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\"\n+\t\t\t \"\\\"name\\\":\\\"dump_inner\\\",\\\"flags\\\":0,\\\"elements\\\":%s}]\",\n+\t\t\t root_id, type_name, outer, inner_id, inner);\n+\telse\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":[]}]\", root_id, type_name);\n+\tif (dump_map(root_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_json\");\n+\tif (dump_map(root_id, \"--json --recursive\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_long_options\");\n+\tcheck_plain(root_id, inner_id, type_name, entries, typed);\n+\n+\t/* Recursion on an ordinary map still emits a single map object. */\n+\tsnprintf(expected, sizeof(expected),\n+\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"hash\\\",\\\"name\\\":\\\"dump_inner\\\",\"\n+\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}]\", inner_id, inner);\n+\tif (dump_map(inner_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"ordinary_recursive\");\n+out:\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+\tbtf__free(btf);\n+}\n+\n+static void test_multiple_roots(void)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tchar command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];\n+\tchar output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE * 4], elements[OUTPUT_SIZE];\n+\tstatic const char * const types[] = { \"hash\", \"array_of_maps\", \"hash_of_maps\", \"hash\" };\n+\tint fds[] = { -1, -1, -1, -1 };\n+\t__u32 ids[4], key;\n+\tint i, len = 0;\n+\n+\t/*\n+\t * Select the first inner map and both outers as roots. The other inner\n+\t * map must be appended after all three roots, even though it is found\n+\t * while dumping the first outer. A process-specific name avoids other\n+\t * tests' maps joining the selection.\n+\t */\n+\tsnprintf(name, sizeof(name), \"dump_%u\", getpid());\n+\tfds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[0], \"create_selected_inner\"))\n+\t\tgoto out;\n+\tfds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_discovered\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(fds[3], \"create_discovered_inner\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = fds[0];\n+\tfds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[1], \"create_array_root\"))\n+\t\tgoto out;\n+\tfds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, \u0026opts);\n+\tif (!ASSERT_OK_FD(fds[2], \"create_hash_root\"))\n+\t\tgoto out;\n+\tfor (i = 1; i \u003c= 2; i++) {\n+\t\tkey = 0;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[0], BPF_ANY),\n+\t\t\t \"reference_selected_inner\"))\n+\t\t\tgoto out;\n+\t\tkey = 1;\n+\t\tif (!ASSERT_OK(bpf_map_update_elem(fds[i], \u0026key, \u0026fds[3], BPF_ANY),\n+\t\t\t \"reference_discovered_inner\"))\n+\t\t\tgoto out;\n+\t}\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++) {\n+\t\tids[i] = map_id(fds[i]);\n+\t\tif (!ids[i] || !dump_map(ids[i], \"-j\", elements))\n+\t\t\tgoto out;\n+\t\tlen += snprintf(expected + len, sizeof(expected) - len,\n+\t\t\t\t\"%s{\\\"id\\\":%u,\\\"type\\\":\\\"%s\\\",\\\"name\\\":\\\"%s\\\",\"\n+\t\t\t\t\"\\\"flags\\\":0,\\\"elements\\\":%s}%s\",\n+\t\t\t\ti ? \",\" : \"[\", ids[i], types[i],\n+\t\t\t\ti == 3 ? \"dump_discovered\" : name, elements, i == 3 ? \"]\" : \"\");\n+\t}\n+\tsnprintf(command, sizeof(command), \"-j -r map dump name %s\", name);\n+\tif (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"dump_multiple_roots\")) {\n+\t\toutput[strcspn(output, \"\\n\")] = '\\0';\n+\t\tASSERT_STREQ(output, expected, \"roots_first_and_seed_dedup\");\n+\t}\n+out:\n+\tfor (i = 0; i \u003c ARRAY_SIZE(fds); i++)\n+\t\tif (fds[i] \u003e= 0)\n+\t\t\tclose(fds[i]);\n+}\n+\n+static void test_unreadable(bool outer)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tchar elements[OUTPUT_SIZE], output[OUTPUT_SIZE], root[OUTPUT_SIZE];\n+\tchar expected[OUTPUT_SIZE * 3], plain[OUTPUT_SIZE] = {};\n+\tchar command[MAX_BPFTOOL_CMD_LEN];\n+\tint inner_fd = -1, outer_fd = -1, lookup_errno;\n+\t__u32 inner_id, root_id, key = 0, value;\n+\n+\t/*\n+\t * Every key is enumerable, but PERF_EVENT_ARRAY lookup returns\n+\t * ENOTSUPP (the kernel-internal errno). Check both entries so an\n+\t * early exit on the first lookup failure cannot pass.\n+\t */\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_PERF_EVENT_ARRAY, \"dump_unreadable\",\n+\t\t\t\t sizeof(key), sizeof(value), 2, NULL);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_unreadable\"))\n+\t\tgoto out;\n+\tif (!ASSERT_LT(bpf_map_lookup_elem(inner_fd, \u0026key, \u0026value), 0,\n+\t\t \"unreadable_lookup\"))\n+\t\tgoto out;\n+\tlookup_errno = errno;\n+\tif (!ASSERT_NEQ(lookup_errno, ENOENT, \"unreadable_not_missing\"))\n+\t\tgoto out;\n+\tinner_id = map_id(inner_fd);\n+\tif (!inner_id || !dump_map(inner_id, \"-j\", elements))\n+\t\tgoto out;\n+\tASSERT_EQ(count_token(elements, \"\\\"error\\\":\"), 2, \"default_json_errors\");\n+\tsnprintf(command, sizeof(command), \"map dump id %u\", inner_id);\n+\tif (!ASSERT_OK(get_bpftool_command_output(command, plain, sizeof(plain) - 1),\n+\t\t \"default_plain_unreadable\"))\n+\t\tgoto out;\n+\tASSERT_EQ(count_token(plain, strerror(lookup_errno)), 2, \"default_plain_errors\");\n+\tASSERT_HAS_SUBSTR(plain, \"Found 0 elements\", \"default_plain_count\");\n+\n+\troot_id = inner_id;\n+\tif (outer) {\n+\t\topts.inner_map_fd = inner_fd;\n+\t\touter_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, \"dump_outer\",\n+\t\t\t\t\t sizeof(key), sizeof(value), 1, \u0026opts);\n+\t\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\") ||\n+\t\t !ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\t\troot_id = map_id(outer_fd);\n+\t\tif (!root_id || !dump_map(root_id, \"-j\", root))\n+\t\t\tgoto out;\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"array_of_maps\\\",\\\"name\\\":\\\"dump_outer\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s},{\\\"id\\\":%u,\"\n+\t\t\t \"\\\"type\\\":\\\"perf_event_array\\\",\\\"name\\\":\\\"dump_unreadable\\\",\"\n+\t\t\t \"\\\"flags\\\":0,\\\"elements\\\":%s}]\", root_id, root, inner_id, elements);\n+\t} else {\n+\t\tsnprintf(expected, sizeof(expected),\n+\t\t\t \"[{\\\"id\\\":%u,\\\"type\\\":\\\"perf_event_array\\\",\"\n+\t\t\t \"\\\"name\\\":\\\"dump_unreadable\\\",\\\"flags\\\":0,\\\"elements\\\":%s}]\",\n+\t\t\t inner_id, elements);\n+\t}\n+\tif (dump_map(root_id, \"-j -r\", output))\n+\t\tASSERT_STREQ(output, expected, \"recursive_unreadable_json\");\n+\tmemset(output, 0, sizeof(output));\n+\tsnprintf(command, sizeof(command), \"-r map dump id %u\", root_id);\n+\tif (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),\n+\t\t \"recursive_unreadable_plain\")) {\n+\t\tASSERT_HAS_SUBSTR(output, plain, \"recursive_plain_preserves_errors\");\n+\t\tASSERT_EQ(count_token(output, strerror(lookup_errno)), 2,\n+\t\t\t \"recursive_plain_errors\");\n+\t\tASSERT_EQ(count_token(output, \"Found \"), outer ? 2 : 1,\n+\t\t\t \"recursive_plain_maps\");\n+\t}\n+out:\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+}\n+\n+static void test_many_inner_maps(bool json)\n+{\n+\tLIBBPF_OPTS(bpf_map_create_opts, opts);\n+\tconst struct rlimit limit = { .rlim_cur = 32, .rlim_max = 32 };\n+\tchar command[MAX_BPFTOOL_CMD_LEN], token[64];\n+\t__u32 ids[64], root_id, key;\n+\tint inner_fd = -1, outer_fd = -1, status;\n+\tint inherited_fds[32], nr_inherited = 0, i;\n+\tchar *output = NULL;\n+\tpid_t pid;\n+\n+\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", 4, 4, 1, NULL);\n+\tif (!ASSERT_OK_FD(inner_fd, \"create_template\"))\n+\t\tgoto out;\n+\topts.inner_map_fd = inner_fd;\n+\touter_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, \"dump_outer\", 4, 4,\n+\t\t\t\t ARRAY_SIZE(ids), \u0026opts);\n+\tclose(inner_fd);\n+\tinner_fd = -1;\n+\tif (!ASSERT_OK_FD(outer_fd, \"create_outer\"))\n+\t\tgoto out;\n+\tfor (key = 0; key \u003c ARRAY_SIZE(ids); key++) {\n+\t\tinner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, \"dump_inner\", 4, 4, 1, NULL);\n+\t\tif (!ASSERT_OK_FD(inner_fd, \"create_inner\") ||\n+\t\t !ASSERT_OK(bpf_map_update_elem(outer_fd, \u0026key, \u0026inner_fd, BPF_ANY),\n+\t\t\t \"populate_outer\"))\n+\t\t\tgoto out;\n+\t\tids[key] = map_id(inner_fd);\n+\t\tif (!ids[key])\n+\t\t\tgoto out;\n+\t\t/* The outer map keeps each distinct inner map alive. */\n+\t\tclose(inner_fd);\n+\t\tinner_fd = -1;\n+\t}\n+\troot_id = map_id(outer_fd);\n+\toutput = calloc(1, 65536);\n+\tif (!root_id || !ASSERT_OK_PTR(output, \"allocate_output\"))\n+\t\tgoto out;\n+\n+\t/* Fill the low FD slots to exercise inherited descriptor cleanup. */\n+\tfor (i = 0; i \u003c ARRAY_SIZE(inherited_fds); i++) {\n+\t\tint fd = open(\"/dev/null\", O_RDONLY);\n+\n+\t\tif (!ASSERT_OK_FD(fd, \"open_inherited_fd\"))\n+\t\t\tgoto out;\n+\t\tinherited_fds[nr_inherited++] = fd;\n+\t}\n+\n+\t/*\n+\t * Create all fixtures before lowering the limit, and keep the test\n+\t * runner's limit unchanged. Retaining every discovered FD would exceed\n+\t * this limit before the recursive dump could visit all inner maps.\n+\t */\n+\tpid = fork();\n+\tif (!ASSERT_GE(pid, 0, \"fork\"))\n+\t\tgoto out;\n+\tif (!pid) {\n+\t\tstruct dirent *entry;\n+\t\tDIR *dir;\n+\n+\t\t/* Reserve a slot for the directory even if the parent is full. */\n+\t\tclose(inherited_fds[nr_inherited - 1]);\n+\t\tdir = opendir(\"/proc/self/fd\");\n+\t\tif (!dir)\n+\t\t\t_exit(6);\n+\t\t/* The parent keeps the outer map and its inner maps alive. */\n+\t\tfor (;;) {\n+\t\t\tchar *end;\n+\t\t\tlong fd;\n+\n+\t\t\terrno = 0;\n+\t\t\tentry = readdir(dir);\n+\t\t\tif (!entry) {\n+\t\t\t\tif (errno)\n+\t\t\t\t\t_exit(6);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t\tfd = strtol(entry-\u003ed_name, \u0026end, 10);\n+\t\t\tif (*end || fd \u003c 3 || fd == dirfd(dir))\n+\t\t\t\tcontinue;\n+\t\t\tclose(fd);\n+\t\t}\n+\t\tif (closedir(dir))\n+\t\t\t_exit(6);\n+\t\tif (setrlimit(RLIMIT_NOFILE, \u0026limit))\n+\t\t\t_exit(1);\n+\t\tsnprintf(command, sizeof(command), \"%s -r map dump id %u\",\n+\t\t\t json ? \"-j\" : \"\", root_id);\n+\t\tif (get_bpftool_command_output(command, output, 65535))\n+\t\t\t_exit(2);\n+\t\tif (count_token(output, json ? \"\\\"id\\\":\" : \"Found \") != ARRAY_SIZE(ids) + 1 ||\n+\t\t count_token(output, json ? \"\\\"inner_map_id\\\":\" : \"inner_map_id:\") !=\n+\t\t ARRAY_SIZE(ids))\n+\t\t\t_exit(3);\n+\t\tfor (key = 0; key \u003c ARRAY_SIZE(ids); key++) {\n+\t\t\tif (json)\n+\t\t\t\tsnprintf(token, sizeof(token), \"\\\"id\\\":%u,\", ids[key]);\n+\t\t\telse\n+\t\t\t\tsnprintf(token, sizeof(token), \"\\n%u: hash name dump_inner \",\n+\t\t\t\t\t ids[key]);\n+\t\t\tif (count_token(output, token) != 1)\n+\t\t\t\t_exit(4);\n+\t\t}\n+\t\tif (json \u0026\u0026 (output[0] != '[' ||\n+\t\t\t strcmp(output + strlen(output) - 2, \"]\\n\")))\n+\t\t\t_exit(5);\n+\t\t_exit(0);\n+\t}\n+\tif (ASSERT_EQ(waitpid(pid, \u0026status, 0), pid, \"waitpid\") \u0026\u0026\n+\t ASSERT_TRUE(WIFEXITED(status), \"child_exited\"))\n+\t\tASSERT_EQ(WEXITSTATUS(status), 0, \"dump_with_low_fd_limit\");\n+\tfor (i = 0; i \u003c nr_inherited; i++)\n+\t\tASSERT_GE(fcntl(inherited_fds[i], F_GETFD), 0, \"parent_fd_preserved\");\n+\tASSERT_EQ(map_id(outer_fd), root_id, \"parent_outer_preserved\");\n+out:\n+\twhile (nr_inherited)\n+\t\tclose(inherited_fds[--nr_inherited]);\n+\tfree(output);\n+\tif (outer_fd \u003e= 0)\n+\t\tclose(outer_fd);\n+\tif (inner_fd \u003e= 0)\n+\t\tclose(inner_fd);\n+}\n+\n+void test_bpftool_map_dump(void)\n+{\n+\tif (test__start_subtest(\"unreadable_ordinary\"))\n+\t\ttest_unreadable(false);\n+\tif (test__start_subtest(\"unreadable_inner\"))\n+\t\ttest_unreadable(true);\n+\tif (test__start_subtest(\"many_inner_maps_json\"))\n+\t\ttest_many_inner_maps(true);\n+\tif (test__start_subtest(\"many_inner_maps_plain\"))\n+\t\ttest_many_inner_maps(false);\n+\tif (test__start_subtest(\"multiple_roots\"))\n+\t\ttest_multiple_roots();\n+\tif (test__start_subtest(\"array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);\n+\tif (test__start_subtest(\"shared_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);\n+\tif (test__start_subtest(\"empty_array_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"empty_hash_of_maps\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);\n+\tif (test__start_subtest(\"btf_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);\n+\tif (test__start_subtest(\"empty_inner\"))\n+\t\ttest_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);\n+}\n"
} |
| 2/1 | 2026/09/07 06:34 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies user-space tools (bpftool) under tools/bpf/bpftool and tests under tools/testing/selftests/bpf. It does not touch any kernel-space code or affect the compiled kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 78f76ba74731c3296cfd7d7f769ea2c8736f01f6
Author: syz-cluster <triage@syzkaller.com>
Date: Mon Sep 7 06:34:38 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index 5daf3de5c7446..23faa67268587 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -16,7 +16,8 @@ SYNOPSIS
**bpftool** [*OPTIONS*] **map** *COMMAND*
-*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } | { **-n** | **--nomount** } }
+*OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } |
+{ **-n** | **--nomount** } | { **-r** | **--recursive** } }
*COMMANDS* :=
{ **show** | **list** | **create** | **dump** | **update** | **lookup** | **getnext** |
@@ -170,6 +171,25 @@ OPTIONS
Do not automatically attempt to mount any virtual file system (such as
tracefs or BPF virtual file system) when necessary.
+-r, --recursive
+ Also dump the inner maps referenced by **array_of_maps** and **hash_of_maps**
+ entries when running **map dump**. Each map ID is visited once, even if
+ several entries refer to it. Selected maps are followed by their inner maps.
+
+ Plain output includes a header identifying each map. On success, JSON output
+ is always an array of map objects, each containing an **id** and an
+ **elements** array, including when only one map is dumped. Outer map entries
+ retain their **inner_map_id** field, which identifies the corresponding inner
+ map object.
+
+ Inner map IDs are resolved when the maps are visited. The dump is not an
+ atomic snapshot: concurrent updates can change map contents or remove a
+ referenced inner map before it is visited. Failure to open a referenced
+ inner map stops the dump and returns a nonzero exit status. Output may
+ contain maps or entries printed before the error.
+
+ In JSON mode, the enclosing arrays and objects are closed before returning.
+
EXAMPLES
========
**# bpftool map show**
diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index 75cbcb512ebae..45c336d63be0a 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -261,7 +261,7 @@ _bpftool()
# Deal with options
if [[ ${words[cword]} == -* ]]; then
- local c='--version --json --pretty --bpffs --mapcompat --debug \
+ local c='--version --json --pretty --recursive --bpffs --mapcompat --debug \
--use-loader --base-btf --sign -i -k'
COMPREPLY=( $( compgen -W "$c" -- "$cur" ) )
return 0
diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index c91e1a6e1a1ec..424af4a496a5c 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -26,6 +26,7 @@ static int (*last_do_help)(int argc, char **argv);
json_writer_t *json_wtr;
bool pretty_output;
bool json_output;
+bool recursive_dump;
bool show_pinned;
bool block_mount;
bool verifier_logs;
@@ -452,6 +453,7 @@ int main(int argc, char **argv)
{ "json", no_argument, NULL, 'j' },
{ "help", no_argument, NULL, 'h' },
{ "pretty", no_argument, NULL, 'p' },
+ { "recursive", no_argument, NULL, 'r' },
{ "version", no_argument, NULL, 'V' },
{ "bpffs", no_argument, NULL, 'f' },
{ "mapcompat", no_argument, NULL, 'm' },
@@ -485,7 +487,7 @@ int main(int argc, char **argv)
bin_name = "bpftool";
opterr = 0;
- while ((opt = getopt_long(argc, argv, "VhpjfLmndSi:k:B:l",
+ while ((opt = getopt_long(argc, argv, "VhpjrfLmndSi:k:B:l",
options, NULL)) >= 0) {
switch (opt) {
case 'V':
@@ -507,6 +509,9 @@ int main(int argc, char **argv)
}
jsonw_pretty(json_wtr, pretty_output);
break;
+ case 'r':
+ recursive_dump = true;
+ break;
case 'f':
show_pinned = true;
break;
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 78b6e0ebb85d8..76626642e94cb 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -83,6 +83,7 @@ extern const char *bin_name;
extern json_writer_t *json_wtr;
extern bool json_output;
+extern bool recursive_dump;
extern bool show_pinned;
extern bool show_pids;
extern bool block_mount;
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 684a8fb724146..c400b15f16dd2 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -17,6 +17,7 @@
#include <bpf/bpf.h>
#include <bpf/btf.h>
#include <bpf/hashmap.h>
+#include <bpf/libbpf_internal.h>
#include "json_writer.h"
#include "main.h"
@@ -826,12 +827,44 @@ static void free_map_kv_btf(struct btf *btf)
btf__free(btf);
}
+struct map_dump_ctx {
+ struct hashmap *seen;
+ __u32 *pending_ids;
+ size_t pending_cnt;
+};
+
+static int collect_inner_map(struct map_dump_ctx *ctx, __u32 id)
+{
+ __u32 *ids;
+ int err;
+
+ if (hashmap__find(ctx->seen, id, NULL))
+ return 0;
+
+ ids = libbpf_reallocarray(ctx->pending_ids, ctx->pending_cnt + 1,
+ sizeof(*ids));
+ if (!ids) {
+ p_err("mem alloc failed");
+ return -1;
+ }
+ ctx->pending_ids = ids;
+
+ err = hashmap__add(ctx->seen, id, 0);
+ if (err) {
+ p_err("failed to record inner map id %u: %s", id, strerror(-err));
+ return -1;
+ }
+ ids[ctx->pending_cnt++] = id;
+ return 0;
+}
+
static int
map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
- bool show_header)
+ bool show_header, struct map_dump_ctx *ctx)
{
void *key, *value, *prev_key;
unsigned int num_elems = 0;
+ json_writer_t *plain_btf_wtr = NULL;
struct btf *btf = NULL;
int err;
@@ -845,6 +878,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
prev_key = NULL;
+ if (ctx && !wtr && (info->btf_value_type_id ||
+ info->btf_vmlinux_value_type_id)) {
+ plain_btf_wtr = get_btf_writer();
+ if (plain_btf_wtr) {
+ if (show_header)
+ show_map_header_plain(info);
+ show_header = false;
+ wtr = plain_btf_wtr;
+ }
+ }
+
if (wtr) {
err = get_map_kv_btf(info, &btf);
if (err) {
@@ -874,10 +918,20 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
if (err) {
if (errno == ENOENT)
err = 0;
+ else if (ctx)
+ p_err("can't get next key for map id %u: %s",
+ info->id, strerror(errno));
break;
}
- if (!dump_map_elem(fd, key, value, info, btf, wtr))
+ err = dump_map_elem(fd, key, value, info, btf, wtr);
+ if (!err) {
num_elems++;
+ if (ctx && map_is_map_of_maps(info->type)) {
+ err = collect_inner_map(ctx, *(__u32 *)value);
+ if (err)
+ break;
+ }
+ }
prev_key = key;
}
@@ -894,18 +948,25 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
free(key);
free(value);
free_map_kv_btf(btf);
+ if (plain_btf_wtr)
+ jsonw_destroy(&plain_btf_wtr);
return err;
}
static int do_dump(int argc, char **argv)
{
+ LIBBPF_OPTS(bpf_get_fd_by_id_opts, opts,
+ .open_flags = BPF_F_RDONLY,
+ );
json_writer_t *wtr = NULL, *btf_wtr = NULL;
struct bpf_map_info info = {};
+ struct map_dump_ctx ctx = {};
int nb_fds, i = 0;
__u32 len = sizeof(info);
int *fds = NULL;
int err = -1;
+ size_t j;
if (argc != 2)
usage();
@@ -919,9 +980,34 @@ static int do_dump(int argc, char **argv)
if (nb_fds < 1)
goto exit_free;
+ if (recursive_dump) {
+ ctx.seen = hashmap__new(hash_fn_for_key_as_id,
+ equal_fn_for_key_as_id, NULL);
+ if (IS_ERR(ctx.seen)) {
+ ctx.seen = NULL;
+ p_err("failed to create hashmap for recursive dump");
+ goto exit_close;
+ }
+ /* Record the selected maps before discovering any inner maps. */
+ for (i = 0; i < nb_fds; i++) {
+ len = sizeof(info);
+ if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
+ p_err("can't get map info: %s", strerror(errno));
+ err = -1;
+ goto exit_close;
+ }
+ err = hashmap__add(ctx.seen, info.id, 0);
+ if (err) {
+ p_err("failed to record map id %u: %s", info.id,
+ strerror(-err));
+ goto exit_close;
+ }
+ }
+ }
+
if (json_output) {
wtr = json_wtr;
- } else {
+ } else if (!recursive_dump) {
int do_plain_btf;
do_plain_btf = maps_have_btf(fds, nb_fds);
@@ -936,7 +1022,7 @@ static int do_dump(int argc, char **argv)
}
}
- if (wtr && nb_fds > 1)
+ if (wtr && (nb_fds > 1 || recursive_dump))
jsonw_start_array(wtr); /* root array */
for (i = 0; i < nb_fds; i++) {
if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
@@ -944,22 +1030,50 @@ static int do_dump(int argc, char **argv)
err = -1;
break;
}
- err = map_dump(fds[i], &info, wtr, nb_fds > 1);
+ err = map_dump(fds[i], &info, wtr, nb_fds > 1 || recursive_dump,
+ recursive_dump ? &ctx : NULL);
if (!wtr && i != nb_fds - 1)
printf("\n");
if (err)
break;
- close(fds[i]);
+ /* Keep selected maps alive while visiting their inner maps. */
+ if (!recursive_dump)
+ close(fds[i]);
+ }
+ for (j = 0; !err && j < ctx.pending_cnt; j++) {
+ int fd;
+
+ fd = bpf_map_get_fd_by_id_opts(ctx.pending_ids[j], &opts);
+ if (fd < 0) {
+ p_err("can't open inner map id %u: %s",
+ ctx.pending_ids[j], strerror(errno));
+ err = -1;
+ break;
+ }
+ len = sizeof(info);
+ if (bpf_map_get_info_by_fd(fd, &info, &len)) {
+ p_err("can't get map info: %s", strerror(errno));
+ err = -1;
+ } else {
+ if (!wtr)
+ printf("\n");
+ err = map_dump(fd, &info, wtr, true, &ctx);
+ }
+ close(fd);
}
- if (wtr && nb_fds > 1)
+ if (wtr && (nb_fds > 1 || recursive_dump))
jsonw_end_array(wtr); /* root array */
if (btf_wtr)
jsonw_destroy(&btf_wtr);
exit_close:
+ if (recursive_dump)
+ i = 0;
for (; i < nb_fds; i++)
close(fds[i]);
+ hashmap__free(ctx.seen);
+ free(ctx.pending_ids);
exit_free:
free(fds);
free_btf_vmlinux();
@@ -1484,7 +1598,7 @@ static int do_help(int argc, char **argv)
" task_storage | bloom_filter | user_ringbuf | cgrp_storage | arena |\n"
" insn_array | rhash }\n"
" " HELP_SPEC_OPTIONS " |\n"
- " {-f|--bpffs} | {-n|--nomount} }\n"
+ " {-f|--bpffs} | {-n|--nomount} | {-r|--recursive} }\n"
"",
bin_name, argv[-2]);
diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c
new file mode 100644
index 0000000000000..9c88743a8f842
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/bpftool_map_dump.c
@@ -0,0 +1,465 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <test_progs.h>
+#include <bpftool_helpers.h>
+#include <bpf/btf.h>
+#include <sys/resource.h>
+#include <dirent.h>
+
+#define OUTPUT_SIZE 8192
+
+static bool dump_map(__u32 id, const char *options, char *output)
+{
+ char command[MAX_BPFTOOL_CMD_LEN];
+
+ snprintf(command, sizeof(command), "%s map dump id %u", options, id);
+ memset(output, 0, OUTPUT_SIZE);
+ if (!ASSERT_OK(get_bpftool_command_output(command, output, OUTPUT_SIZE - 1),
+ "dump_map"))
+ return false;
+ /* The helper doesn't terminate or strip the output. */
+ output[strcspn(output, "\n")] = '\0';
+ return true;
+}
+
+static __u32 map_id(int fd)
+{
+ struct bpf_map_info info = {};
+ __u32 len = sizeof(info);
+
+ if (!ASSERT_OK(bpf_map_get_info_by_fd(fd, &info, &len), "map_info"))
+ return 0;
+ return info.id;
+}
+
+static int count_token(const char *output, const char *token)
+{
+ int count = 0;
+
+ while ((output = strstr(output, token))) {
+ count++;
+ output += strlen(token);
+ }
+ return count;
+}
+
+static void check_plain(__u32 root_id, __u32 inner_id, const char *type,
+ int entries, bool typed)
+{
+ char command[MAX_BPFTOOL_CMD_LEN], header[128];
+ char output[OUTPUT_SIZE] = {};
+ const char *root, *inner;
+
+ snprintf(command, sizeof(command), "--recursive map dump id %u", root_id);
+ if (!ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+ "plain_dump"))
+ return;
+ snprintf(header, sizeof(header), "%u: %s name dump_outer ", root_id, type);
+ root = strstr(output, header);
+ if (!ASSERT_OK_PTR(root, "plain_root_header"))
+ return;
+ ASSERT_EQ(root - output, 0, "plain_root_first");
+ ASSERT_EQ(count_token(output, "inner_map_id:"), entries, "plain_references");
+ if (entries) {
+ snprintf(header, sizeof(header), "%u: hash name dump_inner ", inner_id);
+ inner = strstr(output, header);
+ if (ASSERT_OK_PTR(inner, "plain_inner_header"))
+ ASSERT_GT(inner - root, 0, "plain_inner_after_root");
+ ASSERT_EQ(count_token(output, header), 1, "plain_inner_once");
+ }
+ ASSERT_EQ(count_token(output, "Found "), entries && !typed ? 2 : 1,
+ "plain_map_count");
+ if (typed) {
+ ASSERT_HAS_SUBSTR(output, "\"key\": 0", "plain_btf_key");
+ ASSERT_HAS_SUBSTR(output, "\"value\": 16843009", "plain_btf_value");
+ }
+}
+
+static void test_outer(enum bpf_map_type type, int entries, bool empty_inner,
+ bool typed)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ LIBBPF_OPTS(bpf_map_create_opts, inner_opts);
+ struct btf *btf = NULL;
+ char outer[OUTPUT_SIZE], inner[OUTPUT_SIZE], output[OUTPUT_SIZE];
+ char expected[OUTPUT_SIZE * 3], reference[64];
+ const char *type_name = libbpf_bpf_map_type_str(type);
+ int inner_fd = -1, outer_fd = -1;
+ __u32 root_id, inner_id, key, value = 0x01010101;
+
+ if (typed) {
+ btf = btf__new_empty();
+ if (!ASSERT_OK_PTR(btf, "create_btf") ||
+ !ASSERT_EQ(btf__add_int(btf, "unsigned int", 4, 0), 1, "btf_int") ||
+ !ASSERT_OK(btf__load_into_kernel(btf), "load_btf"))
+ goto out;
+ inner_opts.btf_fd = btf__fd(btf);
+ inner_opts.btf_key_type_id = 1;
+ inner_opts.btf_value_type_id = 1;
+ }
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", sizeof(key),
+ sizeof(value), 2, &inner_opts);
+ if (!ASSERT_OK_FD(inner_fd, "create_inner"))
+ goto out;
+ key = 0;
+ if (!empty_inner &&
+ !ASSERT_OK(bpf_map_update_elem(inner_fd, &key, &value, BPF_ANY),
+ "populate_inner"))
+ goto out;
+ opts.inner_map_fd = inner_fd;
+ outer_fd = bpf_map_create(type, "dump_outer", sizeof(key), sizeof(__u32),
+ 3, &opts);
+ if (!ASSERT_OK_FD(outer_fd, "create_outer"))
+ goto out;
+ /* The unused third array slot also exercises failed lookups. */
+ for (key = 0; key < entries; key++)
+ if (!ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+ "populate_outer"))
+ goto out;
+ root_id = map_id(outer_fd);
+ inner_id = map_id(inner_fd);
+ if (!root_id || !inner_id || !dump_map(root_id, "-j", outer) ||
+ !dump_map(inner_id, "-j", inner))
+ goto out;
+
+ ASSERT_EQ(outer[0], '[', "default_array");
+ ASSERT_EQ(count_token(outer, "\"elements\":"), 0, "default_no_wrapper");
+ ASSERT_EQ(count_token(outer, "\"id\":"), 0, "default_no_header");
+ snprintf(reference, sizeof(reference), "\"inner_map_id\":%u", inner_id);
+ ASSERT_EQ(count_token(outer, reference), entries, "default_references");
+ if (!entries)
+ ASSERT_STREQ(outer, "[]", "empty_outer_default");
+ if (empty_inner)
+ ASSERT_STREQ(inner, "[]", "empty_inner_default");
+ else if (typed)
+ ASSERT_HAS_SUBSTR(inner, "\"formatted\":{\"key\":0,\"value\":16843009}",
+ "typed_inner");
+ else
+ ASSERT_STREQ(inner,
+ "[{\"key\":[\"0x00\",\"0x00\",\"0x00\",\"0x00\"],"
+ "\"value\":[\"0x01\",\"0x01\",\"0x01\",\"0x01\"]}]",
+ "ordinary_default");
+
+ /*
+ * Compare the complete JSON document: a flat array with the root first,
+ * one copy of the shared inner map, and unchanged entry representations.
+ */
+ if (entries)
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\","
+ "\"flags\":0,\"elements\":%s},{\"id\":%u,\"type\":\"hash\","
+ "\"name\":\"dump_inner\",\"flags\":0,\"elements\":%s}]",
+ root_id, type_name, outer, inner_id, inner);
+ else
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"%s\",\"name\":\"dump_outer\","
+ "\"flags\":0,\"elements\":[]}]", root_id, type_name);
+ if (dump_map(root_id, "-j -r", output))
+ ASSERT_STREQ(output, expected, "recursive_json");
+ if (dump_map(root_id, "--json --recursive", output))
+ ASSERT_STREQ(output, expected, "recursive_long_options");
+ check_plain(root_id, inner_id, type_name, entries, typed);
+
+ /* Recursion on an ordinary map still emits a single map object. */
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"hash\",\"name\":\"dump_inner\","
+ "\"flags\":0,\"elements\":%s}]", inner_id, inner);
+ if (dump_map(inner_id, "-j -r", output))
+ ASSERT_STREQ(output, expected, "ordinary_recursive");
+out:
+ if (outer_fd >= 0)
+ close(outer_fd);
+ if (inner_fd >= 0)
+ close(inner_fd);
+ btf__free(btf);
+}
+
+static void test_multiple_roots(void)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ char command[MAX_BPFTOOL_CMD_LEN], name[BPF_OBJ_NAME_LEN];
+ char output[OUTPUT_SIZE] = {}, expected[OUTPUT_SIZE * 4], elements[OUTPUT_SIZE];
+ static const char * const types[] = { "hash", "array_of_maps", "hash_of_maps", "hash" };
+ int fds[] = { -1, -1, -1, -1 };
+ __u32 ids[4], key;
+ int i, len = 0;
+
+ /*
+ * Select the first inner map and both outers as roots. The other inner
+ * map must be appended after all three roots, even though it is found
+ * while dumping the first outer. A process-specific name avoids other
+ * tests' maps joining the selection.
+ */
+ snprintf(name, sizeof(name), "dump_%u", getpid());
+ fds[0] = bpf_map_create(BPF_MAP_TYPE_HASH, name, 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(fds[0], "create_selected_inner"))
+ goto out;
+ fds[3] = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_discovered", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(fds[3], "create_discovered_inner"))
+ goto out;
+ opts.inner_map_fd = fds[0];
+ fds[1] = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, name, 4, 4, 2, &opts);
+ if (!ASSERT_OK_FD(fds[1], "create_array_root"))
+ goto out;
+ fds[2] = bpf_map_create(BPF_MAP_TYPE_HASH_OF_MAPS, name, 4, 4, 2, &opts);
+ if (!ASSERT_OK_FD(fds[2], "create_hash_root"))
+ goto out;
+ for (i = 1; i <= 2; i++) {
+ key = 0;
+ if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[0], BPF_ANY),
+ "reference_selected_inner"))
+ goto out;
+ key = 1;
+ if (!ASSERT_OK(bpf_map_update_elem(fds[i], &key, &fds[3], BPF_ANY),
+ "reference_discovered_inner"))
+ goto out;
+ }
+ for (i = 0; i < ARRAY_SIZE(fds); i++) {
+ ids[i] = map_id(fds[i]);
+ if (!ids[i] || !dump_map(ids[i], "-j", elements))
+ goto out;
+ len += snprintf(expected + len, sizeof(expected) - len,
+ "%s{\"id\":%u,\"type\":\"%s\",\"name\":\"%s\","
+ "\"flags\":0,\"elements\":%s}%s",
+ i ? "," : "[", ids[i], types[i],
+ i == 3 ? "dump_discovered" : name, elements, i == 3 ? "]" : "");
+ }
+ snprintf(command, sizeof(command), "-j -r map dump name %s", name);
+ if (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+ "dump_multiple_roots")) {
+ output[strcspn(output, "\n")] = '\0';
+ ASSERT_STREQ(output, expected, "roots_first_and_seed_dedup");
+ }
+out:
+ for (i = 0; i < ARRAY_SIZE(fds); i++)
+ if (fds[i] >= 0)
+ close(fds[i]);
+}
+
+static void test_unreadable(bool outer)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ char elements[OUTPUT_SIZE], output[OUTPUT_SIZE], root[OUTPUT_SIZE];
+ char expected[OUTPUT_SIZE * 3], plain[OUTPUT_SIZE] = {};
+ char command[MAX_BPFTOOL_CMD_LEN];
+ int inner_fd = -1, outer_fd = -1, lookup_errno;
+ __u32 inner_id, root_id, key = 0, value;
+
+ /*
+ * Every key is enumerable, but PERF_EVENT_ARRAY lookup returns
+ * ENOTSUPP (the kernel-internal errno). Check both entries so an
+ * early exit on the first lookup failure cannot pass.
+ */
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_PERF_EVENT_ARRAY, "dump_unreadable",
+ sizeof(key), sizeof(value), 2, NULL);
+ if (!ASSERT_OK_FD(inner_fd, "create_unreadable"))
+ goto out;
+ if (!ASSERT_LT(bpf_map_lookup_elem(inner_fd, &key, &value), 0,
+ "unreadable_lookup"))
+ goto out;
+ lookup_errno = errno;
+ if (!ASSERT_NEQ(lookup_errno, ENOENT, "unreadable_not_missing"))
+ goto out;
+ inner_id = map_id(inner_fd);
+ if (!inner_id || !dump_map(inner_id, "-j", elements))
+ goto out;
+ ASSERT_EQ(count_token(elements, "\"error\":"), 2, "default_json_errors");
+ snprintf(command, sizeof(command), "map dump id %u", inner_id);
+ if (!ASSERT_OK(get_bpftool_command_output(command, plain, sizeof(plain) - 1),
+ "default_plain_unreadable"))
+ goto out;
+ ASSERT_EQ(count_token(plain, strerror(lookup_errno)), 2, "default_plain_errors");
+ ASSERT_HAS_SUBSTR(plain, "Found 0 elements", "default_plain_count");
+
+ root_id = inner_id;
+ if (outer) {
+ opts.inner_map_fd = inner_fd;
+ outer_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, "dump_outer",
+ sizeof(key), sizeof(value), 1, &opts);
+ if (!ASSERT_OK_FD(outer_fd, "create_outer") ||
+ !ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+ "populate_outer"))
+ goto out;
+ root_id = map_id(outer_fd);
+ if (!root_id || !dump_map(root_id, "-j", root))
+ goto out;
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"array_of_maps\",\"name\":\"dump_outer\","
+ "\"flags\":0,\"elements\":%s},{\"id\":%u,"
+ "\"type\":\"perf_event_array\",\"name\":\"dump_unreadable\","
+ "\"flags\":0,\"elements\":%s}]", root_id, root, inner_id, elements);
+ } else {
+ snprintf(expected, sizeof(expected),
+ "[{\"id\":%u,\"type\":\"perf_event_array\","
+ "\"name\":\"dump_unreadable\",\"flags\":0,\"elements\":%s}]",
+ inner_id, elements);
+ }
+ if (dump_map(root_id, "-j -r", output))
+ ASSERT_STREQ(output, expected, "recursive_unreadable_json");
+ memset(output, 0, sizeof(output));
+ snprintf(command, sizeof(command), "-r map dump id %u", root_id);
+ if (ASSERT_OK(get_bpftool_command_output(command, output, sizeof(output) - 1),
+ "recursive_unreadable_plain")) {
+ ASSERT_HAS_SUBSTR(output, plain, "recursive_plain_preserves_errors");
+ ASSERT_EQ(count_token(output, strerror(lookup_errno)), 2,
+ "recursive_plain_errors");
+ ASSERT_EQ(count_token(output, "Found "), outer ? 2 : 1,
+ "recursive_plain_maps");
+ }
+out:
+ if (outer_fd >= 0)
+ close(outer_fd);
+ if (inner_fd >= 0)
+ close(inner_fd);
+}
+
+static void test_many_inner_maps(bool json)
+{
+ LIBBPF_OPTS(bpf_map_create_opts, opts);
+ const struct rlimit limit = { .rlim_cur = 32, .rlim_max = 32 };
+ char command[MAX_BPFTOOL_CMD_LEN], token[64];
+ __u32 ids[64], root_id, key;
+ int inner_fd = -1, outer_fd = -1, status;
+ int inherited_fds[32], nr_inherited = 0, i;
+ char *output = NULL;
+ pid_t pid;
+
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(inner_fd, "create_template"))
+ goto out;
+ opts.inner_map_fd = inner_fd;
+ outer_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY_OF_MAPS, "dump_outer", 4, 4,
+ ARRAY_SIZE(ids), &opts);
+ close(inner_fd);
+ inner_fd = -1;
+ if (!ASSERT_OK_FD(outer_fd, "create_outer"))
+ goto out;
+ for (key = 0; key < ARRAY_SIZE(ids); key++) {
+ inner_fd = bpf_map_create(BPF_MAP_TYPE_HASH, "dump_inner", 4, 4, 1, NULL);
+ if (!ASSERT_OK_FD(inner_fd, "create_inner") ||
+ !ASSERT_OK(bpf_map_update_elem(outer_fd, &key, &inner_fd, BPF_ANY),
+ "populate_outer"))
+ goto out;
+ ids[key] = map_id(inner_fd);
+ if (!ids[key])
+ goto out;
+ /* The outer map keeps each distinct inner map alive. */
+ close(inner_fd);
+ inner_fd = -1;
+ }
+ root_id = map_id(outer_fd);
+ output = calloc(1, 65536);
+ if (!root_id || !ASSERT_OK_PTR(output, "allocate_output"))
+ goto out;
+
+ /* Fill the low FD slots to exercise inherited descriptor cleanup. */
+ for (i = 0; i < ARRAY_SIZE(inherited_fds); i++) {
+ int fd = open("/dev/null", O_RDONLY);
+
+ if (!ASSERT_OK_FD(fd, "open_inherited_fd"))
+ goto out;
+ inherited_fds[nr_inherited++] = fd;
+ }
+
+ /*
+ * Create all fixtures before lowering the limit, and keep the test
+ * runner's limit unchanged. Retaining every discovered FD would exceed
+ * this limit before the recursive dump could visit all inner maps.
+ */
+ pid = fork();
+ if (!ASSERT_GE(pid, 0, "fork"))
+ goto out;
+ if (!pid) {
+ struct dirent *entry;
+ DIR *dir;
+
+ /* Reserve a slot for the directory even if the parent is full. */
+ close(inherited_fds[nr_inherited - 1]);
+ dir = opendir("/proc/self/fd");
+ if (!dir)
+ _exit(6);
+ /* The parent keeps the outer map and its inner maps alive. */
+ for (;;) {
+ char *end;
+ long fd;
+
+ errno = 0;
+ entry = readdir(dir);
+ if (!entry) {
+ if (errno)
+ _exit(6);
+ break;
+ }
+ fd = strtol(entry->d_name, &end, 10);
+ if (*end || fd < 3 || fd == dirfd(dir))
+ continue;
+ close(fd);
+ }
+ if (closedir(dir))
+ _exit(6);
+ if (setrlimit(RLIMIT_NOFILE, &limit))
+ _exit(1);
+ snprintf(command, sizeof(command), "%s -r map dump id %u",
+ json ? "-j" : "", root_id);
+ if (get_bpftool_command_output(command, output, 65535))
+ _exit(2);
+ if (count_token(output, json ? "\"id\":" : "Found ") != ARRAY_SIZE(ids) + 1 ||
+ count_token(output, json ? "\"inner_map_id\":" : "inner_map_id:") !=
+ ARRAY_SIZE(ids))
+ _exit(3);
+ for (key = 0; key < ARRAY_SIZE(ids); key++) {
+ if (json)
+ snprintf(token, sizeof(token), "\"id\":%u,", ids[key]);
+ else
+ snprintf(token, sizeof(token), "\n%u: hash name dump_inner ",
+ ids[key]);
+ if (count_token(output, token) != 1)
+ _exit(4);
+ }
+ if (json && (output[0] != '[' ||
+ strcmp(output + strlen(output) - 2, "]\n")))
+ _exit(5);
+ _exit(0);
+ }
+ if (ASSERT_EQ(waitpid(pid, &status, 0), pid, "waitpid") &&
+ ASSERT_TRUE(WIFEXITED(status), "child_exited"))
+ ASSERT_EQ(WEXITSTATUS(status), 0, "dump_with_low_fd_limit");
+ for (i = 0; i < nr_inherited; i++)
+ ASSERT_GE(fcntl(inherited_fds[i], F_GETFD), 0, "parent_fd_preserved");
+ ASSERT_EQ(map_id(outer_fd), root_id, "parent_outer_preserved");
+out:
+ while (nr_inherited)
+ close(inherited_fds[--nr_inherited]);
+ free(output);
+ if (outer_fd >= 0)
+ close(outer_fd);
+ if (inner_fd >= 0)
+ close(inner_fd);
+}
+
+void test_bpftool_map_dump(void)
+{
+ if (test__start_subtest("unreadable_ordinary"))
+ test_unreadable(false);
+ if (test__start_subtest("unreadable_inner"))
+ test_unreadable(true);
+ if (test__start_subtest("many_inner_maps_json"))
+ test_many_inner_maps(true);
+ if (test__start_subtest("many_inner_maps_plain"))
+ test_many_inner_maps(false);
+ if (test__start_subtest("multiple_roots"))
+ test_multiple_roots();
+ if (test__start_subtest("array_of_maps"))
+ test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 1, false, false);
+ if (test__start_subtest("hash_of_maps"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, false);
+ if (test__start_subtest("shared_inner"))
+ test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 2, false, false);
+ if (test__start_subtest("empty_array_of_maps"))
+ test_outer(BPF_MAP_TYPE_ARRAY_OF_MAPS, 0, false, false);
+ if (test__start_subtest("empty_hash_of_maps"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 0, false, false);
+ if (test__start_subtest("btf_inner"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, false, true);
+ if (test__start_subtest("empty_inner"))
+ test_outer(BPF_MAP_TYPE_HASH_OF_MAPS, 1, true, false);
+}
|
| 3/2 | 2026/09/07 06:34 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13985 output: 90 thoughts: 551 Thoughts: **Patch Analysis: WorthFuzzing Determination** Okay, let's break down this patch. My initial scan of the diff reveals changes scattered across several files, specifically within `tools/bpf/bpftool/` and `tools/testing/selftests/bpf/`. I see updates to documentation, bash completion, the main program, map functionality, and a selftest. Now, let's quickly cross-reference that with the defined criteria for `WorthFuzzing`. The negative criteria (when to *not* fuzz) is what I need to focus on. Specifically, it states that modifications confined to "Non-kernel and non-executable changes" or "User-space directories, self-tests, samples, or scripts... that do not affect the compiled kernel image (vmlinux) or kernel modules" warrant a `WorthFuzzing=false` verdict. First, I need to confirm the scope. My analysis confirms the absence of changes outside the `tools/` directory. No touching of critical kernel components like `kernel/`, `net/`, `drivers/`, `include/`, `arch/`, `fs/`, or `mm/` is present. All modifications are contained within `tools/bpf/bpftool/` and `tools/testing/selftests/bpf/`. Given this, the patch exclusively alters user-space tools and associated selftests. According to the criteria, this definitively falls under the "WorthFuzzing=false" category. Therefore, I'm going to set `WorthFuzzing` to `false`. The reasoning is straightforward: "The patch only modifies user-space tools (`tools/bpf/bpftool/`) and selftests (`tools/testing/selftests/`), and does not alter the compiled kernel image (vmlinux) or kernel modules." No additional configuration flags are needed, so `EnableConfigs` and `FocusSymbols` will be empty. I'm ready to proceed with the `set-results` call. |
| 4/2 | 2026/09/07 06:34 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies user-space tools (bpftool) under tools/bpf/bpftool and tests under tools/testing/selftests/bpf. It does not touch any kernel-space code or affect the compiled kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies user-space tools (bpftool) under tools/bpf/bpftool and tests under tools/testing/selftests/bpf. It does not touch any kernel-space code or affect the compiled kernel image (vmlinux) or kernel modules.",
"WorthFuzzing": false
} |
| 5/1 | 2026/09/07 06:34 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|