AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only modifies userspace libraries, tools, and selftests under tools/ (bpftool, libbpf, and BPF selftests) and makes no changes to the kernel code.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 5f7d4bec3c328c7f0590401ec27ba2341cf7ad5a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Aug 31 14:44:30 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c\nindex a9f730d407a92..8c2f9255b36d7 100644\n--- a/tools/bpf/bpftool/prog.c\n+++ b/tools/bpf/bpftool/prog.c\n@@ -1769,7 +1769,7 @@ static int load_with_options(int argc, char **argv, bool first_prog_only)\n \t\t}\n \n \t\tif (prog_type == BPF_PROG_TYPE_XDP \u0026\u0026 xdpmeta_ifindex) {\n-\t\t\tbpf_program__set_flags(pos, BPF_F_XDP_DEV_BOUND_ONLY);\n+\t\t\tbpf_program__set_flags(pos, bpf_program__flags(pos) | BPF_F_XDP_DEV_BOUND_ONLY);\n \t\t\tbpf_program__set_ifindex(pos, xdpmeta_ifindex);\n \t\t} else {\n \t\t\tbpf_program__set_ifindex(pos, offload_ifindex);\ndiff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c\nindex b749c01742ee0..27779b4cddd09 100644\n--- a/tools/lib/bpf/libbpf.c\n+++ b/tools/lib/bpf/libbpf.c\n@@ -7879,6 +7879,19 @@ static int tracing_multi_mod_fd(struct bpf_program *prog, int *btf_obj_fd)\n \treturn 0;\n }\n \n+static int libbpf_setup_prog_flags(struct bpf_program *prog, long cookie)\n+{\n+\tenum sec_def_flags def = cookie;\n+\n+\tif (def \u0026 SEC_SLEEPABLE)\n+\t\tprog-\u003eprog_flags |= BPF_F_SLEEPABLE;\n+\n+\tif (def \u0026 SEC_XDP_FRAGS)\n+\t\tprog-\u003eprog_flags |= BPF_F_XDP_HAS_FRAGS;\n+\n+\treturn 0;\n+}\n+\n /* this is called as prog-\u003esec_def-\u003eprog_prepare_load_fn for libbpf-supported sec_defs */\n static int libbpf_prepare_prog_load(struct bpf_program *prog,\n \t\t\t\t    struct bpf_prog_load_opts *opts, long cookie)\n@@ -7889,12 +7902,6 @@ static int libbpf_prepare_prog_load(struct bpf_program *prog,\n \tif ((def \u0026 SEC_EXP_ATTACH_OPT) \u0026\u0026 !kernel_supports(prog-\u003eobj, FEAT_EXP_ATTACH_TYPE))\n \t\topts-\u003eexpected_attach_type = 0;\n \n-\tif (def \u0026 SEC_SLEEPABLE)\n-\t\topts-\u003eprog_flags |= BPF_F_SLEEPABLE;\n-\n-\tif (prog-\u003etype == BPF_PROG_TYPE_XDP \u0026\u0026 (def \u0026 SEC_XDP_FRAGS))\n-\t\topts-\u003eprog_flags |= BPF_F_XDP_HAS_FRAGS;\n-\n \t/* special check for usdt to use uprobe_multi link */\n \tif ((def \u0026 SEC_USDT) \u0026\u0026 kernel_supports(prog-\u003eobj, FEAT_UPROBE_MULTI_LINK)) {\n \t\t/* for BPF_TRACE_UPROBE_MULTI, user might want to query expected_attach_type\n@@ -10099,6 +10106,7 @@ int bpf_program__clone(struct bpf_program *prog, const struct bpf_prog_load_opts\n \t.prog_type = BPF_PROG_TYPE_##ptype,\t\t\t\t    \\\n \t.expected_attach_type = atype,\t\t\t\t\t    \\\n \t.cookie = (long)(flags),\t\t\t\t\t    \\\n+\t.prog_setup_fn = libbpf_setup_prog_flags,\t\t\t    \\\n \t.prog_prepare_load_fn = libbpf_prepare_prog_load,\t\t    \\\n \t__VA_ARGS__\t\t\t\t\t\t\t    \\\n }\ndiff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c\nindex e8c1a619e330e..7dadb90e7b689 100644\n--- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c\n+++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c\n@@ -543,8 +543,10 @@ static void test_kprobe_sleepable(void)\n \t\treturn;\n \n \t/* sleepable kprobe test case needs flags set before loading */\n-\tif (!ASSERT_OK(bpf_program__set_flags(skel-\u003eprogs.handle_kprobe_sleepable,\n-\t\tBPF_F_SLEEPABLE), \"kprobe_sleepable_flags\"))\n+\tif (!ASSERT_OK(bpf_program__set_flags(\n+\t\t\t       skel-\u003eprogs.handle_kprobe_sleepable,\n+\t\t\t       bpf_program__flags(skel-\u003eprogs.handle_kprobe_sleepable) | BPF_F_SLEEPABLE),\n+\t\t       \"kprobe_sleepable_flags\"))\n \t\tgoto cleanup;\n \n \tif (!ASSERT_OK(test_attach_kprobe_sleepable__load(skel),\ndiff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c\nindex 97b00c7efe943..25eb59f460abe 100644\n--- a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c\n+++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c\n@@ -16,6 +16,9 @@ void test_kernel_flag(void)\n \tif (!ASSERT_OK_PTR(lsm_skel, \"lsm_skel\"))\n \t\treturn;\n \n+\tASSERT_EQ(bpf_program__flags(lsm_skel-\u003eprogs.bpf) \u0026 BPF_F_SLEEPABLE,\n+\t\t  BPF_F_SLEEPABLE, \"sleepable in program flags\");\n+\n \tlsm_skel-\u003ebss-\u003emonitored_tid = sys_gettid();\n \n \tret = test_kernel_flag__attach(lsm_skel);\ndiff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c\nindex 2e0ddef77ba51..ed3fd0a88dab6 100644\n--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c\n+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c\n@@ -362,7 +362,7 @@ static void test_attach_api_fails(void)\n \tsl_skel-\u003ebss-\u003euser_ptr = sl_skel;\n \n \terr = bpf_program__set_flags(sl_skel-\u003eprogs.handle_kprobe_multi_sleepable,\n-\t\t\t\t     BPF_F_SLEEPABLE);\n+\t\t\t\t     bpf_program__flags(sl_skel-\u003eprogs.handle_kprobe_multi_sleepable) | BPF_F_SLEEPABLE);\n \tif (!ASSERT_OK(err, \"sleep_skel_set_flags\"))\n \t\tgoto cleanup;\n \ndiff --git a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c\nindex fce203640f8cf..a894b1ab46f4e 100644\n--- a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c\n+++ b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c\n@@ -18,6 +18,9 @@ static void test_xdp_update_frags(void)\n \t\treturn;\n \n \tprog = bpf_object__next_program(obj, NULL);\n+\tASSERT_EQ(bpf_program__flags(prog) \u0026 BPF_F_XDP_HAS_FRAGS,\n+\t\t  BPF_F_XDP_HAS_FRAGS, \"frags in program flags\");\n+\n \tif (bpf_object__load(obj))\n \t\treturn;\n \ndiff --git a/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c b/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c\nindex a8ab05216c385..dff6b3e7266ee 100644\n--- a/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c\n+++ b/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c\n@@ -146,6 +146,11 @@ static void test_xdp_with_devmap_frags_helpers(void)\n \tif (!ASSERT_OK_PTR(skel, \"test_xdp_with_devmap_helpers__open_and_load\"))\n \t\treturn;\n \n+\tASSERT_EQ(bpf_program__flags(skel-\u003eprogs.xdp_dummy_dm_frags) \u0026 BPF_F_XDP_HAS_FRAGS,\n+\t\t  BPF_F_XDP_HAS_FRAGS, \"frags in program flags\");\n+\tASSERT_EQ(bpf_program__flags(skel-\u003eprogs.xdp_dummy_dm) \u0026 BPF_F_XDP_HAS_FRAGS,\n+\t\t  0, \"frags not in program flags\");\n+\n \tdm_fd_frags = bpf_program__fd(skel-\u003eprogs.xdp_dummy_dm_frags);\n \tmap_fd = bpf_map__fd(skel-\u003emaps.dm_ports);\n \terr = bpf_prog_get_info_by_fd(dm_fd_frags, \u0026info, \u0026len);\ndiff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c\nindex 5c31054ad4a4c..047dfdc322a2f 100644\n--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c\n+++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c\n@@ -408,14 +408,14 @@ void test_xdp_metadata(void)\n \n \tprog = bpf_object__find_program_by_name(bpf_obj-\u003eobj, \"rx\");\n \tbpf_program__set_ifindex(prog, rx_ifindex);\n-\tbpf_program__set_flags(prog, BPF_F_XDP_DEV_BOUND_ONLY);\n+\tbpf_program__set_flags(prog, bpf_program__flags(prog) | BPF_F_XDP_DEV_BOUND_ONLY);\n \n \t/* Make sure we can load a dev-bound program that performs\n \t * XDP_REDIRECT into a devmap.\n \t */\n \tnew_prog = bpf_object__find_program_by_name(bpf_obj-\u003eobj, \"redirect\");\n \tbpf_program__set_ifindex(new_prog, rx_ifindex);\n-\tbpf_program__set_flags(new_prog, BPF_F_XDP_DEV_BOUND_ONLY);\n+\tbpf_program__set_flags(new_prog, bpf_program__flags(new_prog) | BPF_F_XDP_DEV_BOUND_ONLY);\n \n \tif (!ASSERT_OK(xdp_metadata__load(bpf_obj), \"load skeleton\"))\n \t\tgoto out;\ndiff --git a/tools/testing/selftests/bpf/xdp_hw_metadata.c b/tools/testing/selftests/bpf/xdp_hw_metadata.c\nindex 6db3b5555a22e..c5501b3fdf48f 100644\n--- a/tools/testing/selftests/bpf/xdp_hw_metadata.c\n+++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c\n@@ -845,7 +845,7 @@ int main(int argc, char *argv[])\n \n \tprog = bpf_object__find_program_by_name(bpf_obj-\u003eobj, \"rx\");\n \tbpf_program__set_ifindex(prog, ifindex);\n-\tbpf_program__set_flags(prog, BPF_F_XDP_DEV_BOUND_ONLY);\n+\tbpf_program__set_flags(prog, bpf_program__flags(prog) | BPF_F_XDP_DEV_BOUND_ONLY);\n \n \tprintf(\"load bpf program...\\n\");\n \tret = xdp_hw_metadata__load(bpf_obj);\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace libraries, tools, and selftests under tools/ (bpftool, libbpf, and BPF selftests) and makes no changes to the kernel code.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 5f7d4bec3c328c7f0590401ec27ba2341cf7ad5a
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Aug 31 14:44:30 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index a9f730d407a92..8c2f9255b36d7 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -1769,7 +1769,7 @@ static int load_with_options(int argc, char **argv, bool first_prog_only)
 		}
 
 		if (prog_type == BPF_PROG_TYPE_XDP && xdpmeta_ifindex) {
-			bpf_program__set_flags(pos, BPF_F_XDP_DEV_BOUND_ONLY);
+			bpf_program__set_flags(pos, bpf_program__flags(pos) | BPF_F_XDP_DEV_BOUND_ONLY);
 			bpf_program__set_ifindex(pos, xdpmeta_ifindex);
 		} else {
 			bpf_program__set_ifindex(pos, offload_ifindex);
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b749c01742ee0..27779b4cddd09 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -7879,6 +7879,19 @@ static int tracing_multi_mod_fd(struct bpf_program *prog, int *btf_obj_fd)
 	return 0;
 }
 
+static int libbpf_setup_prog_flags(struct bpf_program *prog, long cookie)
+{
+	enum sec_def_flags def = cookie;
+
+	if (def & SEC_SLEEPABLE)
+		prog->prog_flags |= BPF_F_SLEEPABLE;
+
+	if (def & SEC_XDP_FRAGS)
+		prog->prog_flags |= BPF_F_XDP_HAS_FRAGS;
+
+	return 0;
+}
+
 /* this is called as prog->sec_def->prog_prepare_load_fn for libbpf-supported sec_defs */
 static int libbpf_prepare_prog_load(struct bpf_program *prog,
 				    struct bpf_prog_load_opts *opts, long cookie)
@@ -7889,12 +7902,6 @@ static int libbpf_prepare_prog_load(struct bpf_program *prog,
 	if ((def & SEC_EXP_ATTACH_OPT) && !kernel_supports(prog->obj, FEAT_EXP_ATTACH_TYPE))
 		opts->expected_attach_type = 0;
 
-	if (def & SEC_SLEEPABLE)
-		opts->prog_flags |= BPF_F_SLEEPABLE;
-
-	if (prog->type == BPF_PROG_TYPE_XDP && (def & SEC_XDP_FRAGS))
-		opts->prog_flags |= BPF_F_XDP_HAS_FRAGS;
-
 	/* special check for usdt to use uprobe_multi link */
 	if ((def & SEC_USDT) && kernel_supports(prog->obj, FEAT_UPROBE_MULTI_LINK)) {
 		/* for BPF_TRACE_UPROBE_MULTI, user might want to query expected_attach_type
@@ -10099,6 +10106,7 @@ int bpf_program__clone(struct bpf_program *prog, const struct bpf_prog_load_opts
 	.prog_type = BPF_PROG_TYPE_##ptype,				    \
 	.expected_attach_type = atype,					    \
 	.cookie = (long)(flags),					    \
+	.prog_setup_fn = libbpf_setup_prog_flags,			    \
 	.prog_prepare_load_fn = libbpf_prepare_prog_load,		    \
 	__VA_ARGS__							    \
 }
diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
index e8c1a619e330e..7dadb90e7b689 100644
--- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
+++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
@@ -543,8 +543,10 @@ static void test_kprobe_sleepable(void)
 		return;
 
 	/* sleepable kprobe test case needs flags set before loading */
-	if (!ASSERT_OK(bpf_program__set_flags(skel->progs.handle_kprobe_sleepable,
-		BPF_F_SLEEPABLE), "kprobe_sleepable_flags"))
+	if (!ASSERT_OK(bpf_program__set_flags(
+			       skel->progs.handle_kprobe_sleepable,
+			       bpf_program__flags(skel->progs.handle_kprobe_sleepable) | BPF_F_SLEEPABLE),
+		       "kprobe_sleepable_flags"))
 		goto cleanup;
 
 	if (!ASSERT_OK(test_attach_kprobe_sleepable__load(skel),
diff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
index 97b00c7efe943..25eb59f460abe 100644
--- a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
+++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
@@ -16,6 +16,9 @@ void test_kernel_flag(void)
 	if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel"))
 		return;
 
+	ASSERT_EQ(bpf_program__flags(lsm_skel->progs.bpf) & BPF_F_SLEEPABLE,
+		  BPF_F_SLEEPABLE, "sleepable in program flags");
+
 	lsm_skel->bss->monitored_tid = sys_gettid();
 
 	ret = test_kernel_flag__attach(lsm_skel);
diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index 2e0ddef77ba51..ed3fd0a88dab6 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -362,7 +362,7 @@ static void test_attach_api_fails(void)
 	sl_skel->bss->user_ptr = sl_skel;
 
 	err = bpf_program__set_flags(sl_skel->progs.handle_kprobe_multi_sleepable,
-				     BPF_F_SLEEPABLE);
+				     bpf_program__flags(sl_skel->progs.handle_kprobe_multi_sleepable) | BPF_F_SLEEPABLE);
 	if (!ASSERT_OK(err, "sleep_skel_set_flags"))
 		goto cleanup;
 
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c
index fce203640f8cf..a894b1ab46f4e 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_frags.c
@@ -18,6 +18,9 @@ static void test_xdp_update_frags(void)
 		return;
 
 	prog = bpf_object__next_program(obj, NULL);
+	ASSERT_EQ(bpf_program__flags(prog) & BPF_F_XDP_HAS_FRAGS,
+		  BPF_F_XDP_HAS_FRAGS, "frags in program flags");
+
 	if (bpf_object__load(obj))
 		return;
 
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c b/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c
index a8ab05216c385..dff6b3e7266ee 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c
@@ -146,6 +146,11 @@ static void test_xdp_with_devmap_frags_helpers(void)
 	if (!ASSERT_OK_PTR(skel, "test_xdp_with_devmap_helpers__open_and_load"))
 		return;
 
+	ASSERT_EQ(bpf_program__flags(skel->progs.xdp_dummy_dm_frags) & BPF_F_XDP_HAS_FRAGS,
+		  BPF_F_XDP_HAS_FRAGS, "frags in program flags");
+	ASSERT_EQ(bpf_program__flags(skel->progs.xdp_dummy_dm) & BPF_F_XDP_HAS_FRAGS,
+		  0, "frags not in program flags");
+
 	dm_fd_frags = bpf_program__fd(skel->progs.xdp_dummy_dm_frags);
 	map_fd = bpf_map__fd(skel->maps.dm_ports);
 	err = bpf_prog_get_info_by_fd(dm_fd_frags, &info, &len);
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
index 5c31054ad4a4c..047dfdc322a2f 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
@@ -408,14 +408,14 @@ void test_xdp_metadata(void)
 
 	prog = bpf_object__find_program_by_name(bpf_obj->obj, "rx");
 	bpf_program__set_ifindex(prog, rx_ifindex);
-	bpf_program__set_flags(prog, BPF_F_XDP_DEV_BOUND_ONLY);
+	bpf_program__set_flags(prog, bpf_program__flags(prog) | BPF_F_XDP_DEV_BOUND_ONLY);
 
 	/* Make sure we can load a dev-bound program that performs
 	 * XDP_REDIRECT into a devmap.
 	 */
 	new_prog = bpf_object__find_program_by_name(bpf_obj->obj, "redirect");
 	bpf_program__set_ifindex(new_prog, rx_ifindex);
-	bpf_program__set_flags(new_prog, BPF_F_XDP_DEV_BOUND_ONLY);
+	bpf_program__set_flags(new_prog, bpf_program__flags(new_prog) | BPF_F_XDP_DEV_BOUND_ONLY);
 
 	if (!ASSERT_OK(xdp_metadata__load(bpf_obj), "load skeleton"))
 		goto out;
diff --git a/tools/testing/selftests/bpf/xdp_hw_metadata.c b/tools/testing/selftests/bpf/xdp_hw_metadata.c
index 6db3b5555a22e..c5501b3fdf48f 100644
--- a/tools/testing/selftests/bpf/xdp_hw_metadata.c
+++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c
@@ -845,7 +845,7 @@ int main(int argc, char *argv[])
 
 	prog = bpf_object__find_program_by_name(bpf_obj->obj, "rx");
 	bpf_program__set_ifindex(prog, ifindex);
-	bpf_program__set_flags(prog, BPF_F_XDP_DEV_BOUND_ONLY);
+	bpf_program__set_flags(prog, bpf_program__flags(prog) | BPF_F_XDP_DEV_BOUND_ONLY);
 
 	printf("load bpf program...\n");
 	ret = xdp_hw_metadata__load(bpf_obj);

gemini-3.7-flash

null

null

							input: 5330
							output: 73
							thoughts: 842
						

**Patch Analysis: Not Worth Fuzzing**

Okay, let's break this patch down. My initial assessment is that it's probably not something we need to flag for Syzkaller fuzzing. The files affected are all tucked away in the `tools/` directory – `bpftool`, `libbpf`, and a slew of BPF self-tests. That screams "userspace tooling" to me, not core kernel functionality.

I'm making sure to be thorough, however. The fact that it *touches* anything BPF-related warrants a closer look, even if it's not kernel-space code. The BPF subsystem is pretty sensitive, so I'm double-checking.

Let me refresh myself on the fuzzing criteria. The instructions specify that patches modifying things like documentation, comments, decorative logging, unreachable code paths, etc., are usually a "no-go". The key is: does this patch affect *reachable, core kernel logic, drivers, or architectures*? If it doesn't, we can skip it.

Alright, a closer look at the file list. I don't see anything like `kernel/`, `net/`, `drivers/`, `fs/`, `arch/`, or `include/`. All the files are definitively under `tools/`. None of the listed files are part of `vmlinux` or are kernel modules. Syzkaller's primary focus is fuzzing the kernel via system calls, and this doesn't seem to impact that.

I'm confident in my assessment, but it's always good to be certain. Now, let's call `set-results` and set `WorthFuzzing` to `false`. My reasoning will be clear: this patch is confined to userspace tools, specifically `libbpf`, `bpftool`, and BPF self-tests in the `tools/` directory, and doesn't introduce any modifications to the kernel itself. No need to flag it.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace libraries, tools, and selftests under tools/ (bpftool, libbpf, and BPF selftests) and makes no changes to the kernel code.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies userspace libraries, tools, and selftests under tools/ (bpftool, libbpf, and BPF selftests) and makes no changes to the kernel code.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null