AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only removes a blank line in the kernel (kernel/bpf/verifier.c) and modifies userspace tools (libbpf, bpftool) and selftests. There are no functional changes to the kernel itself.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 3d696535eaada23d73308d00e47fb2b2f7b399b0\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Aug 14 18:15:00 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c\nindex 6ac1afced20bf..81eae8f70acdb 100644\n--- a/kernel/bpf/verifier.c\n+++ b/kernel/bpf/verifier.c\n@@ -12113,7 +12113,6 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me\n \t\t\tref_tname = btf_name_by_offset(btf, ref_t-\u003ename_off);\n \t\t}\n \n-\n \t\tif (bpf_register_is_null(reg) \u0026\u0026 type_may_be_null(kf_arg_type))\n \t\t\tcontinue;\n \ndiff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c\nindex a50540ef6521c..e5e82255af24a 100644\n--- a/tools/bpf/bpftool/gen.c\n+++ b/tools/bpf/bpftool/gen.c\n@@ -303,7 +303,7 @@ static int codegen_datasecs(struct bpf_object *obj, const char *obj_name)\n \t\treturn -errno;\n \n \tbpf_object__for_each_map(map, obj) {\n-\t\t/* only generate definitions for memory-mapped internal maps */\n+\t\t/* only generate definitions for skel data maps */\n \t\tif (!is_skel_data(map, map_ident, sizeof(map_ident)))\n \t\t\tcontinue;\n \n@@ -510,7 +510,7 @@ static size_t bpf_map_mmap_sz(const struct bpf_map *map)\n \treturn map_sz;\n }\n \n-/* Emit type size asserts for all top-level fields in memory-mapped internal maps. */\n+/* Emit type size asserts for all top-level fields in skel data maps. */\n static void codegen_asserts(struct bpf_object *obj, const char *obj_name)\n {\n \tstruct btf *btf = bpf_object__btf(obj);\ndiff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c\nindex e574870fb7169..b749c01742ee0 100644\n--- a/tools/lib/bpf/libbpf.c\n+++ b/tools/lib/bpf/libbpf.c\n@@ -1841,9 +1841,8 @@ static size_t bpf_map_mmap_sz(const struct bpf_map *map)\n \n \tswitch (map-\u003edef.type) {\n \tcase BPF_MAP_TYPE_ARRAY:\n-\t\treturn array_map_mmap_sz(map-\u003edef.value_size, map-\u003edef.max_entries);\n \tcase BPF_MAP_TYPE_PERCPU_ARRAY:\n-\t\treturn map-\u003edef.value_size;\n+\t\treturn array_map_mmap_sz(map-\u003edef.value_size, map-\u003edef.max_entries);\n \tcase BPF_MAP_TYPE_ARENA:\n \t\treturn page_sz * map-\u003edef.max_entries;\n \tdefault:\n@@ -1951,7 +1950,7 @@ static bool map_is_mmapable(struct bpf_object *obj, struct bpf_map *map)\n \t\treturn false;\n \n \t/*\n-\t * The internal PERCPU maps are not mmapble because the underlying\n+\t * The internal PERCPU maps are not mmapable because the underlying\n \t * percpu_array maps do not have mmap support.\n \t */\n \tif (map-\u003elibbpf_type == LIBBPF_MAP_PERCPU)\n@@ -2831,7 +2830,7 @@ static size_t adjust_ringbuf_sz(size_t sz)\n \t\treturn 0;\n \t/* Kernel expects BPF_MAP_TYPE_RINGBUF's max_entries to be\n \t * a power-of-2 multiple of kernel's page size. If user diligently\n-\t * satisified these conditions, pass the size through.\n+\t * satisfied these conditions, pass the size through.\n \t */\n \tif ((sz % page_sz) == 0 \u0026\u0026 is_pow_of_2(sz / page_sz))\n \t\treturn sz;\n@@ -6989,7 +6988,7 @@ bpf_object__reloc_code(struct bpf_object *obj, struct bpf_program *main_prog,\n  *    +-----------+------+------+\n  *\n  * At this point, we relocate subA calls, then go one level up and finish with\n- * relocatin mainA calls. mainA is done.\n+ * relocation mainA calls. mainA is done.\n  *\n  * For mainB process is similar but results in different order. We start with\n  * mainB and skip subA and subB, as mainB never calls them (at least\n@@ -7936,7 +7935,7 @@ static int libbpf_prepare_prog_load(struct bpf_program *prog,\n \t\tprog-\u003eattach_btf_id = btf_type_id;\n \n \t\t/* but by now libbpf common logic is not utilizing\n-\t\t * prog-\u003eatach_btf_obj_fd/prog-\u003eattach_btf_id anymore because\n+\t\t * prog-\u003eattach_btf_obj_fd/prog-\u003eattach_btf_id anymore because\n \t\t * this callback is called after opts were populated by\n \t\t * libbpf, so this callback has to update opts explicitly here\n \t\t */\n@@ -14219,7 +14218,7 @@ perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size,\n \t\tif (((void *)ehdr) + ehdr_size \u003e base + mmap_size) {\n \t\t\tvoid *copy_start = ehdr;\n \t\t\tsize_t len_first = base + mmap_size - copy_start;\n-\t\t\tsize_t len_secnd = ehdr_size - len_first;\n+\t\t\tsize_t len_second = ehdr_size - len_first;\n \n \t\t\tif (*copy_size \u003c ehdr_size) {\n \t\t\t\tfree(*copy_mem);\n@@ -14233,7 +14232,7 @@ perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size,\n \t\t\t}\n \n \t\t\tmemcpy(*copy_mem, copy_start, len_first);\n-\t\t\tmemcpy(*copy_mem + len_first, base, len_secnd);\n+\t\t\tmemcpy(*copy_mem + len_first, base, len_second);\n \t\t\tehdr = *copy_mem;\n \t\t}\n \n@@ -14251,7 +14250,7 @@ struct perf_buffer;\n \n struct perf_buffer_params {\n \tstruct perf_event_attr *attr;\n-\t/* if event_cb is specified, it takes precendence */\n+\t/* if event_cb is specified, it takes precedence */\n \tperf_buffer_event_fn event_cb;\n \t/* sample_cb and lost_cb are higher-level common-case callbacks */\n \tperf_buffer_sample_fn sample_cb;\ndiff --git a/tools/testing/selftests/bpf/prog_tests/global_data_init.c b/tools/testing/selftests/bpf/prog_tests/global_data_init.c\nindex 7d6bda9092954..c6d055b9457df 100644\n--- a/tools/testing/selftests/bpf/prog_tests/global_data_init.c\n+++ b/tools/testing/selftests/bpf/prog_tests/global_data_init.c\n@@ -68,12 +68,9 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f\n {\n \tstruct test_global_percpu_data__percpu *data = NULL;\n \tint i, err, key = 0, num_online, run = 0;\n-\t__u64 args[2] = {0x1234ULL, 0x5678ULL};\n \tsize_t data_sz;\n \tbool *online;\n \tLIBBPF_OPTS(bpf_test_run_opts, topts,\n-\t\t    .ctx_in = args,\n-\t\t    .ctx_size_in = sizeof(args),\n \t\t    .flags = BPF_F_TEST_RUN_ON_CPU,\n \t);\n \n@@ -81,7 +78,7 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f\n \tif (!ASSERT_OK(err, \"parse_cpu_mask_file\"))\n \t\treturn;\n \n-\tdata_sz = map ? bpf_map__value_size(map) : sizeof(*data);\n+\tdata_sz = sizeof(*data);\n \tdata = calloc(1, data_sz);\n \tif (!ASSERT_OK_PTR(data, \"calloc percpu data\"))\n \t\tgoto out;\n@@ -109,7 +106,7 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f\n \t\t\tbreak;\n \n \t\tASSERT_EQ(*runp, ++run, \"run\");\n-\t\tASSERT_EQ(data-\u003ecpu_id[0], i, \"cpu_id\");\n+\t\tASSERT_EQ(data-\u003ecpu_id, i, \"cpu_id\");\n \t\tASSERT_EQ(data-\u003edata, 1, \"data\");\n \t\tASSERT_TRUE(data-\u003eset, \"set\");\n \t\tASSERT_EQ(data-\u003enums[6], 0xc0de, \"nums[6]\");\n@@ -126,11 +123,11 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f\n static void test_global_percpu_data_init(void)\n {\n \tstruct test_global_percpu_data__percpu init_value = {};\n+\tconst __u32 desired_sz = sysconf(_SC_PAGE_SIZE) * 2;\n \tstruct test_global_percpu_data__percpu *init_data;\n-\tconst __u32 desired_sz = sysconf(_SC_PAGE_SIZE);\n \tstruct test_global_percpu_data *skel = NULL;\n+\tstruct bpf_map *map, *map_percpu_arr;\n \tsize_t init_data_sz;\n-\tstruct bpf_map *map;\n \tint prog_fd, err;\n \n \tskel = test_global_percpu_data__open();\n@@ -163,9 +160,11 @@ static void test_global_percpu_data_init(void)\n \tif (!ASSERT_EQ(bpf_map__type(map), BPF_MAP_TYPE_PERCPU_ARRAY, \"bpf_map__type\"))\n \t\tgoto out;\n \n+\tinit_value.set = 1;\n \tinit_value.data = 2;\n \tinit_value.nums[6] = -1;\n \tinit_value.struct_data.i = 2;\n+\tinit_value.struct_data.set = 1;\n \tinit_value.struct_data.nums[6] = -1;\n \terr = bpf_map__set_initial_value(map, \u0026init_value, sizeof(init_value));\n \tif (!ASSERT_OK(err, \"bpf_map__set_initial_value\"))\n@@ -177,33 +176,37 @@ static void test_global_percpu_data_init(void)\n \n \tASSERT_EQ(init_data-\u003edata, init_value.data, \"init_value data\");\n \tASSERT_EQ(init_data-\u003eset, init_value.set, \"init_value set\");\n+\tASSERT_EQ(init_data-\u003enums[6], init_value.nums[6], \"init_value nums[6]\");\n \tASSERT_EQ(init_data-\u003estruct_data.i, init_value.struct_data.i, \"init_value struct_data.i\");\n+\tASSERT_EQ(init_data-\u003estruct_data.set, init_value.struct_data.set,\n+\t\t  \"init_value struct_data.set\");\n \tASSERT_EQ(init_data-\u003estruct_data.nums[6], init_value.struct_data.nums[6],\n \t\t  \"init_value struct_data.nums[6]\");\n \tASSERT_EQ(init_data_sz, sizeof(init_value), \"init_value size\");\n \tASSERT_EQ((void *) init_data, (void *) skel-\u003epercpu, \"skel-\u003epercpu eq init_data\");\n \tASSERT_EQ(skel-\u003epercpu-\u003edata, init_value.data, \"skel-\u003epercpu-\u003edata\");\n \tASSERT_EQ(skel-\u003epercpu-\u003eset, init_value.set, \"skel-\u003epercpu-\u003eset\");\n+\tASSERT_EQ(skel-\u003epercpu-\u003enums[6], init_value.nums[6], \"skel-\u003epercpu-\u003enums[6]\");\n \tASSERT_EQ(skel-\u003epercpu-\u003estruct_data.i, init_value.struct_data.i,\n \t\t  \"skel-\u003epercpu-\u003estruct_data.i\");\n+\tASSERT_EQ(skel-\u003epercpu-\u003estruct_data.set, init_value.struct_data.set,\n+\t\t  \"skel-\u003epercpu-\u003estruct_data.set\");\n \tASSERT_EQ(skel-\u003epercpu-\u003estruct_data.nums[6], init_value.struct_data.nums[6],\n \t\t  \"skel-\u003epercpu-\u003estruct_data.nums[6]\");\n \n-\tASSERT_GT(desired_sz, sizeof(init_value), \"desired_sz\");\n-\terr = bpf_map__set_value_size(map, desired_sz);\n+\tskel-\u003epercpu_arr-\u003earr[0] = -1;\n+\tmap_percpu_arr = skel-\u003emaps.percpu_arr;\n+\terr = bpf_map__set_value_size(map_percpu_arr, desired_sz);\n \tif (!ASSERT_OK(err, \"bpf_map__set_value_size\"))\n \t\tgoto out;\n-\tif (!ASSERT_EQ(bpf_map__value_size(map), desired_sz, \"percpu value size\"))\n-\t\tgoto out;\n-\tif (!ASSERT_NEQ(bpf_map__btf_value_type_id(map), 0, \"percpu BTF value type\"))\n+\tif (!ASSERT_EQ(bpf_map__value_size(map_percpu_arr), desired_sz, \"percpu value size\"))\n \t\tgoto out;\n-\n-\tinit_data = bpf_map__initial_value(map, \u0026init_data_sz);\n-\tif (!ASSERT_OK_PTR(init_data, \"resized bpf_map__initial_value\"))\n+\tif (!ASSERT_NEQ(bpf_map__btf_value_type_id(map_percpu_arr), 0, \"percpu BTF value type\"))\n \t\tgoto out;\n-\tif (!ASSERT_EQ(init_data_sz, desired_sz, \"resized initial value size\"))\n+\tskel-\u003epercpu_arr = bpf_map__initial_value(map_percpu_arr, \u0026init_data_sz);\n+\tif (!ASSERT_OK_PTR(skel-\u003epercpu_arr, \"resized percpu_arr value\"))\n \t\tgoto out;\n-\tif (!ASSERT_EQ(init_data-\u003edata, init_value.data, \"resized initial value data\"))\n+\tif (!ASSERT_EQ(skel-\u003epercpu_arr-\u003earr[0], -1, \"arr[0]\"))\n \t\tgoto out;\n \n \terr = test_global_percpu_data__load(skel);\n@@ -345,8 +348,8 @@ static void test_global_percpu_data_iter(void)\n \t\treturn;\n \n \tskel-\u003erodata-\u003enum_cpus = num_cpus;\n-\tskel-\u003erodata-\u003eoffsetof_num = offsetof(struct test_global_percpu_data__percpu, struct_data);\n-\tskel-\u003erodata-\u003eoffsetof_num += sizeof(skel-\u003epercpu-\u003estruct_data) - sizeof(int);\n+\tskel-\u003erodata-\u003enum_off = offsetof(struct test_global_percpu_data__percpu,\n+\t\t\t\t\t struct_data.nums[6]);\n \tskel-\u003erodata-\u003eelem_sz = roundup(sizeof(struct test_global_percpu_data__percpu), 8);\n \tskel-\u003epercpu-\u003estruct_data.nums[6] = 0xc0de;\n \n@@ -369,7 +372,7 @@ static void test_global_percpu_data_iter(void)\n \t\tdo { } while (0);\n \tASSERT_EQ(len, 0, \"read iter\");\n \tASSERT_TRUE(skel-\u003ebss-\u003erun_iter, \"run_iter\");\n-\tASSERT_EQ(skel-\u003ebss-\u003epercpu_data_sum, 0xc0de * num_cpus, \"percpu_data_sum\");\n+\tASSERT_EQ(skel-\u003ebss-\u003esum, 0xc0de * num_cpus, \"sum\");\n \n \tclose(fd);\n out:\ndiff --git a/tools/testing/selftests/bpf/progs/test_global_percpu_data.c b/tools/testing/selftests/bpf/progs/test_global_percpu_data.c\nindex 71ff8d1bf49eb..175c44000753d 100644\n--- a/tools/testing/selftests/bpf/progs/test_global_percpu_data.c\n+++ b/tools/testing/selftests/bpf/progs/test_global_percpu_data.c\n@@ -8,9 +8,11 @@ int loong SEC(\".percpu.looooooooong\");\n int data3 SEC(\".data.percpu\");\n int data2 SEC(\".percpu.data\");\n \n+/* Used for testing bpf_map__set_value_size(). */\n+int arr[1] SEC(\".percpu.arr\");\n+\n int run;\n-/* cpu_id as array to verify map value resizing. */\n-int cpu_id[1] SEC(\".percpu\");\n+int cpu_id SEC(\".percpu\");\n int data SEC(\".percpu\") = -1;\n int nums[7] SEC(\".percpu\");\n bool set SEC(\".percpu\") = false;\n@@ -34,7 +36,7 @@ int update_percpu_data(void *ctx)\n \tdata = 1;\n \trun++;\n \tset = true;\n-\tcpu_id[0] = bpf_get_smp_processor_id();\n+\tcpu_id = bpf_get_smp_processor_id();\n \treturn 0;\n }\n \n@@ -62,9 +64,9 @@ int verifier_snprintf(void *ctx)\n }\n \n volatile const __u32 num_cpus = 0;\n-volatile const int offsetof_num;\n+volatile const int num_off;\n volatile const int elem_sz;\n-__u32 percpu_data_sum = 0;\n+__u32 sum = 0;\n bool run_iter = false;\n \n SEC(\"iter/bpf_map_elem\")\n@@ -80,7 +82,7 @@ int dump_percpu_data(struct bpf_iter__bpf_map_elem *ctx)\n \trun_iter = true;\n \n \tfor (i = 0; i \u003c num_cpus; i++) {\n-\t\tpercpu_data_sum += *(int *) (pptr + offsetof_num);\n+\t\tsum += *(int *) (pptr + num_off);\n \t\tpptr += elem_sz;\n \t}\n \treturn 0;\n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only removes a blank line in the kernel (kernel/bpf/verifier.c) and modifies userspace tools (libbpf, bpftool) and selftests. There are no functional changes to the kernel itself.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 3d696535eaada23d73308d00e47fb2b2f7b399b0
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Aug 14 18:15:00 2026 +0000

    syz-cluster: applied patch under review

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6ac1afced20bf..81eae8f70acdb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12113,7 +12113,6 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
 			ref_tname = btf_name_by_offset(btf, ref_t->name_off);
 		}
 
-
 		if (bpf_register_is_null(reg) && type_may_be_null(kf_arg_type))
 			continue;
 
diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
index a50540ef6521c..e5e82255af24a 100644
--- a/tools/bpf/bpftool/gen.c
+++ b/tools/bpf/bpftool/gen.c
@@ -303,7 +303,7 @@ static int codegen_datasecs(struct bpf_object *obj, const char *obj_name)
 		return -errno;
 
 	bpf_object__for_each_map(map, obj) {
-		/* only generate definitions for memory-mapped internal maps */
+		/* only generate definitions for skel data maps */
 		if (!is_skel_data(map, map_ident, sizeof(map_ident)))
 			continue;
 
@@ -510,7 +510,7 @@ static size_t bpf_map_mmap_sz(const struct bpf_map *map)
 	return map_sz;
 }
 
-/* Emit type size asserts for all top-level fields in memory-mapped internal maps. */
+/* Emit type size asserts for all top-level fields in skel data maps. */
 static void codegen_asserts(struct bpf_object *obj, const char *obj_name)
 {
 	struct btf *btf = bpf_object__btf(obj);
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index e574870fb7169..b749c01742ee0 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1841,9 +1841,8 @@ static size_t bpf_map_mmap_sz(const struct bpf_map *map)
 
 	switch (map->def.type) {
 	case BPF_MAP_TYPE_ARRAY:
-		return array_map_mmap_sz(map->def.value_size, map->def.max_entries);
 	case BPF_MAP_TYPE_PERCPU_ARRAY:
-		return map->def.value_size;
+		return array_map_mmap_sz(map->def.value_size, map->def.max_entries);
 	case BPF_MAP_TYPE_ARENA:
 		return page_sz * map->def.max_entries;
 	default:
@@ -1951,7 +1950,7 @@ static bool map_is_mmapable(struct bpf_object *obj, struct bpf_map *map)
 		return false;
 
 	/*
-	 * The internal PERCPU maps are not mmapble because the underlying
+	 * The internal PERCPU maps are not mmapable because the underlying
 	 * percpu_array maps do not have mmap support.
 	 */
 	if (map->libbpf_type == LIBBPF_MAP_PERCPU)
@@ -2831,7 +2830,7 @@ static size_t adjust_ringbuf_sz(size_t sz)
 		return 0;
 	/* Kernel expects BPF_MAP_TYPE_RINGBUF's max_entries to be
 	 * a power-of-2 multiple of kernel's page size. If user diligently
-	 * satisified these conditions, pass the size through.
+	 * satisfied these conditions, pass the size through.
 	 */
 	if ((sz % page_sz) == 0 && is_pow_of_2(sz / page_sz))
 		return sz;
@@ -6989,7 +6988,7 @@ bpf_object__reloc_code(struct bpf_object *obj, struct bpf_program *main_prog,
  *    +-----------+------+------+
  *
  * At this point, we relocate subA calls, then go one level up and finish with
- * relocatin mainA calls. mainA is done.
+ * relocation mainA calls. mainA is done.
  *
  * For mainB process is similar but results in different order. We start with
  * mainB and skip subA and subB, as mainB never calls them (at least
@@ -7936,7 +7935,7 @@ static int libbpf_prepare_prog_load(struct bpf_program *prog,
 		prog->attach_btf_id = btf_type_id;
 
 		/* but by now libbpf common logic is not utilizing
-		 * prog->atach_btf_obj_fd/prog->attach_btf_id anymore because
+		 * prog->attach_btf_obj_fd/prog->attach_btf_id anymore because
 		 * this callback is called after opts were populated by
 		 * libbpf, so this callback has to update opts explicitly here
 		 */
@@ -14219,7 +14218,7 @@ perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size,
 		if (((void *)ehdr) + ehdr_size > base + mmap_size) {
 			void *copy_start = ehdr;
 			size_t len_first = base + mmap_size - copy_start;
-			size_t len_secnd = ehdr_size - len_first;
+			size_t len_second = ehdr_size - len_first;
 
 			if (*copy_size < ehdr_size) {
 				free(*copy_mem);
@@ -14233,7 +14232,7 @@ perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size,
 			}
 
 			memcpy(*copy_mem, copy_start, len_first);
-			memcpy(*copy_mem + len_first, base, len_secnd);
+			memcpy(*copy_mem + len_first, base, len_second);
 			ehdr = *copy_mem;
 		}
 
@@ -14251,7 +14250,7 @@ struct perf_buffer;
 
 struct perf_buffer_params {
 	struct perf_event_attr *attr;
-	/* if event_cb is specified, it takes precendence */
+	/* if event_cb is specified, it takes precedence */
 	perf_buffer_event_fn event_cb;
 	/* sample_cb and lost_cb are higher-level common-case callbacks */
 	perf_buffer_sample_fn sample_cb;
diff --git a/tools/testing/selftests/bpf/prog_tests/global_data_init.c b/tools/testing/selftests/bpf/prog_tests/global_data_init.c
index 7d6bda9092954..c6d055b9457df 100644
--- a/tools/testing/selftests/bpf/prog_tests/global_data_init.c
+++ b/tools/testing/selftests/bpf/prog_tests/global_data_init.c
@@ -68,12 +68,9 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f
 {
 	struct test_global_percpu_data__percpu *data = NULL;
 	int i, err, key = 0, num_online, run = 0;
-	__u64 args[2] = {0x1234ULL, 0x5678ULL};
 	size_t data_sz;
 	bool *online;
 	LIBBPF_OPTS(bpf_test_run_opts, topts,
-		    .ctx_in = args,
-		    .ctx_size_in = sizeof(args),
 		    .flags = BPF_F_TEST_RUN_ON_CPU,
 	);
 
@@ -81,7 +78,7 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f
 	if (!ASSERT_OK(err, "parse_cpu_mask_file"))
 		return;
 
-	data_sz = map ? bpf_map__value_size(map) : sizeof(*data);
+	data_sz = sizeof(*data);
 	data = calloc(1, data_sz);
 	if (!ASSERT_OK_PTR(data, "calloc percpu data"))
 		goto out;
@@ -109,7 +106,7 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f
 			break;
 
 		ASSERT_EQ(*runp, ++run, "run");
-		ASSERT_EQ(data->cpu_id[0], i, "cpu_id");
+		ASSERT_EQ(data->cpu_id, i, "cpu_id");
 		ASSERT_EQ(data->data, 1, "data");
 		ASSERT_TRUE(data->set, "set");
 		ASSERT_EQ(data->nums[6], 0xc0de, "nums[6]");
@@ -126,11 +123,11 @@ static void test_percpu_data_on_cpus(struct bpf_map *map, int map_fd, int prog_f
 static void test_global_percpu_data_init(void)
 {
 	struct test_global_percpu_data__percpu init_value = {};
+	const __u32 desired_sz = sysconf(_SC_PAGE_SIZE) * 2;
 	struct test_global_percpu_data__percpu *init_data;
-	const __u32 desired_sz = sysconf(_SC_PAGE_SIZE);
 	struct test_global_percpu_data *skel = NULL;
+	struct bpf_map *map, *map_percpu_arr;
 	size_t init_data_sz;
-	struct bpf_map *map;
 	int prog_fd, err;
 
 	skel = test_global_percpu_data__open();
@@ -163,9 +160,11 @@ static void test_global_percpu_data_init(void)
 	if (!ASSERT_EQ(bpf_map__type(map), BPF_MAP_TYPE_PERCPU_ARRAY, "bpf_map__type"))
 		goto out;
 
+	init_value.set = 1;
 	init_value.data = 2;
 	init_value.nums[6] = -1;
 	init_value.struct_data.i = 2;
+	init_value.struct_data.set = 1;
 	init_value.struct_data.nums[6] = -1;
 	err = bpf_map__set_initial_value(map, &init_value, sizeof(init_value));
 	if (!ASSERT_OK(err, "bpf_map__set_initial_value"))
@@ -177,33 +176,37 @@ static void test_global_percpu_data_init(void)
 
 	ASSERT_EQ(init_data->data, init_value.data, "init_value data");
 	ASSERT_EQ(init_data->set, init_value.set, "init_value set");
+	ASSERT_EQ(init_data->nums[6], init_value.nums[6], "init_value nums[6]");
 	ASSERT_EQ(init_data->struct_data.i, init_value.struct_data.i, "init_value struct_data.i");
+	ASSERT_EQ(init_data->struct_data.set, init_value.struct_data.set,
+		  "init_value struct_data.set");
 	ASSERT_EQ(init_data->struct_data.nums[6], init_value.struct_data.nums[6],
 		  "init_value struct_data.nums[6]");
 	ASSERT_EQ(init_data_sz, sizeof(init_value), "init_value size");
 	ASSERT_EQ((void *) init_data, (void *) skel->percpu, "skel->percpu eq init_data");
 	ASSERT_EQ(skel->percpu->data, init_value.data, "skel->percpu->data");
 	ASSERT_EQ(skel->percpu->set, init_value.set, "skel->percpu->set");
+	ASSERT_EQ(skel->percpu->nums[6], init_value.nums[6], "skel->percpu->nums[6]");
 	ASSERT_EQ(skel->percpu->struct_data.i, init_value.struct_data.i,
 		  "skel->percpu->struct_data.i");
+	ASSERT_EQ(skel->percpu->struct_data.set, init_value.struct_data.set,
+		  "skel->percpu->struct_data.set");
 	ASSERT_EQ(skel->percpu->struct_data.nums[6], init_value.struct_data.nums[6],
 		  "skel->percpu->struct_data.nums[6]");
 
-	ASSERT_GT(desired_sz, sizeof(init_value), "desired_sz");
-	err = bpf_map__set_value_size(map, desired_sz);
+	skel->percpu_arr->arr[0] = -1;
+	map_percpu_arr = skel->maps.percpu_arr;
+	err = bpf_map__set_value_size(map_percpu_arr, desired_sz);
 	if (!ASSERT_OK(err, "bpf_map__set_value_size"))
 		goto out;
-	if (!ASSERT_EQ(bpf_map__value_size(map), desired_sz, "percpu value size"))
-		goto out;
-	if (!ASSERT_NEQ(bpf_map__btf_value_type_id(map), 0, "percpu BTF value type"))
+	if (!ASSERT_EQ(bpf_map__value_size(map_percpu_arr), desired_sz, "percpu value size"))
 		goto out;
-
-	init_data = bpf_map__initial_value(map, &init_data_sz);
-	if (!ASSERT_OK_PTR(init_data, "resized bpf_map__initial_value"))
+	if (!ASSERT_NEQ(bpf_map__btf_value_type_id(map_percpu_arr), 0, "percpu BTF value type"))
 		goto out;
-	if (!ASSERT_EQ(init_data_sz, desired_sz, "resized initial value size"))
+	skel->percpu_arr = bpf_map__initial_value(map_percpu_arr, &init_data_sz);
+	if (!ASSERT_OK_PTR(skel->percpu_arr, "resized percpu_arr value"))
 		goto out;
-	if (!ASSERT_EQ(init_data->data, init_value.data, "resized initial value data"))
+	if (!ASSERT_EQ(skel->percpu_arr->arr[0], -1, "arr[0]"))
 		goto out;
 
 	err = test_global_percpu_data__load(skel);
@@ -345,8 +348,8 @@ static void test_global_percpu_data_iter(void)
 		return;
 
 	skel->rodata->num_cpus = num_cpus;
-	skel->rodata->offsetof_num = offsetof(struct test_global_percpu_data__percpu, struct_data);
-	skel->rodata->offsetof_num += sizeof(skel->percpu->struct_data) - sizeof(int);
+	skel->rodata->num_off = offsetof(struct test_global_percpu_data__percpu,
+					 struct_data.nums[6]);
 	skel->rodata->elem_sz = roundup(sizeof(struct test_global_percpu_data__percpu), 8);
 	skel->percpu->struct_data.nums[6] = 0xc0de;
 
@@ -369,7 +372,7 @@ static void test_global_percpu_data_iter(void)
 		do { } while (0);
 	ASSERT_EQ(len, 0, "read iter");
 	ASSERT_TRUE(skel->bss->run_iter, "run_iter");
-	ASSERT_EQ(skel->bss->percpu_data_sum, 0xc0de * num_cpus, "percpu_data_sum");
+	ASSERT_EQ(skel->bss->sum, 0xc0de * num_cpus, "sum");
 
 	close(fd);
 out:
diff --git a/tools/testing/selftests/bpf/progs/test_global_percpu_data.c b/tools/testing/selftests/bpf/progs/test_global_percpu_data.c
index 71ff8d1bf49eb..175c44000753d 100644
--- a/tools/testing/selftests/bpf/progs/test_global_percpu_data.c
+++ b/tools/testing/selftests/bpf/progs/test_global_percpu_data.c
@@ -8,9 +8,11 @@ int loong SEC(".percpu.looooooooong");
 int data3 SEC(".data.percpu");
 int data2 SEC(".percpu.data");
 
+/* Used for testing bpf_map__set_value_size(). */
+int arr[1] SEC(".percpu.arr");
+
 int run;
-/* cpu_id as array to verify map value resizing. */
-int cpu_id[1] SEC(".percpu");
+int cpu_id SEC(".percpu");
 int data SEC(".percpu") = -1;
 int nums[7] SEC(".percpu");
 bool set SEC(".percpu") = false;
@@ -34,7 +36,7 @@ int update_percpu_data(void *ctx)
 	data = 1;
 	run++;
 	set = true;
-	cpu_id[0] = bpf_get_smp_processor_id();
+	cpu_id = bpf_get_smp_processor_id();
 	return 0;
 }
 
@@ -62,9 +64,9 @@ int verifier_snprintf(void *ctx)
 }
 
 volatile const __u32 num_cpus = 0;
-volatile const int offsetof_num;
+volatile const int num_off;
 volatile const int elem_sz;
-__u32 percpu_data_sum = 0;
+__u32 sum = 0;
 bool run_iter = false;
 
 SEC("iter/bpf_map_elem")
@@ -80,7 +82,7 @@ int dump_percpu_data(struct bpf_iter__bpf_map_elem *ctx)
 	run_iter = true;
 
 	for (i = 0; i < num_cpus; i++) {
-		percpu_data_sum += *(int *) (pptr + offsetof_num);
+		sum += *(int *) (pptr + num_off);
 		pptr += elem_sz;
 	}
 	return 0;

gemini-3.1-pro-preview

null

null

							input: 6847
							output: 80
							thoughts: 1564
						

**Patch Series Analysis for Fuzzing Eligibility**

Okay, let's break this down. My goal is to determine if this patch series necessitates fuzzing, meaning if it introduces functional changes to the kernel itself. I see that the patch touches several files: `kernel/bpf/verifier.c`, `tools/bpf/bpftool/gen.c`, `tools/lib/bpf/libbpf.c`, and a couple of selftest files.

First, I examine `kernel/bpf/verifier.c`. It looks like the change is minor – just the removal of an empty line. This is a purely cosmetic change and doesn't affect kernel functionality. This one is quickly dismissed.

Next, the `tools/bpf/bpftool/gen.c` modification appears to be related to comments. Again, this doesn't impact core kernel execution, so it's not relevant for fuzzing.

Now, `tools/lib/bpf/libbpf.c` needs a closer look. I see a change in a switch statement that alters the return value for `BPF_MAP_TYPE_PERCPU_ARRAY`. Initially, it returned `map->def.value_size` but now it's using `array_map_mmap_sz(map->def.value_size, map->def.max_entries)`. *Wait*... I need to remind myself that `libbpf` is a *userspace* library, even though it's part of the kernel tree. Changes here don't directly modify the kernel's execution path. Though it is a functional change, it is not within the kernel, so this needs to be discounted.

The selftests are just that: self tests. They are userspace programs and/or BPF programs designed for testing. They do not represent kernel code and do not need to be considered.

The prompt explicitly states that I need to determine if there are functional changes to *the kernel*. The prompt also explicitly says that the change is not worthy of fuzzing if it only contains: ... Modifications to Documentation/, Kconfig files, or code comments. ... Purely decorative changes ... Code paths that are impossible to reach in virtualized environments ... Driver .remove ... If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true."

Essentially, my task is to isolate *kernel* logic changes that *could* be exploited. Given that the critical part is the removal of a blank line in `kernel/bpf/verifier.c` and the rest are either comments or userspace library/tool changes, this patch series doesn't meet the criteria for fuzzing.

My conclusion: **WorthFuzzing=false** because the patch doesn't make functional changes to the kernel that would need to be fuzzed.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only removes a blank line in the kernel (kernel/bpf/verifier.c) and modifies userspace tools (libbpf, bpftool) and selftests. There are no functional changes to the kernel itself.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only removes a blank line in the kernel (kernel/bpf/verifier.c) and modifies userspace tools (libbpf, bpftool) and selftests. There are no functional changes to the kernel itself.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null