AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch only modifies BPF selftests and the selftest kernel module under tools/testing/selftests/bpf/. It introduces no functional changes to core kernel code or drivers.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 6f6bd233407d31b758fc319607caca4c0fc81049\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Aug 28 04:51:56 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c\nnew file mode 100644\nindex 0000000000000..5a21aedd02fc5\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c\n@@ -0,0 +1,41 @@\n+// SPDX-License-Identifier: GPL-2.0\n+#include \u003ctest_progs.h\u003e\n+#include \"struct_ops_trampoline.skel.h\"\n+\n+#if defined(__loongarch__) || defined(__riscv)\n+static void run_struct_ops_trampoline(void)\n+{\n+\tstruct struct_ops_trampoline *skel;\n+\tstruct bpf_link *link;\n+\tint err;\n+\n+\tskel = struct_ops_trampoline__open();\n+\tif (!ASSERT_OK_PTR(skel, \"struct_ops_trampoline__open\"))\n+\t\treturn;\n+\n+\terr = struct_ops_trampoline__load(skel);\n+\tif (!ASSERT_OK(err, \"struct_ops_trampoline__load\"))\n+\t\tgoto cleanup;\n+\n+\tlink = bpf_map__attach_struct_ops(skel-\u003emaps.testmod_trampoline);\n+\tif (!ASSERT_OK_PTR(link, \"attach_struct_ops\"))\n+\t\tgoto cleanup;\n+\n+\tASSERT_OK(trigger_module_test_read(256), \"trigger_read\");\n+\n+\tASSERT_EQ(skel-\u003ebss-\u003egot_arg9, 9999, \"check_stack_passed_arg9\");\n+\n+\tbpf_link__destroy(link);\n+cleanup:\n+\tstruct_ops_trampoline__destroy(skel);\n+}\n+#endif\n+\n+void test_struct_ops_trampoline(void)\n+{\n+#if defined(__loongarch__) || defined(__riscv)\n+\trun_struct_ops_trampoline();\n+#else\n+\ttest__skip();\n+#endif\n+}\ndiff --git a/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c\nnew file mode 100644\nindex 0000000000000..b0fc19a2a0c53\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c\n@@ -0,0 +1,24 @@\n+// SPDX-License-Identifier: GPL-2.0\n+#include \u003cvmlinux.h\u003e\n+#include \u003cbpf/bpf_tracing.h\u003e\n+#include \"../test_kmods/bpf_testmod.h\"\n+#include \"bpf_misc.h\"\n+\n+char _license[] SEC(\"license\") = \"GPL\";\n+\n+__u64 got_arg9 = 0;\n+\n+SEC(\"struct_ops/test_trampoline\")\n+int BPF_PROG(test_trampoline, int arg1, int arg2, int arg3,\n+\t\t\t      int arg4, int arg5, int arg6,\n+\t\t\t      int arg7, int arg8, int arg9)\n+{\n+\tgot_arg9 = arg9;\n+\n+\treturn 0;\n+}\n+\n+SEC(\".struct_ops.link\")\n+struct bpf_testmod_ops testmod_trampoline = {\n+\t.test_trampoline = (void *)test_trampoline,\n+};\ndiff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\nindex 850cf4f830c48..be96bbc1b7c04 100644\n--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\n+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c\n@@ -589,6 +589,9 @@ noinline int bpf_testmod_trampoline_count_test(void)\n \treturn 0;\n }\n \n+struct bpf_testmod_ops;\n+static struct bpf_testmod_ops *st_ops_trampoline;\n+\n noinline ssize_t\n bpf_testmod_test_read(struct file *file, struct kobject *kobj,\n \t\t      const struct bin_attribute *bin_attr,\n@@ -637,6 +640,9 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,\n \n \tbpf_testmod_test_struct_ops3();\n \n+\tif (st_ops_trampoline \u0026\u0026 st_ops_trampoline-\u003etest_trampoline)\n+\t\tst_ops_trampoline-\u003etest_trampoline(1, 2, 3, 4, 5, 6, 7, 8, 9999);\n+\n \tstruct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +\n \t\t\t\tsizeof(int)), GFP_KERNEL);\n \tif (struct_arg3 != NULL) {\n@@ -1619,6 +1625,10 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,\n \t\t((struct bpf_testmod_ops *)kdata)-\u003edata = ((struct bpf_testmod_ops *)udata)-\u003edata;\n \t\treturn 1;\n \t}\n+\n+\tif (member-\u003eoffset == offsetof(struct bpf_testmod_ops, test_trampoline) * 8)\n+\t\tst_ops_trampoline = (struct bpf_testmod_ops *)kdata;\n+\n \treturn 0;\n }\n \n@@ -1694,6 +1704,13 @@ bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,\n \treturn NULL;\n }\n \n+static int bpf_testmod_ops__test_trampoline(int arg1, int arg2, int arg3,\n+\t\t\t\t\t    int arg4, int arg5, int arg6,\n+\t\t\t\t\t    int arg7, int arg8, int arg9)\n+{\n+\treturn arg9;\n+}\n+\n static struct bpf_testmod_ops __bpf_testmod_ops = {\n \t.test_1 = bpf_testmod_test_1,\n \t.test_2 = bpf_testmod_test_2,\n@@ -1701,6 +1718,7 @@ static struct bpf_testmod_ops __bpf_testmod_ops = {\n \t.test_refcounted = bpf_testmod_ops__test_refcounted,\n \t.test_refcounted_multi = bpf_testmod_ops__test_refcounted_multi,\n \t.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,\n+\t.test_trampoline = bpf_testmod_ops__test_trampoline,\n };\n \n struct bpf_struct_ops bpf_bpf_testmod_ops = {\ndiff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h\nindex 210b919290cc2..a5349d09ce55a 100644\n--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h\n+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h\n@@ -46,6 +46,11 @@ struct bpf_testmod_ops {\n \tstruct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task,\n \t\t\t\t\t\t    struct cgroup *cgrp);\n \n+\t/* Used to test indirect struct_ops trampolines stack-passed arguments (\u003e8 args). */\n+\tint (*test_trampoline)(int arg1, int arg2, int arg3,\n+\t\t\t       int arg4, int arg5, int arg6,\n+\t\t\t       int arg7, int arg8, int arg9);\n+\n \t/* The following fields are used to test shadow copies. */\n \tchar onebyte;\n \tstruct {\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and the selftest kernel module under tools/testing/selftests/bpf/. It introduces no functional changes to core kernel code or drivers.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 6f6bd233407d31b758fc319607caca4c0fc81049
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Aug 28 04:51:56 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
new file mode 100644
index 0000000000000..5a21aedd02fc5
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include "struct_ops_trampoline.skel.h"
+
+#if defined(__loongarch__) || defined(__riscv)
+static void run_struct_ops_trampoline(void)
+{
+	struct struct_ops_trampoline *skel;
+	struct bpf_link *link;
+	int err;
+
+	skel = struct_ops_trampoline__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_trampoline__open"))
+		return;
+
+	err = struct_ops_trampoline__load(skel);
+	if (!ASSERT_OK(err, "struct_ops_trampoline__load"))
+		goto cleanup;
+
+	link = bpf_map__attach_struct_ops(skel->maps.testmod_trampoline);
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		goto cleanup;
+
+	ASSERT_OK(trigger_module_test_read(256), "trigger_read");
+
+	ASSERT_EQ(skel->bss->got_arg9, 9999, "check_stack_passed_arg9");
+
+	bpf_link__destroy(link);
+cleanup:
+	struct_ops_trampoline__destroy(skel);
+}
+#endif
+
+void test_struct_ops_trampoline(void)
+{
+#if defined(__loongarch__) || defined(__riscv)
+	run_struct_ops_trampoline();
+#else
+	test__skip();
+#endif
+}
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c
new file mode 100644
index 0000000000000..b0fc19a2a0c53
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include "../test_kmods/bpf_testmod.h"
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+__u64 got_arg9 = 0;
+
+SEC("struct_ops/test_trampoline")
+int BPF_PROG(test_trampoline, int arg1, int arg2, int arg3,
+			      int arg4, int arg5, int arg6,
+			      int arg7, int arg8, int arg9)
+{
+	got_arg9 = arg9;
+
+	return 0;
+}
+
+SEC(".struct_ops.link")
+struct bpf_testmod_ops testmod_trampoline = {
+	.test_trampoline = (void *)test_trampoline,
+};
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 850cf4f830c48..be96bbc1b7c04 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -589,6 +589,9 @@ noinline int bpf_testmod_trampoline_count_test(void)
 	return 0;
 }
 
+struct bpf_testmod_ops;
+static struct bpf_testmod_ops *st_ops_trampoline;
+
 noinline ssize_t
 bpf_testmod_test_read(struct file *file, struct kobject *kobj,
 		      const struct bin_attribute *bin_attr,
@@ -637,6 +640,9 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
 
 	bpf_testmod_test_struct_ops3();
 
+	if (st_ops_trampoline && st_ops_trampoline->test_trampoline)
+		st_ops_trampoline->test_trampoline(1, 2, 3, 4, 5, 6, 7, 8, 9999);
+
 	struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +
 				sizeof(int)), GFP_KERNEL);
 	if (struct_arg3 != NULL) {
@@ -1619,6 +1625,10 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
 		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
 		return 1;
 	}
+
+	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline) * 8)
+		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
+
 	return 0;
 }
 
@@ -1694,6 +1704,13 @@ bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,
 	return NULL;
 }
 
+static int bpf_testmod_ops__test_trampoline(int arg1, int arg2, int arg3,
+					    int arg4, int arg5, int arg6,
+					    int arg7, int arg8, int arg9)
+{
+	return arg9;
+}
+
 static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_1 = bpf_testmod_test_1,
 	.test_2 = bpf_testmod_test_2,
@@ -1701,6 +1718,7 @@ static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_refcounted = bpf_testmod_ops__test_refcounted,
 	.test_refcounted_multi = bpf_testmod_ops__test_refcounted_multi,
 	.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,
+	.test_trampoline = bpf_testmod_ops__test_trampoline,
 };
 
 struct bpf_struct_ops bpf_bpf_testmod_ops = {
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
index 210b919290cc2..a5349d09ce55a 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
@@ -46,6 +46,11 @@ struct bpf_testmod_ops {
 	struct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task,
 						    struct cgroup *cgrp);
 
+	/* Used to test indirect struct_ops trampolines stack-passed arguments (>8 args). */
+	int (*test_trampoline)(int arg1, int arg2, int arg3,
+			       int arg4, int arg5, int arg6,
+			       int arg7, int arg8, int arg9);
+
 	/* The following fields are used to test shadow copies. */
 	char onebyte;
 	struct {

gemini-3.7-flash

null

null

							input: 4053
							output: 26
							thoughts: 617
						

**Analyzing This Patch: A Quick Assessment**

Okay, let's break down this patch. My initial thought is to analyze the file changes within the context of fuzzing potential. From what I see, it looks like this commit primarily modifies files within `tools/testing/selftests/bpf/`. Specifically, I see changes to `test_struct_ops_trampoline.c`, `struct_ops_trampoline.c`, `bpf_testmod.c`, and `bpf_testmod.h`. All of which are under that self-tests directory.

The immediate reaction is to verify this is the *only* place the modifications exist, to rule out any potential surprises elsewhere. I'll double-check this using either `git` directly or a quick scan of the diff, just to be absolutely sure. A good habit! Yep, the diff confirms all the changes are within `tools/testing/selftests/bpf/`.

Now, let me clarify my understanding of `bpf_testmod`. It's a test module, residing in `tools/testing/selftests/bpf/test_kmods/`. The key here is the distinction between this and core kernel code. Self-tests are primarily userspace test suites and out-of-tree test kernel modules for these tests. It's *not* code that's compiled directly into the vmlinux or into core kernel drivers.

Given this context, I'll need to think about fuzzing. I have a good understanding of the guidelines. Patches that *only* change Documentation, Kconfig files, or code comments don't warrant fuzzing. More importantly, those that do *not* modify reachable core kernel logic, drivers, or architectures don't typically warrant it, either.

In this case, since this patch deals exclusively with `tools/testing/selftests/`, it doesn't represent changes to the kernel itself, and therefore, no functional changes. It's contained within the testing framework.

To be extra thorough, I'll perform a quick check, maybe with `grepper`, to confirm that the diff is indeed comprehensive. Just to be sure. Ultimately, based on my analysis, I'm confident that this is a non-fuzzable patch from a core kernel perspective.

{
  "Expression": "bpf_testmod_ops__test_trampoline"
}

{
  "Output": "tools/testing/selftests/bpf/test_kmods/bpf_testmod.c=1701=bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,\n--\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c-1706-\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c:1707:static int bpf_testmod_ops__test_trampoline(int arg1, int arg2, int arg3,\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c-1708-\t\t\t\t\t    int arg4, int arg5, int arg6,\n--\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c=1714=static struct bpf_testmod_ops __bpf_testmod_ops = {\n--\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c-1720-\t.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c:1721:\t.test_trampoline = bpf_testmod_ops__test_trampoline,\ntools/testing/selftests/bpf/test_kmods/bpf_testmod.c-1722-};\n"
}

gemini-3.7-flash

null

null

							input: 5580
							output: 70
							thoughts: 156
						

**My Assessment of the Patch's Impact**

Okay, so I've taken a look at this patch, and the scope is reassuringly narrow. It's confined solely to the `tools/testing/selftests/bpf/` directory. No kernel source files outside of `tools/` are even touched, which is precisely what I like to see. These are selftest additions and modifications; they're *not* going to bleed into the kernel's execution or alter its behavior in any way. Given that, **`WorthFuzzing`** is unequivocally **`false`**. We're not dealing with any functional changes here; it's contained within the testing framework.

Now, let's make doubly sure everything is set correctly for `set-results`. The `EnableConfigs` and `FocusSymbols` are null or empty – that's expected given the context. The `Reasoning` should succinctly reflect that this patch is isolated to BPF selftests and `bpf_testmod` under `tools/testing/selftests/bpf/` and that it does *not* touch the functional aspects of the Linux kernel. It's time to invoke `set-results` with this solid assessment.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and the selftest kernel module under tools/testing/selftests/bpf/. It introduces no functional changes to core kernel code or drivers.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and the selftest kernel module under tools/testing/selftests/bpf/. It introduces no functional changes to core kernel code or drivers.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null