AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/07/23 11:30	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "BPF_JIT", "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_int_jit_compile", "bpf_jit_free", "bpf_jit_binary_pack_finalize" ], "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.", "WorthFuzzing": true }
1/1	2026/07/23 11:30	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit d7f662172a8e4edd983ad2949b553615a03168f7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jul 23 11:30:19 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c\nindex 4cdc7dfb05ba9a..e200b0207f7ab9 100644\n--- a/arch/arm64/net/bpf_jit_comp.c\n+++ b/arch/arm64/net/bpf_jit_comp.c\n@@ -2258,7 +2258,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr\n \t\t\tgoto out_free_hdr;\n \t\t}\n \t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\n-\t\t\t/* ro_header and header has been freed /\n+\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n \t\t\tro_header = NULL;\n \t\t\theader = NULL;\n \t\t\tgoto out_free_hdr;\n@@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog prog)\n \t\t /\n \t\tif (jit_data) {\n \t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\n+\t\t\tkvfree(jit_data-\u003ectx.offset);\n \t\t\tkfree(jit_data);\n \t\t}\n \t\tprog-\u003ebpf_func = (void )prog-\u003ebpf_func - cfi_get_offset();\ndiff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c\nindex 2738b4db116533..c8c8664dccafa8 100644\n--- a/arch/loongarch/net/bpf_jit.c\n+++ b/arch/loongarch/net/bpf_jit.c\n@@ -2298,7 +2298,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr\n \t\t\tgoto out_free;\n \t\t}\n \t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\n-\t\t\t/* ro_header and header have been freed /\n+\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n \t\t\tro_header = NULL;\n \t\t\theader = NULL;\n \t\t\tgoto out_free;\n@@ -2361,6 +2361,7 @@ void bpf_jit_free(struct bpf_prog prog)\n \t\t /\n \t\tif (jit_data) {\n \t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\n+\t\t\tkvfree(jit_data-\u003ectx.offset);\n \t\t\tkfree(jit_data);\n \t\t}\n \t\thdr = bpf_jit_binary_pack_hdr(prog);\ndiff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c\nindex 7b07b43575f111..0ca14b7d0b0e65 100644\n--- a/arch/powerpc/net/bpf_jit_comp.c\n+++ b/arch/powerpc/net/bpf_jit_comp.c\n@@ -339,8 +339,10 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr\n #endif\n \n \tif (!fp-\u003eis_func \|\| extra_pass) {\n-\t\tif (bpf_jit_binary_pack_finalize(fhdr, hdr))\n+\t\tif (bpf_jit_binary_pack_finalize(fhdr, hdr)) {\n+\t\t\tbpf_jit_binary_pack_free(fhdr, NULL);\n \t\t\tgoto out_err;\n+\t\t}\n \t}\n \n \tfp-\u003ebpf_func = (void )fimage;\ndiff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c\nindex cbfcd287ea1668..440d5b965e6040 100644\n--- a/arch/riscv/net/bpf_jit_core.c\n+++ b/arch/riscv/net/bpf_jit_core.c\n@@ -154,7 +154,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr\n \n \tif (!prog-\u003eis_func \|\| extra_pass) {\n \t\tif (WARN_ON(bpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader))) {\n-\t\t\t/* ro_header has been freed /\n+\t\t\tbpf_jit_binary_pack_free(jit_data-\u003ero_header, NULL);\n \t\t\tjit_data-\u003ero_header = NULL;\n \t\t\tjit_data-\u003eheader = NULL;\n \t\t\tgoto out_free_hdr;\n@@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog prog)\n \t\t\tkvfree(jit_data-\u003ectx.offset);\n \t\t\tkfree(jit_data);\n \t\t}\n+\t\tprog-\u003ebpf_func = (void )prog-\u003ebpf_func - cfi_get_offset();\n \t\thdr = bpf_jit_binary_pack_hdr(prog);\n \t\tbpf_jit_binary_pack_free(hdr, NULL);\n \t\tWARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));\ndiff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c\nindex de7515ea1beae8..d017bb0397b88b 100644\n--- a/arch/x86/net/bpf_jit_comp.c\n+++ b/arch/x86/net/bpf_jit_comp.c\n@@ -3988,7 +3988,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr\n \t\t\t Both cases are serious bugs and justify WARN_ON.\n \t\t\t /\n \t\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) {\n-\t\t\t\t/ header has been freed /\n+\t\t\t\tbpf_jit_binary_pack_free(header, NULL);\n \t\t\t\theader = NULL;\n \t\t\t\tgoto out_image;\n \t\t\t}\ndiff --git a/kernel/bpf/core.c b/kernel/bpf/core.c\nindex 47fe047ad30b88..77195911a3b371 100644\n--- a/kernel/bpf/core.c\n+++ b/kernel/bpf/core.c\n@@ -1237,10 +1237,9 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_header ro_header,\n \n \tkvfree(rw_header);\n \n-\tif (IS_ERR(ptr)) {\n-\t\tbpf_prog_pack_free(ro_header, ro_header-\u003esize);\n+\tif (IS_ERR(ptr))\n \t\treturn PTR_ERR(ptr);\n-\t}\n+\n \treturn 0;\n }\n \n" }
2/1	2026/07/23 11:30	agent	patch-evaluator	0m Model: best-expensive Args: null Results: { "EnableConfigs": [ "BPF_JIT", "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_int_jit_compile", "bpf_jit_free", "bpf_jit_binary_pack_finalize" ], "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit d7f662172a8e4edd983ad2949b553615a03168f7 Author: syz-cluster <triage@syzkaller.com> Date: Thu Jul 23 11:30:19 2026 +0000 syz-cluster: applied patch under review diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 4cdc7dfb05ba9a..e200b0207f7ab9 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -2258,7 +2258,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr goto out_free_hdr; } if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) { - /* ro_header and header has been freed / + bpf_jit_binary_pack_free(ro_header, NULL); ro_header = NULL; header = NULL; goto out_free_hdr; @@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog prog) / if (jit_data) { bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kvfree(jit_data->ctx.offset); kfree(jit_data); } prog->bpf_func = (void )prog->bpf_func - cfi_get_offset(); diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 2738b4db116533..c8c8664dccafa8 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -2298,7 +2298,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr goto out_free; } if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) { - /* ro_header and header have been freed / + bpf_jit_binary_pack_free(ro_header, NULL); ro_header = NULL; header = NULL; goto out_free; @@ -2361,6 +2361,7 @@ void bpf_jit_free(struct bpf_prog prog) / if (jit_data) { bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kvfree(jit_data->ctx.offset); kfree(jit_data); } hdr = bpf_jit_binary_pack_hdr(prog); diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c index 7b07b43575f111..0ca14b7d0b0e65 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -339,8 +339,10 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr #endif if (!fp->is_func \|\| extra_pass) { - if (bpf_jit_binary_pack_finalize(fhdr, hdr)) + if (bpf_jit_binary_pack_finalize(fhdr, hdr)) { + bpf_jit_binary_pack_free(fhdr, NULL); goto out_err; + } } fp->bpf_func = (void )fimage; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index cbfcd287ea1668..440d5b965e6040 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -154,7 +154,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr if (!prog->is_func \|\| extra_pass) { if (WARN_ON(bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header))) { - /* ro_header has been freed / + bpf_jit_binary_pack_free(jit_data->ro_header, NULL); jit_data->ro_header = NULL; jit_data->header = NULL; goto out_free_hdr; @@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog prog) kvfree(jit_data->ctx.offset); kfree(jit_data); } + prog->bpf_func = (void )prog->bpf_func - cfi_get_offset(); hdr = bpf_jit_binary_pack_hdr(prog); bpf_jit_binary_pack_free(hdr, NULL); WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog)); diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index de7515ea1beae8..d017bb0397b88b 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -3988,7 +3988,7 @@ struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_pr Both cases are serious bugs and justify WARN_ON. / if (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) { - / header has been freed / + bpf_jit_binary_pack_free(header, NULL); header = NULL; goto out_image; } diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 47fe047ad30b88..77195911a3b371 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1237,10 +1237,9 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_header ro_header, kvfree(rw_header); - if (IS_ERR(ptr)) { - bpf_prog_pack_free(ro_header, ro_header->size); + if (IS_ERR(ptr)) return PTR_ERR(ptr); - } + return 0; }
3/2	2026/07/23 11:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3618 output: 24 thoughts: 413 Thoughts: My Initial Assessment of the BPF JIT Patch Okay, so I'm looking at a patch that fundamentally alters the error handling within the BPF JIT compilation process, specifically impacting multiple architectures – arm64, loongarch, powerpc, riscv, and x86, along with the core BPF code within `kernel/bpf/core.c`. This is a significant change, right off the bat, as it modifies how memory management interacts with compilation failures. The core of the change seems to be around `bpf_jit_binary_pack_finalize`. Instead of freeing the `ro_header` on a failure within that function, it's now shifting the responsibility to the caller to call `bpf_jit_binary_pack_free(ro_header, NULL)` when a failure is detected in the `bpf_jit_binary_pack_finalize` function. That's a shift in responsibility that's worth noting and I need to think about that implication. Beyond that, the patch also introduces a few tweaks to the `bpf_jit_free` function for specific architectures. Specifically, the patch adds a `kvfree(jit_data->ctx.offset);` call for arm64 and loongarch in the `bpf_jit_free` and for riscv, `prog->bpf_func = (void )prog->bpf_func - cfi_get_offset();` is added. This is absolutely a functional change, and given its scope, I'm already thinking about fuzzing this. Any shift in memory management or error handling in the JIT compiler is a prime target for fuzzing. I need to confirm the specific functions being modified: `bpf_int_jit_compile` (across the architectures listed earlier) * `bpf_jit_free` (arm64, loongarch, riscv) * `bpf_jit_binary_pack_finalize` (the core one in `kernel/bpf/core.c`) My focus for inspection is definitely going to be those three symbols. And, of course, I'll need to verify that `CONFIG_BPF_JIT` and `CONFIG_BPF_SYSCALL` are enabled, as these are prerequisites for the changes to even be relevant. Time to check the configuration.
4/2	2026/07/23 11:30	tool	grepper	0m Args: { "Expression": "bpf_jit_binary_pack_finalize" } Results: { "Output": "arch/arm64/net/bpf_jit_comp.c=2093=struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_prog prog)\n--\narch/arm64/net/bpf_jit_comp.c-2202-\t image will be later copied to the RX image from where the program\narch/arm64/net/bpf_jit_comp.c:2203:\t * will run. The bpf_jit_binary_pack_finalize() will do this copy in the\narch/arm64/net/bpf_jit_comp.c-2204-\t * final step.\n--\narch/arm64/net/bpf_jit_comp.c-2259-\t\t}\narch/arm64/net/bpf_jit_comp.c:2260:\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\narch/arm64/net/bpf_jit_comp.c-2261-\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n--\narch/arm64/net/bpf_jit_comp.c=3225=void bpf_jit_free(struct bpf_prog prog)\n--\narch/arm64/net/bpf_jit_comp.c-3238-\t\tif (jit_data) {\narch/arm64/net/bpf_jit_comp.c:3239:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\narch/arm64/net/bpf_jit_comp.c-3240-\t\t\tkvfree(jit_data-\u003ectx.offset);\n--\narch/loongarch/net/bpf_jit.c=2197=struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_prog prog)\n--\narch/loongarch/net/bpf_jit.c-2268-\t * image will be later copied to the RX image from where the program will\narch/loongarch/net/bpf_jit.c:2269:\t * run. The bpf_jit_binary_pack_finalize() will do this copy in the final\narch/loongarch/net/bpf_jit.c-2270-\t * step.\n--\narch/loongarch/net/bpf_jit.c-2299-\t\t}\narch/loongarch/net/bpf_jit.c:2300:\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\narch/loongarch/net/bpf_jit.c-2301-\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n--\narch/loongarch/net/bpf_jit.c=2351=void bpf_jit_free(struct bpf_prog prog)\n--\narch/loongarch/net/bpf_jit.c-2362-\t\tif (jit_data) {\narch/loongarch/net/bpf_jit.c:2363:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\narch/loongarch/net/bpf_jit.c-2364-\t\t\tkvfree(jit_data-\u003ectx.offset);\n--\narch/powerpc/net/bpf_jit_comp.c=165=struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_prog fp)\n--\narch/powerpc/net/bpf_jit_comp.c-341-\tif (!fp-\u003eis_func \|\| extra_pass) {\narch/powerpc/net/bpf_jit_comp.c:342:\t\tif (bpf_jit_binary_pack_finalize(fhdr, hdr)) {\narch/powerpc/net/bpf_jit_comp.c-343-\t\t\tbpf_jit_binary_pack_free(fhdr, NULL);\n--\narch/powerpc/net/bpf_jit_comp.c=479=void bpf_jit_free(struct bpf_prog fp)\n--\narch/powerpc/net/bpf_jit_comp.c-492-\t\tif (jit_data) {\narch/powerpc/net/bpf_jit_comp.c:493:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003efhdr, jit_data-\u003ehdr);\narch/powerpc/net/bpf_jit_comp.c-494-\t\t\tkvfree(jit_data-\u003eaddrs);\n--\narch/riscv/net/bpf_jit_core.c=44=struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_prog prog)\n--\narch/riscv/net/bpf_jit_core.c-120-\t\t\t * image will be later copied to the RX image from where the program\narch/riscv/net/bpf_jit_core.c:121:\t\t\t * will run. The bpf_jit_binary_pack_finalize() will do this copy in the\narch/riscv/net/bpf_jit_core.c-122-\t\t\t * final step.\n--\narch/riscv/net/bpf_jit_core.c-155-\tif (!prog-\u003eis_func \|\| extra_pass) {\narch/riscv/net/bpf_jit_core.c:156:\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader))) {\narch/riscv/net/bpf_jit_core.c-157-\t\t\tbpf_jit_binary_pack_free(jit_data-\u003ero_header, NULL);\n--\narch/riscv/net/bpf_jit_core.c=224=void bpf_jit_free(struct bpf_prog prog)\n--\narch/riscv/net/bpf_jit_core.c-235-\t\tif (jit_data) {\narch/riscv/net/bpf_jit_core.c:236:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\narch/riscv/net/bpf_jit_core.c-237-\t\t\tkvfree(jit_data-\u003ectx.offset);\n--\narch/x86/net/bpf_jit_comp.c=3851=struct bpf_prog bpf_int_jit_compile(struct bpf_verifier_env env, struct bpf_prog prog)\n--\narch/x86/net/bpf_jit_comp.c-3983-\t\t\t/\narch/x86/net/bpf_jit_comp.c:3984:\t\t\t bpf_jit_binary_pack_finalize fails in two scenarios:\narch/x86/net/bpf_jit_comp.c-3985-\t\t\t * 1) header is not pointing to proper module memory;\n--\narch/x86/net/bpf_jit_comp.c-3989-\t\t\t /\narch/x86/net/bpf_jit_comp.c:3990:\t\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) {\narch/x86/net/bpf_jit_comp.c-3991-\t\t\t\tbpf_jit_binary_pack_free(header, NULL);\n--\narch/x86/net/bpf_jit_comp.c=4071=void bpf_jit_free(struct bpf_prog prog)\n--\narch/x86/net/bpf_jit_comp.c-4084-\t\tif (jit_data) {\narch/x86/net/bpf_jit_comp.c:4085:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003eheader,\narch/x86/net/bpf_jit_comp.c-4086-\t\t\t\t\t\t jit_data-\u003erw_header);\n--\ninclude/linux/filter.h=1351=bpf_jit_binary_pack_alloc(unsigned int proglen, u8 *ro_image,\n--\ninclude/linux/filter.h-1356-\t\t\t bool was_classic);\ninclude/linux/filter.h:1357:int bpf_jit_binary_pack_finalize(struct bpf_binary_header ro_header,\ninclude/linux/filter.h-1358-\t\t\t\t struct bpf_binary_header rw_header);\n--\nkernel/bpf/core.c=1168=void bpf_jit_binary_free(struct bpf_binary_header hdr)\n--\nkernel/bpf/core.c-1180- * RO memory address, but write JITed program to the RW buffer. Once the\nkernel/bpf/core.c:1181: * JIT engine finishes, it calls bpf_jit_binary_pack_finalize, which copies\nkernel/bpf/core.c-1182- * the JITed program to the RO memory.\n--\nkernel/bpf/core.c=1185=bpf_jit_binary_pack_alloc(unsigned int proglen, u8 *image_ptr,\n--\nkernel/bpf/core.c-1230-/ Copy JITed text from rw_header to its final location, the ro_header. /\nkernel/bpf/core.c:1231:int bpf_jit_binary_pack_finalize(struct bpf_binary_header ro_header,\nkernel/bpf/core.c-1232-\t\t\t\t struct bpf_binary_header rw_header)\n--\nkernel/bpf/core.c-1247- 1) when the program is freed after;\nkernel/bpf/core.c:1248: * 2) when the JIT engine fails (before bpf_jit_binary_pack_finalize).\nkernel/bpf/core.c-1249- * For case 2), we need to free both the RO memory and the RW buffer.\n--\nkernel/bpf/core.c-1252- * bpf_jit_binary_pack_alloc does not set it. Therefore, ro_header-\u003esize\nkernel/bpf/core.c:1253: * must be set with either bpf_jit_binary_pack_finalize (normal path) or\nkernel/bpf/core.c-1254- * bpf_arch_text_copy (when jit fails).\n" }
5/2	2026/07/23 11:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7247 output: 20 thoughts: 30 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: BPF JIT Patch Review - Initial Considerations Alright, so this patch is clearly messing with BPF JIT code. That's immediately interesting, and raises some questions. My first thought is to ensure we're looking at the right foundation. Before diving too deep, I need to confirm that `CONFIG_BPF_JIT` is enabled. A fundamental change like this, especially touching the JIT, is pointless if the feature itself is disabled in the kernel configuration. I can't waste time going through it, only to find the feature isn't even supported. Gotta get that baseline correct before I dig in.
6/2	2026/07/23 11:30	tool	grepper	0m Args: { "Expression": "config BPF_JIT" } Results: { "Output": "kernel/bpf/Kconfig=27=config BPF_SYSCALL\n--\nkernel/bpf/Kconfig-41-\nkernel/bpf/Kconfig:42:config BPF_JIT\nkernel/bpf/Kconfig-43-\tbool \"Enable BPF Just In Time compiler\"\n--\nkernel/bpf/Kconfig-57-\nkernel/bpf/Kconfig:58:config BPF_JIT_ALWAYS_ON\nkernel/bpf/Kconfig-59-\tbool \"Permanently enable BPF JIT and remove BPF interpreter\"\n--\nkernel/bpf/Kconfig-68-\nkernel/bpf/Kconfig:69:config BPF_JIT_DEFAULT_ON\nkernel/bpf/Kconfig-70-\tdef_bool ARCH_WANT_DEFAULT_BPF_JIT \|\| BPF_JIT_ALWAYS_ON\n" }
7/2	2026/07/23 11:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7671 output: 156 thoughts: 210 Thoughts: Fuzzing Strategy for BPF JIT Compiler Patch Okay, after reviewing this patch, I've confirmed that enabling `BPF_JIT` and `BPF_SYSCALL` is the correct approach for our fuzzing configuration. The core of this change affects critical functions within the BPF JIT compiler: `bpf_int_jit_compile`, `bpf_jit_free`, and `bpf_jit_binary_pack_finalize`. These are the key entry points and cleanup routines we need to target. Given the modifications made to memory management, particularly the changes to how `ro_header` is handled during failures in `bpf_jit_binary_pack_finalize`, as well as the newly added `kvfree` calls in `bpf_jit_free`, I'm confident that this represents a functional alteration within the core kernel logic. This type of change is exactly the kind that fuzzing is designed to uncover vulnerabilities in. Therefore, I will set `WorthFuzzing=true`. For the fuzzing campaign itself, the `FocusSymbols` will be set specifically to `bpf_int_jit_compile`, `bpf_jit_free`, and `bpf_jit_binary_pack_finalize`. This allows us to focus our efforts directly on the code that has been changed and to efficiently exercise these paths. Finally, the `EnableConfigs` will remain set to `BPF_JIT`, and `BPF_SYSCALL`, confirming my prior analysis.
8/2	2026/07/23 11:30	tool	set-results	0m Args: { "EnableConfigs": [ "BPF_JIT", "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_int_jit_compile", "bpf_jit_free", "bpf_jit_binary_pack_finalize" ], "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "BPF_JIT", "BPF_SYSCALL" ], "FocusSymbols": [ "bpf_int_jit_compile", "bpf_jit_free", "bpf_jit_binary_pack_finalize" ], "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.", "WorthFuzzing": true }

Trajectory: (Expand/Collapse All)

Seq

Timestamp

Type

Name

Duration

0/0

2026/07/23 11:30

flow

patch-triage

Args:

null

Results:

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_int_jit_compile",
    "bpf_jit_free",
    "bpf_jit_binary_pack_finalize"
  ],
  "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.",
  "WorthFuzzing": true
}

1/1

2026/07/23 11:30

action

read-patch-diff

Args:

null

Results:

{
  "PatchDiff": "commit d7f662172a8e4edd983ad2949b553615a03168f7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 23 11:30:19 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c\nindex 4cdc7dfb05ba9a..e200b0207f7ab9 100644\n--- a/arch/arm64/net/bpf_jit_comp.c\n+++ b/arch/arm64/net/bpf_jit_comp.c\n@@ -2258,7 +2258,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr\n \t\t\tgoto out_free_hdr;\n \t\t}\n \t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\n-\t\t\t/* ro_header and header has been freed */\n+\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n \t\t\tro_header = NULL;\n \t\t\theader = NULL;\n \t\t\tgoto out_free_hdr;\n@@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog)\n \t\t */\n \t\tif (jit_data) {\n \t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\n+\t\t\tkvfree(jit_data-\u003ectx.offset);\n \t\t\tkfree(jit_data);\n \t\t}\n \t\tprog-\u003ebpf_func = (void *)prog-\u003ebpf_func - cfi_get_offset();\ndiff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c\nindex 2738b4db116533..c8c8664dccafa8 100644\n--- a/arch/loongarch/net/bpf_jit.c\n+++ b/arch/loongarch/net/bpf_jit.c\n@@ -2298,7 +2298,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr\n \t\t\tgoto out_free;\n \t\t}\n \t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\n-\t\t\t/* ro_header and header have been freed */\n+\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n \t\t\tro_header = NULL;\n \t\t\theader = NULL;\n \t\t\tgoto out_free;\n@@ -2361,6 +2361,7 @@ void bpf_jit_free(struct bpf_prog *prog)\n \t\t */\n \t\tif (jit_data) {\n \t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\n+\t\t\tkvfree(jit_data-\u003ectx.offset);\n \t\t\tkfree(jit_data);\n \t\t}\n \t\thdr = bpf_jit_binary_pack_hdr(prog);\ndiff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c\nindex 7b07b43575f111..0ca14b7d0b0e65 100644\n--- a/arch/powerpc/net/bpf_jit_comp.c\n+++ b/arch/powerpc/net/bpf_jit_comp.c\n@@ -339,8 +339,10 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr\n #endif\n \n \tif (!fp-\u003eis_func || extra_pass) {\n-\t\tif (bpf_jit_binary_pack_finalize(fhdr, hdr))\n+\t\tif (bpf_jit_binary_pack_finalize(fhdr, hdr)) {\n+\t\t\tbpf_jit_binary_pack_free(fhdr, NULL);\n \t\t\tgoto out_err;\n+\t\t}\n \t}\n \n \tfp-\u003ebpf_func = (void *)fimage;\ndiff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c\nindex cbfcd287ea1668..440d5b965e6040 100644\n--- a/arch/riscv/net/bpf_jit_core.c\n+++ b/arch/riscv/net/bpf_jit_core.c\n@@ -154,7 +154,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr\n \n \tif (!prog-\u003eis_func || extra_pass) {\n \t\tif (WARN_ON(bpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader))) {\n-\t\t\t/* ro_header has been freed */\n+\t\t\tbpf_jit_binary_pack_free(jit_data-\u003ero_header, NULL);\n \t\t\tjit_data-\u003ero_header = NULL;\n \t\t\tjit_data-\u003eheader = NULL;\n \t\t\tgoto out_free_hdr;\n@@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog)\n \t\t\tkvfree(jit_data-\u003ectx.offset);\n \t\t\tkfree(jit_data);\n \t\t}\n+\t\tprog-\u003ebpf_func = (void *)prog-\u003ebpf_func - cfi_get_offset();\n \t\thdr = bpf_jit_binary_pack_hdr(prog);\n \t\tbpf_jit_binary_pack_free(hdr, NULL);\n \t\tWARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));\ndiff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c\nindex de7515ea1beae8..d017bb0397b88b 100644\n--- a/arch/x86/net/bpf_jit_comp.c\n+++ b/arch/x86/net/bpf_jit_comp.c\n@@ -3988,7 +3988,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr\n \t\t\t * Both cases are serious bugs and justify WARN_ON.\n \t\t\t */\n \t\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) {\n-\t\t\t\t/* header has been freed */\n+\t\t\t\tbpf_jit_binary_pack_free(header, NULL);\n \t\t\t\theader = NULL;\n \t\t\t\tgoto out_image;\n \t\t\t}\ndiff --git a/kernel/bpf/core.c b/kernel/bpf/core.c\nindex 47fe047ad30b88..77195911a3b371 100644\n--- a/kernel/bpf/core.c\n+++ b/kernel/bpf/core.c\n@@ -1237,10 +1237,9 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,\n \n \tkvfree(rw_header);\n \n-\tif (IS_ERR(ptr)) {\n-\t\tbpf_prog_pack_free(ro_header, ro_header-\u003esize);\n+\tif (IS_ERR(ptr))\n \t\treturn PTR_ERR(ptr);\n-\t}\n+\n \treturn 0;\n }\n \n"
}

2/1

2026/07/23 11:30

agent

patch-evaluator

Model:

best-expensive

Args:

null

Results:

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_int_jit_compile",
    "bpf_jit_free",
    "bpf_jit_binary_pack_finalize"
  ],
  "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.",
  "WorthFuzzing": true
}

Instruction:

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:

For your convenience, here is the diff of the changes:
commit d7f662172a8e4edd983ad2949b553615a03168f7
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 23 11:30:19 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 4cdc7dfb05ba9a..e200b0207f7ab9 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2258,7 +2258,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 			goto out_free_hdr;
 		}
 		if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {
-			/* ro_header and header has been freed */
+			bpf_jit_binary_pack_free(ro_header, NULL);
 			ro_header = NULL;
 			header = NULL;
 			goto out_free_hdr;
@@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 		 */
 		if (jit_data) {
 			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+			kvfree(jit_data->ctx.offset);
 			kfree(jit_data);
 		}
 		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 2738b4db116533..c8c8664dccafa8 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2298,7 +2298,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 			goto out_free;
 		}
 		if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {
-			/* ro_header and header have been freed */
+			bpf_jit_binary_pack_free(ro_header, NULL);
 			ro_header = NULL;
 			header = NULL;
 			goto out_free;
@@ -2361,6 +2361,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 		 */
 		if (jit_data) {
 			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+			kvfree(jit_data->ctx.offset);
 			kfree(jit_data);
 		}
 		hdr = bpf_jit_binary_pack_hdr(prog);
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 7b07b43575f111..0ca14b7d0b0e65 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -339,8 +339,10 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 #endif
 
 	if (!fp->is_func || extra_pass) {
-		if (bpf_jit_binary_pack_finalize(fhdr, hdr))
+		if (bpf_jit_binary_pack_finalize(fhdr, hdr)) {
+			bpf_jit_binary_pack_free(fhdr, NULL);
 			goto out_err;
+		}
 	}
 
 	fp->bpf_func = (void *)fimage;
diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index cbfcd287ea1668..440d5b965e6040 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -154,7 +154,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 
 	if (!prog->is_func || extra_pass) {
 		if (WARN_ON(bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header))) {
-			/* ro_header has been freed */
+			bpf_jit_binary_pack_free(jit_data->ro_header, NULL);
 			jit_data->ro_header = NULL;
 			jit_data->header = NULL;
 			goto out_free_hdr;
@@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 			kvfree(jit_data->ctx.offset);
 			kfree(jit_data);
 		}
+		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
 		hdr = bpf_jit_binary_pack_hdr(prog);
 		bpf_jit_binary_pack_free(hdr, NULL);
 		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index de7515ea1beae8..d017bb0397b88b 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -3988,7 +3988,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 			 * Both cases are serious bugs and justify WARN_ON.
 			 */
 			if (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) {
-				/* header has been freed */
+				bpf_jit_binary_pack_free(header, NULL);
 				header = NULL;
 				goto out_image;
 			}
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 47fe047ad30b88..77195911a3b371 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1237,10 +1237,9 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,
 
 	kvfree(rw_header);
 
-	if (IS_ERR(ptr)) {
-		bpf_prog_pack_free(ro_header, ro_header->size);
+	if (IS_ERR(ptr))
 		return PTR_ERR(ptr);
-	}
+
 	return 0;
 }

3/2

2026/07/23 11:30

llm

patch-evaluator

Model:

gemini-3.1-pro-preview

Args:

null

Results:

null

Tokens:

							input: 3618
							output: 24
							thoughts: 413

Thoughts:

**My Initial Assessment of the BPF JIT Patch**

Okay, so I'm looking at a patch that fundamentally alters the error handling within the BPF JIT compilation process, specifically impacting multiple architectures – arm64, loongarch, powerpc, riscv, and x86, along with the core BPF code within `kernel/bpf/core.c`. This is a significant change, right off the bat, as it modifies how memory management interacts with compilation failures.

The core of the change seems to be around `bpf_jit_binary_pack_finalize`.  Instead of freeing the `ro_header` on a failure within that function, it's now shifting the responsibility to the *caller* to call `bpf_jit_binary_pack_free(ro_header, NULL)` when a failure is detected in the `bpf_jit_binary_pack_finalize` function. That's a shift in responsibility that's worth noting and I need to think about that implication.

Beyond that, the patch also introduces a few tweaks to the `bpf_jit_free` function for specific architectures. Specifically, the patch adds a `kvfree(jit_data->ctx.offset);` call for arm64 and loongarch in the `bpf_jit_free` and for riscv, `prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();` is added.

This is absolutely a functional change, and given its scope, I'm already thinking about fuzzing this. Any shift in memory management or error handling in the JIT compiler is a prime target for fuzzing.

I need to confirm the specific functions being modified:
*   `bpf_int_jit_compile` (across the architectures listed earlier)
*   `bpf_jit_free` (arm64, loongarch, riscv)
*   `bpf_jit_binary_pack_finalize` (the core one in `kernel/bpf/core.c`)

My focus for inspection is definitely going to be those three symbols.

And, of course, I'll need to verify that `CONFIG_BPF_JIT` and `CONFIG_BPF_SYSCALL` are enabled, as these are prerequisites for the changes to even be relevant. Time to check the configuration.

4/2

2026/07/23 11:30

tool

grepper

Args:

{
  "Expression": "bpf_jit_binary_pack_finalize"
}

Results:

{
  "Output": "arch/arm64/net/bpf_jit_comp.c=2093=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\n--\narch/arm64/net/bpf_jit_comp.c-2202-\t * image will be later copied to the RX image from where the program\narch/arm64/net/bpf_jit_comp.c:2203:\t * will run. The bpf_jit_binary_pack_finalize() will do this copy in the\narch/arm64/net/bpf_jit_comp.c-2204-\t * final step.\n--\narch/arm64/net/bpf_jit_comp.c-2259-\t\t}\narch/arm64/net/bpf_jit_comp.c:2260:\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\narch/arm64/net/bpf_jit_comp.c-2261-\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n--\narch/arm64/net/bpf_jit_comp.c=3225=void bpf_jit_free(struct bpf_prog *prog)\n--\narch/arm64/net/bpf_jit_comp.c-3238-\t\tif (jit_data) {\narch/arm64/net/bpf_jit_comp.c:3239:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\narch/arm64/net/bpf_jit_comp.c-3240-\t\t\tkvfree(jit_data-\u003ectx.offset);\n--\narch/loongarch/net/bpf_jit.c=2197=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\n--\narch/loongarch/net/bpf_jit.c-2268-\t * image will be later copied to the RX image from where the program will\narch/loongarch/net/bpf_jit.c:2269:\t * run. The bpf_jit_binary_pack_finalize() will do this copy in the final\narch/loongarch/net/bpf_jit.c-2270-\t * step.\n--\narch/loongarch/net/bpf_jit.c-2299-\t\t}\narch/loongarch/net/bpf_jit.c:2300:\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {\narch/loongarch/net/bpf_jit.c-2301-\t\t\tbpf_jit_binary_pack_free(ro_header, NULL);\n--\narch/loongarch/net/bpf_jit.c=2351=void bpf_jit_free(struct bpf_prog *prog)\n--\narch/loongarch/net/bpf_jit.c-2362-\t\tif (jit_data) {\narch/loongarch/net/bpf_jit.c:2363:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\narch/loongarch/net/bpf_jit.c-2364-\t\t\tkvfree(jit_data-\u003ectx.offset);\n--\narch/powerpc/net/bpf_jit_comp.c=165=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *fp)\n--\narch/powerpc/net/bpf_jit_comp.c-341-\tif (!fp-\u003eis_func || extra_pass) {\narch/powerpc/net/bpf_jit_comp.c:342:\t\tif (bpf_jit_binary_pack_finalize(fhdr, hdr)) {\narch/powerpc/net/bpf_jit_comp.c-343-\t\t\tbpf_jit_binary_pack_free(fhdr, NULL);\n--\narch/powerpc/net/bpf_jit_comp.c=479=void bpf_jit_free(struct bpf_prog *fp)\n--\narch/powerpc/net/bpf_jit_comp.c-492-\t\tif (jit_data) {\narch/powerpc/net/bpf_jit_comp.c:493:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003efhdr, jit_data-\u003ehdr);\narch/powerpc/net/bpf_jit_comp.c-494-\t\t\tkvfree(jit_data-\u003eaddrs);\n--\narch/riscv/net/bpf_jit_core.c=44=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\n--\narch/riscv/net/bpf_jit_core.c-120-\t\t\t * image will be later copied to the RX image from where the program\narch/riscv/net/bpf_jit_core.c:121:\t\t\t * will run. The bpf_jit_binary_pack_finalize() will do this copy in the\narch/riscv/net/bpf_jit_core.c-122-\t\t\t * final step.\n--\narch/riscv/net/bpf_jit_core.c-155-\tif (!prog-\u003eis_func || extra_pass) {\narch/riscv/net/bpf_jit_core.c:156:\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader))) {\narch/riscv/net/bpf_jit_core.c-157-\t\t\tbpf_jit_binary_pack_free(jit_data-\u003ero_header, NULL);\n--\narch/riscv/net/bpf_jit_core.c=224=void bpf_jit_free(struct bpf_prog *prog)\n--\narch/riscv/net/bpf_jit_core.c-235-\t\tif (jit_data) {\narch/riscv/net/bpf_jit_core.c:236:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003ero_header, jit_data-\u003eheader);\narch/riscv/net/bpf_jit_core.c-237-\t\t\tkvfree(jit_data-\u003ectx.offset);\n--\narch/x86/net/bpf_jit_comp.c=3851=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)\n--\narch/x86/net/bpf_jit_comp.c-3983-\t\t\t/*\narch/x86/net/bpf_jit_comp.c:3984:\t\t\t * bpf_jit_binary_pack_finalize fails in two scenarios:\narch/x86/net/bpf_jit_comp.c-3985-\t\t\t *   1) header is not pointing to proper module memory;\n--\narch/x86/net/bpf_jit_comp.c-3989-\t\t\t */\narch/x86/net/bpf_jit_comp.c:3990:\t\t\tif (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) {\narch/x86/net/bpf_jit_comp.c-3991-\t\t\t\tbpf_jit_binary_pack_free(header, NULL);\n--\narch/x86/net/bpf_jit_comp.c=4071=void bpf_jit_free(struct bpf_prog *prog)\n--\narch/x86/net/bpf_jit_comp.c-4084-\t\tif (jit_data) {\narch/x86/net/bpf_jit_comp.c:4085:\t\t\tbpf_jit_binary_pack_finalize(jit_data-\u003eheader,\narch/x86/net/bpf_jit_comp.c-4086-\t\t\t\t\t\t     jit_data-\u003erw_header);\n--\ninclude/linux/filter.h=1351=bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image,\n--\ninclude/linux/filter.h-1356-\t\t\t  bool was_classic);\ninclude/linux/filter.h:1357:int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,\ninclude/linux/filter.h-1358-\t\t\t\t struct bpf_binary_header *rw_header);\n--\nkernel/bpf/core.c=1168=void bpf_jit_binary_free(struct bpf_binary_header *hdr)\n--\nkernel/bpf/core.c-1180- * RO memory address, but write JITed program to the RW buffer. Once the\nkernel/bpf/core.c:1181: * JIT engine finishes, it calls bpf_jit_binary_pack_finalize, which copies\nkernel/bpf/core.c-1182- * the JITed program to the RO memory.\n--\nkernel/bpf/core.c=1185=bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,\n--\nkernel/bpf/core.c-1230-/* Copy JITed text from rw_header to its final location, the ro_header. */\nkernel/bpf/core.c:1231:int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,\nkernel/bpf/core.c-1232-\t\t\t\t struct bpf_binary_header *rw_header)\n--\nkernel/bpf/core.c-1247- *   1) when the program is freed after;\nkernel/bpf/core.c:1248: *   2) when the JIT engine fails (before bpf_jit_binary_pack_finalize).\nkernel/bpf/core.c-1249- * For case 2), we need to free both the RO memory and the RW buffer.\n--\nkernel/bpf/core.c-1252- * bpf_jit_binary_pack_alloc does not set it. Therefore, ro_header-\u003esize\nkernel/bpf/core.c:1253: * must be set with either bpf_jit_binary_pack_finalize (normal path) or\nkernel/bpf/core.c-1254- * bpf_arch_text_copy (when jit fails).\n"
}

5/2

2026/07/23 11:30

llm

patch-evaluator

Model:

gemini-3.1-pro-preview

Args:

null

Results:

null

Tokens:

							input: 7247
							output: 20
							thoughts: 30

Thoughts:

Okay, here's my take on those thoughts, tailored for an expert audience:

**BPF JIT Patch Review - Initial Considerations**

Alright, so this patch is clearly messing with BPF JIT code. That's immediately interesting, and raises some questions. My first thought is to ensure we're looking at the right foundation. Before diving too deep, I need to confirm that `CONFIG_BPF_JIT` is enabled. A fundamental change like this, especially touching the JIT, is pointless if the feature itself is disabled in the kernel configuration. I can't waste time going through it, only to find the feature isn't even supported. Gotta get that baseline correct before I dig in.

6/2

2026/07/23 11:30

tool

grepper

Args:

{
  "Expression": "config BPF_JIT"
}

Results:

{
  "Output": "kernel/bpf/Kconfig=27=config BPF_SYSCALL\n--\nkernel/bpf/Kconfig-41-\nkernel/bpf/Kconfig:42:config BPF_JIT\nkernel/bpf/Kconfig-43-\tbool \"Enable BPF Just In Time compiler\"\n--\nkernel/bpf/Kconfig-57-\nkernel/bpf/Kconfig:58:config BPF_JIT_ALWAYS_ON\nkernel/bpf/Kconfig-59-\tbool \"Permanently enable BPF JIT and remove BPF interpreter\"\n--\nkernel/bpf/Kconfig-68-\nkernel/bpf/Kconfig:69:config BPF_JIT_DEFAULT_ON\nkernel/bpf/Kconfig-70-\tdef_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON\n"
}

7/2

2026/07/23 11:30

llm

patch-evaluator

Model:

gemini-3.1-pro-preview

Args:

null

Results:

null

Tokens:

							input: 7671
							output: 156
							thoughts: 210

Thoughts:

**Fuzzing Strategy for BPF JIT Compiler Patch**

Okay, after reviewing this patch, I've confirmed that enabling `BPF_JIT` and `BPF_SYSCALL` is the correct approach for our fuzzing configuration. The core of this change affects critical functions within the BPF JIT compiler: `bpf_int_jit_compile`, `bpf_jit_free`, and `bpf_jit_binary_pack_finalize`. These are the key entry points and cleanup routines we need to target.

Given the modifications made to memory management, particularly the changes to how `ro_header` is handled during failures in `bpf_jit_binary_pack_finalize`, as well as the newly added `kvfree` calls in `bpf_jit_free`, I'm confident that this represents a functional alteration within the core kernel logic. This type of change is exactly the kind that fuzzing is designed to uncover vulnerabilities in. Therefore, I will set `WorthFuzzing=true`.

For the fuzzing campaign itself, the `FocusSymbols` will be set specifically to `bpf_int_jit_compile`, `bpf_jit_free`, and `bpf_jit_binary_pack_finalize`. This allows us to focus our efforts directly on the code that has been changed and to efficiently exercise these paths. Finally, the `EnableConfigs` will remain set to `BPF_JIT`, and `BPF_SYSCALL`, confirming my prior analysis.

8/2

2026/07/23 11:30

tool

set-results

Args:

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_int_jit_compile",
    "bpf_jit_free",
    "bpf_jit_binary_pack_finalize"
  ],
  "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.",
  "WorthFuzzing": true
}

Results:

{
  "EnableConfigs": [
    "BPF_JIT",
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "bpf_int_jit_compile",
    "bpf_jit_free",
    "bpf_jit_binary_pack_finalize"
  ],
  "Reasoning": "The patch modifies memory management and error handling in the BPF JIT compiler across multiple architectures. It changes how `ro_header` is freed when `bpf_jit_binary_pack_finalize` fails, and adds missing `kvfree` calls in `bpf_jit_free`. This is a functional change in core kernel logic that should be fuzzed.",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)