map[AckedBy:<nil> Fixes:map[Hash:48cac3f4a96ddf08df8e53809ed066de0dc93915 Title:bpf: Implement formatted output helpers with bstr_printf] KernelBranch:master KernelCommit:5200f5f493f79f14bbdc349e402a40dfb32f23c8 KernelRepo:git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git PatchDescription:bpf: Fix out-of-bounds write in bpf_bprintf_prepare()

The `bpf_bprintf_prepare()` function formats arguments into a temporary
512-byte buffer. There are two distinct bugs in this function that allow
`tmp_buf` to advance past `tmp_buf_end`, bypassing bounds checks and
causing out-of-bounds memory writes.

First, when handling the `%pB` and `%pI4`/`%pI6` format specifiers,
`snprintf()` is used to format the string. `snprintf()` returns the
number of characters that would have been written if the buffer was
large enough. If the remaining buffer space is smaller than the
formatted string, the return value will be greater than or equal to the
remaining space. The code previously advanced `tmp_buf` by `err + 1`,
which could push `tmp_buf` past `tmp_buf_end`.

Second, when handling standard format specifiers, the code aligns
`tmp_buf` and checks if there is enough space using `tmp_buf_end -
tmp_buf < sizeof_cur_arg`. Since `sizeof_cur_arg` is an unsigned
`size_t`, the signed `ptrdiff_t` result of the pointer subtraction is
implicitly cast to unsigned. If `tmp_buf` has already been advanced past
`tmp_buf_end`, the negative difference becomes a huge positive number,
bypassing the check and allowing further out-of-bounds writes.

Fix these issues by checking the return value of `snprintf()` for `%pB`
and `%pI4`/`%pI6`. If it indicates truncation or an error, return
`-ENOSPC` or `-EINVAL` respectively, ensuring the buffer is not overrun
and `bstr_printf()` does not read malformed data. Additionally, rewrite
the bounds checks to use pointer addition (`tmp_buf + sizeof_cur_arg >
tmp_buf_end`), which eliminates the integer signedness bypass, and
harden equality checks for buffer fullness from `tmp_buf_end == tmp_buf`
to `tmp_buf >= tmp_buf_end`.

This prevents memory corruption that can lead to soft lockups and other
crashes. PatchDiff:diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 2bb60200c..0e3d3bddd 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -921,10 +921,22 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 
 			if (fmt[i + 1] == 'B') {
 				if (tmp_buf)  {
+					if (tmp_buf >= tmp_buf_end) {
+						err = -ENOSPC;
+						goto out;
+					}
 					err = snprintf(tmp_buf,
 						       (tmp_buf_end - tmp_buf),
 						       "%pB",
 						       (void *)(long)raw_args[num_spec]);
+					if (err < 0) {
+						err = -EINVAL;
+						goto out;
+					}
+					if (err >= tmp_buf_end - tmp_buf) {
+						err = -ENOSPC;
+						goto out;
+					}
 					tmp_buf += (err + 1);
 				}
 
@@ -944,12 +956,13 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
-			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
+			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
+
 			unsafe_ptr = (char *)(long)raw_args[num_spec];
 			err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 						       sizeof_cur_ip);
@@ -964,6 +977,14 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 			ip_spec[3] = fmt[i];
 			err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 				       ip_spec, &cur_ip);
+			if (err < 0) {
+				err = -EINVAL;
+				goto out;
+			}
+			if (err >= tmp_buf_end - tmp_buf) {
+				err = -ENOSPC;
+				goto out;
+			}
 
 			tmp_buf += err + 1;
 			num_spec++;
@@ -982,7 +1003,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			if (tmp_buf_end == tmp_buf) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
@@ -1004,7 +1025,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			if (tmp_buf_end == tmp_buf) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
@@ -1038,7 +1059,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 nocopy_fmt:
 		if (tmp_buf) {
 			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
-			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
+			if (tmp_buf + sizeof_cur_arg > tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 Recipients:[map[Email:andrii@kernel.org Name:Andrii Nakryiko To:false] map[Email:ast@kernel.org Name:Alexei Starovoitov To:false] map[Email:bpf@vger.kernel.org Name:open list:BPF [GENERAL] (Safe Dynamic Programs and Tools) To:false] map[Email:daniel@iogearbox.net Name:Daniel Borkmann To:false] map[Email:eddyz87@gmail.com Name:Eduard Zingerman To:false] map[Email:jolsa@kernel.org Name:Jiri Olsa To:false] map[Email:linux-kernel@vger.kernel.org Name: To:true] map[Email:martin.lau@linux.dev Name:Martin KaFai Lau To:false] map[Email:memxor@gmail.com Name:Kumar Kartikeya Dwivedi To:false] map[Email:song@kernel.org Name:Song Liu To:false] map[Email:yonghong.song@linux.dev Name:Yonghong Song To:false]] ReportedBy:<nil> ReviewedBy:<nil> TestedBy:<nil>]

map[KernelBranch:master KernelCommit:5200f5f493f79f14bbdc349e402a40dfb32f23c8 KernelRepo:git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git]

map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  socket arguments: [
//    domain: socket_domain = 0xa (8 bytes)
//    type: socket_type = 0x5 (8 bytes)
//    proto: int32 = 0x0 (4 bytes)
//  ]
//  returns sock
	res = syscall(__NR_socket, /*domain=AF_INET6*/0xaul, /*type=SOCK_SEQPACKET*/5ul, /*proto=*/0);
	if (res != -1)
		r[0] = res;
//  bpf$PROG_LOAD arguments: [
//    cmd: const = 0x5 (8 bytes)
//    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
//      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]] {
//        type: bpf_prog_type = 0x5 (4 bytes)
//        ninsn: bytesize8 = 0x2c (4 bytes)
//        insns: ptr[in, bpf_instructions] {
//          union bpf_instructions {
//            ringbuf: bpf_program_ringbuf {
//              initr0: bpf_insn_init_r0 {
//                code: const = 0x18 (1 bytes)
//                dst: const = 0x0 (0 bytes)
//                src: const = 0x0 (1 bytes)
//                off: const = 0x0 (2 bytes)
//                imm: int32 = 0x2 (4 bytes)
//                code2: const = 0x0 (1 bytes)
//                regs2: const = 0x0 (1 bytes)
//                off2: const = 0x0 (2 bytes)
//                imm2: int32 = 0x20 (4 bytes)
//              }
//              reserve: bpf_insn_ringbuf_reserve {
//                insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], ringbuf_map_fd] {
//                  code: const = 0x18 (1 bytes)
//                  dst: const = 0x1 (0 bytes)
//                  src: const = 0x1 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: ringbuf_map_fd (resource)
//                  code2: const = 0x0 (1 bytes)
//                  regs2: const = 0x0 (1 bytes)
//                  off2: const = 0x0 (2 bytes)
//                  imm2: const = 0x0 (4 bytes)
//                }
//                insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[20, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x2 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x14 (4 bytes)
//                }
//                insn3: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_3, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x3 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//                insn4: bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_reserve, int32]] {
//                  code: const = 0x85 (1 bytes)
//                  regs: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  func: const = 0x83 (4 bytes)
//                }
//                insn5: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_9, int8:4], const[BPF_REG_0, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x1 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x9 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//              }
//              null_check: bpf_insn_null_check[BPF_REG_9] {
//                cond_jump: bpf_insn_not_null_jmp[BPF_REG_9] {
//                  code_class: const = 0x5 (0 bytes)
//                  code_s: const = 0x0 (0 bytes)
//                  code_op: const = 0x5 (1 bytes)
//                  dst: const = 0x9 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x1 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//                exit: bpf_insn_exit {
//                  code: const = 0x95 (1 bytes)
//                  regs: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//              }
//              body: array[bpf_insn] {
//                union bpf_insn {
//                  snprintf: bpf_insn_snprintf {
//                    insn1: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_8, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x8 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn2: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], const[-8, int16], const[0, int32]] {
//                      code_class: int8 = 0x3 (0 bytes)
//                      code_size: int8 = 0x3 (0 bytes)
//                      code_mode: int8 = 0x3 (1 bytes)
//                      dst: const = 0xa (0 bytes)
//                      src: const = 0x8 (1 bytes)
//                      off: const = 0xfff8 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn3: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_8, int8:4], const[0, int8:4], const[0, int16], int32] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x8 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: int32 = 0x9 (4 bytes)
//                    }
//                    insn4: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], const[-16, int16], const[0, int32]] {
//                      code_class: int8 = 0x3 (0 bytes)
//                      code_size: int8 = 0x3 (0 bytes)
//                      code_mode: int8 = 0x3 (1 bytes)
//                      dst: const = 0xa (0 bytes)
//                      src: const = 0x8 (1 bytes)
//                      off: const = 0xfff0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn5: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_1, int8:4], const[BPF_REG_10, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x1 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0xa (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn6: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, const[BPF_REG_1, int8:4], const[0, int8:4], const[0, int16], const[-8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0x0 (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0xfffffff8 (4 bytes)
//                    }
//                    insn7: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_4, int8:4], const[BPF_REG_10, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x1 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x4 (0 bytes)
//                      src: const = 0xa (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn8: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, const[BPF_REG_4, int8:4], const[0, int8:4], const[0, int16], const[-16, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0x0 (1 bytes)
//                      dst: const = 0x4 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0xfffffff0 (4 bytes)
//                    }
//                    insn9: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x8 (4 bytes)
//                    }
//                    insn10: bpf_insn_map_value_t[const[BPF_REG_3, int8:4], bpf_frozen_const_str, const[0, int32]] {
//                      code: const = 0x18 (1 bytes)
//                      dst: const = 0x3 (0 bytes)
//                      src: const = 0x2 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: bpf_frozen_const_str (resource)
//                      code2: const = 0x0 (1 bytes)
//                      regs2: const = 0x0 (1 bytes)
//                      off2: const = 0x0 (2 bytes)
//                      imm2: const = 0x0 (4 bytes)
//                    }
//                    insn11: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_5, int8:4], const[0, int8:4], const[0, int16], const[8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x5 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x8 (4 bytes)
//                    }
//                    insn12: bpf_insn_call_helper_t[const[BPF_FUNC_snprintf, int32]] {
//                      code: const = 0x85 (1 bytes)
//                      regs: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      func: const = 0xa5 (4 bytes)
//                    }
//                  }
//                }
//                union bpf_insn {
//                  alu: bpf_insn_alu_t[bpf_alu_insn, bpf_alu_source, bpf_alu_op, flags[bpf_reg, int8:4], flags[bpf_reg, int8:4], flags[bpf_insn_offsets, int16], flags[bpf_insn_immediates, int32]] {
//                    code_class: bpf_alu_insn = 0x7 (0 bytes)
//                    code_s: bpf_alu_source = 0x1 (0 bytes)
//                    code_op: bpf_alu_op = 0x9 (1 bytes)
//                    dst: bpf_reg = 0x5 (0 bytes)
//                    src: bpf_reg = 0x2 (1 bytes)
//                    off: bpf_insn_offsets = 0xfffffffffffffffc (2 bytes)
//                    imm: bpf_insn_immediates = 0xfffffffffffffffc (4 bytes)
//                  }
//                }
//                union bpf_insn {
//                  cb_func: bpf_insn_cb_func {
//                    code: const = 0x18 (1 bytes)
//                    dst: bpf_reg = 0x4 (0 bytes)
//                    src: const = 0x4 (1 bytes)
//                    off: const = 0x0 (2 bytes)
//                    imm: int32 = 0x7 (4 bytes)
//                    code2: const = 0x0 (1 bytes)
//                    regs2: const = 0x0 (1 bytes)
//                    off2: const = 0x0 (2 bytes)
//                    imm2: const = 0x0 (4 bytes)
//                  }
//                }
//                union bpf_insn {
//                  ringbuf_query: bpf_insn_ringbuf_query {
//                    insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], tail_call_map] {
//                      code: const = 0x18 (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0x1 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: tail_call_map (resource)
//                      code2: const = 0x0 (1 bytes)
//                      regs2: const = 0x0 (1 bytes)
//                      off2: const = 0x0 (2 bytes)
//                      imm2: const = 0x0 (4 bytes)
//                    }
//                    insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn3: bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_query, int32]] {
//                      code: const = 0x85 (1 bytes)
//                      regs: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      func: const = 0x86 (4 bytes)
//                    }
//                  }
//                }
//                union bpf_insn {
//                  ringbuf_output: bpf_insn_ringbuf_output {
//                    insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], tail_call_map] {
//                      code: const = 0x18 (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0x1 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: tail_call_map (resource)
//                      code2: const = 0x0 (1 bytes)
//                      regs2: const = 0x0 (1 bytes)
//                      off2: const = 0x0 (2 bytes)
//                      imm2: const = 0x0 (4 bytes)
//                    }
//                    insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_8, int8:4], const[0, int8:4], const[0, int16], int32] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x8 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: int32 = 0x10000 (4 bytes)
//                    }
//                    insn3: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], const[-8, int16], const[0, int32]] {
//                      code_class: int8 = 0x3 (0 bytes)
//                      code_size: int8 = 0x3 (0 bytes)
//                      code_mode: int8 = 0x3 (1 bytes)
//                      dst: const = 0xa (0 bytes)
//                      src: const = 0x8 (1 bytes)
//                      off: const = 0xfff8 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn4: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_2, int8:4], const[BPF_REG_10, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x1 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0xa (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn5: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[-8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0x0 (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0xfffffff8 (4 bytes)
//                    }
//                    insn6: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_3, int8:4], const[0, int8:4], const[0, int16], const[8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x3 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x8 (4 bytes)
//                    }
//                    insn7: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_4, int8:4], const[0, int8:4], const[0, int16], flags[bpf_ringbuf_wakeup_flags, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x4 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: bpf_ringbuf_wakeup_flags = 0x0 (4 bytes)
//                    }
//                    insn8: bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_output, int32]] {
//                      code: const = 0x85 (1 bytes)
//                      regs: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      func: const = 0x82 (4 bytes)
//                    }
//                  }
//                }
//              }
//              free: bpf_insn_ringbuf_free {
//                insn1: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_1, int8:4], const[BPF_REG_9, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x1 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x1 (0 bytes)
//                  src: const = 0x9 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//                insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], flags[bpf_ringbuf_wakeup_flags, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x2 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: bpf_ringbuf_wakeup_flags = 0x1 (4 bytes)
//                }
//                insn3: bpf_insn_call_helper_t[flags[bpf_helpers_ringbuf_free, int32]] {
//                  code: const = 0x85 (1 bytes)
//                  regs: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  func: bpf_helpers_ringbuf_free = 0x85 (4 bytes)
//                }
//                insn4: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_0, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x0 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//              }
//              exit: bpf_insn_exit {
//                code: const = 0x95 (1 bytes)
//                regs: const = 0x0 (1 bytes)
//                off: const = 0x0 (2 bytes)
//                imm: const = 0x0 (4 bytes)
//              }
//            }
//          }
//        }
//        license: nil
//        loglev: int32 = 0x8 (4 bytes)
//        logsize: len = 0x0 (4 bytes)
//        log: nil
//        kern_version: bpf_kern_version = 0x41100 (4 bytes)
//        flags: bpf_prog_load_flags = 0x2 (4 bytes)
//        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        prog_ifindex: ifindex (resource)
//        expected_attach_type: union bpf_prog_attach_types {
//          fallback: bpf_attach_types = 0x0 (4 bytes)
//        }
//        btf_fd: fd_btf (resource)
//        func_info_rec_size: const = 0x8 (4 bytes)
//        func_info: nil
//        func_info_cnt: len = 0x0 (4 bytes)
//        line_info_rec_size: const = 0x10 (4 bytes)
//        line_info: nil
//        line_info_cnt: len = 0x0 (4 bytes)
//        attach_btf_id: bpf_btf_id (resource)
//        attach_prog_fd: fd_bpf_prog (resource)
//        core_relo_cnt: len = 0x0 (4 bytes)
//        fd_array: nil
//        core_relos: nil
//        core_relo_rec_size: const = 0x10 (4 bytes)
//        log_true_size: int32 = 0x1 (4 bytes)
//        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_prog_token_fd_wrapper {
//          void: buffer: {} (length 0x0)
//        }
//        pad: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_pad_wrapper {
//          value: const = 0x0 (4 bytes)
//        }
//      }
//    }
//    size: len = 0x90 (8 bytes)
//  ]
//  returns fd_bpf_prog
*(uint32_t*)0x200000000c40 = 5;
*(uint32_t*)0x200000000c44 = 0x2c;
*(uint64_t*)0x200000000c48 = 0x200000000080;
*(uint8_t*)0x200000000080 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000081, 0, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000081, 0, 4, 4);
*(uint16_t*)0x200000000082 = 0;
*(uint32_t*)0x200000000084 = 2;
*(uint8_t*)0x200000000088 = 0;
*(uint8_t*)0x200000000089 = 0;
*(uint16_t*)0x20000000008a = 0;
*(uint32_t*)0x20000000008c = 0x20;
*(uint8_t*)0x200000000090 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000091, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000091, 1, 4, 4);
*(uint16_t*)0x200000000092 = 0;
*(uint32_t*)0x200000000094 = -1;
*(uint8_t*)0x200000000098 = 0;
*(uint8_t*)0x200000000099 = 0;
*(uint16_t*)0x20000000009a = 0;
*(uint32_t*)0x20000000009c = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000a0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a1, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a1, 0, 4, 4);
*(uint16_t*)0x2000000000a2 = 0;
*(uint32_t*)0x2000000000a4 = 0x14;
STORE_BY_BITMASK(uint8_t, , 0x2000000000a8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a8, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a9, 3, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a9, 0, 4, 4);
*(uint16_t*)0x2000000000aa = 0;
*(uint32_t*)0x2000000000ac = 0;
*(uint8_t*)0x2000000000b0 = 0x85;
*(uint8_t*)0x2000000000b1 = 0;
*(uint16_t*)0x2000000000b2 = 0;
*(uint32_t*)0x2000000000b4 = 0x83;
STORE_BY_BITMASK(uint8_t, , 0x2000000000b8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b8, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b9, 9, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b9, 0, 4, 4);
*(uint16_t*)0x2000000000ba = 0;
*(uint32_t*)0x2000000000bc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000c0, 5, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c0, 5, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c1, 9, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c1, 0, 4, 4);
*(uint16_t*)0x2000000000c2 = 1;
*(uint32_t*)0x2000000000c4 = 0;
*(uint8_t*)0x2000000000c8 = 0x95;
*(uint8_t*)0x2000000000c9 = 0;
*(uint16_t*)0x2000000000ca = 0;
*(uint32_t*)0x2000000000cc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000d0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d1, 8, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d1, 0, 4, 4);
*(uint16_t*)0x2000000000d2 = 0;
*(uint32_t*)0x2000000000d4 = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000d8, 3, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d8, 3, 3, 2);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d8, 3, 5, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d9, 0xa, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d9, 8, 4, 4);
*(uint16_t*)0x2000000000da = 0xfff8;
*(uint32_t*)0x2000000000dc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000e0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e1, 8, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e1, 0, 4, 4);
*(uint16_t*)0x2000000000e2 = 0;
*(uint32_t*)0x2000000000e4 = 9;
STORE_BY_BITMASK(uint8_t, , 0x2000000000e8, 3, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e8, 3, 3, 2);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e8, 3, 5, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e9, 0xa, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e9, 8, 4, 4);
*(uint16_t*)0x2000000000ea = 0xfff0;
*(uint32_t*)0x2000000000ec = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000f0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f0, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f1, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f1, 0xa, 4, 4);
*(uint16_t*)0x2000000000f2 = 0;
*(uint32_t*)0x2000000000f4 = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000f8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f8, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f8, 0, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f9, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f9, 0, 4, 4);
*(uint16_t*)0x2000000000fa = 0;
*(uint32_t*)0x2000000000fc = 0xfffffff8;
STORE_BY_BITMASK(uint8_t, , 0x200000000100, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000100, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000100, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000101, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000101, 0xa, 4, 4);
*(uint16_t*)0x200000000102 = 0;
*(uint32_t*)0x200000000104 = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000108, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000108, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000108, 0, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000109, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000109, 0, 4, 4);
*(uint16_t*)0x20000000010a = 0;
*(uint32_t*)0x20000000010c = 0xfffffff0;
STORE_BY_BITMASK(uint8_t, , 0x200000000110, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000110, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000110, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000111, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000111, 0, 4, 4);
*(uint16_t*)0x200000000112 = 0;
*(uint32_t*)0x200000000114 = 8;
*(uint8_t*)0x200000000118 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000119, 3, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000119, 2, 4, 4);
*(uint16_t*)0x20000000011a = 0;
*(uint32_t*)0x20000000011c = -1;
*(uint8_t*)0x200000000120 = 0;
*(uint8_t*)0x200000000121 = 0;
*(uint16_t*)0x200000000122 = 0;
*(uint32_t*)0x200000000124 = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000128, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000128, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000128, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000129, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000129, 0, 4, 4);
*(uint16_t*)0x20000000012a = 0;
*(uint32_t*)0x20000000012c = 8;
*(uint8_t*)0x200000000130 = 0x85;
*(uint8_t*)0x200000000131 = 0;
*(uint16_t*)0x200000000132 = 0;
*(uint32_t*)0x200000000134 = 0xa5;
STORE_BY_BITMASK(uint8_t, , 0x200000000138, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000138, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000138, 9, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000139, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000139, 2, 4, 4);
*(uint16_t*)0x20000000013a = 0xfffc;
*(uint32_t*)0x20000000013c = 0xfffffffc;
*(uint8_t*)0x200000000140 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000141, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000141, 4, 4, 4);
*(uint16_t*)0x200000000142 = 0;
*(uint32_t*)0x200000000144 = 7;
*(uint8_t*)0x200000000148 = 0;
*(uint8_t*)0x200000000149 = 0;
*(uint16_t*)0x20000000014a = 0;
*(uint32_t*)0x20000000014c = 0;
*(uint8_t*)0x200000000150 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000151, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000151, 1, 4, 4);
*(uint16_t*)0x200000000152 = 0;
*(uint32_t*)0x200000000154 = -1;
*(uint8_t*)0x200000000158 = 0;
*(uint8_t*)0x200000000159 = 0;
*(uint16_t*)0x20000000015a = 0;
*(uint32_t*)0x20000000015c = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000160, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000160, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000160, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000161, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000161, 0, 4, 4);
*(uint16_t*)0x200000000162 = 0;
*(uint32_t*)0x200000000164 = 0;
*(uint8_t*)0x200000000168 = 0x85;
*(uint8_t*)0x200000000169 = 0;
*(uint16_t*)0x20000000016a = 0;
*(uint32_t*)0x20000000016c = 0x86;
*(uint8_t*)0x200000000170 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000171, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000171, 1, 4, 4);
*(uint16_t*)0x200000000172 = 0;
*(uint32_t*)0x200000000174 = -1;
*(uint8_t*)0x200000000178 = 0;
*(uint8_t*)0x200000000179 = 0;
*(uint16_t*)0x20000000017a = 0;
*(uint32_t*)0x20000000017c = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000180, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000180, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000180, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000181, 8, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000181, 0, 4, 4);
*(uint16_t*)0x200000000182 = 0;
*(uint32_t*)0x200000000184 = 0x10000;
STORE_BY_BITMASK(uint8_t, , 0x200000000188, 3, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000188, 3, 3, 2);
STORE_BY_BITMASK(uint8_t, , 0x200000000188, 3, 5, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000189, 0xa, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000189, 8, 4, 4);
*(uint16_t*)0x20000000018a = 0xfff8;
*(uint32_t*)0x20000000018c = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000190, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000190, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000190, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000191, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000191, 0xa, 4, 4);
*(uint16_t*)0x200000000192 = 0;
*(uint32_t*)0x200000000194 = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000198, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000198, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000198, 0, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000199, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000199, 0, 4, 4);
*(uint16_t*)0x20000000019a = 0;
*(uint32_t*)0x20000000019c = 0xfffffff8;
STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a1, 3, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a1, 0, 4, 4);
*(uint16_t*)0x2000000001a2 = 0;
*(uint32_t*)0x2000000001a4 = 8;
STORE_BY_BITMASK(uint8_t, , 0x2000000001a8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a8, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a9, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a9, 0, 4, 4);
*(uint16_t*)0x2000000001aa = 0;
*(uint32_t*)0x2000000001ac = 0;
*(uint8_t*)0x2000000001b0 = 0x85;
*(uint8_t*)0x2000000001b1 = 0;
*(uint16_t*)0x2000000001b2 = 0;
*(uint32_t*)0x2000000001b4 = 0x82;
STORE_BY_BITMASK(uint8_t, , 0x2000000001b8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b8, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b9, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b9, 9, 4, 4);
*(uint16_t*)0x2000000001ba = 0;
*(uint32_t*)0x2000000001bc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000001c0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c1, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c1, 0, 4, 4);
*(uint16_t*)0x2000000001c2 = 0;
*(uint32_t*)0x2000000001c4 = 1;
*(uint8_t*)0x2000000001c8 = 0x85;
*(uint8_t*)0x2000000001c9 = 0;
*(uint16_t*)0x2000000001ca = 0;
*(uint32_t*)0x2000000001cc = 0x85;
STORE_BY_BITMASK(uint8_t, , 0x2000000001d0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d1, 0, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d1, 0, 4, 4);
*(uint16_t*)0x2000000001d2 = 0;
*(uint32_t*)0x2000000001d4 = 0;
*(uint8_t*)0x2000000001d8 = 0x95;
*(uint8_t*)0x2000000001d9 = 0;
*(uint16_t*)0x2000000001da = 0;
*(uint32_t*)0x2000000001dc = 0;
*(uint64_t*)0x200000000c50 = 0;
*(uint32_t*)0x200000000c58 = 8;
*(uint32_t*)0x200000000c5c = 0;
*(uint64_t*)0x200000000c60 = 0;
*(uint32_t*)0x200000000c68 = 0x41100;
*(uint32_t*)0x200000000c6c = 2;
memset((void*)0x200000000c70, 0, 16);
*(uint32_t*)0x200000000c80 = 0;
*(uint32_t*)0x200000000c84 = 0;
*(uint32_t*)0x200000000c88 = -1;
*(uint32_t*)0x200000000c8c = 8;
*(uint64_t*)0x200000000c90 = 0;
*(uint32_t*)0x200000000c98 = 0;
*(uint32_t*)0x200000000c9c = 0x10;
*(uint64_t*)0x200000000ca0 = 0;
*(uint32_t*)0x200000000ca8 = 0;
*(uint32_t*)0x200000000cac = 0;
*(uint32_t*)0x200000000cb0 = -1;
*(uint32_t*)0x200000000cb4 = 0;
*(uint64_t*)0x200000000cb8 = 0;
*(uint64_t*)0x200000000cc0 = 0;
*(uint32_t*)0x200000000cc8 = 0x10;
*(uint32_t*)0x200000000ccc = 1;
*(uint32_t*)0x200000000cd0 = 0;
	syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000c40ul, /*size=*/0x90ul);
//  ioctl$ifreq_SIOCGIFINDEX_team arguments: [
//    fd: sock (resource)
//    cmd: const = 0x8933 (4 bytes)
//    arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
//      ifreq_dev_t["team0", ifindex_team] {
//        ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        elem: ifindex_team (resource)
//        pad = 0x0 (20 bytes)
//      }
//    }
//  ]
memcpy((void*)0x200000000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
	syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000600ul);
//  socket$netlink arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: netlink_proto = 0x0 (4 bytes)
//  ]
//  returns sock_netlink
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
	if (res != -1)
		r[1] = res;
//  sendmsg$nl_route_sched arguments: [
//    fd: sock_nl_route (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
//      msghdr_netlink[netlink_msg_route_sched] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
//          iovec[in, netlink_msg_route_sched] {
//            addr: ptr[in, netlink_msg_route_sched] {
//              union netlink_msg_route_sched {
//                newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], tcmsg[AF_UNSPEC], rtm_tca_policy] {
//                  len: len = 0x0 (4 bytes)
//                  type: const = 0x24 (2 bytes)
//                  flags: netlink_msg_flags = 0x0 (2 bytes)
//                  seq: int32 = 0x0 (4 bytes)
//                  pid: int32 = 0x0 (4 bytes)
//                  payload: tcmsg[AF_UNSPEC] {
//                    family: const = 0x0 (1 bytes)
//                    tcm__pad1: const = 0x0 (1 bytes)
//                    tcm__pad2: const = 0x0 (2 bytes)
//                    ifindex: ifindex (resource)
//                    tcm_handle: tcm_handle {
//                      minor: tcm_handle_offsets = 0x0 (2 bytes)
//                      major: tcm_handle_offsets = 0x0 (2 bytes)
//                    }
//                    tcm_parent: tcm_handle {
//                      minor: tcm_handle_offsets = 0x0 (2 bytes)
//                      major: tcm_handle_offsets = 0x0 (2 bytes)
//                    }
//                    tcm_info: tcm_handle {
//                      minor: tcm_handle_offsets = 0x0 (2 bytes)
//                      major: tcm_handle_offsets = 0x0 (2 bytes)
//                    }
//                  }
//                  attrs: array[rtm_tca_policy] {
//                  }
//                }
//              }
//            }
//            len: len = 0xa4 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x0 (8 bytes)
//  ]
*(uint64_t*)0x2000000007c0 = 0;
*(uint32_t*)0x2000000007c8 = 0;
*(uint64_t*)0x2000000007d0 = 0x200000000780;
*(uint64_t*)0x200000000780 = 0x200000000000;
*(uint32_t*)0x200000000000 = 0;
*(uint16_t*)0x200000000004 = 0x24;
*(uint16_t*)0x200000000006 = 0;
*(uint32_t*)0x200000000008 = 0;
*(uint32_t*)0x20000000000c = 0;
*(uint8_t*)0x200000000010 = 0;
*(uint8_t*)0x200000000011 = 0;
*(uint16_t*)0x200000000012 = 0;
*(uint32_t*)0x200000000014 = 0;
*(uint16_t*)0x200000000018 = 0;
*(uint16_t*)0x20000000001a = 0;
*(uint16_t*)0x20000000001c = 0;
*(uint16_t*)0x20000000001e = 0;
*(uint16_t*)0x200000000020 = 0;
*(uint16_t*)0x200000000022 = 0;
*(uint64_t*)0x200000000788 = 0xa4;
*(uint64_t*)0x2000000007d8 = 1;
*(uint64_t*)0x2000000007e0 = 0;
*(uint64_t*)0x2000000007e8 = 0;
*(uint32_t*)0x2000000007f0 = 0;
	syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x2000000007c0ul, /*f=*/0ul);
	return 0;
}
]

map[KernelSrc:/app/workdir/cache/src/d5a02ed91a4f019017141f71e695c75b27c3612e]

map[KernelObj:/app/workdir/cache/build/cd54c62d8f8877071fb7eea687773c2acac9d846]

map[OtherCrashReports:<nil> ReproducedBugTitle:BUG: soft lockup in smp_call_function ReproducedCrashReport:watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [kworker/u9:4:1179]
CPU#0 Utilization every 4000ms during lockup:
	#1: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#2: 100% system,	  1% softirq,	  0% hardirq,	  0% idle
	#3: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#4: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#5: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
Modules linked in:
irq event stamp: 386488
hardirqs last  enabled at (386487): [<ffffffff8100148a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
hardirqs last disabled at (386488): [<ffffffff8b9eb11e>] sysvec_apic_timer_interrupt+0xe/0xb0 arch/x86/kernel/apic/apic.c:1061
softirqs last  enabled at (386486): [<ffffffff8154d59a>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (386486): [<ffffffff8154d59a>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (386486): [<ffffffff8154d59a>] __irq_exit_rcu+0xca/0x210 kernel/softirq.c:735
softirqs last disabled at (386409): [<ffffffff8154d59a>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (386409): [<ffffffff8154d59a>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (386409): [<ffffffff8154d59a>] __irq_exit_rcu+0xca/0x210 kernel/softirq.c:735
CPU: 0 UID: 0 PID: 1179 Comm: kworker/u9:4 Not tainted syzkaller #1 PREEMPT 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0xfcb/0x13b0 kernel/smp.c:892
Code: 79 45 8b 2e 44 89 ee 83 e6 01 31 ff e8 be c6 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 69 c2 0b 00 eb 37 f3 90 <43> 0f b6 04 2c 84 c0 75 10 41 f7 06 01 00 00 00 74 1e e8 4e c2 0b
RSP: 0018:ffffc90005fcf720 EFLAGS: 00000293
RAX: ffffffff81834d62 RBX: ffff88806943ad08 RCX: ffff88801d361c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90005fcf860 R08: ffffffff908e5af7 R09: 1ffffffff211cb5e
R10: dffffc0000000000 R11: fffffbfff211cb5f R12: 1ffff1100d2a7edd
R13: dffffc0000000000 R14: ffff88806953f6e8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880d5abe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555578641490 CR3: 000000000eaf4000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1057
 on_each_cpu include/linux/smp.h:72 [inline]
 smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2773 [inline]
 smp_text_poke_batch_finish+0x5e6/0x1090 arch/x86/kernel/alternative.c:2983
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210
 static_key_enable+0x1a/0x20 kernel/jump_label.c:223
 toggle_allocation_gate+0xab/0x290 mm/kfence/core.c:906
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xad1/0x1740 kernel/workqueue.c:3397
 worker_thread+0xa59/0xfc0 kernel/workqueue.c:3478
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x437/0x9d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #1 PREEMPT 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__remove_hrtimer+0x8e/0x3e0 kernel/time/hrtimer.c:1145
Code: ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d
RSP: 0018:ffffc900001b8d90 EFLAGS: 00000006
RAX: ffffffff817d161e RBX: ffff888069527f40 RCX: 0000000000010000
RDX: ffff8880160c8000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff94f48153 R09: 1ffffffff29e902a
R10: dffffc0000000000 R11: fffffbfff29e902b R12: 0000000000000000
R13: 0000000000000001 R14: ffff888024042300 R15: ffff888069528000
FS:  0000000000000000(0000) GS:ffff8880d5bbe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83db077470 CR3: 000000001f132000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1910 [inline]
 __hrtimer_run_queues+0x299/0xa10 kernel/time/hrtimer.c:1994
 hrtimer_interrupt+0x44b/0x950 kernel/time/hrtimer.c:2113
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x420 arch/x86/kernel/apic/apic.c:1067
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x8b/0xb0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline]
RIP: 0010:default_idle+0xf/0x20 arch/x86/kernel/process.c:768
Code: 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 13 a4 23 00 fb f4 <fa> e9 8b 8d 02 00 cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
RSP: 0018:ffffc9000014fe28 EFLAGS: 00000202
RAX: 00000000006a8f01 RBX: ffffffff81654d3a RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8e3ef513 RDI: ffffffff8c21df20
RBP: ffffc9000014ff20 R08: ffff888069532993 R09: 1ffff1100d2a6532
R10: dffffc0000000000 R11: ffffed100d2a6533 R12: 0000000000000001
R13: 1ffff11002c19000 R14: 0000000000000001 R15: 1ffff11002c19000
 default_idle_call+0x70/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x36a/0x5e0 kernel/sched/idle.c:352
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451
 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x12c/0x137
 </TASK>
 ReproducedFaultInjection:]

map[Index:codesearch-index]

gemini-3.1-pro-preview

You are an experienced Linux kernel developer tasked with debugging a kernel crash root cause.
You need to provide a detailed explanation of the root cause for another developer to be
able to write a fix for the bug based on your explanation. Include all relevant details
into the response: function/struct/field/etc names, code snippets, line numbers,
macro/enum values, etc.



Prefer calling several tools at the same time to save round-trips.

The crash is:

watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [kworker/u9:4:1179]
CPU#0 Utilization every 4000ms during lockup:
	#1: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#2: 100% system,	  1% softirq,	  0% hardirq,	  0% idle
	#3: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#4: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#5: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
Modules linked in:
irq event stamp: 386488
hardirqs last  enabled at (386487): [<ffffffff8100148a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
hardirqs last disabled at (386488): [<ffffffff8b9eb11e>] sysvec_apic_timer_interrupt+0xe/0xb0 arch/x86/kernel/apic/apic.c:1061
softirqs last  enabled at (386486): [<ffffffff8154d59a>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (386486): [<ffffffff8154d59a>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (386486): [<ffffffff8154d59a>] __irq_exit_rcu+0xca/0x210 kernel/softirq.c:735
softirqs last disabled at (386409): [<ffffffff8154d59a>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (386409): [<ffffffff8154d59a>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (386409): [<ffffffff8154d59a>] __irq_exit_rcu+0xca/0x210 kernel/softirq.c:735
CPU: 0 UID: 0 PID: 1179 Comm: kworker/u9:4 Not tainted syzkaller #1 PREEMPT 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0xfcb/0x13b0 kernel/smp.c:892
Code: 79 45 8b 2e 44 89 ee 83 e6 01 31 ff e8 be c6 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 69 c2 0b 00 eb 37 f3 90 <43> 0f b6 04 2c 84 c0 75 10 41 f7 06 01 00 00 00 74 1e e8 4e c2 0b
RSP: 0018:ffffc90005fcf720 EFLAGS: 00000293
RAX: ffffffff81834d62 RBX: ffff88806943ad08 RCX: ffff88801d361c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90005fcf860 R08: ffffffff908e5af7 R09: 1ffffffff211cb5e
R10: dffffc0000000000 R11: fffffbfff211cb5f R12: 1ffff1100d2a7edd
R13: dffffc0000000000 R14: ffff88806953f6e8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880d5abe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555578641490 CR3: 000000000eaf4000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1057
 on_each_cpu include/linux/smp.h:72 [inline]
 smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2773 [inline]
 smp_text_poke_batch_finish+0x5e6/0x1090 arch/x86/kernel/alternative.c:2983
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210
 static_key_enable+0x1a/0x20 kernel/jump_label.c:223
 toggle_allocation_gate+0xab/0x290 mm/kfence/core.c:906
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xad1/0x1740 kernel/workqueue.c:3397
 worker_thread+0xa59/0xfc0 kernel/workqueue.c:3478
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x437/0x9d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #1 PREEMPT 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__remove_hrtimer+0x8e/0x3e0 kernel/time/hrtimer.c:1145
Code: ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d
RSP: 0018:ffffc900001b8d90 EFLAGS: 00000006
RAX: ffffffff817d161e RBX: ffff888069527f40 RCX: 0000000000010000
RDX: ffff8880160c8000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff94f48153 R09: 1ffffffff29e902a
R10: dffffc0000000000 R11: fffffbfff29e902b R12: 0000000000000000
R13: 0000000000000001 R14: ffff888024042300 R15: ffff888069528000
FS:  0000000000000000(0000) GS:ffff8880d5bbe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83db077470 CR3: 000000001f132000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1910 [inline]
 __hrtimer_run_queues+0x299/0xa10 kernel/time/hrtimer.c:1994
 hrtimer_interrupt+0x44b/0x950 kernel/time/hrtimer.c:2113
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x420 arch/x86/kernel/apic/apic.c:1067
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x8b/0xb0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline]
RIP: 0010:default_idle+0xf/0x20 arch/x86/kernel/process.c:768
Code: 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 13 a4 23 00 fb f4 <fa> e9 8b 8d 02 00 cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
RSP: 0018:ffffc9000014fe28 EFLAGS: 00000202
RAX: 00000000006a8f01 RBX: ffffffff81654d3a RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8e3ef513 RDI: ffffffff8c21df20
RBP: ffffc9000014ff20 R08: ffff888069532993 R09: 1ffff1100d2a6532
R10: dffffc0000000000 R11: ffffed100d2a6533 R12: 0000000000000001
R13: 1ffff11002c19000 R14: 0000000000000001 R15: 1ffff11002c19000
 default_idle_call+0x70/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x36a/0x5e0 kernel/sched/idle.c:352
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451
 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x12c/0x137
 </TASK>


The following C code is a draft of the vulnerable syscall sequence. Keep in mind that
it may lack the precise threading, sandboxing, and some arguments of a working reproducer:

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  socket arguments: [
//    domain: socket_domain = 0xa (8 bytes)
//    type: socket_type = 0x5 (8 bytes)
//    proto: int32 = 0x0 (4 bytes)
//  ]
//  returns sock
	res = syscall(__NR_socket, /*domain=AF_INET6*/0xaul, /*type=SOCK_SEQPACKET*/5ul, /*proto=*/0);
	if (res != -1)
		r[0] = res;
//  bpf$PROG_LOAD arguments: [
//    cmd: const = 0x5 (8 bytes)
//    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
//      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]] {
//        type: bpf_prog_type = 0x5 (4 bytes)
//        ninsn: bytesize8 = 0x2c (4 bytes)
//        insns: ptr[in, bpf_instructions] {
//          union bpf_instructions {
//            ringbuf: bpf_program_ringbuf {
//              initr0: bpf_insn_init_r0 {
//                code: const = 0x18 (1 bytes)
//                dst: const = 0x0 (0 bytes)
//                src: const = 0x0 (1 bytes)
//                off: const = 0x0 (2 bytes)
//                imm: int32 = 0x2 (4 bytes)
//                code2: const = 0x0 (1 bytes)
//                regs2: const = 0x0 (1 bytes)
//                off2: const = 0x0 (2 bytes)
//                imm2: int32 = 0x20 (4 bytes)
//              }
//              reserve: bpf_insn_ringbuf_reserve {
//                insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], ringbuf_map_fd] {
//                  code: const = 0x18 (1 bytes)
//                  dst: const = 0x1 (0 bytes)
//                  src: const = 0x1 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: ringbuf_map_fd (resource)
//                  code2: const = 0x0 (1 bytes)
//                  regs2: const = 0x0 (1 bytes)
//                  off2: const = 0x0 (2 bytes)
//                  imm2: const = 0x0 (4 bytes)
//                }
//                insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[20, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x2 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x14 (4 bytes)
//                }
//                insn3: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_3, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x3 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//                insn4: bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_reserve, int32]] {
//                  code: const = 0x85 (1 bytes)
//                  regs: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  func: const = 0x83 (4 bytes)
//                }
//                insn5: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_9, int8:4], const[BPF_REG_0, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x1 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x9 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//              }
//              null_check: bpf_insn_null_check[BPF_REG_9] {
//                cond_jump: bpf_insn_not_null_jmp[BPF_REG_9] {
//                  code_class: const = 0x5 (0 bytes)
//                  code_s: const = 0x0 (0 bytes)
//                  code_op: const = 0x5 (1 bytes)
//                  dst: const = 0x9 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x1 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//                exit: bpf_insn_exit {
//                  code: const = 0x95 (1 bytes)
//                  regs: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//              }
//              body: array[bpf_insn] {
//                union bpf_insn {
//                  snprintf: bpf_insn_snprintf {
//                    insn1: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_8, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x8 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn2: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], const[-8, int16], const[0, int32]] {
//                      code_class: int8 = 0x3 (0 bytes)
//                      code_size: int8 = 0x3 (0 bytes)
//                      code_mode: int8 = 0x3 (1 bytes)
//                      dst: const = 0xa (0 bytes)
//                      src: const = 0x8 (1 bytes)
//                      off: const = 0xfff8 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn3: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_8, int8:4], const[0, int8:4], const[0, int16], int32] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x8 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: int32 = 0x9 (4 bytes)
//                    }
//                    insn4: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], const[-16, int16], const[0, int32]] {
//                      code_class: int8 = 0x3 (0 bytes)
//                      code_size: int8 = 0x3 (0 bytes)
//                      code_mode: int8 = 0x3 (1 bytes)
//                      dst: const = 0xa (0 bytes)
//                      src: const = 0x8 (1 bytes)
//                      off: const = 0xfff0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn5: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_1, int8:4], const[BPF_REG_10, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x1 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0xa (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn6: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, const[BPF_REG_1, int8:4], const[0, int8:4], const[0, int16], const[-8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0x0 (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0xfffffff8 (4 bytes)
//                    }
//                    insn7: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_4, int8:4], const[BPF_REG_10, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x1 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x4 (0 bytes)
//                      src: const = 0xa (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn8: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, const[BPF_REG_4, int8:4], const[0, int8:4], const[0, int16], const[-16, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0x0 (1 bytes)
//                      dst: const = 0x4 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0xfffffff0 (4 bytes)
//                    }
//                    insn9: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x8 (4 bytes)
//                    }
//                    insn10: bpf_insn_map_value_t[const[BPF_REG_3, int8:4], bpf_frozen_const_str, const[0, int32]] {
//                      code: const = 0x18 (1 bytes)
//                      dst: const = 0x3 (0 bytes)
//                      src: const = 0x2 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: bpf_frozen_const_str (resource)
//                      code2: const = 0x0 (1 bytes)
//                      regs2: const = 0x0 (1 bytes)
//                      off2: const = 0x0 (2 bytes)
//                      imm2: const = 0x0 (4 bytes)
//                    }
//                    insn11: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_5, int8:4], const[0, int8:4], const[0, int16], const[8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x5 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x8 (4 bytes)
//                    }
//                    insn12: bpf_insn_call_helper_t[const[BPF_FUNC_snprintf, int32]] {
//                      code: const = 0x85 (1 bytes)
//                      regs: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      func: const = 0xa5 (4 bytes)
//                    }
//                  }
//                }
//                union bpf_insn {
//                  alu: bpf_insn_alu_t[bpf_alu_insn, bpf_alu_source, bpf_alu_op, flags[bpf_reg, int8:4], flags[bpf_reg, int8:4], flags[bpf_insn_offsets, int16], flags[bpf_insn_immediates, int32]] {
//                    code_class: bpf_alu_insn = 0x7 (0 bytes)
//                    code_s: bpf_alu_source = 0x1 (0 bytes)
//                    code_op: bpf_alu_op = 0x9 (1 bytes)
//                    dst: bpf_reg = 0x5 (0 bytes)
//                    src: bpf_reg = 0x2 (1 bytes)
//                    off: bpf_insn_offsets = 0xfffffffffffffffc (2 bytes)
//                    imm: bpf_insn_immediates = 0xfffffffffffffffc (4 bytes)
//                  }
//                }
//                union bpf_insn {
//                  cb_func: bpf_insn_cb_func {
//                    code: const = 0x18 (1 bytes)
//                    dst: bpf_reg = 0x4 (0 bytes)
//                    src: const = 0x4 (1 bytes)
//                    off: const = 0x0 (2 bytes)
//                    imm: int32 = 0x7 (4 bytes)
//                    code2: const = 0x0 (1 bytes)
//                    regs2: const = 0x0 (1 bytes)
//                    off2: const = 0x0 (2 bytes)
//                    imm2: const = 0x0 (4 bytes)
//                  }
//                }
//                union bpf_insn {
//                  ringbuf_query: bpf_insn_ringbuf_query {
//                    insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], tail_call_map] {
//                      code: const = 0x18 (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0x1 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: tail_call_map (resource)
//                      code2: const = 0x0 (1 bytes)
//                      regs2: const = 0x0 (1 bytes)
//                      off2: const = 0x0 (2 bytes)
//                      imm2: const = 0x0 (4 bytes)
//                    }
//                    insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn3: bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_query, int32]] {
//                      code: const = 0x85 (1 bytes)
//                      regs: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      func: const = 0x86 (4 bytes)
//                    }
//                  }
//                }
//                union bpf_insn {
//                  ringbuf_output: bpf_insn_ringbuf_output {
//                    insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], tail_call_map] {
//                      code: const = 0x18 (1 bytes)
//                      dst: const = 0x1 (0 bytes)
//                      src: const = 0x1 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: tail_call_map (resource)
//                      code2: const = 0x0 (1 bytes)
//                      regs2: const = 0x0 (1 bytes)
//                      off2: const = 0x0 (2 bytes)
//                      imm2: const = 0x0 (4 bytes)
//                    }
//                    insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_8, int8:4], const[0, int8:4], const[0, int16], int32] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x8 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: int32 = 0x10000 (4 bytes)
//                    }
//                    insn3: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], const[-8, int16], const[0, int32]] {
//                      code_class: int8 = 0x3 (0 bytes)
//                      code_size: int8 = 0x3 (0 bytes)
//                      code_mode: int8 = 0x3 (1 bytes)
//                      dst: const = 0xa (0 bytes)
//                      src: const = 0x8 (1 bytes)
//                      off: const = 0xfff8 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn4: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_2, int8:4], const[BPF_REG_10, int8:4], const[0, int16], const[0, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x1 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0xa (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x0 (4 bytes)
//                    }
//                    insn5: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], const[-8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0x0 (1 bytes)
//                      dst: const = 0x2 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0xfffffff8 (4 bytes)
//                    }
//                    insn6: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_3, int8:4], const[0, int8:4], const[0, int16], const[8, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x3 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: const = 0x8 (4 bytes)
//                    }
//                    insn7: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_4, int8:4], const[0, int8:4], const[0, int16], flags[bpf_ringbuf_wakeup_flags, int32]] {
//                      code_class: int8 = 0x7 (0 bytes)
//                      code_s: int8 = 0x0 (0 bytes)
//                      code_op: int8 = 0xb (1 bytes)
//                      dst: const = 0x4 (0 bytes)
//                      src: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      imm: bpf_ringbuf_wakeup_flags = 0x0 (4 bytes)
//                    }
//                    insn8: bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_output, int32]] {
//                      code: const = 0x85 (1 bytes)
//                      regs: const = 0x0 (1 bytes)
//                      off: const = 0x0 (2 bytes)
//                      func: const = 0x82 (4 bytes)
//                    }
//                  }
//                }
//              }
//              free: bpf_insn_ringbuf_free {
//                insn1: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, const[BPF_REG_1, int8:4], const[BPF_REG_9, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x1 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x1 (0 bytes)
//                  src: const = 0x9 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//                insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_2, int8:4], const[0, int8:4], const[0, int16], flags[bpf_ringbuf_wakeup_flags, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x2 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: bpf_ringbuf_wakeup_flags = 0x1 (4 bytes)
//                }
//                insn3: bpf_insn_call_helper_t[flags[bpf_helpers_ringbuf_free, int32]] {
//                  code: const = 0x85 (1 bytes)
//                  regs: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  func: bpf_helpers_ringbuf_free = 0x85 (4 bytes)
//                }
//                insn4: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, const[BPF_REG_0, int8:4], const[0, int8:4], const[0, int16], const[0, int32]] {
//                  code_class: int8 = 0x7 (0 bytes)
//                  code_s: int8 = 0x0 (0 bytes)
//                  code_op: int8 = 0xb (1 bytes)
//                  dst: const = 0x0 (0 bytes)
//                  src: const = 0x0 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: const = 0x0 (4 bytes)
//                }
//              }
//              exit: bpf_insn_exit {
//                code: const = 0x95 (1 bytes)
//                regs: const = 0x0 (1 bytes)
//                off: const = 0x0 (2 bytes)
//                imm: const = 0x0 (4 bytes)
//              }
//            }
//          }
//        }
//        license: nil
//        loglev: int32 = 0x8 (4 bytes)
//        logsize: len = 0x0 (4 bytes)
//        log: nil
//        kern_version: bpf_kern_version = 0x41100 (4 bytes)
//        flags: bpf_prog_load_flags = 0x2 (4 bytes)
//        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        prog_ifindex: ifindex (resource)
//        expected_attach_type: union bpf_prog_attach_types {
//          fallback: bpf_attach_types = 0x0 (4 bytes)
//        }
//        btf_fd: fd_btf (resource)
//        func_info_rec_size: const = 0x8 (4 bytes)
//        func_info: nil
//        func_info_cnt: len = 0x0 (4 bytes)
//        line_info_rec_size: const = 0x10 (4 bytes)
//        line_info: nil
//        line_info_cnt: len = 0x0 (4 bytes)
//        attach_btf_id: bpf_btf_id (resource)
//        attach_prog_fd: fd_bpf_prog (resource)
//        core_relo_cnt: len = 0x0 (4 bytes)
//        fd_array: nil
//        core_relos: nil
//        core_relo_rec_size: const = 0x10 (4 bytes)
//        log_true_size: int32 = 0x1 (4 bytes)
//        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_prog_token_fd_wrapper {
//          void: buffer: {} (length 0x0)
//        }
//        pad: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_pad_wrapper {
//          value: const = 0x0 (4 bytes)
//        }
//      }
//    }
//    size: len = 0x90 (8 bytes)
//  ]
//  returns fd_bpf_prog
*(uint32_t*)0x200000000c40 = 5;
*(uint32_t*)0x200000000c44 = 0x2c;
*(uint64_t*)0x200000000c48 = 0x200000000080;
*(uint8_t*)0x200000000080 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000081, 0, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000081, 0, 4, 4);
*(uint16_t*)0x200000000082 = 0;
*(uint32_t*)0x200000000084 = 2;
*(uint8_t*)0x200000000088 = 0;
*(uint8_t*)0x200000000089 = 0;
*(uint16_t*)0x20000000008a = 0;
*(uint32_t*)0x20000000008c = 0x20;
*(uint8_t*)0x200000000090 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000091, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000091, 1, 4, 4);
*(uint16_t*)0x200000000092 = 0;
*(uint32_t*)0x200000000094 = -1;
*(uint8_t*)0x200000000098 = 0;
*(uint8_t*)0x200000000099 = 0;
*(uint16_t*)0x20000000009a = 0;
*(uint32_t*)0x20000000009c = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000a0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a1, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a1, 0, 4, 4);
*(uint16_t*)0x2000000000a2 = 0;
*(uint32_t*)0x2000000000a4 = 0x14;
STORE_BY_BITMASK(uint8_t, , 0x2000000000a8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a8, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a9, 3, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000a9, 0, 4, 4);
*(uint16_t*)0x2000000000aa = 0;
*(uint32_t*)0x2000000000ac = 0;
*(uint8_t*)0x2000000000b0 = 0x85;
*(uint8_t*)0x2000000000b1 = 0;
*(uint16_t*)0x2000000000b2 = 0;
*(uint32_t*)0x2000000000b4 = 0x83;
STORE_BY_BITMASK(uint8_t, , 0x2000000000b8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b8, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b9, 9, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000b9, 0, 4, 4);
*(uint16_t*)0x2000000000ba = 0;
*(uint32_t*)0x2000000000bc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000c0, 5, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c0, 5, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c1, 9, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000c1, 0, 4, 4);
*(uint16_t*)0x2000000000c2 = 1;
*(uint32_t*)0x2000000000c4 = 0;
*(uint8_t*)0x2000000000c8 = 0x95;
*(uint8_t*)0x2000000000c9 = 0;
*(uint16_t*)0x2000000000ca = 0;
*(uint32_t*)0x2000000000cc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000d0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d1, 8, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d1, 0, 4, 4);
*(uint16_t*)0x2000000000d2 = 0;
*(uint32_t*)0x2000000000d4 = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000d8, 3, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d8, 3, 3, 2);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d8, 3, 5, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d9, 0xa, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000d9, 8, 4, 4);
*(uint16_t*)0x2000000000da = 0xfff8;
*(uint32_t*)0x2000000000dc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000e0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e1, 8, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e1, 0, 4, 4);
*(uint16_t*)0x2000000000e2 = 0;
*(uint32_t*)0x2000000000e4 = 9;
STORE_BY_BITMASK(uint8_t, , 0x2000000000e8, 3, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e8, 3, 3, 2);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e8, 3, 5, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e9, 0xa, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000e9, 8, 4, 4);
*(uint16_t*)0x2000000000ea = 0xfff0;
*(uint32_t*)0x2000000000ec = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000f0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f0, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f1, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f1, 0xa, 4, 4);
*(uint16_t*)0x2000000000f2 = 0;
*(uint32_t*)0x2000000000f4 = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000000f8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f8, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f8, 0, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f9, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000000f9, 0, 4, 4);
*(uint16_t*)0x2000000000fa = 0;
*(uint32_t*)0x2000000000fc = 0xfffffff8;
STORE_BY_BITMASK(uint8_t, , 0x200000000100, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000100, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000100, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000101, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000101, 0xa, 4, 4);
*(uint16_t*)0x200000000102 = 0;
*(uint32_t*)0x200000000104 = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000108, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000108, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000108, 0, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000109, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000109, 0, 4, 4);
*(uint16_t*)0x20000000010a = 0;
*(uint32_t*)0x20000000010c = 0xfffffff0;
STORE_BY_BITMASK(uint8_t, , 0x200000000110, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000110, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000110, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000111, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000111, 0, 4, 4);
*(uint16_t*)0x200000000112 = 0;
*(uint32_t*)0x200000000114 = 8;
*(uint8_t*)0x200000000118 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000119, 3, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000119, 2, 4, 4);
*(uint16_t*)0x20000000011a = 0;
*(uint32_t*)0x20000000011c = -1;
*(uint8_t*)0x200000000120 = 0;
*(uint8_t*)0x200000000121 = 0;
*(uint16_t*)0x200000000122 = 0;
*(uint32_t*)0x200000000124 = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000128, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000128, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000128, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000129, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000129, 0, 4, 4);
*(uint16_t*)0x20000000012a = 0;
*(uint32_t*)0x20000000012c = 8;
*(uint8_t*)0x200000000130 = 0x85;
*(uint8_t*)0x200000000131 = 0;
*(uint16_t*)0x200000000132 = 0;
*(uint32_t*)0x200000000134 = 0xa5;
STORE_BY_BITMASK(uint8_t, , 0x200000000138, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000138, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000138, 9, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000139, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000139, 2, 4, 4);
*(uint16_t*)0x20000000013a = 0xfffc;
*(uint32_t*)0x20000000013c = 0xfffffffc;
*(uint8_t*)0x200000000140 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000141, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000141, 4, 4, 4);
*(uint16_t*)0x200000000142 = 0;
*(uint32_t*)0x200000000144 = 7;
*(uint8_t*)0x200000000148 = 0;
*(uint8_t*)0x200000000149 = 0;
*(uint16_t*)0x20000000014a = 0;
*(uint32_t*)0x20000000014c = 0;
*(uint8_t*)0x200000000150 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000151, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000151, 1, 4, 4);
*(uint16_t*)0x200000000152 = 0;
*(uint32_t*)0x200000000154 = -1;
*(uint8_t*)0x200000000158 = 0;
*(uint8_t*)0x200000000159 = 0;
*(uint16_t*)0x20000000015a = 0;
*(uint32_t*)0x20000000015c = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000160, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000160, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000160, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000161, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000161, 0, 4, 4);
*(uint16_t*)0x200000000162 = 0;
*(uint32_t*)0x200000000164 = 0;
*(uint8_t*)0x200000000168 = 0x85;
*(uint8_t*)0x200000000169 = 0;
*(uint16_t*)0x20000000016a = 0;
*(uint32_t*)0x20000000016c = 0x86;
*(uint8_t*)0x200000000170 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000000171, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000171, 1, 4, 4);
*(uint16_t*)0x200000000172 = 0;
*(uint32_t*)0x200000000174 = -1;
*(uint8_t*)0x200000000178 = 0;
*(uint8_t*)0x200000000179 = 0;
*(uint16_t*)0x20000000017a = 0;
*(uint32_t*)0x20000000017c = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000180, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000180, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000180, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000181, 8, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000181, 0, 4, 4);
*(uint16_t*)0x200000000182 = 0;
*(uint32_t*)0x200000000184 = 0x10000;
STORE_BY_BITMASK(uint8_t, , 0x200000000188, 3, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000188, 3, 3, 2);
STORE_BY_BITMASK(uint8_t, , 0x200000000188, 3, 5, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000189, 0xa, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000189, 8, 4, 4);
*(uint16_t*)0x20000000018a = 0xfff8;
*(uint32_t*)0x20000000018c = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000190, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000190, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000190, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000191, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000191, 0xa, 4, 4);
*(uint16_t*)0x200000000192 = 0;
*(uint32_t*)0x200000000194 = 0;
STORE_BY_BITMASK(uint8_t, , 0x200000000198, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000000198, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000000198, 0, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000199, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000000199, 0, 4, 4);
*(uint16_t*)0x20000000019a = 0;
*(uint32_t*)0x20000000019c = 0xfffffff8;
STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a1, 3, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a1, 0, 4, 4);
*(uint16_t*)0x2000000001a2 = 0;
*(uint32_t*)0x2000000001a4 = 8;
STORE_BY_BITMASK(uint8_t, , 0x2000000001a8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a8, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a9, 4, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001a9, 0, 4, 4);
*(uint16_t*)0x2000000001aa = 0;
*(uint32_t*)0x2000000001ac = 0;
*(uint8_t*)0x2000000001b0 = 0x85;
*(uint8_t*)0x2000000001b1 = 0;
*(uint16_t*)0x2000000001b2 = 0;
*(uint32_t*)0x2000000001b4 = 0x82;
STORE_BY_BITMASK(uint8_t, , 0x2000000001b8, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b8, 1, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b8, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b9, 1, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001b9, 9, 4, 4);
*(uint16_t*)0x2000000001ba = 0;
*(uint32_t*)0x2000000001bc = 0;
STORE_BY_BITMASK(uint8_t, , 0x2000000001c0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c1, 2, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001c1, 0, 4, 4);
*(uint16_t*)0x2000000001c2 = 0;
*(uint32_t*)0x2000000001c4 = 1;
*(uint8_t*)0x2000000001c8 = 0x85;
*(uint8_t*)0x2000000001c9 = 0;
*(uint16_t*)0x2000000001ca = 0;
*(uint32_t*)0x2000000001cc = 0x85;
STORE_BY_BITMASK(uint8_t, , 0x2000000001d0, 7, 0, 3);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d0, 0, 3, 1);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d0, 0xb, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d1, 0, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000001d1, 0, 4, 4);
*(uint16_t*)0x2000000001d2 = 0;
*(uint32_t*)0x2000000001d4 = 0;
*(uint8_t*)0x2000000001d8 = 0x95;
*(uint8_t*)0x2000000001d9 = 0;
*(uint16_t*)0x2000000001da = 0;
*(uint32_t*)0x2000000001dc = 0;
*(uint64_t*)0x200000000c50 = 0;
*(uint32_t*)0x200000000c58 = 8;
*(uint32_t*)0x200000000c5c = 0;
*(uint64_t*)0x200000000c60 = 0;
*(uint32_t*)0x200000000c68 = 0x41100;
*(uint32_t*)0x200000000c6c = 2;
memset((void*)0x200000000c70, 0, 16);
*(uint32_t*)0x200000000c80 = 0;
*(uint32_t*)0x200000000c84 = 0;
*(uint32_t*)0x200000000c88 = -1;
*(uint32_t*)0x200000000c8c = 8;
*(uint64_t*)0x200000000c90 = 0;
*(uint32_t*)0x200000000c98 = 0;
*(uint32_t*)0x200000000c9c = 0x10;
*(uint64_t*)0x200000000ca0 = 0;
*(uint32_t*)0x200000000ca8 = 0;
*(uint32_t*)0x200000000cac = 0;
*(uint32_t*)0x200000000cb0 = -1;
*(uint32_t*)0x200000000cb4 = 0;
*(uint64_t*)0x200000000cb8 = 0;
*(uint64_t*)0x200000000cc0 = 0;
*(uint32_t*)0x200000000cc8 = 0x10;
*(uint32_t*)0x200000000ccc = 1;
*(uint32_t*)0x200000000cd0 = 0;
	syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000c40ul, /*size=*/0x90ul);
//  ioctl$ifreq_SIOCGIFINDEX_team arguments: [
//    fd: sock (resource)
//    cmd: const = 0x8933 (4 bytes)
//    arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
//      ifreq_dev_t["team0", ifindex_team] {
//        ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        elem: ifindex_team (resource)
//        pad = 0x0 (20 bytes)
//      }
//    }
//  ]
memcpy((void*)0x200000000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
	syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000600ul);
//  socket$netlink arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: netlink_proto = 0x0 (4 bytes)
//  ]
//  returns sock_netlink
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
	if (res != -1)
		r[1] = res;
//  sendmsg$nl_route_sched arguments: [
//    fd: sock_nl_route (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
//      msghdr_netlink[netlink_msg_route_sched] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
//          iovec[in, netlink_msg_route_sched] {
//            addr: ptr[in, netlink_msg_route_sched] {
//              union netlink_msg_route_sched {
//                newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], tcmsg[AF_UNSPEC], rtm_tca_policy] {
//                  len: len = 0x0 (4 bytes)
//                  type: const = 0x24 (2 bytes)
//                  flags: netlink_msg_flags = 0x0 (2 bytes)
//                  seq: int32 = 0x0 (4 bytes)
//                  pid: int32 = 0x0 (4 bytes)
//                  payload: tcmsg[AF_UNSPEC] {
//                    family: const = 0x0 (1 bytes)
//                    tcm__pad1: const = 0x0 (1 bytes)
//                    tcm__pad2: const = 0x0 (2 bytes)
//                    ifindex: ifindex (resource)
//                    tcm_handle: tcm_handle {
//                      minor: tcm_handle_offsets = 0x0 (2 bytes)
//                      major: tcm_handle_offsets = 0x0 (2 bytes)
//                    }
//                    tcm_parent: tcm_handle {
//                      minor: tcm_handle_offsets = 0x0 (2 bytes)
//                      major: tcm_handle_offsets = 0x0 (2 bytes)
//                    }
//                    tcm_info: tcm_handle {
//                      minor: tcm_handle_offsets = 0x0 (2 bytes)
//                      major: tcm_handle_offsets = 0x0 (2 bytes)
//                    }
//                  }
//                  attrs: array[rtm_tca_policy] {
//                  }
//                }
//              }
//            }
//            len: len = 0xa4 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x0 (8 bytes)
//  ]
*(uint64_t*)0x2000000007c0 = 0;
*(uint32_t*)0x2000000007c8 = 0;
*(uint64_t*)0x2000000007d0 = 0x200000000780;
*(uint64_t*)0x200000000780 = 0x200000000000;
*(uint32_t*)0x200000000000 = 0;
*(uint16_t*)0x200000000004 = 0x24;
*(uint16_t*)0x200000000006 = 0;
*(uint32_t*)0x200000000008 = 0;
*(uint32_t*)0x20000000000c = 0;
*(uint8_t*)0x200000000010 = 0;
*(uint8_t*)0x200000000011 = 0;
*(uint16_t*)0x200000000012 = 0;
*(uint32_t*)0x200000000014 = 0;
*(uint16_t*)0x200000000018 = 0;
*(uint16_t*)0x20000000001a = 0;
*(uint16_t*)0x20000000001c = 0;
*(uint16_t*)0x20000000001e = 0;
*(uint16_t*)0x200000000020 = 0;
*(uint16_t*)0x200000000022 = 0;
*(uint64_t*)0x200000000788 = 0xa4;
*(uint64_t*)0x2000000007d8 = 1;
*(uint64_t*)0x2000000007e0 = 0;
*(uint64_t*)0x2000000007e8 = 0;
*(uint32_t*)0x2000000007f0 = 0;
	syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x2000000007c0ul, /*f=*/0ul);
	return 0;
}

The root cause of this crash is a massive out-of-bounds memory write (buffer overflow) in the BPF helper `bpf_snprintf` (and other `bprintf`-like helpers) due to integer signedness and unchecked return values in `bpf_bprintf_prepare()`. 

This memory corruption overwrites adjacent kernel memory, which in this case included `hrtimer` structures and their `timerqueue` rbtree nodes. When CPU 1 later attempted to remove a corrupted timer via `__remove_hrtimer` -> `timerqueue_linked_del` -> `rb_erase_linked`, it got stuck in an infinite loop traversing a cyclic rbtree. CPU 0 then detected a soft lockup because it was waiting for CPU 1 to acknowledge an IPI (`csd_lock_wait`), but CPU 1 had interrupts disabled while processing the timer queue.

### Detailed Analysis

In `kernel/bpf/helpers.c`, the `bpf_bprintf_prepare()` function formats arguments into a temporary 512-byte buffer (`buffers->bin_args`). There are two distinct bugs in this function that allow `tmp_buf` to advance past `tmp_buf_end`, bypassing bounds checks.

#### Bug 1: Unchecked `snprintf` return value for `%pB`
When handling the `%pB` format specifier, the code does:
```c
			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}
				i++;
				num_spec++;
				continue;
			}
```
`snprintf` returns the number of characters that *would* have been written if the buffer was large enough, excluding the null terminator. If the remaining buffer space (`tmp_buf_end - tmp_buf`) is smaller than the formatted string, `err` will be greater than or equal to the remaining space. Consequently, `tmp_buf += (err + 1)` will advance `tmp_buf` **past** `tmp_buf_end`.

#### Bug 2: Signedness bug in bounds checking
When handling standard format specifiers (like `%d`, `%x`), the code aligns `tmp_buf` and checks if there is enough space:
```c
			if (tmp_buf) {
				tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
				if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
					err = -ENOSPC;
					goto out;
				}
```
Here, `tmp_buf_end - tmp_buf` is of type `ptrdiff_t` (signed), and `sizeof_cur_arg` is of type `size_t` (unsigned). In C, this comparison forces the signed `ptrdiff_t` to be cast to an unsigned `size_t`. 

If `tmp_buf` has already been advanced past `tmp_buf_end` (e.g., via the `%pB` bug above, or by using `%c` to make `tmp_buf` unaligned such that `PTR_ALIGN` pushes it past `tmp_buf_end`), `tmp_buf_end - tmp_buf` becomes negative. When cast to `size_t`, this negative value becomes a huge positive number (e.g., `0xFFFFFFFFFFFFFFF0`). 

The condition `HUGE_NUMBER < sizeof_cur_arg` evaluates to `false`, bypassing the `-ENOSPC` check. The code then writes to `tmp_buf`, corrupting memory out of bounds.

Furthermore, if a `%s` specifier is used after `tmp_buf` is out of bounds:
```c
				if (tmp_buf_end == tmp_buf) {
					err = -ENOSPC;
					goto out;
				}

				unsafe_ptr = (char *)(long)raw_args[num_spec];
				err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
							    fmt_ptype,
							    tmp_buf_end - tmp_buf);
```
The equality check `tmp_buf_end == tmp_buf` fails to catch that `tmp_buf > tmp_buf_end`. Then `bpf_trace_copy_string` is called with a negative `bufsz` (`tmp_buf_end - tmp_buf`), which is cast to a huge `size_t`. This results in copying an arbitrarily large string into kernel memory, causing massive corruption.

### Fix
To fix this vulnerability:
1. For `%pB`, `tmp_buf` should only be advanced by the actual number of bytes written, and it must not exceed `tmp_buf_end`.
2. The bounds checks must correctly handle the case where `tmp_buf >= tmp_buf_end`. A safe way is to cast `tmp_buf_end - tmp_buf` to a signed type and check if it's less than the required size, or simply check `if (tmp_buf + sizeof_cur_arg > tmp_buf_end)`.

gemini-3.1-pro-preview

							input: 26842
							output: 42
							thoughts: 899
						

**Analyzing a Soft Lockup on CPU#0**

Okay, so I've got a soft lockup crash on CPU#0, and the stack trace is pointing towards `csd_lock_wait` within `smp_call_function_many_cond`. This is interesting; it's suggesting we're hitting a contention point related to inter-processor communication, potentially a lock. The trace goes through `smp_text_poke_batch_finish`, `static_key_enable`, and eventually to `toggle_allocation_gate` within the KFENCE code. That `static_key_enable` call is a potential area to investigate - could a key be getting enabled/disabled in a way that's causing this contention? And the call to `toggle_allocation_gate`… that's directly related to KFENCE, so definitely worth a closer look, especially if we're seeing issues around memory allocation or deallocation. Finally it traces into the kernel workqueues. I should look into what that workqueue is doing.

But wait, CPU 1 is also stuck. Now, the second stack trace is showing CPU 1 stuck in `__remove_hrtimer`! That's concerning, because it implies there's a problem with high-resolution timers. `__remove_hrtimer` suggests a timer is being removed or canceled, but it's getting hung up. It seems to be happening within the interrupt context of the APIC timer. That `native_irq_disable` call is also telling. It makes me wonder if there's an interrupt disabling issue combined with hrtimer management, creating a deadlock or a race condition. It's odd that CPU1 is in the interrupt handler and CPU0 is doing the workqueue work, so that looks like it's a potential area of contention. Let's look up how `__remove_hrtimer` behaves in the kernel source.

map[ContextFile:kernel/time/hrtimer.c IncludeLines:true Name:__remove_hrtimer]

map[SourceCode:1131:	/*
1132:	 * __remove_hrtimer - internal function to remove a timer
1133:	 *
1134:	 * High resolution timer mode reprograms the clock event device when the
1135:	 * timer is the one which expires next. The caller can disable this by setting
1136:	 * reprogram to zero. This is useful, when the context does a reprogramming
1137:	 * anyway (e.g. timer interrupt)
1138:	 */
1139:	static void __remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
1140:				     bool newstate, bool reprogram)
1141:	{
1142:		struct hrtimer_cpu_base *cpu_base = base->cpu_base;
1143:		bool was_first;
1144:	
1145:		lockdep_assert_held(&cpu_base->lock);
1146:	
1147:		if (!timer->is_queued)
1148:			return;
1149:	
1150:		/* Pairs with the lockless read in hrtimer_is_queued() */
1151:		WRITE_ONCE(timer->is_queued, newstate);
1152:	
1153:		was_first = !timerqueue_linked_prev(&timer->node);
1154:	
1155:		if (!timerqueue_linked_del(&base->active, &timer->node))
1156:			cpu_base->active_bases &= ~(1 << base->index);
1157:	
1158:		/* Nothing to update if this was not the first timer in the base */
1159:		if (!was_first)
1160:			return;
1161:	
1162:		base_update_next_timer(base);
1163:	
1164:		/*
1165:		 * If reprogram is false don't update cpu_base->next_timer and do not
1166:		 * touch the clock event device.
1167:		 *
1168:		 * This happens when removing the first timer on a remote CPU, which
1169:		 * will be handled by the remote CPU's interrupt. It also happens when
1170:		 * a local timer is removed to be immediately restarted. That's handled
1171:		 * at the call site.
1172:		 */
1173:		if (!reprogram || timer != cpu_base->next_timer || timer->is_lazy)
1174:			return;
1175:	
1176:		if (cpu_base->deferred_rearm)
1177:			cpu_base->deferred_needs_update = true;
1178:		else
1179:			hrtimer_force_reprogram(cpu_base, /* skip_equal */ true);
1180:	}
 SourceFile:kernel/time/hrtimer.c]

gemini-3.1-pro-preview

							input: 28981
							output: 42
							thoughts: 267
						

**Analyzing a Kernel Crash in `__remove_hrtimer`**

Okay, so I'm looking at this kernel crash, and the trace points me directly to `__remove_hrtimer` at line 1145. I see a few key checks there that could be at play: a `lockdep_assert_held` check on `cpu_base->lock`, a check for `timer->is_queued`, and then a `WRITE_ONCE` to update `timer->is_queued`, followed by a check for `was_first`. I'm immediately trying to connect the dots between these conditions and the crash.

Now, that assembly dump is what I really need to dig into. Let's see... looking at the code, I see the crucial instructions highlighted: `45 85 ed 0f 84 33 02 00 00`. I need to figure out what that sequence is doing - the registers and memory accesses are the key here. It's likely involved with conditional jumps based on comparisons, but I need to decipher the exact logic it is implementing, and relate that to the C code snippet.

I should also jump into `__run_hrtimer` to understand how the timer state could be related to the code.

map[ContextFile:kernel/time/hrtimer.c IncludeLines:true Name:__run_hrtimer]

map[SourceCode:1871:	/*
1872:	 * The write_seqcount_barrier()s in __run_hrtimer() split the thing into 3
1873:	 * distinct sections:
1874:	 *
1875:	 *  - queued:	the timer is queued
1876:	 *  - callback:	the timer is being ran
1877:	 *  - post:	the timer is inactive or (re)queued
1878:	 *
1879:	 * On the read side we ensure we observe timer->is_queued and cpu_base->running
1880:	 * from the same section, if anything changed while we looked at it, we retry.
1881:	 * This includes timer->base changing because sequence numbers alone are
1882:	 * insufficient for that.
1883:	 *
1884:	 * The sequence numbers are required because otherwise we could still observe
1885:	 * a false negative if the read side got smeared over multiple consecutive
1886:	 * __run_hrtimer() invocations.
1887:	 */
1888:	static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base, struct hrtimer_clock_base *base,
1889:				  struct hrtimer *timer, ktime_t now, unsigned long flags)
1890:		__must_hold(&cpu_base->lock)
1891:	{
1892:		enum hrtimer_restart (*fn)(struct hrtimer *);
1893:		bool expires_in_hardirq;
1894:		int restart;
1895:	
1896:		lockdep_assert_held(&cpu_base->lock);
1897:	
1898:		debug_hrtimer_deactivate(timer);
1899:		base->running = timer;
1900:	
1901:		/*
1902:		 * Separate the ->running assignment from the ->is_queued assignment.
1903:		 *
1904:		 * As with a regular write barrier, this ensures the read side in
1905:		 * hrtimer_active() cannot observe base->running == NULL &&
1906:		 * timer->is_queued == INACTIVE.
1907:		 */
1908:		raw_write_seqcount_barrier(&base->seq);
1909:	
1910:		__remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE, false);
1911:		fn = ACCESS_PRIVATE(timer, function);
1912:	
1913:		/*
1914:		 * Clear the 'is relative' flag for the TIME_LOW_RES case. If the
1915:		 * timer is restarted with a period then it becomes an absolute
1916:		 * timer. If its not restarted it does not matter.
1917:		 */
1918:		if (IS_ENABLED(CONFIG_TIME_LOW_RES))
1919:			timer->is_rel = false;
1920:	
1921:		/*
1922:		 * The timer is marked as running in the CPU base, so it is
1923:		 * protected against migration to a different CPU even if the lock
1924:		 * is dropped.
1925:		 */
1926:		raw_spin_unlock_irqrestore(&cpu_base->lock, flags);
1927:		trace_hrtimer_expire_entry(timer, now);
1928:		expires_in_hardirq = lockdep_hrtimer_enter(timer);
1929:	
1930:		restart = fn(timer);
1931:	
1932:		lockdep_hrtimer_exit(expires_in_hardirq);
1933:		trace_hrtimer_expire_exit(timer);
1934:		raw_spin_lock_irq(&cpu_base->lock);
1935:	
1936:		/*
1937:		 * Note: We clear the running state after enqueue_hrtimer and
1938:		 * we do not reprogram the event hardware. Happens either in
1939:		 * hrtimer_start_range_ns() or in hrtimer_interrupt()
1940:		 *
1941:		 * Note: Because we dropped the cpu_base->lock above,
1942:		 * hrtimer_start_range_ns() can have popped in and enqueued the timer
1943:		 * for us already.
1944:		 */
1945:		if (restart == HRTIMER_RESTART && !timer->is_queued)
1946:			enqueue_hrtimer(timer, base, HRTIMER_MODE_ABS, false);
1947:	
1948:		/*
1949:		 * Separate the ->running assignment from the ->is_queued assignment.
1950:		 *
1951:		 * As with a regular write barrier, this ensures the read side in
1952:		 * hrtimer_active() cannot observe base->running.timer == NULL &&
1953:		 * timer->is_queued == INACTIVE.
1954:		 */
1955:		raw_write_seqcount_barrier(&base->seq);
1956:	
1957:		WARN_ON_ONCE(base->running != timer);
1958:		base->running = NULL;
1959:	}
 SourceFile:kernel/time/hrtimer.c]

gemini-3.1-pro-preview

							input: 31001
							output: 19
							thoughts: 641
						

**Analyzing a Potential Soft Lockup**

Okay, so I'm seeing a potential soft lockup issue, and it looks like CPU 0 is the primary suspect. It's stuck in `csd_lock_wait`, which is called within a chain of functions: `smp_call_function_many_cond`, `on_each_cpu_cond_mask`, `smp_text_poke_sync_each_cpu`, and finally `smp_text_poke_batch_finish`. Right, `smp_text_poke_sync_each_cpu` is the crucial function, as it's designed to wait for IPI (Inter-Processor Interrupt) completion on all CPUs.

Now, here's where it gets interesting, and potentially tricky. CPU 1 is reported as being in `__remove_hrtimer`. Is CPU 1 hung? At first glance it looked that way, but now it appears CPU 1 is getting an interrupt, specifically a timer interrupt, while it's in the `default_idle` state. That's a normal occurrence.

Examining the call stack for CPU 1: the system is going from `__run_hrtimer` to `__hrtimer_run_queues` to `hrtimer_interrupt`, through the APIC interrupt handler and then finally back to `default_idle`. This makes perfect sense. CPU 1 looks to be just interrupted while in idle, and is likely still working as intended. I need to keep an eye on it.

Aha! Now I see, CPU 1's RIP is inside `__remove_hrtimer` and its exact instruction pointer is `__remove_hrtimer+0x8e/0x3e0`. The question is: is it *actually* stuck in a loop inside `__remove_hrtimer`? I need to analyze the assembly code of that function to understand what's happening.

map[Expression:__remove_hrtimer]

map[Output:Documentation/trace/ftrace.rst=2160=Doing the same with chrt -r 5 and function-trace set.
--
Documentation/trace/ftrace.rst-2225-    <idle>-0       3dN.1   16us : add_preempt_count <-_raw_spin_lock_irqsave
Documentation/trace/ftrace.rst:2226:    <idle>-0       3dN.2   17us : __remove_hrtimer <-remove_hrtimer.part.16
Documentation/trace/ftrace.rst:2227:    <idle>-0       3dN.2   17us : hrtimer_force_reprogram <-__remove_hrtimer
Documentation/trace/ftrace.rst-2228-    <idle>-0       3dN.2   17us : tick_program_event <-hrtimer_force_reprogram
--
Documentation/trace/ftrace.rst=3098=Produces::
--
Documentation/trace/ftrace.rst-3112-            <idle>-0     [003] dN.1  4228.547804: hrtimer_try_to_cancel <-hrtimer_cancel
Documentation/trace/ftrace.rst:3113:            <idle>-0     [003] dN.2  4228.547805: hrtimer_force_reprogram <-__remove_hrtimer
Documentation/trace/ftrace.rst-3114-            <idle>-0     [003] dN.1  4228.547805: hrtimer_forward <-tick_nohz_idle_exit
--
include/linux/hrtimer_defs.h=38=enum hrtimer_base_type {
--
include/linux/hrtimer_defs.h-77- *
include/linux/hrtimer_defs.h:78: * Note: next_timer is just an optimization for __remove_hrtimer().
include/linux/hrtimer_defs.h-79- *	 Do not dereference the pointer because it is not reliable on
--
kernel/time/hrtimer.c=1124=static inline void base_update_next_timer(struct hrtimer_clock_base *base)
--
kernel/time/hrtimer.c-1131-/*
kernel/time/hrtimer.c:1132: * __remove_hrtimer - internal function to remove a timer
kernel/time/hrtimer.c-1133- *
--
kernel/time/hrtimer.c-1138- */
kernel/time/hrtimer.c:1139:static void __remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
kernel/time/hrtimer.c-1140-			     bool newstate, bool reprogram)
--
kernel/time/hrtimer.c=1182=static inline bool remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
--
kernel/time/hrtimer.c-1201-
kernel/time/hrtimer.c:1202:		__remove_hrtimer(timer, base, newstate, reprogram);
kernel/time/hrtimer.c-1203-		return true;
--
kernel/time/hrtimer.c=1888=static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base, struct hrtimer_clock_base *base,
--
kernel/time/hrtimer.c-1909-
kernel/time/hrtimer.c:1910:	__remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE, false);
kernel/time/hrtimer.c-1911-	fn = ACCESS_PRIVATE(timer, function);
--
kernel/time/hrtimer.c=2438=static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
--
kernel/time/hrtimer.c-2453-		 */
kernel/time/hrtimer.c:2454:		__remove_hrtimer(timer, old_base, HRTIMER_STATE_ENQUEUED, false);
kernel/time/hrtimer.c-2455-		timer->base = new_base;
]

gemini-3.1-pro-preview

							input: 33134
							output: 183
							thoughts: 218
						

**Analyzing the Crash in `__remove_hrtimer`**

Okay, so the crash happened in `__remove_hrtimer+0x8e`. Right, let's take a look at the code at that address. Hmm, here's the assembly: `Code: ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d`. Now, it's time to disassemble this and dig into it. We've got work to do here. Let's see if we can identify what's going wrong.

map[Question:Disassemble this x86_64 code snippet:
ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d
]

map[Answer:The provided x86_64 code snippet is disassembled as follows:

```nasm
ee              out    dx,al
e8 f6 fd 11 00  call   0x11fdfb
45 85 ed        test   r13d,r13d
48 89 5c 24 08  mov    QWORD PTR [rsp+0x8],rbx
74 2a           je     0x40
48 8d 7b 18     lea    rdi,[rbx+0x18]
be ff ff ff ff  mov    esi,0xffffffff
e8 ce a2 21 0a  call   0xa21a2ce
41 89 c5        mov    r13d,eax
31 ff           xor    edi,edi
89 c6           mov    esi,eax
e8 d2 fd 11 00  call   0x11fdf9
45 85 ed        test   r13d,r13d
0f 84 33 02 00 00 je     0x27c
e8 84 f9 11 00  call   0x11f9b3
eb 05           jmp    0x3a
e8 7d f9 11 00  call   0x11f9b1
4d              rex.WRB
```

### Analysis of the Code
The snippet appears to be from a kernel function, likely related to synchronization or waiting mechanisms (such as `io_uring` or `mutex` slow paths), given the patterns of testing return values and calling into other kernel sections.

1.  **`out dx, al` (`ee`)**: This is an I/O instruction. In modern kernel code, it is relatively rare except in specific drivers or legacy support.
2.  **`test r13d, r13d`**: This checks a 32-bit value in the `r13` register (likely a return code or status).
3.  **`lea rdi, [rbx+0x18]`**: This calculates the address of a field at offset `0x18` (24 bytes) from the base address in `rbx`. Depending on the structure in `rbx`, this could be `&task->__state` (if `rbx` is `task_struct`) or a member of a synchronization primitive.
4.  **`mov esi, 0xffffffff`**: Sets the second argument for the subsequent call to `-1`.
5.  **`call 0xa21a2ce`**: A call with a large relative offset, often indicating a call between the kernel core and a module, or between two distant modules.
6.  **`xor edi, edi; mov esi, eax; call ...`**: This prepares arguments `(0, eax)` for a function call, where `eax` is the return value of the previous call. This pattern is common in tracing (e.g., `trace_contention_end(lock, ret)` where `lock` is NULL).
7.  **The `<45>` marker**: In the original input, the byte `45` was enclosed in `< >`. This is a standard convention in Linux kernel "oops" or "panic" logs to indicate the instruction pointer (RIP) at the time of the fault. The instruction starting at this byte is `45 85 ed` (`test r13d, r13d`).]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

Disassemble this x86_64 code snippet:
ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d

The provided x86_64 code snippet is disassembled as follows:

```nasm
ee              out    dx,al
e8 f6 fd 11 00  call   0x11fdfb
45 85 ed        test   r13d,r13d
48 89 5c 24 08  mov    QWORD PTR [rsp+0x8],rbx
74 2a           je     0x40
48 8d 7b 18     lea    rdi,[rbx+0x18]
be ff ff ff ff  mov    esi,0xffffffff
e8 ce a2 21 0a  call   0xa21a2ce
41 89 c5        mov    r13d,eax
31 ff           xor    edi,edi
89 c6           mov    esi,eax
e8 d2 fd 11 00  call   0x11fdf9
45 85 ed        test   r13d,r13d
0f 84 33 02 00 00 je     0x27c
e8 84 f9 11 00  call   0x11f9b3
eb 05           jmp    0x3a
e8 7d f9 11 00  call   0x11f9b1
4d              rex.WRB
```

### Analysis of the Code
The snippet appears to be from a kernel function, likely related to synchronization or waiting mechanisms (such as `io_uring` or `mutex` slow paths), given the patterns of testing return values and calling into other kernel sections.

1.  **`out dx, al` (`ee`)**: This is an I/O instruction. In modern kernel code, it is relatively rare except in specific drivers or legacy support.
2.  **`test r13d, r13d`**: This checks a 32-bit value in the `r13` register (likely a return code or status).
3.  **`lea rdi, [rbx+0x18]`**: This calculates the address of a field at offset `0x18` (24 bytes) from the base address in `rbx`. Depending on the structure in `rbx`, this could be `&task->__state` (if `rbx` is `task_struct`) or a member of a synchronization primitive.
4.  **`mov esi, 0xffffffff`**: Sets the second argument for the subsequent call to `-1`.
5.  **`call 0xa21a2ce`**: A call with a large relative offset, often indicating a call between the kernel core and a module, or between two distant modules.
6.  **`xor edi, edi; mov esi, eax; call ...`**: This prepares arguments `(0, eax)` for a function call, where `eax` is the return value of the previous call. This pattern is common in tracing (e.g., `trace_contention_end(lock, ret)` where `lock` is NULL).
7.  **The `<45>` marker**: In the original input, the byte `45` was enclosed in `< >`. This is a standard convention in Linux kernel "oops" or "panic" logs to indicate the instruction pointer (RIP) at the time of the fault. The instruction starting at this byte is `45 85 ed` (`test r13d, r13d`).

gemini-3-flash-preview

							input: 2421
							output: 19
							thoughts: 6225
						

**Disassembly and Analysis of an x86_64 Code Snippet**

Okay, here's what I'm thinking about this code snippet. The user wants me to break down this assembly, and it looks like a kernel oops. The `ee` at the beginning is probably garbage, and I'll ignore it. It is likely the tail end of the previous instruction. The code snippet begins with a `call` instruction, a `test r13d` instruction, which tests r13d. The following `mov`, `jz`, and `lea` instructions followed by a `mov esi, -1` sequence looks like a potential error handling or initialization sequence. The code calls a series of functions. There is a very large call offset to `0x0a21a2ce` which indicates that it might be calling a function far away. This could be within a kernel module or calling from a module to kernel.

The `45 85 ed` instruction, `test r13d, r13d`, appears multiple times, which looks suspicious. It's likely checking return values. There is a `jz` instruction that follows it, making me think it's a conditional check. The fact that the first instance of it is marked with `<45>` hints that this is the instruction pointer at the time of an error. `test r13d, r13d` is not likely to fault by itself, unless there is something very peculiar. The code appears to be saving the `rbx` register and then loading a field from an object pointed to by `rbx` into `rdi`. The instruction that moves `esi` to -1 is quite common. The relative calls suggest that the control flow is within a close range. The last `e8` call, `e8 7d f9 11 00`, is suspicious, since it is a relative call that might be a jump.

I'm interpreting the code like this:
1.  A `call` to some function
2.  Test the return value in `r13d`
3.  Conditional jump if zero
4.  Load address of object field into `rdi`
5.  Call another function.
6.  `C` to another function using return value of the previous `B` function call.

Based on the pattern, it seems like the code is trying to check a status, maybe from a previous call, and branch based on it. Also, the code appears to be operating on a structure where a field at offset 0x18 is used. The code appears to be saving `rbx` to the stack and calling functions. It also calls another function that is quite large. It is difficult to ascertain the exact function without more data, but the patterns are relatively clear.

My conclusion is that this looks like an error handling routine within some kernel code, possibly a module, or some function call between modules.

map[Name:file]

map[Fields:[map[Name:f_lock OffsetBits:0 SizeBits:512] map[Name:f_mode OffsetBits:512 SizeBits:32] map[Name:f_op OffsetBits:576 SizeBits:64] map[Name:f_mapping OffsetBits:640 SizeBits:64] map[Name:private_data OffsetBits:704 SizeBits:64] map[Name:f_inode OffsetBits:768 SizeBits:64] map[Name:f_flags OffsetBits:832 SizeBits:32] map[Name:f_iocb_flags OffsetBits:864 SizeBits:32] map[Name:f_cred OffsetBits:896 SizeBits:64] map[Name:f_owner OffsetBits:960 SizeBits:64] map[Name: OffsetBits:1024 SizeBits:128] map[Name: OffsetBits:1152 SizeBits:1088] map[Name:f_pos OffsetBits:2240 SizeBits:64] map[Name:f_security OffsetBits:2304 SizeBits:64] map[Name:f_wb_err OffsetBits:2368 SizeBits:32] map[Name:f_sb_err OffsetBits:2400 SizeBits:32] map[Name:f_ep OffsetBits:2432 SizeBits:64] map[Name: OffsetBits:2496 SizeBits:256] map[Name:f_ref OffsetBits:2752 SizeBits:64]]]

gemini-3-flash-preview

							input: 9716
							output: 23
							thoughts: 1987
						

**Dissecting a Code Snippet: A Journey into Kernel Internals**

Okay, so I've stumbled upon this assembly snippet and I'm trying to figure out its purpose within the kernel. My initial thought was about memory offsets within `struct file`, but that didn't pan out. I had a brief moment of confusion with `f_lock` and its size, but I quickly realized the x86_64 architecture uses a 4-byte `spinlock_t`. Still, I'm second-guessing if I'm even looking in the right place, so I've temporarily moved on from considering offsets.

My current approach is to understand the logic flow, so I'm trying to disassemble the instructions more accurately. I'm focusing on the call instructions (`e8`) and conditional jumps to get the overall structure. There seems to be a call to `func1`, followed by a conditional check (likely the return value of `func1`), then either `func2` or `func3` will be called. There's also a `jz` instruction that has a significant offset. This indicates a longer jump. This indicates a likely if/else construct, and the `0x233` jump offset has me suspicious that this is a case of handling an error.

I've identified the main pattern as `Call1()`, followed by an `if` statement based on the return value of `Call1`, which then either calls `Call2` and unconditionally jumps, or only calls `Call3`.

I'm zeroing in on `Call2`, because it takes `rbx + 0x18` and `-1` as arguments. Based on the pattern, I'm trying to understand the likely arguments. I'm assuming that `-1` is a special value (like `MAX_SCHEDULE_TIMEOUT` or some kind of error code). I'm also looking at what kind of struct `rbx + 0x18` might be, but it's not immediately obvious and could be a few different types of structs.

Then, there is `Call3` with a zero and the return of `Call2`, so I'm making guesses on what the return of `Call2` means. This could be something like a function that checks status, and then a function that interprets the status, such as a function that converts a status to an error.

I was thinking about searching for the byte sequence, but that may be difficult to interpret, even if I find something. I've realized that `r13d` is a callee-saved register, so it's a local variable. So I've shifted my attention to what these calls are doing with this local variable. I'm seeing if I can pinpoint which structs have offset 24 (0x18) to get a more concrete lead. I'm going to check `struct task_struct`, `struct kiocb`, and `struct io_kiocb` (for io_uring).

Let's start there.

map[Name:io_kiocb]

map[Fields:[map[Name: OffsetBits:0 SizeBits:512] map[Name:opcode OffsetBits:512 SizeBits:8] map[Name:iopoll_completed OffsetBits:520 SizeBits:8] map[Name:buf_index OffsetBits:528 SizeBits:16] map[Name:nr_tw OffsetBits:544 SizeBits:32] map[Name:flags OffsetBits:576 SizeBits:64] map[Name:cqe OffsetBits:640 SizeBits:128] map[Name:ctx OffsetBits:768 SizeBits:64] map[Name:tctx OffsetBits:832 SizeBits:64] map[Name: OffsetBits:896 SizeBits:64] map[Name: OffsetBits:960 SizeBits:64] map[Name:file_node OffsetBits:1024 SizeBits:64] map[Name:refs OffsetBits:1088 SizeBits:32] map[Name:cancel_seq_set OffsetBits:1120 SizeBits:8] map[Name: OffsetBits:1152 SizeBits:128] map[Name: OffsetBits:1280 SizeBits:128] map[Name:apoll OffsetBits:1408 SizeBits:64] map[Name:async_data OffsetBits:1472 SizeBits:64] map[Name:poll_refs OffsetBits:1536 SizeBits:32] map[Name:link OffsetBits:1600 SizeBits:64] map[Name:creds OffsetBits:1664 SizeBits:64] map[Name:work OffsetBits:1728 SizeBits:128] map[Name:big_cqe OffsetBits:1856 SizeBits:128]]]

gemini-3-flash-preview

							input: 12853
							output: 21
							thoughts: 3216
						

**Analyzing a Kernel Oops Code Snippet**

Okay, here's the breakdown of my thought process as I try to decipher this kernel oops:

Initially, I was trying to locate specific offsets within data structures like `io_kiocb`, `struct file`, and `struct socket` based on the given addresses, but that didn't pan out. I tried to use a byte sequence search, but couldn't.

Then I focused on the provided "Code:" line, interpreting the assembly instructions. I immediately recognized `45 85 ed` as `test r13d, r13d` and tried to determine where the faulting instruction was. Realized that the `<45>` might be marking the end of the previous instruction.

I recalled seeing a similar `Code:` line in previous bug reports and started to piece together some common instruction patterns. I noticed `mov [rsp+8], rbx`, a pattern frequently seen in function entry code or with specific compiler optimizations, especially if `rbx` is saved but the function doesn't use the usual `push` instruction.

The `e8 ...` call instructions with similar offsets were intriguing, suggesting calls to functions in a close area of the kernel. This helped to narrow down the context. I then tried to look for specific instructions like `lea rdi, [rbx+0x18]` to determine the data being accessed. Through this, I figured out that `rbx+0x18` likely pointed to `wait_queue_entry->entry` and considered the implications of `be ff ff ff ff` setting `esi` to `-1`.

I considered the `task_struct` layout at one point, but then tried to search for the specific byte sequence in the kernel. This also failed. I tried searching for function references, such as `__wait_event_common` to find the related code.

The `-1` value for `esi` made me think of `schedule_timeout`, but then I realized that the argument should be in `rsi`. Then I realized that `0xffffffff` corresponds to a very large number of jiffies and it made me consider what function took an `int` with a value of `-1`. I tried `wait_for_completion_interruptible_timeout`, but the argument was `long`. I considered if the code might have been related to `io_uring` based on the context of the `test r13d, r13d` instruction.

I was focusing on `mov [rsp+8], rbx` being a function prologue. The `jz +0x233` instruction suggested a large conditional block. I tried to search for the whole byte sequence to locate the code but failed.

I considered `trace_...` functions based on the code at the end of the snippet, and whether it may be from an inline wrapper.

I was getting nowhere with these ideas, so I considered where `45 85 ed 0f 84 33 02 00 00` may be used. I tried to look for where `jz +0x233` and other functions are used.

I then revisited the entire `Code:` line, breaking it down instruction by instruction and trying to determine the logic, especially with the calls. I noted that `mov r13d, eax` could mean that the `test r13d, r13d` uses the return value of some prior call. Then, I considered that maybe the `rbx+0x18` parameter in the earlier call could be `24` in a `task_struct`.

map[Name:task_struct]

map[Fields:[map[Name:thread_info OffsetBits:0 SizeBits:192] map[Name:__state OffsetBits:192 SizeBits:32] map[Name:saved_state OffsetBits:224 SizeBits:32] map[Name:stack OffsetBits:256 SizeBits:64] map[Name:usage OffsetBits:320 SizeBits:32] map[Name:flags OffsetBits:352 SizeBits:32] map[Name:ptrace OffsetBits:384 SizeBits:32] map[Name:on_cpu OffsetBits:416 SizeBits:32] map[Name:wake_entry OffsetBits:448 SizeBits:128] map[Name:wakee_flips OffsetBits:576 SizeBits:32] map[Name:wakee_flip_decay_ts OffsetBits:640 SizeBits:64] map[Name:last_wakee OffsetBits:704 SizeBits:64] map[Name:recent_used_cpu OffsetBits:768 SizeBits:32] map[Name:wake_cpu OffsetBits:800 SizeBits:32] map[Name:on_rq OffsetBits:832 SizeBits:32] map[Name:prio OffsetBits:864 SizeBits:32] map[Name:static_prio OffsetBits:896 SizeBits:32] map[Name:normal_prio OffsetBits:928 SizeBits:32] map[Name:rt_priority OffsetBits:960 SizeBits:32] map[Name:se OffsetBits:1024 SizeBits:2560] map[Name:rt OffsetBits:3584 SizeBits:384] map[Name:dl OffsetBits:3968 SizeBits:2176] map[Name:dl_server OffsetBits:6144 SizeBits:64] map[Name:sched_class OffsetBits:6208 SizeBits:64] map[Name:sched_task_group OffsetBits:6272 SizeBits:64] map[Name:sched_throttle_work OffsetBits:6336 SizeBits:128] map[Name:throttle_node OffsetBits:6464 SizeBits:128] map[Name:throttled OffsetBits:6592 SizeBits:8] map[Name:stats OffsetBits:6656 SizeBits:2048] map[Name:policy OffsetBits:8704 SizeBits:32] map[Name:max_allowed_capacity OffsetBits:8768 SizeBits:64] map[Name:nr_cpus_allowed OffsetBits:8832 SizeBits:32] map[Name:cpus_ptr OffsetBits:8896 SizeBits:64] map[Name:user_cpus_ptr OffsetBits:8960 SizeBits:64] map[Name:cpus_mask OffsetBits:9024 SizeBits:64] map[Name:migration_pending OffsetBits:9088 SizeBits:64] map[Name:migration_disabled OffsetBits:9152 SizeBits:16] map[Name:migration_flags OffsetBits:9168 SizeBits:16] map[Name:rcu_read_lock_nesting OffsetBits:9184 SizeBits:32] map[Name:rcu_read_unlock_special OffsetBits:9216 SizeBits:32] map[Name:rcu_node_entry OffsetBits:9280 SizeBits:128] map[Name:rcu_blocked_node OffsetBits:9408 SizeBits:64] map[Name:rcu_tasks_nvcsw OffsetBits:9472 SizeBits:64] map[Name:rcu_tasks_holdout OffsetBits:9536 SizeBits:8] map[Name:rcu_tasks_idx OffsetBits:9544 SizeBits:8] map[Name:rcu_tasks_idle_cpu OffsetBits:9568 SizeBits:32] map[Name:rcu_tasks_holdout_list OffsetBits:9600 SizeBits:128] map[Name:rcu_tasks_exit_cpu OffsetBits:9728 SizeBits:32] map[Name:rcu_tasks_exit_list OffsetBits:9792 SizeBits:128] map[Name:trc_reader_nesting OffsetBits:9920 SizeBits:32] map[Name:trc_reader_scp OffsetBits:9984 SizeBits:64] map[Name:sched_info OffsetBits:10048 SizeBits:512] map[Name:tasks OffsetBits:10560 SizeBits:128] map[Name:pushable_tasks OffsetBits:10688 SizeBits:320] map[Name:pushable_dl_tasks OffsetBits:11008 SizeBits:192] map[Name:mm OffsetBits:11200 SizeBits:64] map[Name:active_mm OffsetBits:11264 SizeBits:64] map[Name:exit_state OffsetBits:11328 SizeBits:32] map[Name:exit_code OffsetBits:11360 SizeBits:32] map[Name:exit_signal OffsetBits:11392 SizeBits:32] map[Name:pdeath_signal OffsetBits:11424 SizeBits:32] map[Name:jobctl OffsetBits:11456 SizeBits:64] map[Name:personality OffsetBits:11520 SizeBits:32] map[Name:sched_reset_on_fork OffsetBits:11552 SizeBits:1] map[Name:sched_contributes_to_load OffsetBits:11553 SizeBits:1] map[Name:sched_migrated OffsetBits:11554 SizeBits:1] map[Name:sched_task_hot OffsetBits:11555 SizeBits:1] map[Name: OffsetBits:11584 SizeBits:0] map[Name:sched_remote_wakeup OffsetBits:11584 SizeBits:1] map[Name:sched_rt_mutex OffsetBits:11585 SizeBits:1] map[Name:user_dumpable OffsetBits:11586 SizeBits:1] map[Name:in_execve OffsetBits:11587 SizeBits:1] map[Name:in_iowait OffsetBits:11588 SizeBits:1] map[Name:restore_sigmask OffsetBits:11589 SizeBits:1] map[Name:no_cgroup_migration OffsetBits:11590 SizeBits:1] map[Name:frozen OffsetBits:11591 SizeBits:1] map[Name:use_memdelay OffsetBits:11592 SizeBits:1] map[Name:in_memstall OffsetBits:11593 SizeBits:1] map[Name:in_page_owner OffsetBits:11594 SizeBits:1] map[Name:in_eventfd OffsetBits:11595 SizeBits:1] map[Name:reported_split_lock OffsetBits:11596 SizeBits:1] map[Name:in_nf_duplicate OffsetBits:11597 SizeBits:1] map[Name:atomic_flags OffsetBits:11648 SizeBits:64] map[Name:restart_block OffsetBits:11712 SizeBits:448] map[Name:pid OffsetBits:12160 SizeBits:32] map[Name:tgid OffsetBits:12192 SizeBits:32] map[Name:stack_canary OffsetBits:12224 SizeBits:64] map[Name:real_parent OffsetBits:12288 SizeBits:64] map[Name:parent OffsetBits:12352 SizeBits:64] map[Name:children OffsetBits:12416 SizeBits:128] map[Name:sibling OffsetBits:12544 SizeBits:128] map[Name:group_leader OffsetBits:12672 SizeBits:64] map[Name:ptraced OffsetBits:12736 SizeBits:128] map[Name:ptrace_entry OffsetBits:12864 SizeBits:128] map[Name:thread_pid OffsetBits:12992 SizeBits:64] map[Name:pid_links OffsetBits:13056 SizeBits:512] map[Name:thread_node OffsetBits:13568 SizeBits:128] map[Name:vfork_done OffsetBits:13696 SizeBits:64] map[Name:set_child_tid OffsetBits:13760 SizeBits:64] map[Name:clear_child_tid OffsetBits:13824 SizeBits:64] map[Name:worker_private OffsetBits:13888 SizeBits:64] map[Name:utime OffsetBits:13952 SizeBits:64] map[Name:stime OffsetBits:14016 SizeBits:64] map[Name:gtime OffsetBits:14080 SizeBits:64] map[Name:prev_cputime OffsetBits:14144 SizeBits:640] map[Name:vtime OffsetBits:14784 SizeBits:704] map[Name:nvcsw OffsetBits:15488 SizeBits:64] map[Name:nivcsw OffsetBits:15552 SizeBits:64] map[Name:start_time OffsetBits:15616 SizeBits:64] map[Name:start_boottime OffsetBits:15680 SizeBits:64] map[Name:min_flt OffsetBits:15744 SizeBits:64] map[Name:maj_flt OffsetBits:15808 SizeBits:64] map[Name:posix_cputimers OffsetBits:15872 SizeBits:640] map[Name:posix_cputimers_work OffsetBits:16512 SizeBits:1280] map[Name:ptracer_cred OffsetBits:17792 SizeBits:64] map[Name:real_cred OffsetBits:17856 SizeBits:64] map[Name:cred OffsetBits:17920 SizeBits:64] map[Name:cached_requested_key OffsetBits:17984 SizeBits:64] map[Name:comm OffsetBits:18048 SizeBits:128] map[Name:nameidata OffsetBits:18176 SizeBits:64] map[Name:sysvsem OffsetBits:18240 SizeBits:64] map[Name:sysvshm OffsetBits:18304 SizeBits:128] map[Name:last_switch_count OffsetBits:18432 SizeBits:64] map[Name:last_switch_time OffsetBits:18496 SizeBits:64] map[Name:fs OffsetBits:18560 SizeBits:64] map[Name:files OffsetBits:18624 SizeBits:64] map[Name:io_uring OffsetBits:18688 SizeBits:64] map[Name:io_uring_restrict OffsetBits:18752 SizeBits:64] map[Name:nsproxy OffsetBits:18816 SizeBits:64] map[Name:signal OffsetBits:18880 SizeBits:64] map[Name:sighand OffsetBits:18944 SizeBits:64] map[Name:blocked OffsetBits:19008 SizeBits:64] map[Name:real_blocked OffsetBits:19072 SizeBits:64] map[Name:saved_sigmask OffsetBits:19136 SizeBits:64] map[Name:pending OffsetBits:19200 SizeBits:192] map[Name:sas_ss_sp OffsetBits:19392 SizeBits:64] map[Name:sas_ss_size OffsetBits:19456 SizeBits:64] map[Name:sas_ss_flags OffsetBits:19520 SizeBits:32] map[Name:task_works OffsetBits:19584 SizeBits:64] map[Name:audit_context OffsetBits:19648 SizeBits:64] map[Name:loginuid OffsetBits:19712 SizeBits:32] map[Name:sessionid OffsetBits:19744 SizeBits:32] map[Name:seccomp OffsetBits:19776 SizeBits:128] map[Name:syscall_dispatch OffsetBits:19904 SizeBits:256] map[Name:parent_exec_id OffsetBits:20160 SizeBits:64] map[Name:self_exec_id OffsetBits:20224 SizeBits:64] map[Name:alloc_lock OffsetBits:20288 SizeBits:512] map[Name:pi_lock OffsetBits:20800 SizeBits:512] map[Name:wake_q OffsetBits:21312 SizeBits:64] map[Name:pi_waiters OffsetBits:21376 SizeBits:128] map[Name:pi_top_task OffsetBits:21504 SizeBits:64] map[Name:pi_blocked_on OffsetBits:21568 SizeBits:64] map[Name:blocked_on OffsetBits:21632 SizeBits:64] map[Name:blocked_lock OffsetBits:21696 SizeBits:512] map[Name:blocker OffsetBits:22208 SizeBits:64] map[Name:non_block_count OffsetBits:22272 SizeBits:32] map[Name:irqtrace OffsetBits:22336 SizeBits:448] map[Name:hardirq_threaded OffsetBits:22784 SizeBits:32] map[Name:hardirq_chain_key OffsetBits:22848 SizeBits:64] map[Name:softirqs_enabled OffsetBits:22912 SizeBits:32] map[Name:softirq_context OffsetBits:22944 SizeBits:32] map[Name:irq_config OffsetBits:22976 SizeBits:32] map[Name:curr_chain_key OffsetBits:23040 SizeBits:64] map[Name:lockdep_depth OffsetBits:23104 SizeBits:32] map[Name:lockdep_recursion OffsetBits:23136 SizeBits:32] map[Name:held_locks OffsetBits:23168 SizeBits:15360] map[Name:in_ubsan OffsetBits:38528 SizeBits:32] map[Name:journal_info OffsetBits:38592 SizeBits:64] map[Name:bio_list OffsetBits:38656 SizeBits:64] map[Name:plug OffsetBits:38720 SizeBits:64] map[Name:reclaim_state OffsetBits:38784 SizeBits:64] map[Name:io_context OffsetBits:38848 SizeBits:64] map[Name:capture_control OffsetBits:38912 SizeBits:64] map[Name:ptrace_message OffsetBits:38976 SizeBits:64] map[Name:last_siginfo OffsetBits:39040 SizeBits:64] map[Name:ioac OffsetBits:39104 SizeBits:448] map[Name:psi_flags OffsetBits:39552 SizeBits:32] map[Name:acct_rss_mem1 OffsetBits:39616 SizeBits:64] map[Name:acct_vm_mem1 OffsetBits:39680 SizeBits:64] map[Name:acct_timexpd OffsetBits:39744 SizeBits:64] map[Name:mems_allowed OffsetBits:39808 SizeBits:64] map[Name:mems_allowed_seq OffsetBits:39872 SizeBits:448] map[Name:cpuset_mem_spread_rotor OffsetBits:40320 SizeBits:32] map[Name:cgroups OffsetBits:40384 SizeBits:64] map[Name:cg_list OffsetBits:40448 SizeBits:128] map[Name:robust_list OffsetBits:40576 SizeBits:64] map[Name:pi_state_list OffsetBits:40640 SizeBits:128] map[Name:pi_state_cache OffsetBits:40768 SizeBits:64] map[Name:futex_exit_mutex OffsetBits:40832 SizeBits:1088] map[Name:futex_state OffsetBits:41920 SizeBits:32] map[Name:perf_recursion OffsetBits:41952 SizeBits:32] map[Name:perf_event_ctxp OffsetBits:41984 SizeBits:64] map[Name:perf_event_mutex OffsetBits:42048 SizeBits:1088] map[Name:perf_event_list OffsetBits:43136 SizeBits:128] map[Name:perf_ctx_data OffsetBits:43264 SizeBits:64] map[Name:preempt_disable_ip OffsetBits:43328 SizeBits:64] map[Name:mempolicy OffsetBits:43392 SizeBits:64] map[Name:il_prev OffsetBits:43456 SizeBits:16] map[Name:il_weight OffsetBits:43472 SizeBits:8] map[Name:pref_node_fork OffsetBits:43488 SizeBits:16] map[Name:numa_scan_seq OffsetBits:43520 SizeBits:32] map[Name:numa_scan_period OffsetBits:43552 SizeBits:32] map[Name:numa_scan_period_max OffsetBits:43584 SizeBits:32] map[Name:numa_preferred_nid OffsetBits:43616 SizeBits:32] map[Name:numa_migrate_retry OffsetBits:43648 SizeBits:64] map[Name:node_stamp OffsetBits:43712 SizeBits:64] map[Name:last_task_numa_placement OffsetBits:43776 SizeBits:64] map[Name:last_sum_exec_runtime OffsetBits:43840 SizeBits:64] map[Name:numa_work OffsetBits:43904 SizeBits:128] map[Name:numa_group OffsetBits:44032 SizeBits:64] map[Name:numa_faults OffsetBits:44096 SizeBits:64] map[Name:total_numa_faults OffsetBits:44160 SizeBits:64] map[Name:numa_faults_locality OffsetBits:44224 SizeBits:192] map[Name:numa_pages_migrated OffsetBits:44416 SizeBits:64] map[Name:rseq OffsetBits:44480 SizeBits:320] map[Name:mm_cid OffsetBits:44800 SizeBits:192] map[Name:tlb_ubc OffsetBits:44992 SizeBits:192] map[Name:splice_pipe OffsetBits:45184 SizeBits:64] map[Name:task_frag OffsetBits:45248 SizeBits:128] map[Name:make_it_fail OffsetBits:45376 SizeBits:32] map[Name:fail_nth OffsetBits:45408 SizeBits:32] map[Name:nr_dirtied OffsetBits:45440 SizeBits:32] map[Name:nr_dirtied_pause OffsetBits:45472 SizeBits:32] map[Name:dirty_paused_when OffsetBits:45504 SizeBits:64] map[Name:timer_slack_ns OffsetBits:45568 SizeBits:64] map[Name:default_timer_slack_ns OffsetBits:45632 SizeBits:64] map[Name:kasan_depth OffsetBits:45696 SizeBits:32] map[Name:trace_recursion OffsetBits:45760 SizeBits:64] map[Name:kcov_mode OffsetBits:45824 SizeBits:32] map[Name:kcov_size OffsetBits:45856 SizeBits:32] map[Name:kcov_area OffsetBits:45888 SizeBits:64] map[Name:kcov OffsetBits:45952 SizeBits:64] map[Name:kcov_handle OffsetBits:46016 SizeBits:64] map[Name:kcov_sequence OffsetBits:46080 SizeBits:32] map[Name:kcov_softirq OffsetBits:46112 SizeBits:32] map[Name:memcg_nr_pages_over_high OffsetBits:46144 SizeBits:32] map[Name:active_memcg OffsetBits:46208 SizeBits:64] map[Name:objcg OffsetBits:46272 SizeBits:64] map[Name:throttle_disk OffsetBits:46336 SizeBits:64] map[Name:sequential_io OffsetBits:46400 SizeBits:32] map[Name:sequential_io_avg OffsetBits:46432 SizeBits:32] map[Name:kmap_ctrl OffsetBits:46464 SizeBits:0] map[Name:task_state_change OffsetBits:46464 SizeBits:64] map[Name:rcu OffsetBits:46528 SizeBits:128] map[Name:rcu_users OffsetBits:46656 SizeBits:32] map[Name:pagefault_disabled OffsetBits:46688 SizeBits:32] map[Name:oom_reaper_list OffsetBits:46720 SizeBits:64] map[Name:oom_reaper_timer OffsetBits:46784 SizeBits:640] map[Name:stack_vm_area OffsetBits:47424 SizeBits:64] map[Name:stack_refcount OffsetBits:47488 SizeBits:32] map[Name:security OffsetBits:47552 SizeBits:64] map[Name:bpf_storage OffsetBits:47616 SizeBits:64] map[Name:bpf_ctx OffsetBits:47680 SizeBits:64] map[Name:bpf_net_context OffsetBits:47744 SizeBits:64] map[Name:mce_vaddr OffsetBits:47808 SizeBits:64] map[Name:mce_kflags OffsetBits:47872 SizeBits:64] map[Name:mce_addr OffsetBits:47936 SizeBits:64] map[Name:mce_ripv OffsetBits:48000 SizeBits:1] map[Name:mce_whole_page OffsetBits:48001 SizeBits:1] map[Name:__mce_reserved OffsetBits:48002 SizeBits:62] map[Name:mce_kill_me OffsetBits:48064 SizeBits:128] map[Name:mce_count OffsetBits:48192 SizeBits:32] map[Name:l1d_flush_kill OffsetBits:48256 SizeBits:128] map[Name:unwind_info OffsetBits:48384 SizeBits:320] map[Name:thread OffsetBits:48704 SizeBits:1216]]]

gemini-3-flash-preview

							input: 23200
							output: 44
							thoughts: 1062
						

**Dissecting a Code Snippet: A Journey Through Memory and Context**

Okay, so I'm looking at this bit of code, and I need to figure out what it's doing. The first thing that jumps out is `0x18`. That offset immediately sets off alarm bells, so I have to try to figure out what is at that offset.  It seems to be `lea rdi, [rbx+0x18]`, indicating an address calculation. `rbx` is the base, and I'm figuring that 0x18 is an offset into something.

My initial thought was `task_struct`, since that's a common structure, and I know the offset for the `__state` field is 192 bits (24 bytes). But wait, `__state` is just an `unsigned int`!  Why would you be taking the *address* of a simple integer? That means it's likely being passed as a pointer to a function. Perhaps `signal_pending_state`? But, no, `signal_pending_state` expects a different signature.

Let's look at the instruction sequence: `Call2`, then a move to `r13d`, `xor edi, edi`, `mov esi, eax`, then `Call3`. So, `Call2` is likely returning a value that is then being passed to `Call3` with zero as the first argument. Is this a scheduling call? Probably not `trace_sched_switch` from what I see.

Okay, let's back up. Maybe `rbx` *isn't* a `task_struct`. What about a `wait_queue_head`? Its structure starts with a spinlock and a `list_head`, which I know from memory are a total of 20 bytes. That's not right. 

Let's try a different tack. I can look for the sequence itself. I'm looking for the `lea rdi, [rbx+0x18]`, `mov esi, -1`, then a `call` instruction, followed by the `mov r13d, eax`, `xor edi, edi`, `mov esi, eax`, and the final `call`.

Okay, the `xor edi, edi` and `mov esi, eax` part suggests a function call where the arguments are `(0, eax)`. Where `eax` is the return value of the previous call. Let's try some function possibilities... nope.

Okay, back to square one. `48 8d 7b 18` is `lea rdi, [rbx+0x18]`. What if `rbx` is a `struct hrtimer_sleeper`?  It has a `struct hrtimer timer` at the beginning, which is large. What's at offset 0x18 in that struct?

Aha! `struct kiocb`! `ki_ioprio` is at offset 24 (0x18) and it is an `unsigned short`. So `lea rdi, [rbx+0x18]` is the address of `kiocb->ki_ioprio`.

I'll check the structure of `struct io_kiocb` again. Hmmm.

Hang on... I see a pattern. The presence of `e8 ... 45 85 ed 0f 84 ...` looks like something like `mutex_lock` slow path. But the `lea rdi, [rbx+0x18]` is still very specific.

I can't assemble this mentally, so, I will attempt to apply some tools in my mental inventory... I'll look for functions and definitions in my codebase. Maybe an `io_uring` function like `io_cqring_wait`?

Now, let's look at `io_cqring_wait` in `io_uring/io_uring.c`. I have a feeling I'm close.

map[ContextFile:io_uring/io_uring.c IncludeLines:true Name:io_cqring_wait]

map[SourceCode: 185:	/*
 186:	 * Wait until events become available, if we don't already have some. The
 187:	 * application must reap them itself, as they reside on the shared cq ring.
 188:	 */
 189:	int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, u32 flags,
 190:			   struct ext_arg *ext_arg)
 191:	{
 192:		struct io_wait_queue iowq;
 193:		struct io_rings *rings;
 194:		ktime_t start_time;
 195:		int ret, nr_wait;
 196:	
 197:		min_events = min_t(int, min_events, ctx->cq_entries);
 198:	
 199:		if (!io_allowed_run_tw(ctx))
 200:			return -EEXIST;
 201:		if (io_local_work_pending(ctx))
 202:			io_run_local_work(ctx, min_events,
 203:					  max(IO_LOCAL_TW_DEFAULT_MAX, min_events));
 204:		io_run_task_work();
 205:	
 206:		if (unlikely(test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq)))
 207:			io_cqring_do_overflow_flush(ctx);
 208:	
 209:		rcu_read_lock();
 210:		rings = io_get_rings(ctx);
 211:		if (__io_cqring_events_user(ctx) >= min_events) {
 212:			rcu_read_unlock();
 213:			return 0;
 214:		}
 215:	
 216:		init_waitqueue_func_entry(&iowq.wq, io_wake_function);
 217:		iowq.wq.private = current;
 218:		INIT_LIST_HEAD(&iowq.wq.entry);
 219:		iowq.ctx = ctx;
 220:		iowq.cq_tail = READ_ONCE(rings->cq.head) + min_events;
 221:		iowq.cq_min_tail = READ_ONCE(rings->cq.tail);
 222:		nr_wait = (int) iowq.cq_tail - READ_ONCE(rings->cq.tail);
 223:		rcu_read_unlock();
 224:		rings = NULL;
 225:		iowq.nr_timeouts = atomic_read(&ctx->cq_timeouts);
 226:		iowq.hit_timeout = 0;
 227:		iowq.min_timeout = ext_arg->min_time;
 228:		iowq.timeout = KTIME_MAX;
 229:		start_time = io_get_time(ctx);
 230:	
 231:		if (ext_arg->ts_set) {
 232:			iowq.timeout = timespec64_to_ktime(ext_arg->ts);
 233:			if (flags & IORING_ENTER_ABS_TIMER)
 234:				iowq.timeout = timens_ktime_to_host(ctx->clockid,
 235:								    iowq.timeout);
 236:			else
 237:				iowq.timeout = ktime_add(iowq.timeout, start_time);
 238:		}
 239:	
 240:		if (ext_arg->sig) {
 241:	#ifdef CONFIG_COMPAT
 242:			if (in_compat_syscall())
 243:				ret = set_compat_user_sigmask((const compat_sigset_t __user *)ext_arg->sig,
 244:							      ext_arg->argsz);
 245:			else
 246:	#endif
 247:				ret = set_user_sigmask(ext_arg->sig, ext_arg->argsz);
 248:	
 249:			if (ret)
 250:				return ret;
 251:		}
 252:	
 253:		io_napi_busy_loop(ctx, &iowq);
 254:	
 255:		trace_io_uring_cqring_wait(ctx, min_events);
 256:		do {
 257:			unsigned long check_cq;
 258:	
 259:			if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) {
 260:				atomic_set(&ctx->cq_wait_nr, nr_wait);
 261:				set_current_state(TASK_INTERRUPTIBLE);
 262:			} else {
 263:				prepare_to_wait_exclusive(&ctx->cq_wait, &iowq.wq,
 264:								TASK_INTERRUPTIBLE);
 265:			}
 266:	
 267:			ret = io_cqring_wait_schedule(ctx, &iowq, ext_arg, start_time);
 268:			__set_current_state(TASK_RUNNING);
 269:			atomic_set(&ctx->cq_wait_nr, IO_CQ_WAKE_INIT);
 270:	
 271:			/*
 272:			 * Run task_work after scheduling and before io_should_wake().
 273:			 * If we got woken because of task_work being processed, run it
 274:			 * now rather than let the caller do another wait loop.
 275:			 */
 276:			if (io_local_work_pending(ctx))
 277:				io_run_local_work(ctx, nr_wait, nr_wait);
 278:			io_run_task_work();
 279:	
 280:			/*
 281:			 * Non-local task_work will be run on exit to userspace, but
 282:			 * if we're using DEFER_TASKRUN, then we could have waited
 283:			 * with a timeout for a number of requests. If the timeout
 284:			 * hits, we could have some requests ready to process. Ensure
 285:			 * this break is _after_ we have run task_work, to avoid
 286:			 * deferring running potentially pending requests until the
 287:			 * next time we wait for events.
 288:			 */
 289:			if (ret < 0)
 290:				break;
 291:	
 292:			check_cq = READ_ONCE(ctx->check_cq);
 293:			if (unlikely(check_cq)) {
 294:				/* let the caller flush overflows, retry */
 295:				if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT))
 296:					io_cqring_do_overflow_flush(ctx);
 297:				if (check_cq & BIT(IO_CHECK_CQ_DROPPED_BIT)) {
 298:					ret = -EBADR;
 299:					break;
 300:				}
 301:			}
 302:	
 303:			if (io_should_wake(&iowq)) {
 304:				ret = 0;
 305:				break;
 306:			}
 307:			cond_resched();
 308:	
 309:			/* if min timeout has been hit, don't reset wait count */
 310:			if (!iowq.hit_timeout)
 311:				scoped_guard(rcu)
 312:					nr_wait = (int) iowq.cq_tail -
 313:							READ_ONCE(io_get_rings(ctx)->cq.tail);
 314:			else
 315:				nr_wait = 1;
 316:		} while (1);
 317:	
 318:		if (!(ctx->flags & IORING_SETUP_DEFER_TASKRUN))
 319:			finish_wait(&ctx->cq_wait, &iowq.wq);
 320:		restore_saved_sigmask_unless(ret == -EINTR);
 321:	
 322:		guard(rcu)();
 323:		return READ_ONCE(io_get_rings(ctx)->cq.head) == READ_ONCE(io_get_rings(ctx)->cq.tail) ? ret : 0;
 324:	}
 SourceFile:io_uring/wait.c]

gemini-3-flash-preview

							input: 27522
							output: 44
							thoughts: 282
						

**Analyzing the `io_uring/wait.c` file**

Okay, so I'm digging into `io_uring/wait.c` because something isn't quite clicking. Let's start by revisiting the `io_cqring_wait_schedule` function.

Right, the key lines of code here are: `e8 ce a2 21 0a` (Call2), then `41 89 c5` (mov r13d, eax), `31 ff` (xor edi, edi), `89 c6` (mov esi, eax), and finally `e8 d2 fd 11 00` (Call3).

Hmm... let's break that down.  `xor edi, edi` and `mov esi, eax` paired together usually translates to `Call3(0, res)`. I need to figure out the purpose of `Call3`. It seems like I'm looking for a function that takes two integer arguments and is called after a schedule operation completes. `signal_pending` doesn't quite fit.

Wait a minute... I remember seeing `restore_saved_sigmask_unless(ret == -EINTR)` around line 320. That seems relevant. And it's an inline or a macro! `restore_saved_sigmask_unless` calls `restore_saved_sigmask()` if the condition is false. Now, let's go look at the definition of `restore_saved_sigmask_unless`. Something seems to be connecting here...

map[ContextFile:io_uring/wait.c IncludeLines:true Name:restore_saved_sigmask_unless]

map[SourceCode: 549:	static inline void restore_saved_sigmask_unless(bool interrupted)
 550:	{
 551:		if (interrupted)
 552:			WARN_ON(!signal_pending(current));
 553:		else
 554:			restore_saved_sigmask();
 555:	}
 SourceFile:include/linux/sched/signal.h]

gemini-3-flash-preview

							input: 28301
							output: 25
							thoughts: 879
						

**Deconstructing the IO Completion Queue Wait Logic**

Okay, let's break this down piece by piece. First, I noticed the potential confusion with the signal mask restoration. It's `__restore_saved_sigmask()`, not `set_restore_sigmask()` as I initially thought. Good to clarify that.

Now, focusing on the code sequence, I see `e8 d2 fd 11 00` which is a `Call3`, followed by `test r13d, r13d` and a conditional jump `jz +0x233`.  The significance hinges on the value of `r13d`. If `r13d` is the return value, then the `jz` instruction is executed only if it's zero.

The key is that `io_cqring_wait` returns `ret`. Looking at line 323, it confirms that the function returns `ret` only if there are no completion queue entries, otherwise it returns 0.

Let's trace the execution flow:

`Call1`, `test r13d`, `mov [rsp+8], rbx`, `jz ...`, `lea rdi, [rbx+0x18]`, `mov esi, -1`, and then `Call2`, followed by `mov r13d, eax`, `xor edi, edi`, `mov esi, eax`, and finally, the `Call3` and another `test r13d` instruction.

My hunch is that `Call2` is `io_cqring_wait_schedule`, and based on the arguments to `Call3` – `0` and the return value of `Call2` – it is `Call3(0, res)`. This indicates that the `Call2` which is `io_cqring_wait_schedule` function is being followed.

Now, comparing this to `io_cqring_wait` implementation in the kernel, it is confirmed that `__set_current_state(TASK_RUNNING)` and `atomic_set(&ctx->cq_wait_nr, IO_CQ_WAKE_INIT)` calls are made after `io_cqring_wait_schedule`. Also, the function `io_run_local_work` is called, with the arguments `ctx, nr_wait, nr_wait`.

The key is in the `xor edi, edi` and `mov esi, eax` instructions. That's a `func(0, eax)` call where `eax` is the return value. This suggests a potential `restore_saved_sigmask_unless(ret == -EINTR)`. However, there's no comparison of `eax` with `-4` (the value for `EINTR`). The code does not compare `eax` with `EINTR`, so this theory does not hold.

I'll search for the sequence `45 85 ed 48 89 5c 24 08 74 2a` looking for `__mutex_lock_slowpath`, or similar. Let's see if that helps to clarify the call sequence and argument interpretation. I'll use `codesearch-find-references` to do this.

log-in to see details

map[Name:__mutex_lock_slowpath]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 29923
							output: 22
							thoughts: 28
						

Okay, here's my interpretation of those thoughts, presented as a summary:

**Digging into a Mutex Lock**

Right, so I'm suspecting the issue centers around a mutex lock. The function name that's coming to mind is `__mutex_lock`. Let me just double-check that by looking at the core implementation. I should probably head straight to `kernel/locking/mutex.c` to see how it's actually implemented. That's the best place to get the details I need.

map[Dir:kernel/locking/]

map[Files:[irqflag-debug.c lock_events.c lock_events.h lock_events_list.h lockdep.c lockdep_internals.h lockdep_proc.c lockdep_states.h locktorture.c mcs_spinlock.h mutex-debug.c mutex.c mutex.h osq_lock.c percpu-rwsem.c qrwlock.c qspinlock.c qspinlock.h qspinlock_paravirt.h qspinlock_stat.h rtmutex.c rtmutex_api.c rtmutex_common.h rwbase_rt.c rwsem.c semaphore.c spinlock.c spinlock_debug.c spinlock_rt.c test-ww_mutex.c ww_mutex.h ww_rt_mutex.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 30362
							output: 26
							thoughts: 14
						

Here's my take on the kernel's mutex implementation, from a seasoned perspective:

**Diving Deep into the Heart of Mutual Exclusion**

Alright, let's crack open `kernel/locking/mutex.c` and see what makes these mutexes tick. I want to understand the *why* as much as the *how*, so I'm thinking about the low-level mechanics and the implications for real-world concurrency issues. This isn't just about reading code; it's about seeing the *intent* behind the design choices.

First, I need to focus on the data structures. The `struct mutex` itself is probably pretty lean, focusing on an owner, a wait queue, and maybe some state flags. I'm guessing they're leveraging a clever mix of atomic operations and lock-free techniques where possible, perhaps using compare-and-swap or similar primitives to minimize contention. I need to look closely at how the wait queue is managed. Is it a simple linked list, or are they using a more sophisticated data structure like a priority queue to handle fairness or priority inheritance? How is this queue managed to avoid any race conditions?

Then, the acquisition and release paths are crucial. I imagine `mutex_lock()` will have a fast path for uncontended cases, just a simple atomic exchange or test-and-set. For contention, it's gotta involve placing the current task on the wait queue, and perhaps sleeping or yielding the CPU until the mutex becomes available. And the "wakeup" side of things, in `mutex_unlock()`, must be carefully crafted to avoid any lost wakeup issues. It needs to wake up *one* waiter, and it has to be done atomically. Is it using a spinlock around the queue manipulation to keep things safe? Or is there some more subtle way to do it?

I need to see how they handle recursive locking, and whether that is supported. Also, the handling of priority inheritance is a key area. How do they avoid priority inversion problems where a high-priority task can get blocked indefinitely by a lower-priority task holding the mutex? Is there a mechanism to temporarily boost the priority of the lower-priority task? I'm betting that's probably implemented here.

Finally, I'll be looking for any clever optimizations or special handling for different CPU architectures. Are there any platform-specific tricks, like using atomic instructions or lock elision techniques available on certain processors? I expect there will be lots of assembly-level code here that has been meticulously tuned for performance. I am also curious about the debugging and instrumentation. Are there any debug flags or tracing facilities to help identify mutex contention and performance bottlenecks?

This has the potential to be a fascinating exploration. Let's see what the kernel folks have come up with.

map[SourceFile:kernel/locking/mutex.c]

map[Entities:[map[Kind:function Name:__mutex_add_waiter] map[Kind:function Name:__mutex_clear_flag] map[Kind:function Name:__mutex_handoff] map[Kind:function Name:__mutex_init_generic] map[Kind:function Name:__mutex_lock] map[Kind:function Name:__mutex_lock_common] map[Kind:function Name:__mutex_remove_waiter] map[Kind:function Name:__mutex_set_flag] map[Kind:function Name:__mutex_trylock] map[Kind:function Name:__mutex_trylock_common] map[Kind:function Name:__mutex_trylock_or_handoff] map[Kind:function Name:__mutex_trylock_or_owner] map[Kind:function Name:__mutex_unlock_slowpath] map[Kind:function Name:__owner_flags] map[Kind:function Name:__owner_task] map[Kind:function Name:__ww_mutex_lock] map[Kind:function Name:_mutex_lock_killable] map[Kind:function Name:_mutex_lock_nest_lock] map[Kind:function Name:_mutex_trylock_nest_lock] map[Kind:function Name:atomic_dec_and_mutex_lock] map[Kind:function Name:mutex_can_spin_on_owner] map[Kind:function Name:mutex_get_owner] map[Kind:function Name:mutex_init_lockdep] map[Kind:function Name:mutex_is_locked] map[Kind:function Name:mutex_lock_interruptible_nested] map[Kind:function Name:mutex_lock_io_nested] map[Kind:function Name:mutex_lock_nested] map[Kind:function Name:mutex_optimistic_spin] map[Kind:function Name:mutex_spin_on_owner] map[Kind:function Name:mutex_unlock] map[Kind:function Name:ww_mutex_deadlock_injection] map[Kind:function Name:ww_mutex_lock] map[Kind:function Name:ww_mutex_lock_interruptible] map[Kind:function Name:ww_mutex_spin_on_owner] map[Kind:function Name:ww_mutex_trylock] map[Kind:function Name:ww_mutex_unlock] map[Kind:global_variable Name:__UNIQUE_ID_addressable___SCK__tp_func_contention_begin_589] map[Kind:global_variable Name:__UNIQUE_ID_addressable___SCK__tp_func_contention_end_593] map[Kind:global_variable Name:__UNIQUE_ID_addressable___SCT__tp_func_contention_begin_590] map[Kind:global_variable Name:__UNIQUE_ID_addressable___SCT__tp_func_contention_end_594] map[Kind:global_variable Name:__UNIQUE_ID_addressable___traceiter_contention_begin_588] map[Kind:global_variable Name:__UNIQUE_ID_addressable___traceiter_contention_end_592] map[Kind:global_variable Name:__UNIQUE_ID_addressable___tracepoint_contention_begin_587] map[Kind:global_variable Name:__UNIQUE_ID_addressable___tracepoint_contention_end_591] map[Kind:global_variable Name:__UNIQUE_ID_addressable__mutex_lock_killable_578] map[Kind:global_variable Name:__UNIQUE_ID_addressable__mutex_lock_nest_lock_577] map[Kind:global_variable Name:__UNIQUE_ID_addressable__mutex_trylock_nest_lock_586] map[Kind:global_variable Name:__UNIQUE_ID_addressable_atomic_dec_and_mutex_lock_595] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mutex_init_lockdep_555] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mutex_is_locked_553] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mutex_lock_interruptible_nested_579] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mutex_lock_io_nested_580] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mutex_lock_nested_576] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mutex_unlock_568] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ww_mutex_lock_581] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ww_mutex_lock_interruptible_582] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ww_mutex_trylock_575] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ww_mutex_unlock_569] map[Kind:global_variable Name:__trace_check_contention_begin] map[Kind:global_variable Name:__trace_check_contention_end]]]

gemini-3-flash-preview

							input: 32378
							output: 42
							thoughts: 13
						

Okay, let's dive into this. Here's my take on those thoughts, as if they're my own:

**Analyzing `__mutex_lock_common`**

Alright, I'm focusing in on `__mutex_lock_common`. This is a critical function, the bedrock of our mutex implementation. I need to understand its mechanics inside and out. It's the point where contention really begins to manifest, and where efficiency gains or bottlenecks will become most apparent. I'm thinking about the various architectural implications: the atomic operations used, the spin-waiting vs. sleep strategy decisions, and how this common code path is optimized for the typical, uncontended case. I know from experience that micro-optimizations here can have a macro impact on overall system performance. I need to be thinking about lock ordering, deadlock avoidance, and how this function plays with the kernel's scheduler. The goal is a deep grasp of how to identify, and fix, any potential locking issues this function could exhibit.

map[ContextFile:kernel/locking/mutex.c IncludeLines:true Name:__mutex_lock_common]

map[SourceCode: 605:	/*
 606:	 * Lock a mutex (possibly interruptible), slowpath:
 607:	 */
 608:	static __always_inline int __sched
 609:	__mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclass,
 610:			    struct lockdep_map *nest_lock, unsigned long ip,
 611:			    struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
 612:		__cond_acquires(0, lock)
 613:	{
 614:		DEFINE_WAKE_Q(wake_q);
 615:		struct mutex_waiter waiter;
 616:		struct ww_mutex *ww;
 617:		unsigned long flags;
 618:		int ret;
 619:	
 620:		if (!use_ww_ctx)
 621:			ww_ctx = NULL;
 622:	
 623:		might_sleep();
 624:	
 625:		MUTEX_WARN_ON(lock->magic != lock);
 626:	
 627:		ww = container_of(lock, struct ww_mutex, base);
 628:		if (ww_ctx) {
 629:			if (unlikely(ww_ctx == READ_ONCE(ww->ctx)))
 630:				return -EALREADY;
 631:	
 632:			/*
 633:			 * Reset the wounded flag after a kill. No other process can
 634:			 * race and wound us here since they can't have a valid owner
 635:			 * pointer if we don't have any locks held.
 636:			 */
 637:			if (ww_ctx->acquired == 0)
 638:				ww_ctx->wounded = 0;
 639:	
 640:	#ifdef CONFIG_DEBUG_LOCK_ALLOC
 641:			nest_lock = &ww_ctx->dep_map;
 642:	#endif
 643:		}
 644:	
 645:		preempt_disable();
 646:		mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip);
 647:	
 648:		trace_contention_begin(lock, LCB_F_MUTEX | LCB_F_SPIN);
 649:		if (__mutex_trylock(lock) ||
 650:		    mutex_optimistic_spin(lock, ww_ctx, NULL)) {
 651:			/* got the lock, yay! */
 652:			lock_acquired(&lock->dep_map, ip);
 653:			if (ww_ctx)
 654:				ww_mutex_set_context_fastpath(ww, ww_ctx);
 655:			trace_contention_end(lock, 0);
 656:			preempt_enable();
 657:			return 0;
 658:		}
 659:	
 660:		raw_spin_lock_irqsave(&lock->wait_lock, flags);
 661:		/*
 662:		 * After waiting to acquire the wait_lock, try again.
 663:		 */
 664:		if (__mutex_trylock(lock)) {
 665:			if (ww_ctx)
 666:				__ww_mutex_check_waiters(lock, ww_ctx, &wake_q);
 667:	
 668:			goto skip_wait;
 669:		}
 670:	
 671:		debug_mutex_lock_common(lock, &waiter);
 672:		waiter.task = current;
 673:		if (use_ww_ctx)
 674:			waiter.ww_ctx = ww_ctx;
 675:	
 676:		lock_contended(&lock->dep_map, ip);
 677:	
 678:		if (!use_ww_ctx) {
 679:			/* add waiting tasks to the end of the waitqueue (FIFO): */
 680:			__mutex_add_waiter(lock, &waiter, NULL);
 681:		} else {
 682:			/*
 683:			 * Add in stamp order, waking up waiters that must kill
 684:			 * themselves.
 685:			 */
 686:			ret = __ww_mutex_add_waiter(&waiter, lock, ww_ctx, &wake_q);
 687:			if (ret)
 688:				goto err_early_kill;
 689:		}
 690:	
 691:		raw_spin_lock(&current->blocked_lock);
 692:		__set_task_blocked_on(current, lock);
 693:		set_current_state(state);
 694:		trace_contention_begin(lock, LCB_F_MUTEX);
 695:		for (;;) {
 696:			bool first;
 697:	
 698:			/*
 699:			 * Once we hold wait_lock, we're serialized against
 700:			 * mutex_unlock() handing the lock off to us, do a trylock
 701:			 * before testing the error conditions to make sure we pick up
 702:			 * the handoff.
 703:			 */
 704:			if (__mutex_trylock(lock))
 705:				break;
 706:	
 707:			raw_spin_unlock(&current->blocked_lock);
 708:			/*
 709:			 * Check for signals and kill conditions while holding
 710:			 * wait_lock. This ensures the lock cancellation is ordered
 711:			 * against mutex_unlock() and wake-ups do not go missing.
 712:			 */
 713:			if (signal_pending_state(state, current)) {
 714:				ret = -EINTR;
 715:				goto err;
 716:			}
 717:	
 718:			if (ww_ctx) {
 719:				ret = __ww_mutex_check_kill(lock, &waiter, ww_ctx);
 720:				if (ret)
 721:					goto err;
 722:			}
 723:	
 724:			raw_spin_unlock_irqrestore_wake(&lock->wait_lock, flags, &wake_q);
 725:	
 726:			schedule_preempt_disabled();
 727:	
 728:			first = lock->first_waiter == &waiter;
 729:	
 730:			raw_spin_lock_irqsave(&lock->wait_lock, flags);
 731:			raw_spin_lock(&current->blocked_lock);
 732:			/*
 733:			 * As we likely have been woken up by task
 734:			 * that has cleared our blocked_on state, re-set
 735:			 * it to the lock we are trying to acquire.
 736:			 */
 737:			__set_task_blocked_on(current, lock);
 738:			set_current_state(state);
 739:			/*
 740:			 * Here we order against unlock; we must either see it change
 741:			 * state back to RUNNING and fall through the next schedule(),
 742:			 * or we must see its unlock and acquire.
 743:			 */
 744:			if (__mutex_trylock_or_handoff(lock, first))
 745:				break;
 746:	
 747:			if (first) {
 748:				bool opt_acquired;
 749:	
 750:				/*
 751:				 * mutex_optimistic_spin() can call schedule(), so
 752:				 * we need to release these locks before calling it,
 753:				 * and clear blocked on so we don't become unselectable
 754:				 * to run.
 755:				 */
 756:				__clear_task_blocked_on(current, lock);
 757:				raw_spin_unlock(&current->blocked_lock);
 758:				raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 759:	
 760:				trace_contention_begin(lock, LCB_F_MUTEX | LCB_F_SPIN);
 761:				opt_acquired = mutex_optimistic_spin(lock, ww_ctx, &waiter);
 762:	
 763:				raw_spin_lock_irqsave(&lock->wait_lock, flags);
 764:				raw_spin_lock(&current->blocked_lock);
 765:				__set_task_blocked_on(current, lock);
 766:	
 767:				if (opt_acquired)
 768:					break;
 769:				trace_contention_begin(lock, LCB_F_MUTEX);
 770:			}
 771:		}
 772:		__clear_task_blocked_on(current, lock);
 773:		__set_current_state(TASK_RUNNING);
 774:		raw_spin_unlock(&current->blocked_lock);
 775:	
 776:		if (ww_ctx) {
 777:			/*
 778:			 * Wound-Wait; we stole the lock (!first_waiter), check the
 779:			 * waiters as anyone might want to wound us.
 780:			 */
 781:			if (!ww_ctx->is_wait_die && lock->first_waiter != &waiter)
 782:				__ww_mutex_check_waiters(lock, ww_ctx, &wake_q);
 783:		}
 784:	
 785:		__mutex_remove_waiter(lock, &waiter);
 786:	
 787:		debug_mutex_free_waiter(&waiter);
 788:	
 789:	skip_wait:
 790:		/* got the lock - cleanup and rejoice! */
 791:		lock_acquired(&lock->dep_map, ip);
 792:		trace_contention_end(lock, 0);
 793:	
 794:		if (ww_ctx)
 795:			ww_mutex_lock_acquired(ww, ww_ctx);
 796:	
 797:		raw_spin_unlock_irqrestore_wake(&lock->wait_lock, flags, &wake_q);
 798:		preempt_enable();
 799:		return 0;
 800:	
 801:	err:
 802:		clear_task_blocked_on(current, lock);
 803:		__set_current_state(TASK_RUNNING);
 804:		__mutex_remove_waiter(lock, &waiter);
 805:	err_early_kill:
 806:		WARN_ON(get_task_blocked_on(current));
 807:		trace_contention_end(lock, ret);
 808:		raw_spin_unlock_irqrestore_wake(&lock->wait_lock, flags, &wake_q);
 809:		debug_mutex_free_waiter(&waiter);
 810:		mutex_release(&lock->dep_map, ip);
 811:		preempt_enable();
 812:		return ret;
 813:	}
 SourceFile:kernel/locking/mutex.c]

gemini-3-flash-preview

							input: 35783
							output: 19
							thoughts: 84
						

**Analyzing This Code Snippet**

Okay, this code block is fairly extensive. My initial instinct is to zero in on a specific pattern that often signals a particular operation. I'm focusing on the `lea rdi, [rbx+0x18]` sequence, paired with the subsequent `mov esi, -1`. That pairing frequently indicates some form of initialization or pointer setup, specifically around a wait lock.

Now, that `rbx+0x18` address... that’s piquing my interest. Could `rbx` be related to a mutex structure, and `+0x18` pointing to its `wait_lock` field? Seems plausible. I'm going to quickly cross-reference the `struct mutex` definition. I want to confirm the offset of that `wait_lock` member within the struct. Knowing the layout precisely will give me a better understanding of the overall purpose of this code. It's time to verify my hypothesis.

map[Name:mutex]

map[Fields:[map[Name:owner OffsetBits:0 SizeBits:64] map[Name:wait_lock OffsetBits:64 SizeBits:512] map[Name:osq OffsetBits:576 SizeBits:32] map[Name:first_waiter OffsetBits:640 SizeBits:64] map[Name:magic OffsetBits:704 SizeBits:64] map[Name:dep_map OffsetBits:768 SizeBits:320]]]

gemini-3-flash-preview

							input: 36225
							output: 41
							thoughts: 232
						

**Decoding That Memory Access**

Okay, so I'm looking at these memory offsets for this `struct mutex`, and something doesn't quite line up. I've got `wait_lock` at 8 bytes, `osq` at 72, `first_waiter` at 80... and now I see this offset of `0x18` (24 bytes) that's just hanging out, right? Seems out of place for a defined field within the mutex itself.

Wait a second... that instruction, `48 8d 7b 18`, is a `lea rdi, [rbx+0x18]`. The Register `rbx` immediately suggests `struct task_struct`, which I know like the back of my hand. And didn't I see earlier that `__state` is at 24 bytes (0x18) into the `task_struct`? Bingo! That `lea` is loading the address of `current->__state` into `rdi`.

So, what function could possibly be taking `&current->__state` and `-1` as arguments? Gotta be something important. I recall seeing that combination used with `signal_pending_state(state, current)` from line 713 (which is, obviously, often inlined for performance). I should probably go back and refresh my memory on the inline definition of that function, as that will offer more insight. This is making more sense now.

map[ContextFile:kernel/locking/mutex.c IncludeLines:true Name:signal_pending_state]

map[SourceCode: 409:	static inline int signal_pending_state(unsigned int state, struct task_struct *p)
 410:	{
 411:		if (!(state & (TASK_INTERRUPTIBLE | TASK_WAKEKILL)))
 412:			return 0;
 413:		if (!signal_pending(p))
 414:			return 0;
 415:	
 416:		return (state & TASK_INTERRUPTIBLE) || __fatal_signal_pending(p);
 417:	}
 SourceFile:include/linux/sched/signal.h]

gemini-3-flash-preview

							input: 36988
							output: 44
							thoughts: 797
						

**Deconstructing the Code**

Okay, so I'm looking at this snippet, and initially, the `lea rdi, [rbx+0x18]` and `mov esi, -1` threw me for a loop. It didn't immediately click. Let's think... that `be ff ff ff ff` is indeed `mov esi, -1`. Was that `__refrigerator(false)`? No. Let's look at the assembly...

Okay, I see these function calls: `e8 ce a2 21 0a` -> `Call2`, `41 89 c5` -> `mov r13d, eax`, `31 ff` -> `xor edi, edi`, `89 c6` -> `mov esi, eax`, `e8 d2 fd 11 00` -> `Call3`.

Aha! `xor edi, edi` and `mov esi, eax` means `Call3(0, eax)`. That `eax` is the return of `Call2`. Okay. Is `Call2` `schedule_timeout`? No, it takes a `long`.

Wait, the `lea rdi, [rbx+0x18]` is a key clue! It's `48 8d 7b 18`. If `rbx` is a `struct wait_queue_entry`, then `0x18` is an offset of 24 bytes, and `struct wait_queue_entry` has `entry` there, which is a `list_head`. So `lea rdi, [rbx+0x18]` is `&waiter->entry`.

So what function might take a `&waiter->entry` and `-1`? `list_del_init`? No, no.

Hmm... I can't use the hex string in the repo.

I can't use `codesearch-find-references` on `__SCT__tp_func_contention_begin`.

Let's look at the `Code:` again.
`ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d`

Okay, `45 85 ed` is `test r13d, r13d`. If `r13d` contains the return value... it's a conditional: `if (ret) { ... }`. So it's: `ret = Call2(&waiter->entry, -1);`, `Call3(0, ret);` and `if (ret == 0) goto ...`.

Right! `0f 84 33 02 00 00` is `jz`. If `ret == 0`, it jumps!

Aha! I think I've got it! This looks like something related to `io_uring` and waiting on the completion queue. I'll bet it's similar to `io_cqring_wait`. Let's confirm it, by looking at `io_cqring_wait_schedule` in `io_uring/wait.c`.

map[ContextFile:io_uring/wait.c IncludeLines:true Name:io_cqring_wait_schedule]

map[SourceCode: 165:	/* If this returns > 0, the caller should retry */
 166:	static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx,
 167:						  struct io_wait_queue *iowq,
 168:						  struct ext_arg *ext_arg,
 169:						  ktime_t start_time)
 170:	{
 171:		if (unlikely(READ_ONCE(ctx->check_cq)))
 172:			return 1;
 173:		if (unlikely(io_local_work_pending(ctx)))
 174:			return 1;
 175:		if (unlikely(task_work_pending(current)))
 176:			return 1;
 177:		if (unlikely(task_sigpending(current)))
 178:			return -EINTR;
 179:		if (unlikely(io_should_wake(iowq)))
 180:			return 0;
 181:	
 182:		return __io_cqring_wait_schedule(ctx, iowq, ext_arg, start_time);
 183:	}
 SourceFile:io_uring/wait.c]

gemini-3-flash-preview

							input: 38991
							output: 45
							thoughts: 16
						

Okay, let's dive into this `__io_cqring_wait_schedule` function. I need to understand this kernel function thoroughly, as it's critical for I/O completion queue management, and that's a cornerstone of high-performance storage. First, I need to remind myself of the broader context. Where does this fit within the larger I/O stack? Is it a core scheduler function, or more of a low-level completion handler?

I'm thinking about the implications for different hardware architectures. Does this function have specific optimizations for different NVMe controllers or SAS HBAs? I'll need to check the surrounding code for architecture-specific branches or inline assembly. I'm also wondering about the potential for contention. How does this function handle concurrent accesses to the completion queue? Are there spinlocks, atomic operations, or other synchronization mechanisms at play?

More specifically, I need to know the waiting mechanism. Is it a busy-wait loop, or is it more sophisticated using something like a wait queue? What are the implications in terms of CPU power consumption and overall system responsiveness? If it's a sleep-based mechanism, what's the typical timeout interval, and how is it calculated? I want to understand the trade-offs between responsiveness and efficiency.

Finally, I want to see if any of the performance counters are affected. If so, which ones? I'm anticipating that understanding the impact on counters will be key to optimizing performance. I will be looking for any hints about potential bottlenecks, and any opportunities for improvement.

map[ContextFile:io_uring/wait.c IncludeLines:true Name:__io_cqring_wait_schedule]

map[SourceCode: 143:	static int __io_cqring_wait_schedule(struct io_ring_ctx *ctx,
 144:					     struct io_wait_queue *iowq,
 145:					     struct ext_arg *ext_arg,
 146:					     ktime_t start_time)
 147:	{
 148:		int ret = 0;
 149:	
 150:		/*
 151:		 * Mark us as being in io_wait if we have pending requests, so cpufreq
 152:		 * can take into account that the task is waiting for IO - turns out
 153:		 * to be important for low QD IO.
 154:		 */
 155:		if (ext_arg->iowait && current_pending_io())
 156:			current->in_iowait = 1;
 157:		if (iowq->timeout != KTIME_MAX || iowq->min_timeout)
 158:			ret = io_cqring_schedule_timeout(iowq, ctx->clockid, start_time);
 159:		else
 160:			schedule();
 161:		current->in_iowait = 0;
 162:		return ret;
 163:	}
 SourceFile:io_uring/wait.c]

gemini-3-flash-preview

							input: 39745
							output: 37
							thoughts: 1504
						

**Dissecting This Code Snippet**

Okay, this code isn't immediately obvious. It doesn't seem to fit any known pattern, so I need to carefully disassemble it. Let's start from the top again and break it down instruction by instruction.

Right, the `e8` calls are key. The proximity of `e8 d2 fd 11 00` and `e8 f6 fd 11 00` suggests they're likely calls to similar functions, potentially related to tracing. The differences are small, hinting at possible `trace_...` calls. But wait, these are direct calls, not conditional ones. That's unusual. It's also not `__fentry__`, the location is wrong.

Now, let me look at the `lea rdi, [rbx+0x18]` and `mov esi, -1` instructions. If `rbx` is a `wait_queue_entry`, then `0x18` makes sense but I have other thoughts about this. If `rbx` represents a mutex, 24 bytes could refer to a member within the wait lock. And if the value is negative one, then that translates to a timeout value.

Ah, I remember that `schedule_timeout(-1)` is actually `schedule_timeout(MAX_SCHEDULE_TIMEOUT)`! That resolves the `-1` issue. However, I still need to understand what type of timeout this refers to.

I'll search the kernel for the byte sequence `48 8d 7b 18 be ff ff ff ff` around `mutex_lock`. No luck, that's a dead end.

I'm going to revisit the disassembly. The `test r13d, r13d` and conditional jumps are important. `r13d` might be `ret`, so we have an `if (ret) {...}` structure. It looks like we're doing something like `ret = Call2(rbx+0x18, -1);` and then `Call3(0, ret);` with a conditional based on the return value.

Now, `Call3(0, ret)`... This looks very similar to tracing, particularly `trace_sched_stat_wait(current, ret)`. But wait, that takes a `struct task_struct *p`, but `0` is probably not the current task!

How about `trace_contention_end(lock, ret)`? That takes `(void *lock, int ret)`. I've got `xor edi, edi` and then `mov esi, eax`. The `0` could be assigned to a lock. I need to be careful with the register assignments, and compare this to `kernel/locking/mutex.c` line 807 where `trace_contention_end(lock, ret)` might appear.

If `rbx` is the lock, then `lea rdi, [rbx+0x18]` is `&lock->something`. But what is at offset `0x18` within `struct mutex`? I need to check the current version of the structure. I'm checking different offsets, but I'm looking at an old version of the `struct mutex`. I need to consult the most recent source code. Let's see...

map[ContextFile:include/linux/mutex.h IncludeLines:true Name:mutex]

map[SourceCode:  13:	/*
  14:	 * Simple, straightforward mutexes with strict semantics:
  15:	 *
  16:	 * - only one task can hold the mutex at a time
  17:	 * - only the owner can unlock the mutex
  18:	 * - multiple unlocks are not permitted
  19:	 * - recursive locking is not permitted
  20:	 * - a mutex object must be initialized via the API
  21:	 * - a mutex object must not be initialized via memset or copying
  22:	 * - task may not exit with mutex held
  23:	 * - memory areas where held locks reside must not be freed
  24:	 * - held mutexes must not be reinitialized
  25:	 * - mutexes may not be used in hardware or software interrupt
  26:	 *   contexts such as tasklets and timers
  27:	 *
  28:	 * These semantics are fully enforced when DEBUG_MUTEXES is
  29:	 * enabled. Furthermore, besides enforcing the above rules, the mutex
  30:	 * debugging code also implements a number of additional features
  31:	 * that make lock debugging easier and faster:
  32:	 *
  33:	 * - uses symbolic names of mutexes, whenever they are printed in debug output
  34:	 * - point-of-acquire tracking, symbolic lookup of function names
  35:	 * - list of all locks held in the system, printout of them
  36:	 * - owner tracking
  37:	 * - detects self-recursing locks and prints out all relevant info
  38:	 * - detects multi-task circular deadlocks and prints out all affected
  39:	 *   locks and tasks (and only those tasks)
  40:	 */
  41:	context_lock_struct(mutex) {
  42:		atomic_long_t		owner;
  43:		raw_spinlock_t		wait_lock;
  44:	#ifdef CONFIG_MUTEX_SPIN_ON_OWNER
  45:		struct optimistic_spin_queue osq; /* Spinner MCS lock */
  46:	#endif
  47:		struct mutex_waiter	*first_waiter __guarded_by(&wait_lock);
  48:	#ifdef CONFIG_DEBUG_MUTEXES
  49:		void			*magic;
  50:	#endif
  51:	#ifdef CONFIG_DEBUG_LOCK_ALLOC
  52:		struct lockdep_map	dep_map;
  53:	#endif
  54:	};
 SourceFile:include/linux/mutex_types.h]

gemini-3-flash-preview

							input: 42662
							output: 22
							thoughts: 299
						

**Dissecting the Mutex Structure**

Okay, let's break down this mutex structure. My initial assumptions were based on standard x86_64 conventions, but let's be precise. I see `owner` as an `atomic_long_t`, so that's 8 bytes—standard for a 64-bit architecture, naturally. The `wait_lock` is a `raw_spinlock_t`, which, on x86_64, usually clocks in at 4 bytes. `osq`, a `struct optimistic_spin_queue`, is an `atomic_t`, so another 4 bytes. And `first_waiter` is a pointer, another 8 bytes in this 64-bit context.

So, adding it up, we have: `owner (8) + wait_lock (4) + osq (4) + first_waiter (8) = 24 bytes`. Now, the instruction `lea rdi, [rbx+0x18]` – that's 0x18, or 24 decimal, offset from `rbx`, which likely points to the mutex. That implies the member at this offset must be the "magic" number I am seeing.

However, the real puzzle is: Why would anyone take the *address* of something like "magic"? Perhaps my initial assumption about "magic" being the correct field is incorrect. What's the context here?

Aha! `CONFIG_MUTEX_SPIN_ON_OWNER` can change things; if that's *not* defined, then the `osq` field is actually *not* present, so we're starting with a different structure size! Further, if `CONFIG_DEBUG_MUTEXES` isn't defined, then the "magic" value I'm looking at isn't there, either! That complicates the memory layout.

Wait a moment, I think I'm onto something. If `CONFIG_DEBUG_LOCK_ALLOC` *is* defined, then the `dep_map` is there! And I know that thing can be *quite* large. I need to get the full picture of `struct lockdep_map` to understand the true size implications of this. I have to see how that affects the structure.

map[Name:lockdep_map]

map[Fields:[map[Name:key OffsetBits:0 SizeBits:64] map[Name:class_cache OffsetBits:64 SizeBits:128] map[Name:name OffsetBits:192 SizeBits:64] map[Name:wait_type_outer OffsetBits:256 SizeBits:8] map[Name:wait_type_inner OffsetBits:264 SizeBits:8] map[Name:lock_type OffsetBits:272 SizeBits:8]]]

gemini-3-flash-preview

							input: 43611
							output: 24
							thoughts: 1039
						

**Dissecting the Assembly: A Mutex Locking Mystery**

Okay, let's break this down. First, I'm noting the structure of `lockdep_map`. Key, class cache, name – that's 40 bytes total. If `dep_map` sits at offset 24, as it seems, then the instruction `lea rdi, [rbx+0x18]` is definitely pointing to `&lock->dep_map`.  We have owner, wait_lock, osq, first_waiter and *then* the `dep_map` at offset 24, which aligns with the conditions: `CONFIG_MUTEX_SPIN_ON_OWNER` and *no* `CONFIG_DEBUG_MUTEXES`.

So, `rdi` is confirmed as `&lock->dep_map`.  The next clue is the `-1`, or `0xffffffff`. I need to figure out what function takes `&lock->dep_map` and a value that could be interpreted as `-1`.

My mind jumps to `mutex_acquire_nest`, but the `subclass` argument seems unlikely to be `-1` - that wouldn't make sense.  Then, I remember the more general `lock_acquire` with its plethora of arguments: a `struct lockdep_map`, an `unsigned int subclass`, the trylock/read/check flags, and a nested lock.

Looking back at the assembly... `Call2` seems interesting. We only see `rdi` and `esi` being set: `rdi` as our `&lock->dep_map` and `esi` as `-1`. This strongly suggests that our function must take exactly those two arguments: `(lockdep_map*, int)`.  I started looking into tracepoint calls.

`trace_contention_begin(lock, flags)` seems a possibility with a `(void *lock, unsigned int flags)` structure. However, the `flags` being -1 would not hold true.

So, I decided to focus on searching for the key byte sequence `48 8d 7b 18 be ff ff ff ff e8` that contains the `lea rdi, [rbx+0x18]` and `mov esi, -1` sequences. Searching for references to `__mutex_lock` directly seems difficult.

Maybe, the call comes from `__mutex_lock_common` in `kernel/locking/mutex.c`. But `trace_contention_begin` uses `LCB_F_MUTEX | LCB_F_SPIN` (1 | 2 = 3), not -1. So, that's not it.

Okay, let's rethink that `-1`... Could it *actually* be something other than -1 in a 64-bit context? Yes, `0xffffffff` is a large positive value in 64-bit.

I'll try to find the target of the `Call2` instruction. If the offset is `0x0a21a2ce`, that's huge!  It's likely a call to something not in this current code section - a tracepoint or a function in a different part of the kernel.

I'll change tack and search for the byte sequence that precedes that call, `45 85 ed 48 89 5c 24 08 74 2a`, using `codesearch-find-references` on `mutex_optimistic_spin`. Let's see if that gets us anywhere.

map[Name:mutex_optimistic_spin]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__mutex_lock_common SourceFile:kernel/locking/mutex.c SourceLine:650] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__mutex_lock_common SourceFile:kernel/locking/mutex.c SourceLine:761]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 45568
							output: 21
							thoughts: 622
						

**Analyzing the Mutex Lock and Optimistic Spin**

Okay, let's dive into this `__mutex_lock_common` function, specifically around line 761. I see `trace_contention_begin` there, which I know is a macro. It expands to check `trace_contention_begin_enabled` and then the actual tracepoint. This looks like a static branch, so I should keep that in mind.

I'm examining the assembly code now. The snippet has `ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d`. `45 85 ed` catches my eye; it's `test r13d, r13d`. If `r13d` is `opt_acquired`, then that `if (opt_acquired) break;` on line 767 makes perfect sense.

So, the `Call2` instruction I see, could that be `mutex_optimistic_spin`? The function signature is `(struct mutex *lock, struct ww_acquire_ctx *ww_ctx, struct mutex_waiter *waiter)`. The arguments are passed via registers: `rdi = lock`, `rsi = ww_ctx`, and `rdx = waiter`. However, looking at the snippet, I see `rdi = rbx + 0x18`, `rsi = -1`, and then `Call2`. That doesn't match the expected argument passing for `mutex_optimistic_spin`. `rsi = -1` makes no sense.

Okay, let's re-evaluate. Could `Call2` be `trace_contention_begin` instead? That function takes `(struct mutex *lock, LCB_F_MUTEX | LCB_F_SPIN)` or `(rdi = lock, rsi = 3)`. Still, the immediate operand `be ff ff ff ff` doesn't fit with this function either.

Alright, I'll switch gears and try a different approach. I'll search for the instruction sequence `48 8d 7b 18 be ff ff ff ff`. Perhaps the `rbx` register holds a `struct rw_semaphore` instance? It would make sense given the arguments. Time to check the layout of `struct rw_semaphore`... This should give me some clues as to what's going on!

map[Name:rw_semaphore]

map[Fields:[map[Name:count OffsetBits:0 SizeBits:64] map[Name:owner OffsetBits:64 SizeBits:64] map[Name:osq OffsetBits:128 SizeBits:32] map[Name:wait_lock OffsetBits:192 SizeBits:512] map[Name:first_waiter OffsetBits:704 SizeBits:64] map[Name:magic OffsetBits:768 SizeBits:64] map[Name:dep_map OffsetBits:832 SizeBits:320]]]

gemini-3-flash-preview

							input: 47016
							output: 27
							thoughts: 119
						

**Analyzing the Read-Write Semaphore Lock**

Okay, let's break this down. I'm seeing `count`, `owner`, and `osq` showing up frequently, eight times and four times respectively. Right, so `wait_lock` is at 192 bits – that's 24 bytes, or `0x18` in hex. Makes sense. Therefore, the instruction `lea rdi, [rbx+0x18]` is effectively getting the address of `rwsem->wait_lock`.

Now, the question is, what function is being called, passing the address of that `wait_lock` and a value of `-1`? The binary representation `be ff ff ff ff` immediately tells me this is the value `-1`. Let's confirm with the source.

Okay, time to consult `kernel/locking/rwsem.c`. That's where the read-write semaphore implementation should be. Let's see what that address and value are for.

map[SourceFile:kernel/locking/rwsem.c]

map[Entities:[map[Kind:function Name:__down_read] map[Kind:function Name:__down_read_common] map[Kind:function Name:__down_read_interruptible] map[Kind:function Name:__down_read_killable] map[Kind:function Name:__down_read_trylock] map[Kind:function Name:__down_write] map[Kind:function Name:__down_write_common] map[Kind:function Name:__down_write_killable] map[Kind:function Name:__down_write_trylock] map[Kind:function Name:__downgrade_write] map[Kind:function Name:__init_rwsem] map[Kind:function Name:__rwsem_del_waiter] map[Kind:function Name:__rwsem_set_reader_owned] map[Kind:function Name:__up_read] map[Kind:function Name:__up_write] map[Kind:function Name:_down_write_nest_lock] map[Kind:function Name:clear_nonspinnable] map[Kind:function Name:down_read] map[Kind:function Name:down_read_interruptible] map[Kind:function Name:down_read_killable] map[Kind:function Name:down_read_killable_nested] map[Kind:function Name:down_read_nested] map[Kind:function Name:down_read_non_owner] map[Kind:function Name:down_read_trylock] map[Kind:function Name:down_write] map[Kind:function Name:down_write_killable] map[Kind:function Name:down_write_killable_nested] map[Kind:function Name:down_write_nested] map[Kind:function Name:down_write_trylock] map[Kind:function Name:downgrade_write] map[Kind:function Name:is_rwsem_reader_owned] map[Kind:function Name:next_waiter] map[Kind:function Name:rwsem_can_spin_on_owner] map[Kind:function Name:rwsem_clear_owner] map[Kind:function Name:rwsem_clear_reader_owned] map[Kind:function Name:rwsem_cond_wake_waiter] map[Kind:function Name:rwsem_del_waiter] map[Kind:function Name:rwsem_del_wake_waiter] map[Kind:function Name:rwsem_down_read_slowpath] map[Kind:function Name:rwsem_down_write_slowpath] map[Kind:function Name:rwsem_downgrade_wake] map[Kind:function Name:rwsem_mark_wake] map[Kind:function Name:rwsem_optimistic_spin] map[Kind:function Name:rwsem_owner] map[Kind:function Name:rwsem_owner_flags] map[Kind:function Name:rwsem_owner_state] map[Kind:function Name:rwsem_read_trylock] map[Kind:function Name:rwsem_rspin_threshold] map[Kind:function Name:rwsem_set_nonspinnable] map[Kind:function Name:rwsem_set_owner] map[Kind:function Name:rwsem_set_reader_owned] map[Kind:function Name:rwsem_spin_on_owner] map[Kind:function Name:rwsem_test_oflags] map[Kind:function Name:rwsem_try_write_lock] map[Kind:function Name:rwsem_try_write_lock_unqueued] map[Kind:function Name:rwsem_wake] map[Kind:function Name:rwsem_write_trylock] map[Kind:function Name:up_read] map[Kind:function Name:up_read_non_owner] map[Kind:function Name:up_write] map[Kind:struct Name:rwsem_waiter] map[Kind:global_variable Name:__UNIQUE_ID_addressable___init_rwsem_334] map[Kind:global_variable Name:__UNIQUE_ID_addressable__down_write_nest_lock_364] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_352] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_interruptible_353] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_killable_354] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_killable_nested_363] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_nested_362] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_non_owner_365] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_read_trylock_355] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_write_356] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_write_killable_357] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_write_killable_nested_367] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_write_nested_366] map[Kind:global_variable Name:__UNIQUE_ID_addressable_down_write_trylock_358] map[Kind:global_variable Name:__UNIQUE_ID_addressable_downgrade_write_361] map[Kind:global_variable Name:__UNIQUE_ID_addressable_up_read_359] map[Kind:global_variable Name:__UNIQUE_ID_addressable_up_read_non_owner_369] map[Kind:global_variable Name:__UNIQUE_ID_addressable_up_write_360] map[Kind:enum Name:owner_state] map[Kind:enum Name:rwsem_waiter_type] map[Kind:enum Name:rwsem_wake_type]]]

gemini-3-flash-preview

							input: 49055
							output: 46
							thoughts: 16
						

Okay, let's dive into this `rwsem_down_write_slowpath` function. I've seen this before, and it's always interesting to see how the kernel handles the write semaphore when things aren't straightforward. My immediate thought is, "Ah, the slow path... gotta be some contention or a special case involved here." I need to understand what triggers this specific path and what it's trying to achieve. Is this about blocking, spinning, or some form of fairness guarantee?

I immediately start thinking about potential scenarios: Are there existing readers holding the semaphore? Are there writers waiting ahead of me? Is there a priority boost somewhere? I need to analyze how it differentiates from the fast path, what the actual *symptoms* are that land it here. My experience tells me that slow paths frequently handle edge cases, error conditions, or situations demanding more complex resource management. Perhaps there's an attempt at deadlock prevention or starvation avoidance within. I'll need to look at the surrounding code to determine the exact conditions, and how its data structures are impacted.

map[ContextFile:kernel/locking/rwsem.c IncludeLines:true Name:rwsem_down_write_slowpath]

map[SourceCode:1135:	/*
1136:	 * Wait until we successfully acquire the write lock
1137:	 */
1138:	static struct rw_semaphore __sched *
1139:	rwsem_down_write_slowpath(struct rw_semaphore *sem, int state)
1140:	{
1141:		struct rwsem_waiter waiter, *first;
1142:		DEFINE_WAKE_Q(wake_q);
1143:	
1144:		/* do optimistic spinning and steal lock if possible */
1145:		if (rwsem_can_spin_on_owner(sem) && rwsem_optimistic_spin(sem)) {
1146:			/* rwsem_optimistic_spin() implies ACQUIRE on success */
1147:			return sem;
1148:		}
1149:	
1150:		/*
1151:		 * Optimistic spinning failed, proceed to the slowpath
1152:		 * and block until we can acquire the sem.
1153:		 */
1154:		waiter.task = current;
1155:		waiter.type = RWSEM_WAITING_FOR_WRITE;
1156:		waiter.timeout = jiffies + RWSEM_WAIT_TIMEOUT;
1157:		waiter.handoff_set = false;
1158:	
1159:		raw_spin_lock_irq(&sem->wait_lock);
1160:	
1161:		first = sem->first_waiter;
1162:		if (first) {
1163:			list_add_tail(&waiter.list, &first->list);
1164:			rwsem_cond_wake_waiter(sem, atomic_long_read(&sem->count),
1165:					       &wake_q);
1166:			if (!wake_q_empty(&wake_q)) {
1167:				/*
1168:				 * We want to minimize wait_lock hold time especially
1169:				 * when a large number of readers are to be woken up.
1170:				 */
1171:				raw_spin_unlock_irq(&sem->wait_lock);
1172:				wake_up_q(&wake_q);
1173:				raw_spin_lock_irq(&sem->wait_lock);
1174:			}
1175:		} else {
1176:			INIT_LIST_HEAD(&waiter.list);
1177:			sem->first_waiter = &waiter;
1178:			atomic_long_or(RWSEM_FLAG_WAITERS, &sem->count);
1179:		}
1180:	
1181:		/* wait until we successfully acquire the lock */
1182:		set_current_state(state);
1183:		trace_contention_begin(sem, LCB_F_WRITE);
1184:	
1185:		if (state == TASK_UNINTERRUPTIBLE)
1186:			hung_task_set_blocker(sem, BLOCKER_TYPE_RWSEM_WRITER);
1187:	
1188:		for (;;) {
1189:			if (rwsem_try_write_lock(sem, &waiter)) {
1190:				/* rwsem_try_write_lock() implies ACQUIRE on success */
1191:				break;
1192:			}
1193:	
1194:			raw_spin_unlock_irq(&sem->wait_lock);
1195:	
1196:			if (signal_pending_state(state, current))
1197:				goto out_nolock;
1198:	
1199:			/*
1200:			 * After setting the handoff bit and failing to acquire
1201:			 * the lock, attempt to spin on owner to accelerate lock
1202:			 * transfer. If the previous owner is a on-cpu writer and it
1203:			 * has just released the lock, OWNER_NULL will be returned.
1204:			 * In this case, we attempt to acquire the lock again
1205:			 * without sleeping.
1206:			 */
1207:			if (waiter.handoff_set) {
1208:				enum owner_state owner_state;
1209:	
1210:				owner_state = rwsem_spin_on_owner(sem);
1211:				if (owner_state == OWNER_NULL)
1212:					goto trylock_again;
1213:			}
1214:	
1215:			schedule_preempt_disabled();
1216:			lockevent_inc(rwsem_sleep_writer);
1217:			set_current_state(state);
1218:	trylock_again:
1219:			raw_spin_lock_irq(&sem->wait_lock);
1220:		}
1221:	
1222:		if (state == TASK_UNINTERRUPTIBLE)
1223:			hung_task_clear_blocker();
1224:	
1225:		__set_current_state(TASK_RUNNING);
1226:		raw_spin_unlock_irq(&sem->wait_lock);
1227:		lockevent_inc(rwsem_wlock);
1228:		trace_contention_end(sem, 0);
1229:		return sem;
1230:	
1231:	out_nolock:
1232:		__set_current_state(TASK_RUNNING);
1233:		raw_spin_lock_irq(&sem->wait_lock);
1234:		rwsem_del_wake_waiter(sem, &waiter, &wake_q);
1235:		lockevent_inc(rwsem_wlock_fail);
1236:		trace_contention_end(sem, -EINTR);
1237:		return ERR_PTR(-EINTR);
1238:	}
 SourceFile:kernel/locking/rwsem.c]

gemini-3-flash-preview

							input: 50962
							output: 19
							thoughts: 858
						

**Dissecting a Kernel Code Snippet**

Okay, so I'm looking at this assembly and it's not immediately clicking. The initial instructions, specifically `lea rdi, [rbx+0x18]` and `mov esi, -1`, aren't quite lining up with my expectations. Time to dig deeper. I'll start by searching the kernel source for that byte sequence `48 8d 7b 18 be ff ff ff ff e8`. I'll use `codesearch-find-references` on `schedule_timeout`, just to get a broader context.

Hang on... I should analyze `schedule_timeout` assembly directly, maybe there's something to glean there.

Aha! That `be ff ff ff ff` is a dead giveaway: `mov esi, -1`. My initial hunch about this being related to timeout is likely correct. Could this be `schedule_timeout(MAX_SCHEDULE_TIMEOUT)`? Let's see... `MAX_SCHEDULE_TIMEOUT` is, of course, `0x7fffffffffffffff`, but `be ff ff ff ff` is a 32-bit `0xffffffff`. Ah, right, that's `-1`. If the function expects an `int`, `-1` is correct. If it's a `long`, then it would be `0x00000000ffffffff`.

Eureka! I think I've got something. I've found a sequence! I'm seeing `e8 ce a2 21 0a` which is `Call2`, followed by `41 89 c5` which is `mov r13d, eax`, then `31 ff` for `xor edi, edi`, and finally, `89 c6` which is `mov esi, eax`. And finally `e8 d2 fd 11 00` which is `Call3`.

This looks like `Call3(0, ret)` where `ret` is the return value of `Call2`. My gut says that this must be `trace_contention_end(sem, ret)`. If `edi` is zero, then `sem` is NULL. That's interesting, this suggests contention tracing is possibly being called with a NULL lock!

I need to see the conditional. Now, I should look for `45 85 ed 0f 84 33 02 00 00`, which is `test r13d, r13d`, and then `jz +0x233`.

Oh wait, I've already done that search! Right, I was using `codesearch-find-references` with `__mutex_lock_common` and I already tried the `test r13d, r13d` sequence.

Okay, let's go back and look at the `Code:` line again, and walk through it. I see `ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d`.

Hmm, this `e8 84 f9 11 00` and `e8 7d f9 11 00` are close, just 7 bytes different! And `eb 05` is `jmp +5`. This is likely a simple `if (condition) func1(); else func2();` pattern. The fact that the two calls are so close indicates that `func1` and `func2` are close in memory, and that's a common pattern with tracing.

I'll try searching for `48 8d 7b 18 be ff ff ff ff`, that should help define what `rbx` is. Perhaps `rbx` is a `struct socket`? That seems like a logical next step - I should check the `struct socket` layout and see if the offset at `0x18` makes sense.

map[Name:socket]

map[Fields:[map[Name:state OffsetBits:0 SizeBits:32] map[Name:type OffsetBits:32 SizeBits:16] map[Name:flags OffsetBits:64 SizeBits:64] map[Name:file OffsetBits:128 SizeBits:64] map[Name:sk OffsetBits:192 SizeBits:64] map[Name:ops OffsetBits:256 SizeBits:64] map[Name:wq OffsetBits:512 SizeBits:1024]]]

gemini-3-flash-preview

							input: 52970
							output: 810
							thoughts: 62910
						

gemini-3.1-pro-preview

							input: 34610
							output: 43
							thoughts: 233
						

**Dissecting a Potential Code Issue**

Okay, here's what's going through my mind as I analyze this code snippet. I initially saw `out dx, al` being represented as `ee`. My first thought was, "That's odd, `ee` *is* the opcode for `out dx, al`." But then I wondered if there's a potential prefix or a multi-byte instruction sequence, so I looked into it. Specifically, is `ee` part of a longer instruction like `... ee e8 ...`? Perhaps the `ee` is a remnant.

Then, I shifted my focus to `__remove_hrtimer`. I recall it has `lockdep_assert_held(&cpu_base->lock);`, so I want to make sure I'm following the proper lock discipline. I need to make sure I'm grasping the intent of this function. I'll read it one more time.

```c
	if (!timer->is_queued)
		return;

	/* Pairs with the lockless read in hrtimer_is_queued() */
	WRITE_ONCE(timer->is_queued, newstate);

	was_first = !timerqueue_linked_prev(&timer->node);

	if (!timerqueue_linked_del(&base->active, &timer->node))
		cpu_base->active_bases &= ~(1 << base->index);
```

Okay, I see the conditional checks and the `WRITE_ONCE` usage. It seems like the core operation here is related to `timerqueue_linked_del`.

Given the surrounding context, I suspect the issue could be within `timerqueue_linked_del`. I'll delve deeper into the implementation of `timerqueue_linked_del` and examine its definition in `include/linux/timerqueue.h`. This feels like the right place to focus my investigation.

map[ContextFile:include/linux/timerqueue.h IncludeLines:true Name:timerqueue_linked_del]

map[SourceCode:  63:	static __always_inline
  64:	bool timerqueue_linked_del(struct timerqueue_linked_head *head, struct timerqueue_linked_node *node)
  65:	{
  66:		return rb_erase_linked(&node->node, &head->rb_root);
  67:	}
 SourceFile:include/linux/timerqueue.h]

gemini-3.1-pro-preview

							input: 35408
							output: 39
							thoughts: 57
						

Here's my summary, as though I'm thinking through this process:

**Diving into Timer Queue Deletion**

Okay, hold on a second. I thought `timerqueue_linked_del` was the one that ultimately called `rb_erase_linked`, but now I'm getting a flash that it's actually `timerqueue_del` that handles the red-black tree removal via `rb_erase_cached`. I need to confirm this before I go any further. Let me just double-check that by heading straight over to `lib/timerqueue.c` and digging into the source code for the `timerqueue_del` function. Gotta make sure I'm on the right track before assuming anything. Gotta stay sharp!

map[ContextFile:lib/timerqueue.c IncludeLines:true Name:timerqueue_del]

map[SourceCode:  44:	/**
  45:	 * timerqueue_del - Removes a timer from the timerqueue.
  46:	 *
  47:	 * @head: head of timerqueue
  48:	 * @node: timer node to be removed
  49:	 *
  50:	 * Removes the timer node from the timerqueue. Returns true if the queue is
  51:	 * not empty after the remove.
  52:	 */
  53:	bool timerqueue_del(struct timerqueue_head *head, struct timerqueue_node *node)
  54:	{
  55:		WARN_ON_ONCE(RB_EMPTY_NODE(&node->node));
  56:	
  57:		rb_erase_cached(&node->node, &head->rb_root);
  58:		RB_CLEAR_NODE(&node->node);
  59:	
  60:		return !RB_EMPTY_ROOT(&head->rb_root.rb_root);
  61:	}
 SourceFile:lib/timerqueue.c]

gemini-3.1-pro-preview

							input: 35943
							output: 41
							thoughts: 292
						

**Delving into Timerqueue Functions**

Okay, first thought: Hang on, where *is* `timerqueue_linked_del`? I was sure I saw it in `lib/timerqueue.c`, but it's not there. Oh, right, it's more likely in `kernel/time/hrtimer.c`, isn't it? Let me just double-check… hmm, `timerqueue_del` or `timerqueue_linked_del`? Wait, is `timerqueue_linked_del` even a *standard* function? That feels off.

Let me just quickly verify in `kernel/time/hrtimer.c`… Aha! Line 1155 says: `if (!timerqueue_del(&base->active, &timer->node))`. Okay, that's interesting.

My previous codesearch for `__remove_hrtimer` seemed to show… let me check that... Ah, no, it showed:
```c
1153:		was_first = !timerqueue_linked_prev(&timer->node);
1154:	
1155:		if (!timerqueue_linked_del(&base->active, &timer->node))
1156:			cpu_base->active_bases &= ~(1 << base->index);
```
Wait, *wait* a second.  I'm seeing `timerqueue_linked_del` again. Is this a custom implementation or something I'm missing? That function truly doesn't seem to exist in the standard kernel headers, so maybe it's a recent change? Let's go look at `timerqueue_del` in `include/linux/timerqueue.h` to see how it's handled.

map[ContextFile:include/linux/timerqueue.h IncludeLines:true Name:timerqueue_del]

map[SourceCode:  44:	/**
  45:	 * timerqueue_del - Removes a timer from the timerqueue.
  46:	 *
  47:	 * @head: head of timerqueue
  48:	 * @node: timer node to be removed
  49:	 *
  50:	 * Removes the timer node from the timerqueue. Returns true if the queue is
  51:	 * not empty after the remove.
  52:	 */
  53:	bool timerqueue_del(struct timerqueue_head *head, struct timerqueue_node *node)
  54:	{
  55:		WARN_ON_ONCE(RB_EMPTY_NODE(&node->node));
  56:	
  57:		rb_erase_cached(&node->node, &head->rb_root);
  58:		RB_CLEAR_NODE(&node->node);
  59:	
  60:		return !RB_EMPTY_ROOT(&head->rb_root.rb_root);
  61:	}
 SourceFile:lib/timerqueue.c]

gemini-3.1-pro-preview

							input: 36937
							output: 23
							thoughts: 33
						

Here's my thought process, summarized as you requested:

**Navigating the Timer Queue Implementation**

Okay, so I'm looking at `timerqueue_del`, and it's telling me that this function, which is crucial for removing timers from the queue, resides within `lib/timerqueue.c`. That's the first key piece of information. Now, to understand the function's declaration, data structures, and the overall API for timer queue manipulation, the next logical step is to dive into the header file. I need to examine `include/linux/timerqueue.h`. This is where I'll find the structures involved, the function prototypes, and any associated macros or inline functions that I need to be aware of to fully grasp how this timer queue implementation works. That header will give me the building blocks to understand how these timers are managed.

map[File:include/linux/timerqueue.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _LINUX_TIMERQUEUE_H
#define _LINUX_TIMERQUEUE_H

#include <linux/rbtree.h>
#include <linux/timerqueue_types.h>

bool timerqueue_add(struct timerqueue_head *head, struct timerqueue_node *node);
bool timerqueue_del(struct timerqueue_head *head, struct timerqueue_node *node);
struct timerqueue_node *timerqueue_iterate_next(struct timerqueue_node *node);

bool timerqueue_linked_add(struct timerqueue_linked_head *head, struct timerqueue_linked_node *node);

/**
 * timerqueue_getnext - Returns the timer with the earliest expiration time
 *
 * @head: head of timerqueue
 *
 * Returns a pointer to the timer node that has the earliest expiration time.
 */
static inline struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head)
{
	struct rb_node *leftmost = rb_first_cached(&head->rb_root);

	return rb_entry_safe(leftmost, struct timerqueue_node, node);
}

static inline void timerqueue_init(struct timerqueue_node *node)
{
	RB_CLEAR_NODE(&node->node);
}

static inline bool timerqueue_node_queued(struct timerqueue_node *node)
{
	return !RB_EMPTY_NODE(&node->node);
}

static inline void timerqueue_init_head(struct timerqueue_head *head)
{
	head->rb_root = RB_ROOT_CACHED;
}

/* Timer queues with linked nodes */

static __always_inline
struct timerqueue_linked_node *timerqueue_linked_first(struct timerqueue_linked_head *head)
{
	return rb_entry_safe(head->rb_root.rb_leftmost, struct timerqueue_linked_node, node);
}

static __always_inline
struct timerqueue_linked_node *timerqueue_linked_next(struct timerqueue_linked_node *node)
{
	return rb_entry_safe(node->node.next, struct timerqueue_linked_node, node);
}

static __always_inline
struct timerqueue_linked_node *timerqueue_linked_prev(struct timerqueue_linked_node *node)
{
	return rb_entry_safe(node->node.prev, struct timerqueue_linked_node, node);
}

static __always_inline
bool timerqueue_linked_del(struct timerqueue_linked_head *head, struct timerqueue_linked_node *node)
{
	return rb_erase_linked(&node->node, &head->rb_root);
}

static __always_inline void timerqueue_linked_init(struct timerqueue_linked_node *node)
{
	RB_CLEAR_LINKED_NODE(&node->node);
}

static __always_inline bool timerqueue_linked_node_queued(struct timerqueue_linked_node *node)
{
	return !RB_EMPTY_LINKED_NODE(&node->node);
}

static __always_inline void timerqueue_linked_init_head(struct timerqueue_linked_head *head)
{
	head->rb_root = RB_ROOT_LINKED;
}

#endif /* _LINUX_TIMERQUEUE_H */
]

gemini-3.1-pro-preview

							input: 37973
							output: 42
							thoughts: 50
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the Timer Queue Deletion Mechanism**

Alright, so `timerqueue_linked_del` is the culprit. That function is clearly calling `rb_erase_linked`, interesting. I need to get a better handle on the actual implementation of the red-black tree deletion being used here. My first instinct is to dig into the details of `rb_erase_linked`. Given that it's a core data structure operation, the definition will either be in `include/linux/rbtree.h` for inline optimization or `lib/rbtree.c` for a more general implementation. I'll check both locations to see where the core logic resides and examine it closely. This is a critical point to understand for performance or potential race conditions.

map[ContextFile:include/linux/rbtree.h IncludeLines:true Name:rb_erase_linked]

map[SourceCode: 449:	bool rb_erase_linked(struct rb_node_linked *node, struct rb_root_linked *root)
 450:	{
 451:		if (node->prev)
 452:			node->prev->next = node->next;
 453:		else
 454:			root->rb_leftmost = node->next;
 455:	
 456:		if (node->next)
 457:			node->next->prev = node->prev;
 458:	
 459:		rb_erase(&node->node, &root->rb_root);
 460:		RB_CLEAR_LINKED_NODE(node);
 461:	
 462:		return !!root->rb_leftmost;
 463:	}
 SourceFile:lib/rbtree.c]

gemini-3.1-pro-preview

							input: 38479
							output: 38
							thoughts: 38
						

Here's my summary, as the thought process unfolds:

**Examining the Red-Black Tree Erase Implementation**

Okay, so I'm digging into how the red-black tree's erase function is implemented, specifically within the Ruby standard library. The trace shows a call to `rb_erase_linked`, so I need to find its definition. Right, it's telling me it's located in `lib/rbtree.c`. That makes sense; it's a core data structure implementation. Now, the next logical step is to analyze the `rb_erase` function itself. I need to understand its control flow, the cases it handles (node color, parent-child relationships, rebalancing operations), and any special considerations for linked nodes as hinted by `rb_erase_linked`. Let's get to the source code and start tracing the logic!

map[ContextFile:lib/rbtree.c IncludeLines:true Name:rb_erase]

map[SourceCode: 440:	void rb_erase(struct rb_node *node, struct rb_root *root)
 441:	{
 442:		struct rb_node *rebalance;
 443:		rebalance = __rb_erase_augmented(node, root, &dummy_callbacks);
 444:		if (rebalance)
 445:			____rb_erase_color(rebalance, root, dummy_rotate);
 446:	}
 SourceFile:lib/rbtree.c]

gemini-3.1-pro-preview

							input: 38885
							output: 46
							thoughts: 1725
						

**Analyzing a Kernel Bug: BPF, Locks, and Assembly**

Okay, so I'm looking at this crash in `__remove_hrtimer`, and the first thing that jumps out is that it's holding `cpu_base->lock`. That's important.  I need to figure out why CPU 1 seems stuck in `rb_erase`. Let's dig back into the assembly code.

The assembly is kind of tricky to parse, but I notice this `call 0xa21a2ce` instruction. That's a huge clue!  It's very likely this is a call to a BPF program. I need to understand what this BPF program is doing.  Syzkaller reproducer always gives me an important lead. Let's look at the reproducer.

Aha!  The reproducer is using a `bpf` syscall with a specific command and address. It is very likely a BPF program is loaded here, probably type 5. I need to be sure though. Checking the reproducer shows that it does `ioctl` on a team interface named `team0`. Then it creates a socket and sends a `netlink` message. It looks like it is setting up a traffic control queue discipline (`QDISC`). This is probably what the BPF program does.

So, the reproducer uses a BPF program and attaches it to something traffic control related. I need to confirm the BPF program type from `include/uapi/linux/bpf.h`. Then I need to see what the program does. The assembly and this reproducer are key! This looks like a race or lock issue related to BPF programs attached to traffic control. It is likely that the program messes with the timer which causes the lock to be held. Let's see how they interact.

map[ContextFile:include/uapi/linux/bpf.h IncludeLines:true Name:bpf_prog_type]

map[SourceCode:1052:	/* Note that tracing related programs such as
1053:	 * BPF_PROG_TYPE_{KPROBE,TRACEPOINT,PERF_EVENT,RAW_TRACEPOINT}
1054:	 * are not subject to a stable API since kernel internal data
1055:	 * structures can change from release to release and may
1056:	 * therefore break existing tracing BPF programs. Tracing BPF
1057:	 * programs correspond to /a/ specific kernel which is to be
1058:	 * analyzed, and not /a/ specific kernel /and/ all future ones.
1059:	 */
1060:	enum bpf_prog_type {
1061:		BPF_PROG_TYPE_UNSPEC,
1062:		BPF_PROG_TYPE_SOCKET_FILTER,
1063:		BPF_PROG_TYPE_KPROBE,
1064:		BPF_PROG_TYPE_SCHED_CLS,
1065:		BPF_PROG_TYPE_SCHED_ACT,
1066:		BPF_PROG_TYPE_TRACEPOINT,
1067:		BPF_PROG_TYPE_XDP,
1068:		BPF_PROG_TYPE_PERF_EVENT,
1069:		BPF_PROG_TYPE_CGROUP_SKB,
1070:		BPF_PROG_TYPE_CGROUP_SOCK,
1071:		BPF_PROG_TYPE_LWT_IN,
1072:		BPF_PROG_TYPE_LWT_OUT,
1073:		BPF_PROG_TYPE_LWT_XMIT,
1074:		BPF_PROG_TYPE_SOCK_OPS,
1075:		BPF_PROG_TYPE_SK_SKB,
1076:		BPF_PROG_TYPE_CGROUP_DEVICE,
1077:		BPF_PROG_TYPE_SK_MSG,
1078:		BPF_PROG_TYPE_RAW_TRACEPOINT,
1079:		BPF_PROG_TYPE_CGROUP_SOCK_ADDR,
1080:		BPF_PROG_TYPE_LWT_SEG6LOCAL,
1081:		BPF_PROG_TYPE_LIRC_MODE2,
1082:		BPF_PROG_TYPE_SK_REUSEPORT,
1083:		BPF_PROG_TYPE_FLOW_DISSECTOR,
1084:		BPF_PROG_TYPE_CGROUP_SYSCTL,
1085:		BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE,
1086:		BPF_PROG_TYPE_CGROUP_SOCKOPT,
1087:		BPF_PROG_TYPE_TRACING,
1088:		BPF_PROG_TYPE_STRUCT_OPS,
1089:		BPF_PROG_TYPE_EXT,
1090:		BPF_PROG_TYPE_LSM,
1091:		BPF_PROG_TYPE_SK_LOOKUP,
1092:		BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
1093:		BPF_PROG_TYPE_NETFILTER,
1094:		__MAX_BPF_PROG_TYPE
1095:	};
 SourceFile:include/uapi/linux/bpf.h]

gemini-3.1-pro-preview

							input: 41940
							output: 42
							thoughts: 1072
						

**Analyzing a BPF-Related Soft Lockup**

Okay, so type 5 is `BPF_PROG_TYPE_TRACEPOINT`. The reproducer loads a tracepoint BPF program and then sends an `RTM_NEWQDISC` netlink message (0x24). I'm not seeing any explicit `bpf$PROG_ATTACH` or `perf_event_open` syscalls, but it's likely just loading the program for later use. Looking at the reproducer's `bpf$PROG_LOAD` arguments confirms this, with the type field set to 0x5. I don't see any attach though.

The soft lockup is happening in a pretty standard spot: `toggle_allocation_gate` -> `static_key_enable` -> `arch_jump_label_transform_apply` -> `smp_text_poke_batch_finish` -> `smp_text_poke_sync_each_cpu` -> `on_each_cpu_cond_mask` -> `smp_call_function_many_cond` -> `csd_lock_wait`. CPU 0 is waiting for an IPI from CPU 1.

CPU 1 is stuck in `__remove_hrtimer`. That's not good. Is the rbtree corrupted? That would explain the infinite loop in `rb_erase` or `timerqueue_del`. But, how could the rbtree get corrupted?

Wait a minute, let's look at the BPF program itself. It's using `BPF_FUNC_ringbuf_reserve`, `BPF_FUNC_snprintf`, `BPF_FUNC_ringbuf_query`, `BPF_FUNC_ringbuf_output` and then `bpf_helpers_ringbuf_free`.

Aha! `BPF_FUNC_snprintf`! That's interesting. Could there be a bug in `bpf_snprintf`? Time to dig into `kernel/bpf/helpers.c` and see what's going on there.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_snprintf]

map[SourceCode:1064:	BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
 SourceFile:kernel/bpf/helpers.c]

gemini-3.1-pro-preview

							input: 43567
							output: 43
							thoughts: 15
						

Okay, let's dive into this. I need to understand this `bpf_snprintf` function in detail. I'm assuming it's related to BPF (Berkeley Packet Filter), but I need to be sure. I'm going to pull up the definitive documentation or source code for `bpf_snprintf` - wherever I can find the *complete* definition. I need to understand its parameters, return type, and, most importantly, how it interacts with the BPF context and environment. What's special about it that differentiates it from a standard `snprintf`? Are there any BPF-specific limitations or considerations? I need to know the specifics: data types, potential for memory access restrictions, any unique error handling, and the implications for performance within the BPF VM. Getting a solid grasp of this will give me the building blocks I require to work with it properly. It's time to dig in.

log-in to see details

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:BPF_CALL_5]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 43841
							output: 26
							thoughts: 23
						

Here's my thought process, as requested:

**Investigating BPF Helper Function Implementation**

Okay, so I need to understand how `bpf_snprintf` is implemented. I'm going to start by going directly to the source. The most logical place to begin is the kernel's BPF helper function implementation file, which is almost certainly in `kernel/bpf/helpers.c`. That's where I would expect to find the definition and logic for this function. Let's get to it. Time to dive into the code.

map[Expression:BPF_CALL_5\(bpf_snprintf]

map[Output:kernel/bpf/helpers.c=818=int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
--
kernel/bpf/helpers.c-1063-
kernel/bpf/helpers.c:1064:BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
kernel/bpf/helpers.c-1065-	   const void *, args, u32, data_len)
--
kernel/trace/bpf_trace.c=976=static int bpf_btf_printf_prepare(struct btf_ptr *ptr, u32 btf_ptr_size,
--
kernel/trace/bpf_trace.c-1005-
kernel/trace/bpf_trace.c:1006:BPF_CALL_5(bpf_snprintf_btf, char *, str, u32, str_size, struct btf_ptr *, ptr,
kernel/trace/bpf_trace.c-1007-	   u32, btf_ptr_size, u64, flags)
]

gemini-3.1-pro-preview

							input: 44310
							output: 23
							thoughts: 22
						

Here's a summary of my thought process, as requested:

**Diving into `helpers.c`**

Okay, time to get my hands dirty. I need to understand something specific about the BPF helper functions, so I'm heading directly into the source code. Let's start with `kernel/bpf/helpers.c`. My hunch is whatever I'm looking for is in that file, and I'm guessing it's around line 1064. That should be a good starting point for a targeted investigation. I'll need to remember to pay close attention to the surrounding context as well – no point in just looking at one line, I need to see how it fits into the broader picture. Let's see what we find.

map[File:kernel/bpf/helpers.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
 */
#include <linux/bpf.h>
#include <linux/btf.h>
#include <linux/bpf-cgroup.h>
#include <linux/cgroup.h>
#include <linux/rcupdate.h>
#include <linux/random.h>
#include <linux/smp.h>
#include <linux/topology.h>
#include <linux/ktime.h>
#include <linux/sched.h>
#include <linux/uidgid.h>
#include <linux/filter.h>
#include <linux/ctype.h>
#include <linux/jiffies.h>
#include <linux/pid_namespace.h>
#include <linux/poison.h>
#include <linux/proc_ns.h>
#include <linux/sched/task.h>
#include <linux/security.h>
#include <linux/btf_ids.h>
#include <linux/bpf_mem_alloc.h>
#include <linux/kasan.h>
#include <linux/bpf_verifier.h>
#include <linux/uaccess.h>
#include <linux/verification.h>
#include <linux/task_work.h>
#include <linux/irq_work.h>
#include <linux/buildid.h>

#include "../../lib/kstrtox.h"

/* If kernel subsystem is allowing eBPF programs to call this function,
 * inside its own verifier_ops->get_func_proto() callback it should return
 * bpf_map_lookup_elem_proto, so that verifier can properly check the arguments
 *
 * Different map implementations will rely on rcu in map methods
 * lookup/update/delete, therefore eBPF programs must run under rcu lock
 * if program is allowed to access maps, so check rcu_read_lock_held() or
 * rcu_read_lock_trace_held() in all three functions.
 */
BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return (unsigned long) map->ops->map_lookup_elem(map, key);
}

const struct bpf_func_proto bpf_map_lookup_elem_proto = {
	.func		= bpf_map_lookup_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_PTR_TO_MAP_VALUE_OR_NULL,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
};

BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key,
	   void *, value, u64, flags)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return map->ops->map_update_elem(map, key, value, flags);
}

const struct bpf_func_proto bpf_map_update_elem_proto = {
	.func		= bpf_map_update_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
	.arg3_type	= ARG_PTR_TO_MAP_VALUE,
	.arg4_type	= ARG_ANYTHING,
};

BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return map->ops->map_delete_elem(map, key);
}

const struct bpf_func_proto bpf_map_delete_elem_proto = {
	.func		= bpf_map_delete_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
};

BPF_CALL_3(bpf_map_push_elem, struct bpf_map *, map, void *, value, u64, flags)
{
	return map->ops->map_push_elem(map, value, flags);
}

const struct bpf_func_proto bpf_map_push_elem_proto = {
	.func		= bpf_map_push_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_VALUE,
	.arg3_type	= ARG_ANYTHING,
};

BPF_CALL_2(bpf_map_pop_elem, struct bpf_map *, map, void *, value)
{
	return map->ops->map_pop_elem(map, value);
}

const struct bpf_func_proto bpf_map_pop_elem_proto = {
	.func		= bpf_map_pop_elem,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE,
};

BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
{
	return map->ops->map_peek_elem(map, value);
}

const struct bpf_func_proto bpf_map_peek_elem_proto = {
	.func		= bpf_map_peek_elem,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE,
};

BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu);
}

const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto = {
	.func		= bpf_map_lookup_percpu_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_PTR_TO_MAP_VALUE_OR_NULL,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
	.arg3_type	= ARG_ANYTHING,
};

const struct bpf_func_proto bpf_get_prandom_u32_proto = {
	.func		= bpf_user_rnd_u32,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_get_smp_processor_id)
{
	return smp_processor_id();
}

const struct bpf_func_proto bpf_get_smp_processor_id_proto = {
	.func		= bpf_get_smp_processor_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.allow_fastcall	= true,
};

BPF_CALL_0(bpf_get_numa_node_id)
{
	return numa_node_id();
}

const struct bpf_func_proto bpf_get_numa_node_id_proto = {
	.func		= bpf_get_numa_node_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_ns)
{
	/* NMI safe access to clock monotonic */
	return ktime_get_mono_fast_ns();
}

const struct bpf_func_proto bpf_ktime_get_ns_proto = {
	.func		= bpf_ktime_get_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_boot_ns)
{
	/* NMI safe access to clock boottime */
	return ktime_get_boot_fast_ns();
}

const struct bpf_func_proto bpf_ktime_get_boot_ns_proto = {
	.func		= bpf_ktime_get_boot_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_coarse_ns)
{
	return ktime_get_coarse_ns();
}

const struct bpf_func_proto bpf_ktime_get_coarse_ns_proto = {
	.func		= bpf_ktime_get_coarse_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_tai_ns)
{
	/* NMI safe access to clock tai */
	return ktime_get_tai_fast_ns();
}

const struct bpf_func_proto bpf_ktime_get_tai_ns_proto = {
	.func		= bpf_ktime_get_tai_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_get_current_pid_tgid)
{
	struct task_struct *task = current;

	if (unlikely(!task))
		return -EINVAL;

	return (u64) task->tgid << 32 | task->pid;
}

const struct bpf_func_proto bpf_get_current_pid_tgid_proto = {
	.func		= bpf_get_current_pid_tgid,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_get_current_uid_gid)
{
	struct task_struct *task = current;
	kuid_t uid;
	kgid_t gid;

	if (unlikely(!task))
		return -EINVAL;

	current_uid_gid(&uid, &gid);
	return (u64) from_kgid(&init_user_ns, gid) << 32 |
		     from_kuid(&init_user_ns, uid);
}

const struct bpf_func_proto bpf_get_current_uid_gid_proto = {
	.func		= bpf_get_current_uid_gid,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_2(bpf_get_current_comm, char *, buf, u32, size)
{
	struct task_struct *task = current;

	if (unlikely(!task))
		goto err_clear;

	/* Verifier guarantees that size > 0 */
	strscpy_pad(buf, task->comm, size);
	return 0;
err_clear:
	memset(buf, 0, size);
	return -EINVAL;
}

const struct bpf_func_proto bpf_get_current_comm_proto = {
	.func		= bpf_get_current_comm,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE,
};

#if defined(CONFIG_QUEUED_SPINLOCKS) || defined(CONFIG_BPF_ARCH_SPINLOCK)

static inline void __bpf_spin_lock(struct bpf_spin_lock *lock)
{
	arch_spinlock_t *l = (void *)lock;
	union {
		__u32 val;
		arch_spinlock_t lock;
	} u = { .lock = __ARCH_SPIN_LOCK_UNLOCKED };

	compiletime_assert(u.val == 0, "__ARCH_SPIN_LOCK_UNLOCKED not 0");
	BUILD_BUG_ON(sizeof(*l) != sizeof(__u32));
	BUILD_BUG_ON(sizeof(*lock) != sizeof(__u32));
	preempt_disable();
	arch_spin_lock(l);
}

static inline void __bpf_spin_unlock(struct bpf_spin_lock *lock)
{
	arch_spinlock_t *l = (void *)lock;

	arch_spin_unlock(l);
	preempt_enable();
}

#else

static inline void __bpf_spin_lock(struct bpf_spin_lock *lock)
{
	atomic_t *l = (void *)lock;

	BUILD_BUG_ON(sizeof(*l) != sizeof(*lock));
	do {
		atomic_cond_read_relaxed(l, !VAL);
	} while (atomic_xchg(l, 1));
}

static inline void __bpf_spin_unlock(struct bpf_spin_lock *lock)
{
	atomic_t *l = (void *)lock;

	atomic_set_release(l, 0);
}

#endif

static DEFINE_PER_CPU(unsigned long, irqsave_flags);

static inline void __bpf_spin_lock_irqsave(struct bpf_spin_lock *lock)
{
	unsigned long flags;

	local_irq_save(flags);
	__bpf_spin_lock(lock);
	__this_cpu_write(irqsave_flags, flags);
}

NOTRACE_BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
{
	__bpf_spin_lock_irqsave(lock);
	return 0;
}

const struct bpf_func_proto bpf_spin_lock_proto = {
	.func		= bpf_spin_lock,
	.gpl_only	= false,
	.ret_type	= RET_VOID,
	.arg1_type	= ARG_PTR_TO_SPIN_LOCK,
	.arg1_btf_id    = BPF_PTR_POISON,
};

static inline void __bpf_spin_unlock_irqrestore(struct bpf_spin_lock *lock)
{
	unsigned long flags;

	flags = __this_cpu_read(irqsave_flags);
	__bpf_spin_unlock(lock);
	local_irq_restore(flags);
}

NOTRACE_BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
{
	__bpf_spin_unlock_irqrestore(lock);
	return 0;
}

const struct bpf_func_proto bpf_spin_unlock_proto = {
	.func		= bpf_spin_unlock,
	.gpl_only	= false,
	.ret_type	= RET_VOID,
	.arg1_type	= ARG_PTR_TO_SPIN_LOCK,
	.arg1_btf_id    = BPF_PTR_POISON,
};

void copy_map_value_locked(struct bpf_map *map, void *dst, void *src,
			   bool lock_src)
{
	struct bpf_spin_lock *lock;

	if (lock_src)
		lock = src + map->record->spin_lock_off;
	else
		lock = dst + map->record->spin_lock_off;
	preempt_disable();
	__bpf_spin_lock_irqsave(lock);
	copy_map_value(map, dst, src);
	__bpf_spin_unlock_irqrestore(lock);
	preempt_enable();
}

BPF_CALL_0(bpf_jiffies64)
{
	return get_jiffies_64();
}

const struct bpf_func_proto bpf_jiffies64_proto = {
	.func		= bpf_jiffies64,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

#ifdef CONFIG_CGROUPS
BPF_CALL_0(bpf_get_current_cgroup_id)
{
	struct cgroup *cgrp;
	u64 cgrp_id;

	rcu_read_lock();
	cgrp = task_dfl_cgroup(current);
	cgrp_id = cgroup_id(cgrp);
	rcu_read_unlock();

	return cgrp_id;
}

const struct bpf_func_proto bpf_get_current_cgroup_id_proto = {
	.func		= bpf_get_current_cgroup_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_1(bpf_get_current_ancestor_cgroup_id, int, ancestor_level)
{
	struct cgroup *cgrp;
	struct cgroup *ancestor;
	u64 cgrp_id;

	rcu_read_lock();
	cgrp = task_dfl_cgroup(current);
	ancestor = cgroup_ancestor(cgrp, ancestor_level);
	cgrp_id = ancestor ? cgroup_id(ancestor) : 0;
	rcu_read_unlock();

	return cgrp_id;
}

const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto = {
	.func		= bpf_get_current_ancestor_cgroup_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_ANYTHING,
};
#endif /* CONFIG_CGROUPS */

#define BPF_STRTOX_BASE_MASK 0x1F

static int __bpf_strtoull(const char *buf, size_t buf_len, u64 flags,
			  unsigned long long *res, bool *is_negative)
{
	unsigned int base = flags & BPF_STRTOX_BASE_MASK;
	const char *cur_buf = buf;
	size_t cur_len = buf_len;
	unsigned int consumed;
	size_t val_len;
	char str[64];

	if (!buf || !buf_len || !res || !is_negative)
		return -EINVAL;

	if (base != 0 && base != 8 && base != 10 && base != 16)
		return -EINVAL;

	if (flags & ~BPF_STRTOX_BASE_MASK)
		return -EINVAL;

	while (cur_buf < buf + buf_len && isspace(*cur_buf))
		++cur_buf;

	*is_negative = (cur_buf < buf + buf_len && *cur_buf == '-');
	if (*is_negative)
		++cur_buf;

	consumed = cur_buf - buf;
	cur_len -= consumed;
	if (!cur_len)
		return -EINVAL;

	cur_len = min(cur_len, sizeof(str) - 1);
	memcpy(str, cur_buf, cur_len);
	str[cur_len] = '\0';
	cur_buf = str;

	cur_buf = _parse_integer_fixup_radix(cur_buf, &base);
	val_len = _parse_integer(cur_buf, base, res);

	if (val_len & KSTRTOX_OVERFLOW)
		return -ERANGE;

	if (val_len == 0)
		return -EINVAL;

	cur_buf += val_len;
	consumed += cur_buf - str;

	return consumed;
}

static int __bpf_strtoll(const char *buf, size_t buf_len, u64 flags,
			 long long *res)
{
	unsigned long long _res;
	bool is_negative;
	int err;

	err = __bpf_strtoull(buf, buf_len, flags, &_res, &is_negative);
	if (err < 0)
		return err;
	if (is_negative) {
		if ((long long)-_res > 0)
			return -ERANGE;
		*res = -_res;
	} else {
		if ((long long)_res < 0)
			return -ERANGE;
		*res = _res;
	}
	return err;
}

BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags,
	   s64 *, res)
{
	long long _res;
	int err;

	*res = 0;
	err = __bpf_strtoll(buf, buf_len, flags, &_res);
	if (err < 0)
		return err;
	*res = _res;
	return err;
}

const struct bpf_func_proto bpf_strtol_proto = {
	.func		= bpf_strtol,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg2_type	= ARG_CONST_SIZE,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
	.arg4_size	= sizeof(s64),
};

BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
	   u64 *, res)
{
	unsigned long long _res;
	bool is_negative;
	int err;

	*res = 0;
	err = __bpf_strtoull(buf, buf_len, flags, &_res, &is_negative);
	if (err < 0)
		return err;
	if (is_negative)
		return -EINVAL;
	*res = _res;
	return err;
}

const struct bpf_func_proto bpf_strtoul_proto = {
	.func		= bpf_strtoul,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg2_type	= ARG_CONST_SIZE,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
	.arg4_size	= sizeof(u64),
};

BPF_CALL_3(bpf_strncmp, const char *, s1, u32, s1_sz, const char *, s2)
{
	return strncmp(s1, s2, s1_sz);
}

static const struct bpf_func_proto bpf_strncmp_proto = {
	.func		= bpf_strncmp,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg2_type	= ARG_CONST_SIZE,
	.arg3_type	= ARG_PTR_TO_CONST_STR,
};

BPF_CALL_4(bpf_get_ns_current_pid_tgid, u64, dev, u64, ino,
	   struct bpf_pidns_info *, nsdata, u32, size)
{
	struct task_struct *task = current;
	struct pid_namespace *pidns;
	int err = -EINVAL;

	if (unlikely(size != sizeof(struct bpf_pidns_info)))
		goto clear;

	if (unlikely((u64)(dev_t)dev != dev))
		goto clear;

	if (unlikely(!task))
		goto clear;

	pidns = task_active_pid_ns(task);
	if (unlikely(!pidns)) {
		err = -ENOENT;
		goto clear;
	}

	if (!ns_match(&pidns->ns, (dev_t)dev, ino))
		goto clear;

	nsdata->pid = task_pid_nr_ns(task, pidns);
	nsdata->tgid = task_tgid_nr_ns(task, pidns);
	return 0;
clear:
	memset((void *)nsdata, 0, (size_t) size);
	return err;
}

const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto = {
	.func		= bpf_get_ns_current_pid_tgid,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_ANYTHING,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type      = ARG_PTR_TO_UNINIT_MEM,
	.arg4_type      = ARG_CONST_SIZE,
};

static const struct bpf_func_proto bpf_get_raw_smp_processor_id_proto = {
	.func		= bpf_get_raw_cpu_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_5(bpf_event_output_data, void *, ctx, struct bpf_map *, map,
	   u64, flags, void *, data, u64, size)
{
	if (unlikely(flags & ~(BPF_F_INDEX_MASK)))
		return -EINVAL;

	return bpf_event_output(map, flags, data, size, NULL, 0, NULL);
}

const struct bpf_func_proto bpf_event_output_data_proto =  {
	.func		= bpf_event_output_data,
	.gpl_only       = true,
	.ret_type       = RET_INTEGER,
	.arg1_type      = ARG_PTR_TO_CTX,
	.arg2_type      = ARG_CONST_MAP_PTR,
	.arg3_type      = ARG_ANYTHING,
	.arg4_type      = ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg5_type      = ARG_CONST_SIZE_OR_ZERO,
};

BPF_CALL_3(bpf_copy_from_user, void *, dst, u32, size,
	   const void __user *, user_ptr)
{
	int ret = copy_from_user(dst, user_ptr, size);

	if (unlikely(ret)) {
		memset(dst, 0, size);
		ret = -EFAULT;
	}

	return ret;
}

const struct bpf_func_proto bpf_copy_from_user_proto = {
	.func		= bpf_copy_from_user,
	.gpl_only	= false,
	.might_sleep	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_ANYTHING,
};

BPF_CALL_5(bpf_copy_from_user_task, void *, dst, u32, size,
	   const void __user *, user_ptr, struct task_struct *, tsk, u64, flags)
{
	int ret;

	/* flags is not used yet */
	if (unlikely(flags))
		return -EINVAL;

	if (unlikely(!size))
		return 0;

	ret = access_process_vm(tsk, (unsigned long)user_ptr, dst, size, 0);
	if (ret == size)
		return 0;

	memset(dst, 0, size);
	/* Return -EFAULT for partial read */
	return ret < 0 ? ret : -EFAULT;
}

const struct bpf_func_proto bpf_copy_from_user_task_proto = {
	.func		= bpf_copy_from_user_task,
	.gpl_only	= true,
	.might_sleep	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_BTF_ID,
	.arg4_btf_id	= &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
	.arg5_type	= ARG_ANYTHING
};

BPF_CALL_2(bpf_per_cpu_ptr, const void *, ptr, u32, cpu)
{
	if (cpu >= nr_cpu_ids)
		return (unsigned long)NULL;

	return (unsigned long)per_cpu_ptr((const void __percpu *)(const uintptr_t)ptr, cpu);
}

const struct bpf_func_proto bpf_per_cpu_ptr_proto = {
	.func		= bpf_per_cpu_ptr,
	.gpl_only	= false,
	.ret_type	= RET_PTR_TO_MEM_OR_BTF_ID | PTR_MAYBE_NULL | MEM_RDONLY,
	.arg1_type	= ARG_PTR_TO_PERCPU_BTF_ID,
	.arg2_type	= ARG_ANYTHING,
};

BPF_CALL_1(bpf_this_cpu_ptr, const void *, percpu_ptr)
{
	return (unsigned long)this_cpu_ptr((const void __percpu *)(const uintptr_t)percpu_ptr);
}

const struct bpf_func_proto bpf_this_cpu_ptr_proto = {
	.func		= bpf_this_cpu_ptr,
	.gpl_only	= false,
	.ret_type	= RET_PTR_TO_MEM_OR_BTF_ID | MEM_RDONLY,
	.arg1_type	= ARG_PTR_TO_PERCPU_BTF_ID,
};

static int bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype,
		size_t bufsz)
{
	void __user *user_ptr = (__force void __user *)unsafe_ptr;

	buf[0] = 0;

	switch (fmt_ptype) {
	case 's':
#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
		if ((unsigned long)unsafe_ptr < TASK_SIZE)
			return strncpy_from_user_nofault(buf, user_ptr, bufsz);
		fallthrough;
#endif
	case 'k':
		return strncpy_from_kernel_nofault(buf, unsafe_ptr, bufsz);
	case 'u':
		return strncpy_from_user_nofault(buf, user_ptr, bufsz);
	}

	return -EINVAL;
}

/* Support executing three nested bprintf helper calls on a given CPU */
#define MAX_BPRINTF_NEST_LEVEL	3

static DEFINE_PER_CPU(struct bpf_bprintf_buffers[MAX_BPRINTF_NEST_LEVEL], bpf_bprintf_bufs);
static DEFINE_PER_CPU(int, bpf_bprintf_nest_level);

int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
{
	int nest_level;

	preempt_disable();
	nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
	if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
		this_cpu_dec(bpf_bprintf_nest_level);
		preempt_enable();
		return -EBUSY;
	}
	*bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);

	return 0;
}

void bpf_put_buffers(void)
{
	if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
		return;
	this_cpu_dec(bpf_bprintf_nest_level);
	preempt_enable();
}

void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
{
	if (!data->bin_args && !data->buf)
		return;
	bpf_put_buffers();
}

/*
 * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
 *
 * Returns a negative value if fmt is an invalid format string or 0 otherwise.
 *
 * This can be used in two ways:
 * - Format string verification only: when data->get_bin_args is false
 * - Arguments preparation: in addition to the above verification, it writes in
 *   data->bin_args a binary representation of arguments usable by bstr_printf
 *   where pointers from BPF have been sanitized.
 *
 * In argument preparation mode, if 0 is returned, safe temporary buffers are
 * allocated and bpf_bprintf_cleanup should be called to free them after use.
 */
int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
			u32 num_args, struct bpf_bprintf_data *data)
{
	bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
	char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
	struct bpf_bprintf_buffers *buffers = NULL;
	size_t sizeof_cur_arg, sizeof_cur_ip;
	int err, i, num_spec = 0;
	u64 cur_arg;
	char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";

	fmt_end = strnchr(fmt, fmt_size, 0);
	if (!fmt_end)
		return -EINVAL;
	fmt_size = fmt_end - fmt;

	if (get_buffers && bpf_try_get_buffers(&buffers))
		return -EBUSY;

	if (data->get_bin_args) {
		if (num_args)
			tmp_buf = buffers->bin_args;
		tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
		data->bin_args = (u32 *)tmp_buf;
	}

	if (data->get_buf)
		data->buf = buffers->buf;

	for (i = 0; i < fmt_size; i++) {
		unsigned char c = fmt[i];

		/*
		 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
		 * through unchanged, while still rejecting ASCII control bytes.
		 */
		if (isascii(c) && !isprint(c) && !isspace(c)) {
			err = -EINVAL;
			goto out;
		}

		if (fmt[i] != '%')
			continue;

		if (fmt[i + 1] == '%') {
			i++;
			continue;
		}

		if (num_spec >= num_args) {
			err = -EINVAL;
			goto out;
		}

		/* The string is zero-terminated so if fmt[i] != 0, we can
		 * always access fmt[i + 1], in the worst case it will be a 0
		 */
		i++;
		c = fmt[i];
		/*
		 * The format parser below only understands ASCII conversion
		 * specifiers and modifiers, so reject non-ASCII after '%'.
		 */
		if (!isascii(c)) {
			err = -EINVAL;
			goto out;
		}

		/* skip optional "[0 +-][num]" width formatting field */
		while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
		       fmt[i] == ' ')
			i++;
		if (fmt[i] >= '1' && fmt[i] <= '9') {
			i++;
			while (fmt[i] >= '0' && fmt[i] <= '9')
				i++;
		}

		if (fmt[i] == 'p') {
			sizeof_cur_arg = sizeof(long);

			if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
			    ispunct(fmt[i + 1])) {
				if (tmp_buf)
					cur_arg = raw_args[num_spec];
				goto nocopy_fmt;
			}

			if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
			    fmt[i + 2] == 's') {
				fmt_ptype = fmt[i + 1];
				i += 2;
				goto fmt_str;
			}

			if (fmt[i + 1] == 'K' ||
			    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
			    fmt[i + 1] == 'S') {
				if (tmp_buf)
					cur_arg = raw_args[num_spec];
				i++;
				goto nocopy_fmt;
			}

			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}

				i++;
				num_spec++;
				continue;
			}

			/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
			if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
			    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
				err = -EINVAL;
				goto out;
			}

			i += 2;
			if (!tmp_buf)
				goto nocopy_fmt;

			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
				err = -ENOSPC;
				goto out;
			}

			unsafe_ptr = (char *)(long)raw_args[num_spec];
			err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
						       sizeof_cur_ip);
			if (err < 0)
				memset(cur_ip, 0, sizeof_cur_ip);

			/* hack: bstr_printf expects IP addresses to be
			 * pre-formatted as strings, ironically, the easiest way
			 * to do that is to call snprintf.
			 */
			ip_spec[2] = fmt[i - 1];
			ip_spec[3] = fmt[i];
			err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
				       ip_spec, &cur_ip);

			tmp_buf += err + 1;
			num_spec++;

			continue;
		} else if (fmt[i] == 's') {
			fmt_ptype = fmt[i];
fmt_str:
			if (fmt[i + 1] != 0 &&
			    !isspace(fmt[i + 1]) &&
			    !ispunct(fmt[i + 1])) {
				err = -EINVAL;
				goto out;
			}

			if (!tmp_buf)
				goto nocopy_fmt;

			if (tmp_buf_end == tmp_buf) {
				err = -ENOSPC;
				goto out;
			}

			unsafe_ptr = (char *)(long)raw_args[num_spec];
			err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
						    fmt_ptype,
						    tmp_buf_end - tmp_buf);
			if (err < 0) {
				tmp_buf[0] = '\0';
				err = 1;
			}

			tmp_buf += err;
			num_spec++;

			continue;
		} else if (fmt[i] == 'c') {
			if (!tmp_buf)
				goto nocopy_fmt;

			if (tmp_buf_end == tmp_buf) {
				err = -ENOSPC;
				goto out;
			}

			*tmp_buf = raw_args[num_spec];
			tmp_buf++;
			num_spec++;

			continue;
		}

		sizeof_cur_arg = sizeof(int);

		if (fmt[i] == 'l') {
			sizeof_cur_arg = sizeof(long);
			i++;
		}
		if (fmt[i] == 'l') {
			sizeof_cur_arg = sizeof(long long);
			i++;
		}

		if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
		    fmt[i] != 'x' && fmt[i] != 'X') {
			err = -EINVAL;
			goto out;
		}

		if (tmp_buf)
			cur_arg = raw_args[num_spec];
nocopy_fmt:
		if (tmp_buf) {
			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
				err = -ENOSPC;
				goto out;
			}

			if (sizeof_cur_arg == 8) {
				*(u32 *)tmp_buf = *(u32 *)&cur_arg;
				*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
			} else {
				*(u32 *)tmp_buf = (u32)(long)cur_arg;
			}
			tmp_buf += sizeof_cur_arg;
		}
		num_spec++;
	}

	err = 0;
out:
	if (err)
		bpf_bprintf_cleanup(data);
	return err;
}

BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
	   const void *, args, u32, data_len)
{
	struct bpf_bprintf_data data = {
		.get_bin_args	= true,
	};
	int err, num_args;

	if (data_len % 8 || data_len > MAX_BPRINTF_VARARGS * 8 ||
	    (data_len && !args))
		return -EINVAL;
	num_args = data_len / 8;

	/* ARG_PTR_TO_CONST_STR guarantees that fmt is zero-terminated so we
	 * can safely give an unbounded size.
	 */
	err = bpf_bprintf_prepare(fmt, UINT_MAX, args, num_args, &data);
	if (err < 0)
		return err;

	err = bstr_printf(str, str_size, fmt, data.bin_args);

	bpf_bprintf_cleanup(&data);

	return err + 1;
}

const struct bpf_func_proto bpf_snprintf_proto = {
	.func		= bpf_snprintf,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM_OR_NULL | MEM_WRITE,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_PTR_TO_CONST_STR,
	.arg4_type	= ARG_PTR_TO_MEM | PTR_MAYBE_NULL | MEM_RDONLY,
	.arg5_type	= ARG_CONST_SIZE_OR_ZERO,
};

static void *map_key_from_value(struct bpf_map *map, void *value, u32 *arr_idx)
{
	if (map->map_type == BPF_MAP_TYPE_ARRAY) {
		struct bpf_array *array = container_of(map, struct bpf_array, map);

		*arr_idx = ((char *)value - array->value) / array->elem_size;
		return arr_idx;
	}
	return (void *)value - round_up(map->key_size, 8);
}

enum bpf_async_type {
	BPF_ASYNC_TYPE_TIMER = 0,
	BPF_ASYNC_TYPE_WQ,
};

enum bpf_async_op {
	BPF_ASYNC_START,
	BPF_ASYNC_CANCEL
};

struct bpf_async_cmd {
	struct llist_node node;
	u64 nsec;
	u32 mode;
	enum bpf_async_op op;
};

struct bpf_async_cb {
	struct bpf_map *map;
	struct bpf_prog *prog;
	void __rcu *callback_fn;
	void *value;
	struct rcu_head rcu;
	u64 flags;
	struct irq_work worker;
	refcount_t refcnt;
	enum bpf_async_type type;
	struct llist_head async_cmds;
};

/* BPF map elements can contain 'struct bpf_timer'.
 * Such map owns all of its BPF timers.
 * 'struct bpf_timer' is allocated as part of map element allocation
 * and it's zero initialized.
 * That space is used to keep 'struct bpf_async_kern'.
 * bpf_timer_init() allocates 'struct bpf_hrtimer', inits hrtimer, and
 * remembers 'struct bpf_map *' pointer it's part of.
 * bpf_timer_set_callback() increments prog refcnt and assign bpf callback_fn.
 * bpf_timer_start() arms the timer.
 * If user space reference to a map goes to zero at this point
 * ops->map_release_uref callback is responsible for cancelling the timers,
 * freeing their memory, and decrementing prog's refcnts.
 * bpf_timer_cancel() cancels the timer and decrements prog's refcnt.
 * Inner maps can contain bpf timers as well. ops->map_release_uref is
 * freeing the timers when inner map is replaced or deleted by user space.
 */
struct bpf_hrtimer {
	struct bpf_async_cb cb;
	struct hrtimer timer;
	atomic_t cancelling;
};

struct bpf_work {
	struct bpf_async_cb cb;
	struct work_struct work;
};

/* the actual struct hidden inside uapi struct bpf_timer and bpf_wq */
struct bpf_async_kern {
	union {
		struct bpf_async_cb *cb;
		struct bpf_hrtimer *timer;
		struct bpf_work *work;
	};
} __attribute__((aligned(8)));

static DEFINE_PER_CPU(struct bpf_hrtimer *, hrtimer_running);

static void bpf_async_refcount_put(struct bpf_async_cb *cb);

static enum hrtimer_restart bpf_timer_cb(struct hrtimer *hrtimer)
{
	struct bpf_hrtimer *t = container_of(hrtimer, struct bpf_hrtimer, timer);
	struct bpf_map *map = t->cb.map;
	void *value = t->cb.value;
	bpf_callback_t callback_fn;
	void *key;
	u32 idx;

	BTF_TYPE_EMIT(struct bpf_timer);
	callback_fn = rcu_dereference_check(t->cb.callback_fn, rcu_read_lock_bh_held());
	if (!callback_fn)
		goto out;

	/* bpf_timer_cb() runs in hrtimer_run_softirq. It doesn't migrate and
	 * cannot be preempted by another bpf_timer_cb() on the same cpu.
	 * Remember the timer this callback is servicing to prevent
	 * deadlock if callback_fn() calls bpf_timer_cancel() or
	 * bpf_map_delete_elem() on the same timer.
	 */
	this_cpu_write(hrtimer_running, t);

	key = map_key_from_value(map, value, &idx);

	callback_fn((u64)(long)map, (u64)(long)key, (u64)(long)value, 0, 0);
	/* The verifier checked that return value is zero. */

	this_cpu_write(hrtimer_running, NULL);
out:
	return HRTIMER_NORESTART;
}

static void bpf_wq_work(struct work_struct *work)
{
	struct bpf_work *w = container_of(work, struct bpf_work, work);
	struct bpf_async_cb *cb = &w->cb;
	struct bpf_map *map = cb->map;
	bpf_callback_t callback_fn;
	void *value = cb->value;
	void *key;
	u32 idx;

	BTF_TYPE_EMIT(struct bpf_wq);

	callback_fn = READ_ONCE(cb->callback_fn);
	if (!callback_fn)
		return;

	key = map_key_from_value(map, value, &idx);

        rcu_read_lock_trace();
        migrate_disable();

	callback_fn((u64)(long)map, (u64)(long)key, (u64)(long)value, 0, 0);

	migrate_enable();
	rcu_read_unlock_trace();
}

static void bpf_async_cb_rcu_free(struct rcu_head *rcu)
{
	struct bpf_async_cb *cb = container_of(rcu, struct bpf_async_cb, rcu);

	/*
	 * Drop the last reference to prog only after RCU GP, as set_callback()
	 * may race with cancel_and_free()
	 */
	if (cb->prog)
		bpf_prog_put(cb->prog);

	kfree_nolock(cb);
}

/* Callback from call_rcu_tasks_trace, chains to call_rcu for final free */
static void bpf_async_cb_rcu_tasks_trace_free(struct rcu_head *rcu)
{
	struct bpf_async_cb *cb = container_of(rcu, struct bpf_async_cb, rcu);
	struct bpf_hrtimer *t = container_of(cb, struct bpf_hrtimer, cb);
	struct bpf_work *w = container_of(cb, struct bpf_work, cb);
	bool retry = false;

	/*
	 * bpf_async_cancel_and_free() tried to cancel timer/wq, but it
	 * could have raced with timer/wq_start. Now refcnt is zero and
	 * srcu/rcu GP completed. Cancel timer/wq again.
	 */
	switch (cb->type) {
	case BPF_ASYNC_TYPE_TIMER:
		if (hrtimer_try_to_cancel(&t->timer) < 0)
			retry = true;
		break;
	case BPF_ASYNC_TYPE_WQ:
		if (!cancel_work(&w->work) && work_busy(&w->work))
			retry = true;
		break;
	}
	if (retry) {
		/*
		 * hrtimer or wq callback may still be running. It must be
		 * in rcu_tasks_trace or rcu CS, so wait for GP again.
		 * It won't retry forever, since refcnt zero prevents all
		 * operations on timer/wq.
		 */
		call_rcu_tasks_trace(&cb->rcu, bpf_async_cb_rcu_tasks_trace_free);
		return;
	}

	/* RCU Tasks Trace grace period implies RCU grace period. */
	bpf_async_cb_rcu_free(rcu);
}

static void worker_for_call_rcu(struct irq_work *work)
{
	struct bpf_async_cb *cb = container_of(work, struct bpf_async_cb, worker);

	call_rcu_tasks_trace(&cb->rcu, bpf_async_cb_rcu_tasks_trace_free);
}

static void bpf_async_refcount_put(struct bpf_async_cb *cb)
{
	if (!refcount_dec_and_test(&cb->refcnt))
		return;

	if (irqs_disabled()) {
		cb->worker = IRQ_WORK_INIT(worker_for_call_rcu);
		irq_work_queue(&cb->worker);
	} else {
		call_rcu_tasks_trace(&cb->rcu, bpf_async_cb_rcu_tasks_trace_free);
	}
}

static void bpf_async_cancel_and_free(struct bpf_async_kern *async);
static void bpf_async_irq_worker(struct irq_work *work);

static int __bpf_async_init(struct bpf_async_kern *async, struct bpf_map *map, u64 flags,
			    enum bpf_async_type type)
{
	struct bpf_async_cb *cb, *old_cb;
	struct bpf_hrtimer *t;
	struct bpf_work *w;
	clockid_t clockid;
	size_t size;

	switch (type) {
	case BPF_ASYNC_TYPE_TIMER:
		size = sizeof(struct bpf_hrtimer);
		break;
	case BPF_ASYNC_TYPE_WQ:
		size = sizeof(struct bpf_work);
		break;
	default:
		return -EINVAL;
	}

	old_cb = READ_ONCE(async->cb);
	if (old_cb)
		return -EBUSY;

	cb = bpf_map_kmalloc_nolock(map, size, 0, map->numa_node);
	if (!cb)
		return -ENOMEM;

	switch (type) {
	case BPF_ASYNC_TYPE_TIMER:
		clockid = flags & (MAX_CLOCKS - 1);
		t = (struct bpf_hrtimer *)cb;

		atomic_set(&t->cancelling, 0);
		hrtimer_setup(&t->timer, bpf_timer_cb, clockid, HRTIMER_MODE_REL_SOFT);
		cb->value = (void *)async - map->record->timer_off;
		break;
	case BPF_ASYNC_TYPE_WQ:
		w = (struct bpf_work *)cb;

		INIT_WORK(&w->work, bpf_wq_work);
		cb->value = (void *)async - map->record->wq_off;
		break;
	}
	cb->map = map;
	cb->prog = NULL;
	cb->flags = flags;
	cb->worker = IRQ_WORK_INIT(bpf_async_irq_worker);
	init_llist_head(&cb->async_cmds);
	refcount_set(&cb->refcnt, 1); /* map's reference */
	cb->type = type;
	rcu_assign_pointer(cb->callback_fn, NULL);

	old_cb = cmpxchg(&async->cb, NULL, cb);
	if (old_cb) {
		/* Lost the race to initialize this bpf_async_kern, drop the allocated object */
		kfree_nolock(cb);
		return -EBUSY;
	}
	/* Guarantee the order between async->cb and map->usercnt. So
	 * when there are concurrent uref release and bpf timer init, either
	 * bpf_timer_cancel_and_free() called by uref release reads a no-NULL
	 * timer or atomic64_read() below returns a zero usercnt.
	 */
	smp_mb();
	if (!atomic64_read(&map->usercnt)) {
		/* maps with timers must be either held by user space
		 * or pinned in bpffs.
		 */
		bpf_async_cancel_and_free(async);
		return -EPERM;
	}

	return 0;
}

BPF_CALL_3(bpf_timer_init, struct bpf_async_kern *, timer, struct bpf_map *, map,
	   u64, flags)
{
	clock_t clockid = flags & (MAX_CLOCKS - 1);

	BUILD_BUG_ON(MAX_CLOCKS != 16);
	BUILD_BUG_ON(sizeof(struct bpf_async_kern) > sizeof(struct bpf_timer));
	BUILD_BUG_ON(__alignof__(struct bpf_async_kern) != __alignof__(struct bpf_timer));

	if (flags >= MAX_CLOCKS ||
	    /* similar to timerfd except _ALARM variants are not supported */
	    (clockid != CLOCK_MONOTONIC &&
	     clockid != CLOCK_REALTIME &&
	     clockid != CLOCK_BOOTTIME))
		return -EINVAL;

	return __bpf_async_init(timer, map, flags, BPF_ASYNC_TYPE_TIMER);
}

static const struct bpf_func_proto bpf_timer_init_proto = {
	.func		= bpf_timer_init,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
	.arg2_type	= ARG_CONST_MAP_PTR,
	.arg3_type	= ARG_ANYTHING,
};

static int bpf_async_update_prog_callback(struct bpf_async_cb *cb,
					  struct bpf_prog *prog,
					  void *callback_fn)
{
	struct bpf_prog *prev;

	/* Acquire a guard reference on prog to prevent it from being freed during the loop */
	if (prog) {
		prog = bpf_prog_inc_not_zero(prog);
		if (IS_ERR(prog))
			return PTR_ERR(prog);
	}

	do {
		if (prog)
			prog = bpf_prog_inc_not_zero(prog);
		prev = xchg(&cb->prog, prog);
		rcu_assign_pointer(cb->callback_fn, callback_fn);

		/*
		 * Release previous prog, make sure that if other CPU is contending,
		 * to set bpf_prog, references are not leaked as each iteration acquires and
		 * releases one reference.
		 */
		if (prev)
			bpf_prog_put(prev);

	} while (READ_ONCE(cb->prog) != prog ||
		 (void __force *)READ_ONCE(cb->callback_fn) != callback_fn);

	if (prog)
		bpf_prog_put(prog);

	return 0;
}

static DEFINE_PER_CPU(struct bpf_async_cb *, async_cb_running);

static int bpf_async_schedule_op(struct bpf_async_cb *cb, enum bpf_async_op op,
				 u64 nsec, u32 timer_mode)
{
	/*
	 * Do not schedule another operation on this cpu if it's in irq_work
	 * callback that is processing async_cmds queue. Otherwise the following
	 * loop is possible:
	 * bpf_timer_start() -> bpf_async_schedule_op() -> irq_work_queue().
	 * irqrestore -> bpf_async_irq_worker() -> tracepoint -> bpf_timer_start().
	 */
	if (this_cpu_read(async_cb_running) == cb) {
		bpf_async_refcount_put(cb);
		return -EDEADLK;
	}

	struct bpf_async_cmd *cmd = kmalloc_nolock(sizeof(*cmd), 0, NUMA_NO_NODE);

	if (!cmd) {
		bpf_async_refcount_put(cb);
		return -ENOMEM;
	}
	init_llist_node(&cmd->node);
	cmd->nsec = nsec;
	cmd->mode = timer_mode;
	cmd->op = op;
	if (llist_add(&cmd->node, &cb->async_cmds))
		irq_work_queue(&cb->worker);
	return 0;
}

static int __bpf_async_set_callback(struct bpf_async_kern *async, void *callback_fn,
				    struct bpf_prog *prog)
{
	struct bpf_async_cb *cb;

	cb = READ_ONCE(async->cb);
	if (!cb)
		return -EINVAL;

	return bpf_async_update_prog_callback(cb, prog, callback_fn);
}

BPF_CALL_3(bpf_timer_set_callback, struct bpf_async_kern *, timer, void *, callback_fn,
	   struct bpf_prog_aux *, aux)
{
	return __bpf_async_set_callback(timer, callback_fn, aux->prog);
}

static const struct bpf_func_proto bpf_timer_set_callback_proto = {
	.func		= bpf_timer_set_callback,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
	.arg2_type	= ARG_PTR_TO_FUNC,
};

static bool defer_timer_wq_op(void)
{
	return in_hardirq() || irqs_disabled();
}

BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, async, u64, nsecs, u64, flags)
{
	struct bpf_hrtimer *t;
	u32 mode;

	if (flags & ~(BPF_F_TIMER_ABS | BPF_F_TIMER_CPU_PIN))
		return -EINVAL;

	t = READ_ONCE(async->timer);
	if (!t || !READ_ONCE(t->cb.prog))
		return -EINVAL;

	if (flags & BPF_F_TIMER_ABS)
		mode = HRTIMER_MODE_ABS_SOFT;
	else
		mode = HRTIMER_MODE_REL_SOFT;

	if (flags & BPF_F_TIMER_CPU_PIN)
		mode |= HRTIMER_MODE_PINNED;

	/*
	 * bpf_async_cancel_and_free() could have dropped refcnt to zero. In
	 * such case BPF progs are not allowed to arm the timer to prevent UAF.
	 */
	if (!refcount_inc_not_zero(&t->cb.refcnt))
		return -ENOENT;

	if (!defer_timer_wq_op()) {
		hrtimer_start(&t->timer, ns_to_ktime(nsecs), mode);
		bpf_async_refcount_put(&t->cb);
		return 0;
	} else {
		return bpf_async_schedule_op(&t->cb, BPF_ASYNC_START, nsecs, mode);
	}
}

static const struct bpf_func_proto bpf_timer_start_proto = {
	.func		= bpf_timer_start,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type	= ARG_ANYTHING,
};

BPF_CALL_1(bpf_timer_cancel, struct bpf_async_kern *, async)
{
	struct bpf_hrtimer *t, *cur_t;
	bool inc = false;
	int ret = 0;

	if (defer_timer_wq_op())
		return -EOPNOTSUPP;

	t = READ_ONCE(async->timer);
	if (!t)
		return -EINVAL;

	cur_t = this_cpu_read(hrtimer_running);
	if (cur_t == t) {
		/* If bpf callback_fn is trying to bpf_timer_cancel()
		 * its own timer the hrtimer_cancel() will deadlock
		 * since it waits for callback_fn to finish.
		 */
		return -EDEADLK;
	}

	/* Only account in-flight cancellations when invoked from a timer
	 * callback, since we want to avoid waiting only if other _callbacks_
	 * are waiting on us, to avoid introducing lockups. Non-callback paths
	 * are ok, since nobody would synchronously wait for their completion.
	 */
	if (!cur_t)
		goto drop;
	atomic_inc(&t->cancelling);
	/* Need full barrier after relaxed atomic_inc */
	smp_mb__after_atomic();
	inc = true;
	if (atomic_read(&cur_t->cancelling)) {
		/* We're cancelling timer t, while some other timer callback is
		 * attempting to cancel us. In such a case, it might be possible
		 * that timer t belongs to the other callback, or some other
		 * callback waiting upon it (creating transitive dependencies
		 * upon us), and we will enter a deadlock if we continue
		 * cancelling and waiting for it synchronously, since it might
		 * do the same. Bail!
		 */
		atomic_dec(&t->cancelling);
		return -EDEADLK;
	}
drop:
	bpf_async_update_prog_callback(&t->cb, NULL, NULL);
	/* Cancel the timer and wait for associated callback to finish
	 * if it was running.
	 */
	ret = hrtimer_cancel(&t->timer);
	if (inc)
		atomic_dec(&t->cancelling);
	return ret;
}

static const struct bpf_func_proto bpf_timer_cancel_proto = {
	.func		= bpf_timer_cancel,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
};

static void bpf_async_process_op(struct bpf_async_cb *cb, u32 op,
				 u64 timer_nsec, u32 timer_mode)
{
	switch (cb->type) {
	case BPF_ASYNC_TYPE_TIMER: {
		struct bpf_hrtimer *t = container_of(cb, struct bpf_hrtimer, cb);

		switch (op) {
		case BPF_ASYNC_START:
			hrtimer_start(&t->timer, ns_to_ktime(timer_nsec), timer_mode);
			break;
		case BPF_ASYNC_CANCEL:
			hrtimer_try_to_cancel(&t->timer);
			break;
		}
		break;
	}
	case BPF_ASYNC_TYPE_WQ: {
		struct bpf_work *w = container_of(cb, struct bpf_work, cb);

		switch (op) {
		case BPF_ASYNC_START:
			schedule_work(&w->work);
			break;
		case BPF_ASYNC_CANCEL:
			cancel_work(&w->work);
			break;
		}
		break;
	}
	}
	bpf_async_refcount_put(cb);
}

static void bpf_async_irq_worker(struct irq_work *work)
{
	struct bpf_async_cb *cb = container_of(work, struct bpf_async_cb, worker);
	struct llist_node *pos, *n, *list;

	list = llist_del_all(&cb->async_cmds);
	if (!list)
		return;

	list = llist_reverse_order(list);
	this_cpu_write(async_cb_running, cb);
	llist_for_each_safe(pos, n, list) {
		struct bpf_async_cmd *cmd;

		cmd = container_of(pos, struct bpf_async_cmd, node);
		bpf_async_process_op(cb, cmd->op, cmd->nsec, cmd->mode);
		kfree_nolock(cmd);
	}
	this_cpu_write(async_cb_running, NULL);
}

static void bpf_async_cancel_and_free(struct bpf_async_kern *async)
{
	struct bpf_async_cb *cb;

	if (!READ_ONCE(async->cb))
		return;

	cb = xchg(&async->cb, NULL);
	if (!cb)
		return;

	bpf_async_update_prog_callback(cb, NULL, NULL);
	/*
	 * No refcount_inc_not_zero(&cb->refcnt) here. Dropping the last
	 * refcnt. Either synchronously or asynchronously in irq_work.
	 */

	if (!defer_timer_wq_op()) {
		bpf_async_process_op(cb, BPF_ASYNC_CANCEL, 0, 0);
	} else {
		(void)bpf_async_schedule_op(cb, BPF_ASYNC_CANCEL, 0, 0);
		/*
		 * bpf_async_schedule_op() either enqueues allocated cmd into llist
		 * or fails with ENOMEM and drop the last refcnt.
		 * This is unlikely, but safe, since bpf_async_cb_rcu_tasks_trace_free()
		 * callback will do additional timer/wq_cancel due to races anyway.
		 */
	}
}

/*
 * This function is called by map_delete/update_elem for individual element and
 * by ops->map_release_uref when the user space reference to a map reaches zero.
 */
void bpf_timer_cancel_and_free(void *val)
{
	bpf_async_cancel_and_free(val);
}

/*
 * This function is called by map_delete/update_elem for individual element and
 * by ops->map_release_uref when the user space reference to a map reaches zero.
 */
void bpf_wq_cancel_and_free(void *val)
{
	bpf_async_cancel_and_free(val);
}

BPF_CALL_2(bpf_kptr_xchg, void *, dst, void *, ptr)
{
	unsigned long *kptr = dst;

	/* This helper may be inlined by verifier. */
	return xchg(kptr, (unsigned long)ptr);
}

/* Unlike other PTR_TO_BTF_ID helpers the btf_id in bpf_kptr_xchg()
 * helper is determined dynamically by the verifier. Use BPF_PTR_POISON to
 * denote type that verifier will determine.
 */
static const struct bpf_func_proto bpf_kptr_xchg_proto = {
	.func         = bpf_kptr_xchg,
	.gpl_only     = false,
	.ret_type     = RET_PTR_TO_BTF_ID_OR_NULL,
	.ret_btf_id   = BPF_PTR_POISON,
	.arg1_type    = ARG_KPTR_XCHG_DEST,
	.arg2_type    = ARG_PTR_TO_BTF_ID_OR_NULL | OBJ_RELEASE,
	.arg2_btf_id  = BPF_PTR_POISON,
};

struct bpf_dynptr_file_impl {
	struct freader freader;
	/* 64 bit offset and size overriding 32 bit ones in bpf_dynptr_kern */
	u64 offset;
	u64 size;
};

/* Since the upper 8 bits of dynptr->size is reserved, the
 * maximum supported size is 2^24 - 1.
 */
#define DYNPTR_MAX_SIZE	((1UL << 24) - 1)
#define DYNPTR_TYPE_SHIFT	28
#define DYNPTR_SIZE_MASK	0xFFFFFF
#define DYNPTR_RDONLY_BIT	BIT(31)

bool __bpf_dynptr_is_rdonly(const struct bpf_dynptr_kern *ptr)
{
	return ptr->size & DYNPTR_RDONLY_BIT;
}

void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr)
{
	ptr->size |= DYNPTR_RDONLY_BIT;
}

static void bpf_dynptr_set_type(struct bpf_dynptr_kern *ptr, enum bpf_dynptr_type type)
{
	ptr->size |= type << DYNPTR_TYPE_SHIFT;
}

static enum bpf_dynptr_type bpf_dynptr_get_type(const struct bpf_dynptr_kern *ptr)
{
	return (ptr->size & ~(DYNPTR_RDONLY_BIT)) >> DYNPTR_TYPE_SHIFT;
}

u64 __bpf_dynptr_size(const struct bpf_dynptr_kern *ptr)
{
	if (bpf_dynptr_get_type(ptr) == BPF_DYNPTR_TYPE_FILE) {
		struct bpf_dynptr_file_impl *df = ptr->data;

		return df->size;
	}

	return ptr->size & DYNPTR_SIZE_MASK;
}

static void bpf_dynptr_advance_offset(struct bpf_dynptr_kern *ptr, u64 off)
{
	if (bpf_dynptr_get_type(ptr) == BPF_DYNPTR_TYPE_FILE) {
		struct bpf_dynptr_file_impl *df = ptr->data;

		df->offset += off;
		return;
	}
	ptr->offset += off;
}

static void bpf_dynptr_set_size(struct bpf_dynptr_kern *ptr, u64 new_size)
{
	u32 metadata = ptr->size & ~DYNPTR_SIZE_MASK;

	if (bpf_dynptr_get_type(ptr) == BPF_DYNPTR_TYPE_FILE) {
		struct bpf_dynptr_file_impl *df = ptr->data;

		df->size = new_size;
		return;
	}
	ptr->size = (u32)new_size | metadata;
}

int bpf_dynptr_check_size(u64 size)
{
	return size > DYNPTR_MAX_SIZE ? -E2BIG : 0;
}

static int bpf_file_fetch_bytes(struct bpf_dynptr_file_impl *df, u64 offset, void *buf, u64 len)
{
	const void *ptr;

	if (!buf)
		return -EINVAL;

	df->freader.buf = buf;
	df->freader.buf_sz = len;
	ptr = freader_fetch(&df->freader, offset + df->offset, len);
	if (!ptr)
		return df->freader.err;

	if (ptr != buf) /* Force copying into the buffer */
		memcpy(buf, ptr, len);

	return 0;
}

void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data,
		     enum bpf_dynptr_type type, u32 offset, u32 size)
{
	ptr->data = data;
	ptr->offset = offset;
	ptr->size = size;
	bpf_dynptr_set_type(ptr, type);
}

void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr)
{
	memset(ptr, 0, sizeof(*ptr));
}

BPF_CALL_4(bpf_dynptr_from_mem, void *, data, u64, size, u64, flags, struct bpf_dynptr_kern *, ptr)
{
	int err;

	BTF_TYPE_EMIT(struct bpf_dynptr);

	err = bpf_dynptr_check_size(size);
	if (err)
		goto error;

	/* flags is currently unsupported */
	if (flags) {
		err = -EINVAL;
		goto error;
	}

	bpf_dynptr_init(ptr, data, BPF_DYNPTR_TYPE_LOCAL, 0, size);

	return 0;

error:
	bpf_dynptr_set_null(ptr);
	return err;
}

static const struct bpf_func_proto bpf_dynptr_from_mem_proto = {
	.func		= bpf_dynptr_from_mem,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT | MEM_WRITE,
};

static int __bpf_dynptr_read(void *dst, u64 len, const struct bpf_dynptr_kern *src,
			     u64 offset, u64 flags)
{
	enum bpf_dynptr_type type;
	int err;

	if (!src->data || flags)
		return -EINVAL;

	err = bpf_dynptr_check_off_len(src, offset, len);
	if (err)
		return err;

	type = bpf_dynptr_get_type(src);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		/* Source and destination may possibly overlap, hence use memmove to
		 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
		 * pointing to overlapping PTR_TO_MAP_VALUE regions.
		 */
		memmove(dst, src->data + src->offset + offset, len);
		return 0;
	case BPF_DYNPTR_TYPE_SKB:
		return __bpf_skb_load_bytes(src->data, src->offset + offset, dst, len);
	case BPF_DYNPTR_TYPE_XDP:
		return __bpf_xdp_load_bytes(src->data, src->offset + offset, dst, len);
	case BPF_DYNPTR_TYPE_SKB_META:
		memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
		return 0;
	case BPF_DYNPTR_TYPE_FILE:
		return bpf_file_fetch_bytes(src->data, offset, dst, len);
	default:
		WARN_ONCE(true, "bpf_dynptr_read: unknown dynptr type %d\n", type);
		return -EFAULT;
	}
}

BPF_CALL_5(bpf_dynptr_read, void *, dst, u64, len, const struct bpf_dynptr_kern *, src,
	   u64, offset, u64, flags)
{
	return __bpf_dynptr_read(dst, len, src, offset, flags);
}

static const struct bpf_func_proto bpf_dynptr_read_proto = {
	.func		= bpf_dynptr_read,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_PTR_TO_DYNPTR | MEM_RDONLY,
	.arg4_type	= ARG_ANYTHING,
	.arg5_type	= ARG_ANYTHING,
};

int __bpf_dynptr_write(const struct bpf_dynptr_kern *dst, u64 offset, void *src,
		       u64 len, u64 flags)
{
	enum bpf_dynptr_type type;
	int err;

	if (!dst->data || __bpf_dynptr_is_rdonly(dst))
		return -EINVAL;

	err = bpf_dynptr_check_off_len(dst, offset, len);
	if (err)
		return err;

	type = bpf_dynptr_get_type(dst);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		if (flags)
			return -EINVAL;
		/* Source and destination may possibly overlap, hence use memmove to
		 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
		 * pointing to overlapping PTR_TO_MAP_VALUE regions.
		 */
		memmove(dst->data + dst->offset + offset, src, len);
		return 0;
	case BPF_DYNPTR_TYPE_SKB:
		return __bpf_skb_store_bytes(dst->data, dst->offset + offset, src, len,
					     flags);
	case BPF_DYNPTR_TYPE_XDP:
		if (flags)
			return -EINVAL;
		return __bpf_xdp_store_bytes(dst->data, dst->offset + offset, src, len);
	case BPF_DYNPTR_TYPE_SKB_META:
		return __bpf_skb_meta_store_bytes(dst->data, dst->offset + offset, src,
						  len, flags);
	default:
		WARN_ONCE(true, "bpf_dynptr_write: unknown dynptr type %d\n", type);
		return -EFAULT;
	}
}

BPF_CALL_5(bpf_dynptr_write, const struct bpf_dynptr_kern *, dst, u64, offset, void *, src,
	   u64, len, u64, flags)
{
	return __bpf_dynptr_write(dst, offset, src, len, flags);
}

static const struct bpf_func_proto bpf_dynptr_write_proto = {
	.func		= bpf_dynptr_write,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_DYNPTR | MEM_RDONLY,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg4_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg5_type	= ARG_ANYTHING,
};

BPF_CALL_3(bpf_dynptr_data, const struct bpf_dynptr_kern *, ptr, u64, offset, u64, len)
{
	enum bpf_dynptr_type type;
	int err;

	if (!ptr->data)
		return 0;

	err = bpf_dynptr_check_off_len(ptr, offset, len);
	if (err)
		return 0;

	if (__bpf_dynptr_is_rdonly(ptr))
		return 0;

	type = bpf_dynptr_get_type(ptr);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		return (unsigned long)(ptr->data + ptr->offset + offset);
	case BPF_DYNPTR_TYPE_SKB:
	case BPF_DYNPTR_TYPE_XDP:
	case BPF_DYNPTR_TYPE_SKB_META:
		/* skb and xdp dynptrs should use bpf_dynptr_slice / bpf_dynptr_slice_rdwr */
		return 0;
	default:
		WARN_ONCE(true, "bpf_dynptr_data: unknown dynptr type %d\n", type);
		return 0;
	}
}

static const struct bpf_func_proto bpf_dynptr_data_proto = {
	.func		= bpf_dynptr_data,
	.gpl_only	= false,
	.ret_type	= RET_PTR_TO_DYNPTR_MEM_OR_NULL,
	.arg1_type	= ARG_PTR_TO_DYNPTR | MEM_RDONLY,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type	= ARG_CONST_ALLOC_SIZE_OR_ZERO,
};

const struct bpf_func_proto bpf_get_current_task_proto __weak;
const struct bpf_func_proto bpf_get_current_task_btf_proto __weak;
const struct bpf_func_proto bpf_probe_read_user_proto __weak;
const struct bpf_func_proto bpf_probe_read_user_str_proto __weak;
const struct bpf_func_proto bpf_probe_read_kernel_proto __weak;
const struct bpf_func_proto bpf_probe_read_kernel_str_proto __weak;
const struct bpf_func_proto bpf_task_pt_regs_proto __weak;
const struct bpf_func_proto bpf_perf_event_read_proto __weak;
const struct bpf_func_proto bpf_send_signal_proto __weak;
const struct bpf_func_proto bpf_send_signal_thread_proto __weak;
const struct bpf_func_proto bpf_get_task_stack_sleepable_proto __weak;
const struct bpf_func_proto bpf_get_task_stack_proto __weak;
const struct bpf_func_proto bpf_get_branch_snapshot_proto __weak;

const struct bpf_func_proto *
bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	switch (func_id) {
	case BPF_FUNC_map_lookup_elem:
		return &bpf_map_lookup_elem_proto;
	case BPF_FUNC_map_update_elem:
		return &bpf_map_update_elem_proto;
	case BPF_FUNC_map_delete_elem:
		return &bpf_map_delete_elem_proto;
	case BPF_FUNC_map_push_elem:
		return &bpf_map_push_elem_proto;
	case BPF_FUNC_map_pop_elem:
		return &bpf_map_pop_elem_proto;
	case BPF_FUNC_map_peek_elem:
		return &bpf_map_peek_elem_proto;
	case BPF_FUNC_map_lookup_percpu_elem:
		return &bpf_map_lookup_percpu_elem_proto;
	case BPF_FUNC_get_prandom_u32:
		return &bpf_get_prandom_u32_proto;
	case BPF_FUNC_get_smp_processor_id:
		return &bpf_get_raw_smp_processor_id_proto;
	case BPF_FUNC_get_numa_node_id:
		return &bpf_get_numa_node_id_proto;
	case BPF_FUNC_tail_call:
		return &bpf_tail_call_proto;
	case BPF_FUNC_ktime_get_ns:
		return &bpf_ktime_get_ns_proto;
	case BPF_FUNC_ktime_get_boot_ns:
		return &bpf_ktime_get_boot_ns_proto;
	case BPF_FUNC_ktime_get_tai_ns:
		return &bpf_ktime_get_tai_ns_proto;
	case BPF_FUNC_ringbuf_output:
		return &bpf_ringbuf_output_proto;
	case BPF_FUNC_ringbuf_reserve:
		return &bpf_ringbuf_reserve_proto;
	case BPF_FUNC_ringbuf_submit:
		return &bpf_ringbuf_submit_proto;
	case BPF_FUNC_ringbuf_discard:
		return &bpf_ringbuf_discard_proto;
	case BPF_FUNC_ringbuf_query:
		return &bpf_ringbuf_query_proto;
	case BPF_FUNC_strncmp:
		return &bpf_strncmp_proto;
	case BPF_FUNC_strtol:
		return &bpf_strtol_proto;
	case BPF_FUNC_strtoul:
		return &bpf_strtoul_proto;
	case BPF_FUNC_get_current_pid_tgid:
		return &bpf_get_current_pid_tgid_proto;
	case BPF_FUNC_get_ns_current_pid_tgid:
		return &bpf_get_ns_current_pid_tgid_proto;
	case BPF_FUNC_get_current_uid_gid:
		return &bpf_get_current_uid_gid_proto;
	default:
		break;
	}

	if (!bpf_token_capable(prog->aux->token, CAP_BPF))
		return NULL;

	switch (func_id) {
	case BPF_FUNC_spin_lock:
		return &bpf_spin_lock_proto;
	case BPF_FUNC_spin_unlock:
		return &bpf_spin_unlock_proto;
	case BPF_FUNC_jiffies64:
		return &bpf_jiffies64_proto;
	case BPF_FUNC_per_cpu_ptr:
		return &bpf_per_cpu_ptr_proto;
	case BPF_FUNC_this_cpu_ptr:
		return &bpf_this_cpu_ptr_proto;
	case BPF_FUNC_timer_init:
		return &bpf_timer_init_proto;
	case BPF_FUNC_timer_set_callback:
		return &bpf_timer_set_callback_proto;
	case BPF_FUNC_timer_start:
		return &bpf_timer_start_proto;
	case BPF_FUNC_timer_cancel:
		return &bpf_timer_cancel_proto;
	case BPF_FUNC_kptr_xchg:
		return &bpf_kptr_xchg_proto;
	case BPF_FUNC_for_each_map_elem:
		return &bpf_for_each_map_elem_proto;
	case BPF_FUNC_loop:
		return &bpf_loop_proto;
	case BPF_FUNC_user_ringbuf_drain:
		return &bpf_user_ringbuf_drain_proto;
	case BPF_FUNC_ringbuf_reserve_dynptr:
		return &bpf_ringbuf_reserve_dynptr_proto;
	case BPF_FUNC_ringbuf_submit_dynptr:
		return &bpf_ringbuf_submit_dynptr_proto;
	case BPF_FUNC_ringbuf_discard_dynptr:
		return &bpf_ringbuf_discard_dynptr_proto;
	case BPF_FUNC_dynptr_from_mem:
		return &bpf_dynptr_from_mem_proto;
	case BPF_FUNC_dynptr_read:
		return &bpf_dynptr_read_proto;
	case BPF_FUNC_dynptr_write:
		return &bpf_dynptr_write_proto;
	case BPF_FUNC_dynptr_data:
		return &bpf_dynptr_data_proto;
#ifdef CONFIG_CGROUPS
	case BPF_FUNC_cgrp_storage_get:
		return &bpf_cgrp_storage_get_proto;
	case BPF_FUNC_cgrp_storage_delete:
		return &bpf_cgrp_storage_delete_proto;
	case BPF_FUNC_get_current_cgroup_id:
		return &bpf_get_current_cgroup_id_proto;
	case BPF_FUNC_get_current_ancestor_cgroup_id:
		return &bpf_get_current_ancestor_cgroup_id_proto;
	case BPF_FUNC_current_task_under_cgroup:
		return &bpf_current_task_under_cgroup_proto;
#endif
#ifdef CONFIG_CGROUP_NET_CLASSID
	case BPF_FUNC_get_cgroup_classid:
		return &bpf_get_cgroup_classid_curr_proto;
#endif
	case BPF_FUNC_task_storage_get:
		return &bpf_task_storage_get_proto;
	case BPF_FUNC_task_storage_delete:
		return &bpf_task_storage_delete_proto;
	default:
		break;
	}

	if (!bpf_token_capable(prog->aux->token, CAP_PERFMON))
		return NULL;

	switch (func_id) {
	case BPF_FUNC_trace_printk:
		return bpf_get_trace_printk_proto();
	case BPF_FUNC_get_current_task:
		return &bpf_get_current_task_proto;
	case BPF_FUNC_get_current_task_btf:
		return &bpf_get_current_task_btf_proto;
	case BPF_FUNC_get_current_comm:
		return &bpf_get_current_comm_proto;
	case BPF_FUNC_probe_read_user:
		return &bpf_probe_read_user_proto;
	case BPF_FUNC_probe_read_kernel:
		return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
		       NULL : &bpf_probe_read_kernel_proto;
	case BPF_FUNC_probe_read_user_str:
		return &bpf_probe_read_user_str_proto;
	case BPF_FUNC_probe_read_kernel_str:
		return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
		       NULL : &bpf_probe_read_kernel_str_proto;
	case BPF_FUNC_copy_from_user:
		return &bpf_copy_from_user_proto;
	case BPF_FUNC_copy_from_user_task:
		return &bpf_copy_from_user_task_proto;
	case BPF_FUNC_snprintf_btf:
		return &bpf_snprintf_btf_proto;
	case BPF_FUNC_snprintf:
		return &bpf_snprintf_proto;
	case BPF_FUNC_task_pt_regs:
		return &bpf_task_pt_regs_proto;
	case BPF_FUNC_trace_vprintk:
		return bpf_get_trace_vprintk_proto();
	case BPF_FUNC_perf_event_read_value:
		return bpf_get_perf_event_read_value_proto();
	case BPF_FUNC_perf_event_read:
		return &bpf_perf_event_read_proto;
	case BPF_FUNC_send_signal:
		return &bpf_send_signal_proto;
	case BPF_FUNC_send_signal_thread:
		return &bpf_send_signal_thread_proto;
	case BPF_FUNC_get_task_stack:
		return prog->sleepable ? &bpf_get_task_stack_sleepable_proto
				       : &bpf_get_task_stack_proto;
	case BPF_FUNC_get_branch_snapshot:
		return &bpf_get_branch_snapshot_proto;
	case BPF_FUNC_find_vma:
		return &bpf_find_vma_proto;
	default:
		return NULL;
	}
}
EXPORT_SYMBOL_GPL(bpf_base_func_proto);

void bpf_list_head_free(const struct btf_field *field, void *list_head,
			struct bpf_spin_lock *spin_lock)
{
	struct list_head *head = list_head, *orig_head = list_head;

	BUILD_BUG_ON(sizeof(struct list_head) > sizeof(struct bpf_list_head));
	BUILD_BUG_ON(__alignof__(struct list_head) > __alignof__(struct bpf_list_head));

	/* Do the actual list draining outside the lock to not hold the lock for
	 * too long, and also prevent deadlocks if tracing programs end up
	 * executing on entry/exit of functions called inside the critical
	 * section, and end up doing map ops that call bpf_list_head_free for
	 * the same map value again.
	 */
	__bpf_spin_lock_irqsave(spin_lock);
	if (!head->next || list_empty(head))
		goto unlock;
	head = head->next;
unlock:
	INIT_LIST_HEAD(orig_head);
	__bpf_spin_unlock_irqrestore(spin_lock);

	while (head != orig_head) {
		void *obj = head;

		obj -= field->graph_root.node_offset;
		head = head->next;
		/* The contained type can also have resources, including a
		 * bpf_list_head which needs to be freed.
		 */
		__bpf_obj_drop_impl(obj, field->graph_root.value_rec, false);
	}
}

/* Like rbtree_postorder_for_each_entry_safe, but 'pos' and 'n' are
 * 'rb_node *', so field name of rb_node within containing struct is not
 * needed.
 *
 * Since bpf_rb_tree's node type has a corresponding struct btf_field with
 * graph_root.node_offset, it's not necessary to know field name
 * or type of node struct
 */
#define bpf_rbtree_postorder_for_each_entry_safe(pos, n, root) \
	for (pos = rb_first_postorder(root); \
	    pos && ({ n = rb_next_postorder(pos); 1; }); \
	    pos = n)

void bpf_rb_root_free(const struct btf_field *field, void *rb_root,
		      struct bpf_spin_lock *spin_lock)
{
	struct rb_root_cached orig_root, *root = rb_root;
	struct rb_node *pos, *n;
	void *obj;

	BUILD_BUG_ON(sizeof(struct rb_root_cached) > sizeof(struct bpf_rb_root));
	BUILD_BUG_ON(__alignof__(struct rb_root_cached) > __alignof__(struct bpf_rb_root));

	__bpf_spin_lock_irqsave(spin_lock);
	orig_root = *root;
	*root = RB_ROOT_CACHED;
	__bpf_spin_unlock_irqrestore(spin_lock);

	bpf_rbtree_postorder_for_each_entry_safe(pos, n, &orig_root.rb_root) {
		obj = pos;
		obj -= field->graph_root.node_offset;


		__bpf_obj_drop_impl(obj, field->graph_root.value_rec, false);
	}
}

__bpf_kfunc_start_defs();

/**
 * bpf_obj_new() - allocate an object described by program BTF
 * @local_type_id__k: type ID in program BTF
 * @meta: verifier-supplied struct metadata
 *
 * Allocate an object of the type identified by @local_type_id__k and
 * initialize its special fields. BPF programs can use
 * bpf_core_type_id_local() to provide @local_type_id__k. The verifier
 * rewrites @meta; BPF programs do not set it.
 *
 * Return: Pointer to the allocated object, or %NULL on failure.
 */
__bpf_kfunc void *bpf_obj_new(u64 local_type_id__k, struct btf_struct_meta *meta)
{
	u64 size = local_type_id__k;
	void *p;

	p = bpf_mem_alloc(&bpf_global_ma, size);
	if (!p)
		return NULL;
	if (meta)
		bpf_obj_init(meta->record, p);

	return p;
}

__bpf_kfunc void *bpf_obj_new_impl(u64 local_type_id__k, void *meta__ign)
{
	return bpf_obj_new(local_type_id__k, meta__ign);
}

/**
 * bpf_percpu_obj_new() - allocate a percpu object described by program BTF
 * @local_type_id__k: type ID in program BTF
 * @meta: verifier-supplied struct metadata
 *
 * Allocate a percpu object of the type identified by @local_type_id__k. BPF
 * programs can use bpf_core_type_id_local() to provide @local_type_id__k.
 * The verifier rewrites @meta; BPF programs do not set it.
 *
 * Return: Pointer to the allocated percpu object, or %NULL on failure.
 */
__bpf_kfunc void *bpf_percpu_obj_new(u64 local_type_id__k, struct btf_struct_meta *meta)
{
	u64 size = local_type_id__k;

	/* The verifier has ensured that meta must be NULL */
	return bpf_mem_alloc(&bpf_global_percpu_ma, size);
}

__bpf_kfunc void *bpf_percpu_obj_new_impl(u64 local_type_id__k, void *meta__ign)
{
	return bpf_percpu_obj_new(local_type_id__k, meta__ign);
}

/* Must be called under migrate_disable(), as required by bpf_mem_free */
void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu)
{
	struct bpf_mem_alloc *ma;

	if (rec && rec->refcount_off >= 0 &&
	    !refcount_dec_and_test((refcount_t *)(p + rec->refcount_off))) {
		/* Object is refcounted and refcount_dec didn't result in 0
		 * refcount. Return without freeing the object
		 */
		return;
	}

	if (rec)
		bpf_obj_free_fields(rec, p);

	if (percpu)
		ma = &bpf_global_percpu_ma;
	else
		ma = &bpf_global_ma;
	bpf_mem_free_rcu(ma, p);
}

/**
 * bpf_obj_drop() - drop a previously allocated object
 * @p__alloc: object to free
 * @meta: verifier-supplied struct metadata
 *
 * Destroy special fields in @p__alloc as needed and free the object. The
 * verifier rewrites @meta; BPF programs do not set it.
 */
__bpf_kfunc void bpf_obj_drop(void *p__alloc, struct btf_struct_meta *meta)
{
	void *p = p__alloc;

	__bpf_obj_drop_impl(p, meta ? meta->record : NULL, false);
}

__bpf_kfunc void bpf_obj_drop_impl(void *p__alloc, void *meta__ign)
{
	return bpf_obj_drop(p__alloc, meta__ign);
}

/**
 * bpf_percpu_obj_drop() - drop a previously allocated percpu object
 * @p__alloc: percpu object to free
 * @meta: verifier-supplied struct metadata
 *
 * Free @p__alloc. The verifier rewrites @meta; BPF programs do not set it.
 */
__bpf_kfunc void bpf_percpu_obj_drop(void *p__alloc, struct btf_struct_meta *meta)
{
	/* The verifier has ensured that meta must be NULL */
	bpf_mem_free_rcu(&bpf_global_percpu_ma, p__alloc);
}

__bpf_kfunc void bpf_percpu_obj_drop_impl(void *p__alloc, void *meta__ign)
{
	bpf_percpu_obj_drop(p__alloc, meta__ign);
}

/**
 * bpf_refcount_acquire() - turn a local kptr into an owning reference
 * @p__refcounted_kptr: non-owning local kptr
 * @meta: verifier-supplied struct metadata
 *
 * Increment the refcount for @p__refcounted_kptr. The verifier rewrites
 * @meta; BPF programs do not set it.
 *
 * Return: Owning reference to @p__refcounted_kptr, or %NULL on failure.
 */
__bpf_kfunc void *bpf_refcount_acquire(void *p__refcounted_kptr, struct btf_struct_meta *meta)
{
	struct bpf_refcount *ref;

	/* Could just cast directly to refcount_t *, but need some code using
	 * bpf_refcount type so that it is emitted in vmlinux BTF
	 */
	ref = (struct bpf_refcount *)(p__refcounted_kptr + meta->record->refcount_off);
	if (!refcount_inc_not_zero((refcount_t *)ref))
		return NULL;

	/* Verifier strips KF_RET_NULL if input is owned ref, see is_kfunc_ret_null
	 * in verifier.c
	 */
	return (void *)p__refcounted_kptr;
}

__bpf_kfunc void *bpf_refcount_acquire_impl(void *p__refcounted_kptr, void *meta__ign)
{
	return bpf_refcount_acquire(p__refcounted_kptr, meta__ign);
}

static int __bpf_list_add(struct bpf_list_node_kern *node,
			  struct bpf_list_head *head,
			  bool tail, struct btf_record *rec, u64 off)
{
	struct list_head *n = &node->list_head, *h = (void *)head;

	/* If list_head was 0-initialized by map, bpf_obj_init_field wasn't
	 * called on its fields, so init here
	 */
	if (unlikely(!h->next))
		INIT_LIST_HEAD(h);

	/* node->owner != NULL implies !list_empty(n), no need to separately
	 * check the latter
	 */
	if (cmpxchg(&node->owner, NULL, BPF_PTR_POISON)) {
		/* Only called from BPF prog, no need to migrate_disable */
		__bpf_obj_drop_impl((void *)n - off, rec, false);
		return -EINVAL;
	}

	tail ? list_add_tail(n, h) : list_add(n, h);
	WRITE_ONCE(node->owner, head);

	return 0;
}

/**
 * bpf_list_push_front() - add a node to the front of a BPF linked list
 * @head: list head
 * @node: node to insert
 * @meta: verifier-supplied struct metadata
 * @off: verifier-supplied offset of @node within the containing object
 *
 * Insert @node at the front of @head. The verifier rewrites @meta and @off;
 * BPF programs do not set them.
 *
 * Return: 0 on success, or %-EINVAL if @node is already linked.
 */
__bpf_kfunc int bpf_list_push_front(struct bpf_list_head *head,
				    struct bpf_list_node *node,
				    struct btf_struct_meta *meta,
				    u64 off)
{
	struct bpf_list_node_kern *n = (void *)node;

	return __bpf_list_add(n, head, false, meta ? meta->record : NULL, off);
}

__bpf_kfunc int bpf_list_push_front_impl(struct bpf_list_head *head,
					 struct bpf_list_node *node,
					 void *meta__ign, u64 off)
{
	return bpf_list_push_front(head, node, meta__ign, off);
}

/**
 * bpf_list_push_back() - add a node to the back of a BPF linked list
 * @head: list head
 * @node: node to insert
 * @meta: verifier-supplied struct metadata
 * @off: verifier-supplied offset of @node within the containing object
 *
 * Insert @node at the back of @head. The verifier rewrites @meta and @off;
 * BPF programs do not set them.
 *
 * Return: 0 on success, or %-EINVAL if @node is already linked.
 */
__bpf_kfunc int bpf_list_push_back(struct bpf_list_head *head,
				   struct bpf_list_node *node,
				   struct btf_struct_meta *meta,
				   u64 off)
{
	struct bpf_list_node_kern *n = (void *)node;

	return __bpf_list_add(n, head, true, meta ? meta->record : NULL, off);
}

__bpf_kfunc int bpf_list_push_back_impl(struct bpf_list_head *head,
					struct bpf_list_node *node,
					void *meta__ign, u64 off)
{
	return bpf_list_push_back(head, node, meta__ign, off);
}

static struct bpf_list_node *__bpf_list_del(struct bpf_list_head *head, bool tail)
{
	struct list_head *n, *h = (void *)head;
	struct bpf_list_node_kern *node;

	/* If list_head was 0-initialized by map, bpf_obj_init_field wasn't
	 * called on its fields, so init here
	 */
	if (unlikely(!h->next))
		INIT_LIST_HEAD(h);
	if (list_empty(h))
		return NULL;

	n = tail ? h->prev : h->next;
	node = container_of(n, struct bpf_list_node_kern, list_head);
	if (WARN_ON_ONCE(READ_ONCE(node->owner) != head))
		return NULL;

	list_del_init(n);
	WRITE_ONCE(node->owner, NULL);
	return (struct bpf_list_node *)n;
}

__bpf_kfunc struct bpf_list_node *bpf_list_pop_front(struct bpf_list_head *head)
{
	return __bpf_list_del(head, false);
}

__bpf_kfunc struct bpf_list_node *bpf_list_pop_back(struct bpf_list_head *head)
{
	return __bpf_list_del(head, true);
}

__bpf_kfunc struct bpf_list_node *bpf_list_front(struct bpf_list_head *head)
{
	struct list_head *h = (struct list_head *)head;

	if (list_empty(h) || unlikely(!h->next))
		return NULL;

	return (struct bpf_list_node *)h->next;
}

__bpf_kfunc struct bpf_list_node *bpf_list_back(struct bpf_list_head *head)
{
	struct list_head *h = (struct list_head *)head;

	if (list_empty(h) || unlikely(!h->next))
		return NULL;

	return (struct bpf_list_node *)h->prev;
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_remove(struct bpf_rb_root *root,
						  struct bpf_rb_node *node)
{
	struct bpf_rb_node_kern *node_internal = (struct bpf_rb_node_kern *)node;
	struct rb_root_cached *r = (struct rb_root_cached *)root;
	struct rb_node *n = &node_internal->rb_node;

	/* node_internal->owner != root implies either RB_EMPTY_NODE(n) or
	 * n is owned by some other tree. No need to check RB_EMPTY_NODE(n)
	 */
	if (READ_ONCE(node_internal->owner) != root)
		return NULL;

	rb_erase_cached(n, r);
	RB_CLEAR_NODE(n);
	WRITE_ONCE(node_internal->owner, NULL);
	return (struct bpf_rb_node *)n;
}

/* Need to copy rbtree_add_cached's logic here because our 'less' is a BPF
 * program
 */
static int __bpf_rbtree_add(struct bpf_rb_root *root,
			    struct bpf_rb_node_kern *node,
			    void *less, struct btf_record *rec, u64 off)
{
	struct rb_node **link = &((struct rb_root_cached *)root)->rb_root.rb_node;
	struct rb_node *parent = NULL, *n = &node->rb_node;
	bpf_callback_t cb = (bpf_callback_t)less;
	bool leftmost = true;

	/* node->owner != NULL implies !RB_EMPTY_NODE(n), no need to separately
	 * check the latter
	 */
	if (cmpxchg(&node->owner, NULL, BPF_PTR_POISON)) {
		/* Only called from BPF prog, no need to migrate_disable */
		__bpf_obj_drop_impl((void *)n - off, rec, false);
		return -EINVAL;
	}

	while (*link) {
		parent = *link;
		if (cb((uintptr_t)node, (uintptr_t)parent, 0, 0, 0)) {
			link = &parent->rb_left;
		} else {
			link = &parent->rb_right;
			leftmost = false;
		}
	}

	rb_link_node(n, parent, link);
	rb_insert_color_cached(n, (struct rb_root_cached *)root, leftmost);
	WRITE_ONCE(node->owner, root);
	return 0;
}

/**
 * bpf_rbtree_add() - add a node to a BPF rbtree
 * @root: tree root
 * @node: node to insert
 * @less: comparator used to order nodes
 * @meta: verifier-supplied struct metadata
 * @off: verifier-supplied offset of @node within the containing object
 *
 * Insert @node into @root using @less. The verifier rewrites @meta and @off;
 * BPF programs do not set them.
 *
 * Return: 0 on success, or %-EINVAL if @node is already linked in a tree.
 */
__bpf_kfunc int bpf_rbtree_add(struct bpf_rb_root *root,
			       struct bpf_rb_node *node,
			       bool (less)(struct bpf_rb_node *a, const struct bpf_rb_node *b),
			       struct btf_struct_meta *meta,
			       u64 off)
{
	struct bpf_rb_node_kern *n = (void *)node;

	return __bpf_rbtree_add(root, n, (void *)less, meta ? meta->record : NULL, off);
}

__bpf_kfunc int bpf_rbtree_add_impl(struct bpf_rb_root *root, struct bpf_rb_node *node,
				    bool (less)(struct bpf_rb_node *a, const struct bpf_rb_node *b),
				    void *meta__ign, u64 off)
{
	return bpf_rbtree_add(root, node, less, meta__ign, off);
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_first(struct bpf_rb_root *root)
{
	struct rb_root_cached *r = (struct rb_root_cached *)root;

	return (struct bpf_rb_node *)rb_first_cached(r);
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_root(struct bpf_rb_root *root)
{
	struct rb_root_cached *r = (struct rb_root_cached *)root;

	return (struct bpf_rb_node *)r->rb_root.rb_node;
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_left(struct bpf_rb_root *root, struct bpf_rb_node *node)
{
	struct bpf_rb_node_kern *node_internal = (struct bpf_rb_node_kern *)node;

	if (READ_ONCE(node_internal->owner) != root)
		return NULL;

	return (struct bpf_rb_node *)node_internal->rb_node.rb_left;
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_right(struct bpf_rb_root *root, struct bpf_rb_node *node)
{
	struct bpf_rb_node_kern *node_internal = (struct bpf_rb_node_kern *)node;

	if (READ_ONCE(node_internal->owner) != root)
		return NULL;

	return (struct bpf_rb_node *)node_internal->rb_node.rb_right;
}

/**
 * bpf_task_acquire - Acquire a reference to a task. A task acquired by this
 * kfunc which is not stored in a map as a kptr, must be released by calling
 * bpf_task_release().
 * @p: The task on which a reference is being acquired.
 */
__bpf_kfunc struct task_struct *bpf_task_acquire(struct task_struct *p)
{
	if (refcount_inc_not_zero(&p->rcu_users))
		return p;
	return NULL;
}

/**
 * bpf_task_release - Release the reference acquired on a task.
 * @p: The task on which a reference is being released.
 */
__bpf_kfunc void bpf_task_release(struct task_struct *p)
{
	put_task_struct_rcu_user(p);
}

__bpf_kfunc void bpf_task_release_dtor(void *p)
{
	put_task_struct_rcu_user(p);
}
CFI_NOSEAL(bpf_task_release_dtor);

#ifdef CONFIG_CGROUPS
/**
 * bpf_cgroup_acquire - Acquire a reference to a cgroup. A cgroup acquired by
 * this kfunc which is not stored in a map as a kptr, must be released by
 * calling bpf_cgroup_release().
 * @cgrp: The cgroup on which a reference is being acquired.
 */
__bpf_kfunc struct cgroup *bpf_cgroup_acquire(struct cgroup *cgrp)
{
	return cgroup_tryget(cgrp) ? cgrp : NULL;
}

/**
 * bpf_cgroup_release - Release the reference acquired on a cgroup.
 * If this kfunc is invoked in an RCU read region, the cgroup is guaranteed to
 * not be freed until the current grace period has ended, even if its refcount
 * drops to 0.
 * @cgrp: The cgroup on which a reference is being released.
 */
__bpf_kfunc void bpf_cgroup_release(struct cgroup *cgrp)
{
	cgroup_put(cgrp);
}

__bpf_kfunc void bpf_cgroup_release_dtor(void *cgrp)
{
	cgroup_put(cgrp);
}
CFI_NOSEAL(bpf_cgroup_release_dtor);

/**
 * bpf_cgroup_ancestor - Perform a lookup on an entry in a cgroup's ancestor
 * array. A cgroup returned by this kfunc which is not subsequently stored in a
 * map, must be released by calling bpf_cgroup_release().
 * @cgrp: The cgroup for which we're performing a lookup.
 * @level: The level of ancestor to look up.
 */
__bpf_kfunc struct cgroup *bpf_cgroup_ancestor(struct cgroup *cgrp, int level)
{
	struct cgroup *ancestor;

	if (level > cgrp->level || level < 0)
		return NULL;

	/* cgrp's refcnt could be 0 here, but ancestors can still be accessed */
	ancestor = cgrp->ancestors[level];
	if (!cgroup_tryget(ancestor))
		return NULL;
	return ancestor;
}

/**
 * bpf_cgroup_from_id - Find a cgroup from its ID. A cgroup returned by this
 * kfunc which is not subsequently stored in a map, must be released by calling
 * bpf_cgroup_release().
 * @cgid: cgroup id.
 */
__bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
{
	struct cgroup *cgrp;

	cgrp = __cgroup_get_from_id(cgid);
	if (IS_ERR(cgrp))
		return NULL;
	return cgrp;
}

/**
 * bpf_task_under_cgroup - wrap task_under_cgroup_hierarchy() as a kfunc, test
 * task's membership of cgroup ancestry.
 * @task: the task to be tested
 * @ancestor: possible ancestor of @task's cgroup
 *
 * Tests whether @task's default cgroup hierarchy is a descendant of @ancestor.
 * It follows all the same rules as cgroup_is_descendant, and only applies
 * to the default hierarchy.
 */
__bpf_kfunc long bpf_task_under_cgroup(struct task_struct *task,
				       struct cgroup *ancestor)
{
	long ret;

	rcu_read_lock();
	ret = task_under_cgroup_hierarchy(task, ancestor);
	rcu_read_unlock();
	return ret;
}

BPF_CALL_2(bpf_current_task_under_cgroup, struct bpf_map *, map, u32, idx)
{
	struct bpf_array *array = container_of(map, struct bpf_array, map);
	struct cgroup *cgrp;

	if (unlikely(idx >= array->map.max_entries))
		return -E2BIG;

	cgrp = READ_ONCE(array->ptrs[idx]);
	if (unlikely(!cgrp))
		return -EAGAIN;

	return task_under_cgroup_hierarchy(current, cgrp);
}

const struct bpf_func_proto bpf_current_task_under_cgroup_proto = {
	.func           = bpf_current_task_under_cgroup,
	.gpl_only       = false,
	.ret_type       = RET_INTEGER,
	.arg1_type      = ARG_CONST_MAP_PTR,
	.arg2_type      = ARG_ANYTHING,
};

/**
 * bpf_task_get_cgroup1 - Acquires the associated cgroup of a task within a
 * specific cgroup1 hierarchy. The cgroup1 hierarchy is identified by its
 * hierarchy ID.
 * @task: The target task
 * @hierarchy_id: The ID of a cgroup1 hierarchy
 *
 * On success, the cgroup is returen. On failure, NULL is returned.
 */
__bpf_kfunc struct cgroup *
bpf_task_get_cgroup1(struct task_struct *task, int hierarchy_id)
{
	struct cgroup *cgrp = task_get_cgroup1(task, hierarchy_id);

	if (IS_ERR(cgrp))
		return NULL;
	return cgrp;
}
#endif /* CONFIG_CGROUPS */

/**
 * bpf_task_from_pid - Find a struct task_struct from its pid by looking it up
 * in the root pid namespace idr. If a task is returned, it must either be
 * stored in a map, or released with bpf_task_release().
 * @pid: The pid of the task being looked up.
 */
__bpf_kfunc struct task_struct *bpf_task_from_pid(s32 pid)
{
	struct task_struct *p;

	rcu_read_lock();
	p = find_task_by_pid_ns(pid, &init_pid_ns);
	if (p)
		p = bpf_task_acquire(p);
	rcu_read_unlock();

	return p;
}

/**
 * bpf_task_from_vpid - Find a struct task_struct from its vpid by looking it up
 * in the pid namespace of the current task. If a task is returned, it must
 * either be stored in a map, or released with bpf_task_release().
 * @vpid: The vpid of the task being looked up.
 */
__bpf_kfunc struct task_struct *bpf_task_from_vpid(s32 vpid)
{
	struct task_struct *p;

	rcu_read_lock();
	p = find_task_by_vpid(vpid);
	if (p)
		p = bpf_task_acquire(p);
	rcu_read_unlock();

	return p;
}

/**
 * bpf_dynptr_slice() - Obtain a read-only pointer to the dynptr data.
 * @p: The dynptr whose data slice to retrieve
 * @offset: Offset into the dynptr
 * @buffer__nullable: User-provided buffer to copy contents into.  May be NULL
 * @buffer__szk: Size (in bytes) of the buffer if present. This is the
 *               length of the requested slice. This must be a constant.
 *
 * For non-skb and non-xdp type dynptrs, there is no difference between
 * bpf_dynptr_slice and bpf_dynptr_data.
 *
 *  If buffer__nullable is NULL, the call will fail if buffer_opt was needed.
 *
 * If the intention is to write to the data slice, please use
 * bpf_dynptr_slice_rdwr.
 *
 * The user must check that the returned pointer is not null before using it.
 *
 * Please note that in the case of skb and xdp dynptrs, bpf_dynptr_slice
 * does not change the underlying packet data pointers, so a call to
 * bpf_dynptr_slice will not invalidate any ctx->data/data_end pointers in
 * the bpf program.
 *
 * Return: NULL if the call failed (eg invalid dynptr), pointer to a read-only
 * data slice (can be either direct pointer to the data or a pointer to the user
 * provided buffer, with its contents containing the data, if unable to obtain
 * direct pointer)
 */
__bpf_kfunc void *bpf_dynptr_slice(const struct bpf_dynptr *p, u64 offset,
				   void *buffer__nullable, u64 buffer__szk)
{
	const struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
	enum bpf_dynptr_type type;
	u64 len = buffer__szk;
	int err;

	if (!ptr->data)
		return NULL;

	err = bpf_dynptr_check_off_len(ptr, offset, len);
	if (err)
		return NULL;

	type = bpf_dynptr_get_type(ptr);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		return ptr->data + ptr->offset + offset;
	case BPF_DYNPTR_TYPE_SKB:
		if (buffer__nullable)
			return skb_header_pointer(ptr->data, ptr->offset + offset, len, buffer__nullable);
		else
			return skb_pointer_if_linear(ptr->data, ptr->offset + offset, len);
	case BPF_DYNPTR_TYPE_XDP:
	{
		void *xdp_ptr = bpf_xdp_pointer(ptr->data, ptr->offset + offset, len);
		if (!IS_ERR_OR_NULL(xdp_ptr))
			return xdp_ptr;

		if (!buffer__nullable)
			return NULL;
		bpf_xdp_copy_buf(ptr->data, ptr->offset + offset, buffer__nullable, len, false);
		return buffer__nullable;
	}
	case BPF_DYNPTR_TYPE_SKB_META:
		return bpf_skb_meta_pointer(ptr->data, ptr->offset + offset);
	case BPF_DYNPTR_TYPE_FILE:
		err = bpf_file_fetch_bytes(ptr->data, offset, buffer__nullable, buffer__szk);
		return err ? NULL : buffer__nullable;
	default:
		WARN_ONCE(true, "unknown dynptr type %d\n", type);
		return NULL;
	}
}

/**
 * bpf_dynptr_slice_rdwr() - Obtain a writable pointer to the dynptr data.
 * @p: The dynptr whose data slice to retrieve
 * @offset: Offset into the dynptr
 * @buffer__nullable: User-provided buffer to copy contents into. May be NULL
 * @buffer__szk: Size (in bytes) of the buffer if present. This is the
 *               length of the requested slice. This must be a constant.
 *
 * For non-skb and non-xdp type dynptrs, there is no difference between
 * bpf_dynptr_slice and bpf_dynptr_data.
 *
 * If buffer__nullable is NULL, the call will fail if buffer_opt was needed.
 *
 * The returned pointer is writable and may point to either directly the dynptr
 * data at the requested offset or to the buffer if unable to obtain a direct
 * data pointer to (example: the requested slice is to the paged area of an skb
 * packet). In the case where the returned pointer is to the buffer, the user
 * is responsible for persisting writes through calling bpf_dynptr_write(). This
 * usually looks something like this pattern:
 *
 * struct eth_hdr *eth = bpf_dynptr_slice_rdwr(&dynptr, 0, buffer, sizeof(buffer));
 * if (!eth)
 *	return TC_ACT_SHOT;
 *
 * // mutate eth header //
 *
 * if (eth == buffer)
 *	bpf_dynptr_write(&ptr, 0, buffer, sizeof(buffer), 0);
 *
 * Please note that, as in the example above, the user must check that the
 * returned pointer is not null before using it.
 *
 * Please also note that in the case of skb and xdp dynptrs, bpf_dynptr_slice_rdwr
 * does not change the underlying packet data pointers, so a call to
 * bpf_dynptr_slice_rdwr will not invalidate any ctx->data/data_end pointers in
 * the bpf program.
 *
 * Return: NULL if the call failed (eg invalid dynptr), pointer to a
 * data slice (can be either direct pointer to the data or a pointer to the user
 * provided buffer, with its contents containing the data, if unable to obtain
 * direct pointer)
 */
__bpf_kfunc void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *p, u64 offset,
					void *buffer__nullable, u64 buffer__szk)
{
	const struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data || __bpf_dynptr_is_rdonly(ptr))
		return NULL;

	/* bpf_dynptr_slice_rdwr is the same logic as bpf_dynptr_slice.
	 *
	 * For skb-type dynptrs, it is safe to write into the returned pointer
	 * if the bpf program allows skb data writes. There are two possibilities
	 * that may occur when calling bpf_dynptr_slice_rdwr:
	 *
	 * 1) The requested slice is in the head of the skb. In this case, the
	 * returned pointer is directly to skb data, and if the skb is cloned, the
	 * verifier will have uncloned it (see bpf_unclone_prologue()) already.
	 * The pointer can be directly written into.
	 *
	 * 2) Some portion of the requested slice is in the paged buffer area.
	 * In this case, the requested data will be copied out into the buffer
	 * and the returned pointer will be a pointer to the buffer. The skb
	 * will not be pulled. To persist the write, the user will need to call
	 * bpf_dynptr_write(), which will pull the skb and commit the write.
	 *
	 * Similarly for xdp programs, if the requested slice is not across xdp
	 * fragments, then a direct pointer will be returned, otherwise the data
	 * will be copied out into the buffer and the user will need to call
	 * bpf_dynptr_write() to commit changes.
	 */
	return bpf_dynptr_slice(p, offset, buffer__nullable, buffer__szk);
}

__bpf_kfunc int bpf_dynptr_adjust(const struct bpf_dynptr *p, u64 start, u64 end)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
	u64 size;

	if (!ptr->data || start > end)
		return -EINVAL;

	size = __bpf_dynptr_size(ptr);

	if (start > size || end > size)
		return -ERANGE;

	bpf_dynptr_advance_offset(ptr, start);
	bpf_dynptr_set_size(ptr, end - start);

	return 0;
}

__bpf_kfunc bool bpf_dynptr_is_null(const struct bpf_dynptr *p)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	return !ptr->data;
}

__bpf_kfunc bool bpf_dynptr_is_rdonly(const struct bpf_dynptr *p)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data)
		return false;

	return __bpf_dynptr_is_rdonly(ptr);
}

__bpf_kfunc u64 bpf_dynptr_size(const struct bpf_dynptr *p)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data)
		return -EINVAL;

	return __bpf_dynptr_size(ptr);
}

__bpf_kfunc int bpf_dynptr_clone(const struct bpf_dynptr *p,
				 struct bpf_dynptr *clone__uninit)
{
	struct bpf_dynptr_kern *clone = (struct bpf_dynptr_kern *)clone__uninit;
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data) {
		bpf_dynptr_set_null(clone);
		return -EINVAL;
	}

	*clone = *ptr;

	return 0;
}

/**
 * bpf_dynptr_copy() - Copy data from one dynptr to another.
 * @dst_ptr: Destination dynptr - where data should be copied to
 * @dst_off: Offset into the destination dynptr
 * @src_ptr: Source dynptr - where data should be copied from
 * @src_off: Offset into the source dynptr
 * @size: Length of the data to copy from source to destination
 *
 * Copies data from source dynptr to destination dynptr.
 * Returns 0 on success; negative error, otherwise.
 */
__bpf_kfunc int bpf_dynptr_copy(struct bpf_dynptr *dst_ptr, u64 dst_off,
				struct bpf_dynptr *src_ptr, u64 src_off, u64 size)
{
	struct bpf_dynptr_kern *dst = (struct bpf_dynptr_kern *)dst_ptr;
	struct bpf_dynptr_kern *src = (struct bpf_dynptr_kern *)src_ptr;
	void *src_slice, *dst_slice;
	char buf[256];
	u64 off;

	src_slice = bpf_dynptr_slice(src_ptr, src_off, NULL, size);
	dst_slice = bpf_dynptr_slice_rdwr(dst_ptr, dst_off, NULL, size);

	if (src_slice && dst_slice) {
		memmove(dst_slice, src_slice, size);
		return 0;
	}

	if (src_slice)
		return __bpf_dynptr_write(dst, dst_off, src_slice, size, 0);

	if (dst_slice)
		return __bpf_dynptr_read(dst_slice, size, src, src_off, 0);

	if (bpf_dynptr_check_off_len(dst, dst_off, size) ||
	    bpf_dynptr_check_off_len(src, src_off, size))
		return -E2BIG;

	off = 0;
	while (off < size) {
		u64 chunk_sz = min_t(u64, sizeof(buf), size - off);
		int err;

		err = __bpf_dynptr_read(buf, chunk_sz, src, src_off + off, 0);
		if (err)
			return err;
		err = __bpf_dynptr_write(dst, dst_off + off, buf, chunk_sz, 0);
		if (err)
			return err;

		off += chunk_sz;
	}
	return 0;
}

/**
 * bpf_dynptr_memset() - Fill dynptr memory with a constant byte.
 * @p: Destination dynptr - where data will be filled
 * @offset: Offset into the dynptr to start filling from
 * @size: Number of bytes to fill
 * @val: Constant byte to fill the memory with
 *
 * Fills the @size bytes of the memory area pointed to by @p
 * at @offset with the constant byte @val.
 * Returns 0 on success; negative error, otherwise.
 */
__bpf_kfunc int bpf_dynptr_memset(struct bpf_dynptr *p, u64 offset, u64 size, u8 val)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
	u64 chunk_sz, write_off;
	char buf[256];
	void* slice;
	int err;

	slice = bpf_dynptr_slice_rdwr(p, offset, NULL, size);
	if (likely(slice)) {
		memset(slice, val, size);
		return 0;
	}

	if (__bpf_dynptr_is_rdonly(ptr))
		return -EINVAL;

	err = bpf_dynptr_check_off_len(ptr, offset, size);
	if (err)
		return err;

	/* Non-linear data under the dynptr, write from a local buffer */
	chunk_sz = min_t(u64, sizeof(buf), size);
	memset(buf, val, chunk_sz);

	for (write_off = 0; write_off < size; write_off += chunk_sz) {
		chunk_sz = min_t(u64, sizeof(buf), size - write_off);
		err = __bpf_dynptr_write(ptr, offset + write_off, buf, chunk_sz, 0);
		if (err)
			return err;
	}

	return 0;
}

__bpf_kfunc void *bpf_cast_to_kern_ctx(void *obj)
{
	return obj;
}

__bpf_kfunc void *bpf_rdonly_cast(const void *obj__ign, u32 btf_id__k)
{
	return (void *)obj__ign;
}

__bpf_kfunc void bpf_rcu_read_lock(void)
{
	rcu_read_lock();
}

__bpf_kfunc void bpf_rcu_read_unlock(void)
{
	rcu_read_unlock();
}

struct bpf_throw_ctx {
	struct bpf_prog_aux *aux;
	u64 sp;
	u64 bp;
	int cnt;
};

static bool bpf_stack_walker(void *cookie, u64 ip, u64 sp, u64 bp)
{
	struct bpf_throw_ctx *ctx = cookie;
	struct bpf_prog *prog;

	/*
	 * The RCU read lock is held to safely traverse the latch tree, but we
	 * don't need its protection when accessing the prog, since it has an
	 * active stack frame on the current stack trace, and won't disappear.
	 */
	rcu_read_lock();
	prog = bpf_prog_ksym_find(ip);
	rcu_read_unlock();
	if (!prog)
		return !ctx->cnt;
	ctx->cnt++;
	if (bpf_is_subprog(prog))
		return true;
	ctx->aux = prog->aux;
	ctx->sp = sp;
	ctx->bp = bp;
	return false;
}

__bpf_kfunc void bpf_throw(u64 cookie)
{
	struct bpf_throw_ctx ctx = {};

	arch_bpf_stack_walk(bpf_stack_walker, &ctx);
	WARN_ON_ONCE(!ctx.aux);
	if (ctx.aux)
		WARN_ON_ONCE(!ctx.aux->exception_boundary);
	WARN_ON_ONCE(!ctx.bp);
	WARN_ON_ONCE(!ctx.cnt);
	/* Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
	 * deeper stack depths than ctx.sp as we do not return from bpf_throw,
	 * which skips compiler generated instrumentation to do the same.
	 */
	kasan_unpoison_task_stack_below((void *)(long)ctx.sp);
	ctx.aux->bpf_exception_cb(cookie, ctx.sp, ctx.bp, 0, 0);
	WARN(1, "A call to BPF exception callback should never return\n");
}

__bpf_kfunc int bpf_wq_init(struct bpf_wq *wq, void *p__map, unsigned int flags)
{
	struct bpf_async_kern *async = (struct bpf_async_kern *)wq;
	struct bpf_map *map = p__map;

	BUILD_BUG_ON(sizeof(struct bpf_async_kern) > sizeof(struct bpf_wq));
	BUILD_BUG_ON(__alignof__(struct bpf_async_kern) != __alignof__(struct bpf_wq));

	if (flags)
		return -EINVAL;

	return __bpf_async_init(async, map, flags, BPF_ASYNC_TYPE_WQ);
}

__bpf_kfunc int bpf_wq_start(struct bpf_wq *wq, unsigned int flags)
{
	struct bpf_async_kern *async = (struct bpf_async_kern *)wq;
	struct bpf_work *w;

	if (flags)
		return -EINVAL;

	w = READ_ONCE(async->work);
	if (!w || !READ_ONCE(w->cb.prog))
		return -EINVAL;

	if (!refcount_inc_not_zero(&w->cb.refcnt))
		return -ENOENT;

	if (!defer_timer_wq_op()) {
		schedule_work(&w->work);
		bpf_async_refcount_put(&w->cb);
		return 0;
	} else {
		return bpf_async_schedule_op(&w->cb, BPF_ASYNC_START, 0, 0);
	}
}

__bpf_kfunc int bpf_wq_set_callback(struct bpf_wq *wq,
				    int (callback_fn)(void *map, int *key, void *value),
				    unsigned int flags,
				    struct bpf_prog_aux *aux)
{
	struct bpf_async_kern *async = (struct bpf_async_kern *)wq;

	if (flags)
		return -EINVAL;

	return __bpf_async_set_callback(async, callback_fn, aux->prog);
}

__bpf_kfunc void bpf_preempt_disable(void)
{
	preempt_disable();
}

__bpf_kfunc void bpf_preempt_enable(void)
{
	preempt_enable();
}

struct bpf_iter_bits {
	__u64 __opaque[2];
} __aligned(8);

#define BITS_ITER_NR_WORDS_MAX 511

struct bpf_iter_bits_kern {
	union {
		__u64 *bits;
		__u64 bits_copy;
	};
	int nr_bits;
	int bit;
} __aligned(8);

/* On 64-bit hosts, unsigned long and u64 have the same size, so passing
 * a u64 pointer and an unsigned long pointer to find_next_bit() will
 * return the same result, as both point to the same 8-byte area.
 *
 * For 32-bit little-endian hosts, using a u64 pointer or unsigned long
 * pointer also makes no difference. This is because the first iterated
 * unsigned long is composed of bits 0-31 of the u64 and the second unsigned
 * long is composed of bits 32-63 of the u64.
 *
 * However, for 32-bit big-endian hosts, this is not the case. The first
 * iterated unsigned long will be bits 32-63 of the u64, so swap these two
 * ulong values within the u64.
 */
static void swap_ulong_in_u64(u64 *bits, unsigned int nr)
{
#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
	unsigned int i;

	for (i = 0; i < nr; i++)
		bits[i] = (bits[i] >> 32) | ((u64)(u32)bits[i] << 32);
#endif
}

/**
 * bpf_iter_bits_new() - Initialize a new bits iterator for a given memory area
 * @it: The new bpf_iter_bits to be created
 * @unsafe_ptr__ign: A pointer pointing to a memory area to be iterated over
 * @nr_words: The size of the specified memory area, measured in 8-byte units.
 * The maximum value of @nr_words is @BITS_ITER_NR_WORDS_MAX. This limit may be
 * further reduced by the BPF memory allocator implementation.
 *
 * This function initializes a new bpf_iter_bits structure for iterating over
 * a memory area which is specified by the @unsafe_ptr__ign and @nr_words. It
 * copies the data of the memory area to the newly created bpf_iter_bits @it for
 * subsequent iteration operations.
 *
 * On success, 0 is returned. On failure, ERR is returned.
 */
__bpf_kfunc int
bpf_iter_bits_new(struct bpf_iter_bits *it, const u64 *unsafe_ptr__ign, u32 nr_words)
{
	struct bpf_iter_bits_kern *kit = (void *)it;
	u32 nr_bytes = nr_words * sizeof(u64);
	u32 nr_bits = BYTES_TO_BITS(nr_bytes);
	int err;

	BUILD_BUG_ON(sizeof(struct bpf_iter_bits_kern) != sizeof(struct bpf_iter_bits));
	BUILD_BUG_ON(__alignof__(struct bpf_iter_bits_kern) !=
		     __alignof__(struct bpf_iter_bits));

	kit->nr_bits = 0;
	kit->bits_copy = 0;
	kit->bit = -1;

	if (!unsafe_ptr__ign || !nr_words)
		return -EINVAL;
	if (nr_words > BITS_ITER_NR_WORDS_MAX)
		return -E2BIG;

	/* Optimization for u64 mask */
	if (nr_bits == 64) {
		err = bpf_probe_read_kernel_common(&kit->bits_copy, nr_bytes, unsafe_ptr__ign);
		if (err)
			return -EFAULT;

		swap_ulong_in_u64(&kit->bits_copy, nr_words);

		kit->nr_bits = nr_bits;
		return 0;
	}

	if (bpf_mem_alloc_check_size(false, nr_bytes))
		return -E2BIG;

	/* Fallback to memalloc */
	kit->bits = bpf_mem_alloc(&bpf_global_ma, nr_bytes);
	if (!kit->bits)
		return -ENOMEM;

	err = bpf_probe_read_kernel_common(kit->bits, nr_bytes, unsafe_ptr__ign);
	if (err) {
		bpf_mem_free(&bpf_global_ma, kit->bits);
		return err;
	}

	swap_ulong_in_u64(kit->bits, nr_words);

	kit->nr_bits = nr_bits;
	return 0;
}

/**
 * bpf_iter_bits_next() - Get the next bit in a bpf_iter_bits
 * @it: The bpf_iter_bits to be checked
 *
 * This function returns a pointer to a number representing the value of the
 * next bit in the bits.
 *
 * If there are no further bits available, it returns NULL.
 */
__bpf_kfunc int *bpf_iter_bits_next(struct bpf_iter_bits *it)
{
	struct bpf_iter_bits_kern *kit = (void *)it;
	int bit = kit->bit, nr_bits = kit->nr_bits;
	const void *bits;

	if (!nr_bits || bit >= nr_bits)
		return NULL;

	bits = nr_bits == 64 ? &kit->bits_copy : kit->bits;
	bit = find_next_bit(bits, nr_bits, bit + 1);
	if (bit >= nr_bits) {
		kit->bit = bit;
		return NULL;
	}

	kit->bit = bit;
	return &kit->bit;
}

/**
 * bpf_iter_bits_destroy() - Destroy a bpf_iter_bits
 * @it: The bpf_iter_bits to be destroyed
 *
 * Destroy the resource associated with the bpf_iter_bits.
 */
__bpf_kfunc void bpf_iter_bits_destroy(struct bpf_iter_bits *it)
{
	struct bpf_iter_bits_kern *kit = (void *)it;

	if (kit->nr_bits <= 64)
		return;
	bpf_mem_free(&bpf_global_ma, kit->bits);
}

/**
 * bpf_copy_from_user_str() - Copy a string from an unsafe user address
 * @dst:             Destination address, in kernel space.  This buffer must be
 *                   at least @dst__sz bytes long.
 * @dst__sz:         Maximum number of bytes to copy, includes the trailing NUL.
 * @unsafe_ptr__ign: Source address, in user space.
 * @flags:           The only supported flag is BPF_F_PAD_ZEROS
 *
 * Copies a NUL-terminated string from userspace to BPF space. If user string is
 * too long this will still ensure zero termination in the dst buffer unless
 * buffer size is 0.
 *
 * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
 * memset all of @dst on failure.
 */
__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__sz, const void __user *unsafe_ptr__ign, u64 flags)
{
	int ret;

	if (unlikely(flags & ~BPF_F_PAD_ZEROS))
		return -EINVAL;

	if (unlikely(!dst__sz))
		return 0;

	ret = strncpy_from_user(dst, unsafe_ptr__ign, dst__sz - 1);
	if (ret < 0) {
		if (flags & BPF_F_PAD_ZEROS)
			memset((char *)dst, 0, dst__sz);

		return ret;
	}

	if (flags & BPF_F_PAD_ZEROS)
		memset((char *)dst + ret, 0, dst__sz - ret);
	else
		((char *)dst)[ret] = '\0';

	return ret + 1;
}

/**
 * bpf_copy_from_user_task_str() - Copy a string from an task's address space
 * @dst:             Destination address, in kernel space.  This buffer must be
 *                   at least @dst__sz bytes long.
 * @dst__sz:         Maximum number of bytes to copy, includes the trailing NUL.
 * @unsafe_ptr__ign: Source address in the task's address space.
 * @tsk:             The task whose address space will be used
 * @flags:           The only supported flag is BPF_F_PAD_ZEROS
 *
 * Copies a NUL terminated string from a task's address space to @dst__sz
 * buffer. If user string is too long this will still ensure zero termination
 * in the @dst__sz buffer unless buffer size is 0.
 *
 * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst__sz to 0 on success
 * and memset all of @dst__sz on failure.
 *
 * Return: The number of copied bytes on success including the NUL terminator.
 * A negative error code on failure.
 */
__bpf_kfunc int bpf_copy_from_user_task_str(void *dst, u32 dst__sz,
					    const void __user *unsafe_ptr__ign,
					    struct task_struct *tsk, u64 flags)
{
	int ret;

	if (unlikely(flags & ~BPF_F_PAD_ZEROS))
		return -EINVAL;

	if (unlikely(dst__sz == 0))
		return 0;

	ret = copy_remote_vm_str(tsk, (unsigned long)unsafe_ptr__ign, dst, dst__sz, 0);
	if (ret < 0) {
		if (flags & BPF_F_PAD_ZEROS)
			memset(dst, 0, dst__sz);
		return ret;
	}

	if (flags & BPF_F_PAD_ZEROS)
		memset(dst + ret, 0, dst__sz - ret);

	return ret + 1;
}

/* Keep unsinged long in prototype so that kfunc is usable when emitted to
 * vmlinux.h in BPF programs directly, but note that while in BPF prog, the
 * unsigned long always points to 8-byte region on stack, the kernel may only
 * read and write the 4-bytes on 32-bit.
 */
__bpf_kfunc void bpf_local_irq_save(unsigned long *flags__irq_flag)
{
	local_irq_save(*flags__irq_flag);
}

__bpf_kfunc void bpf_local_irq_restore(unsigned long *flags__irq_flag)
{
	local_irq_restore(*flags__irq_flag);
}

__bpf_kfunc void __bpf_trap(void)
{
}

/*
 * Kfuncs for string operations.
 *
 * Since strings are not necessarily %NUL-terminated, we cannot directly call
 * in-kernel implementations. Instead, we open-code the implementations using
 * __get_kernel_nofault instead of plain dereference to make them safe.
 */

static int __bpf_strncasecmp(const char *s1, const char *s2, bool ignore_case, size_t len)
{
	char c1, c2;
	int i;

	if (!copy_from_kernel_nofault_allowed(s1, 1) ||
	    !copy_from_kernel_nofault_allowed(s2, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < len && i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&c1, s1, char, err_out);
		__get_kernel_nofault(&c2, s2, char, err_out);
		if (ignore_case) {
			c1 = tolower(c1);
			c2 = tolower(c2);
		}
		if (c1 != c2)
			return c1 < c2 ? -1 : 1;
		if (c1 == '\0')
			return 0;
		s1++;
		s2++;
	}
	return i == XATTR_SIZE_MAX ? -E2BIG : 0;
err_out:
	return -EFAULT;
}

/**
 * bpf_strcmp - Compare two strings
 * @s1__ign: One string
 * @s2__ign: Another string
 *
 * Return:
 * * %0       - Strings are equal
 * * %-1      - @s1__ign is smaller
 * * %1       - @s2__ign is smaller
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of strings is too large
 * * %-ERANGE - One of strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcmp(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strncasecmp(s1__ign, s2__ign, false, XATTR_SIZE_MAX);
}

/**
 * bpf_strcasecmp - Compare two strings, ignoring the case of the characters
 * @s1__ign: One string
 * @s2__ign: Another string
 *
 * Return:
 * * %0       - Strings are equal
 * * %-1      - @s1__ign is smaller
 * * %1       - @s2__ign is smaller
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of strings is too large
 * * %-ERANGE - One of strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcasecmp(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strncasecmp(s1__ign, s2__ign, true, XATTR_SIZE_MAX);
}

/*
 * bpf_strncasecmp - Compare two length-limited strings, ignoring case
 * @s1__ign: One string
 * @s2__ign: Another string
 * @len: The maximum number of characters to compare
 *
 * Return:
 * * %0       - Strings are equal
 * * %-1      - @s1__ign is smaller
 * * %1       - @s2__ign is smaller
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of strings is too large
 * * %-ERANGE - One of strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strncasecmp(const char *s1__ign, const char *s2__ign, size_t len)
{
	return __bpf_strncasecmp(s1__ign, s2__ign, true, len);
}

/**
 * bpf_strnchr - Find a character in a length limited string
 * @s__ign: The string to be searched
 * @count: The number of characters to be searched
 * @c: The character to search for
 *
 * Note that the %NUL-terminator is considered part of the string, and can
 * be searched for.
 *
 * Return:
 * * >=0      - Index of the first occurrence of @c within @s__ign
 * * %-ENOENT - @c not found in the first @count characters of @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strnchr(const char *s__ign, size_t count, char c)
{
	char sc;
	int i;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&sc, s__ign, char, err_out);
		if (sc == c)
			return i;
		if (sc == '\0')
			return -ENOENT;
		s__ign++;
	}
	return i == XATTR_SIZE_MAX ? -E2BIG : -ENOENT;
err_out:
	return -EFAULT;
}

/**
 * bpf_strchr - Find the first occurrence of a character in a string
 * @s__ign: The string to be searched
 * @c: The character to search for
 *
 * Note that the %NUL-terminator is considered part of the string, and can
 * be searched for.
 *
 * Return:
 * * >=0      - The index of the first occurrence of @c within @s__ign
 * * %-ENOENT - @c not found in @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strchr(const char *s__ign, char c)
{
	return bpf_strnchr(s__ign, XATTR_SIZE_MAX, c);
}

/**
 * bpf_strchrnul - Find and return a character in a string, or end of string
 * @s__ign: The string to be searched
 * @c: The character to search for
 *
 * Return:
 * * >=0      - Index of the first occurrence of @c within @s__ign or index of
 *              the null byte at the end of @s__ign when @c is not found
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strchrnul(const char *s__ign, char c)
{
	char sc;
	int i;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&sc, s__ign, char, err_out);
		if (sc == '\0' || sc == c)
			return i;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strrchr - Find the last occurrence of a character in a string
 * @s__ign: The string to be searched
 * @c: The character to search for
 *
 * Return:
 * * >=0      - Index of the last occurrence of @c within @s__ign
 * * %-ENOENT - @c not found in @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strrchr(const char *s__ign, int c)
{
	char sc;
	int i, last = -ENOENT;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&sc, s__ign, char, err_out);
		if (sc == c)
			last = i;
		if (sc == '\0')
			return last;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strnlen - Calculate the length of a length-limited string
 * @s__ign: The string
 * @count: The maximum number of characters to count
 *
 * Return:
 * * >=0      - The length of @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strnlen(const char *s__ign, size_t count)
{
	char c;
	int i;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&c, s__ign, char, err_out);
		if (c == '\0')
			return i;
		s__ign++;
	}
	return i == XATTR_SIZE_MAX ? -E2BIG : i;
err_out:
	return -EFAULT;
}

/**
 * bpf_strlen - Calculate the length of a string
 * @s__ign: The string
 *
 * Return:
 * * >=0      - The length of @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strlen(const char *s__ign)
{
	return bpf_strnlen(s__ign, XATTR_SIZE_MAX);
}

/**
 * bpf_strspn - Calculate the length of the initial substring of @s__ign which
 *              only contains letters in @accept__ign
 * @s__ign: The string to be searched
 * @accept__ign: The string to search for
 *
 * Return:
 * * >=0      - The length of the initial substring of @s__ign which only
 *              contains letters from @accept__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strspn(const char *s__ign, const char *accept__ign)
{
	char cs, ca;
	int i, j;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1) ||
	    !copy_from_kernel_nofault_allowed(accept__ign, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&cs, s__ign, char, err_out);
		if (cs == '\0')
			return i;
		for (j = 0; j < XATTR_SIZE_MAX; j++) {
			__get_kernel_nofault(&ca, accept__ign + j, char, err_out);
			if (cs == ca || ca == '\0')
				break;
		}
		if (j == XATTR_SIZE_MAX)
			return -E2BIG;
		if (ca == '\0')
			return i;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strcspn - Calculate the length of the initial substring of @s__ign which
 *               does not contain letters in @reject__ign
 * @s__ign: The string to be searched
 * @reject__ign: The string to search for
 *
 * Return:
 * * >=0      - The length of the initial substring of @s__ign which does not
 *              contain letters from @reject__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcspn(const char *s__ign, const char *reject__ign)
{
	char cs, cr;
	int i, j;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1) ||
	    !copy_from_kernel_nofault_allowed(reject__ign, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&cs, s__ign, char, err_out);
		if (cs == '\0')
			return i;
		for (j = 0; j < XATTR_SIZE_MAX; j++) {
			__get_kernel_nofault(&cr, reject__ign + j, char, err_out);
			if (cs == cr || cr == '\0')
				break;
		}
		if (j == XATTR_SIZE_MAX)
			return -E2BIG;
		if (cr != '\0')
			return i;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

static int __bpf_strnstr(const char *s1, const char *s2, size_t len,
			 bool ignore_case)
{
	char c1, c2;
	int i, j;

	if (!copy_from_kernel_nofault_allowed(s1, 1) ||
	    !copy_from_kernel_nofault_allowed(s2, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		for (j = 0; i + j <= len && j < XATTR_SIZE_MAX; j++) {
			__get_kernel_nofault(&c2, s2 + j, char, err_out);
			if (c2 == '\0')
				return i;
			/*
			 * We allow reading an extra byte from s2 (note the
			 * `i + j <= len` above) to cover the case when s2 is
			 * a suffix of the first len chars of s1.
			 */
			if (i + j == len)
				break;
			__get_kernel_nofault(&c1, s1 + j, char, err_out);

			if (ignore_case) {
				c1 = tolower(c1);
				c2 = tolower(c2);
			}

			if (c1 == '\0')
				return -ENOENT;
			if (c1 != c2)
				break;
		}
		if (j == XATTR_SIZE_MAX)
			return -E2BIG;
		if (i + j == len)
			return -ENOENT;
		s1++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strstr - Find the first substring in a string
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within @s1__ign
 * * %-ENOENT - @s2__ign is not a substring of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strstr(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strnstr(s1__ign, s2__ign, XATTR_SIZE_MAX, false);
}

/**
 * bpf_strcasestr - Find the first substring in a string, ignoring the case of
 *                  the characters
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within @s1__ign
 * * %-ENOENT - @s2__ign is not a substring of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcasestr(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strnstr(s1__ign, s2__ign, XATTR_SIZE_MAX, true);
}

/**
 * bpf_strnstr - Find the first substring in a length-limited string
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 * @len: the maximum number of characters to search
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within the first @len characters of @s1__ign
 * * %-ENOENT - @s2__ign not found in the first @len characters of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strnstr(const char *s1__ign, const char *s2__ign,
			    size_t len)
{
	return __bpf_strnstr(s1__ign, s2__ign, len, false);
}

/**
 * bpf_strncasestr - Find the first substring in a length-limited string,
 *                   ignoring the case of the characters
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 * @len: the maximum number of characters to search
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within the first @len characters of @s1__ign
 * * %-ENOENT - @s2__ign not found in the first @len characters of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strncasestr(const char *s1__ign, const char *s2__ign,
				size_t len)
{
	return __bpf_strnstr(s1__ign, s2__ign, len, true);
}

#ifdef CONFIG_KEYS
/**
 * bpf_lookup_user_key - lookup a key by its serial
 * @serial: key handle serial number
 * @flags: lookup-specific flags
 *
 * Search a key with a given *serial* and the provided *flags*.
 * If found, increment the reference count of the key by one, and
 * return it in the bpf_key structure.
 *
 * The bpf_key structure must be passed to bpf_key_put() when done
 * with it, so that the key reference count is decremented and the
 * bpf_key structure is freed.
 *
 * Permission checks are deferred to the time the key is used by
 * one of the available key-specific kfuncs.
 *
 * Set *flags* with KEY_LOOKUP_CREATE, to attempt creating a requested
 * special keyring (e.g. session keyring), if it doesn't yet exist.
 * Set *flags* with KEY_LOOKUP_PARTIAL, to lookup a key without waiting
 * for the key construction, and to retrieve uninstantiated keys (keys
 * without data attached to them).
 *
 * Return: a bpf_key pointer with a valid key pointer if the key is found, a
 *         NULL pointer otherwise.
 */
__bpf_kfunc struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags)
{
	key_ref_t key_ref;
	struct bpf_key *bkey;

	if (flags & ~KEY_LOOKUP_ALL)
		return NULL;

	/*
	 * Permission check is deferred until the key is used, as the
	 * intent of the caller is unknown here.
	 */
	key_ref = lookup_user_key(serial, flags, KEY_DEFER_PERM_CHECK);
	if (IS_ERR(key_ref))
		return NULL;

	bkey = kmalloc_obj(*bkey);
	if (!bkey) {
		key_put(key_ref_to_ptr(key_ref));
		return NULL;
	}

	bkey->key = key_ref_to_ptr(key_ref);
	bkey->has_ref = true;

	return bkey;
}

/**
 * bpf_lookup_system_key - lookup a key by a system-defined ID
 * @id: key ID
 *
 * Obtain a bpf_key structure with a key pointer set to the passed key ID.
 * The key pointer is marked as invalid, to prevent bpf_key_put() from
 * attempting to decrement the key reference count on that pointer. The key
 * pointer set in such way is currently understood only by
 * verify_pkcs7_signature().
 *
 * Set *id* to one of the values defined in include/linux/verification.h:
 * 0 for the primary keyring (immutable keyring of system keys);
 * VERIFY_USE_SECONDARY_KEYRING for both the primary and secondary keyring
 * (where keys can be added only if they are vouched for by existing keys
 * in those keyrings); VERIFY_USE_PLATFORM_KEYRING for the platform
 * keyring (primarily used by the integrity subsystem to verify a kexec'ed
 * kerned image and, possibly, the initramfs signature).
 *
 * Return: a bpf_key pointer with an invalid key pointer set from the
 *         pre-determined ID on success, a NULL pointer otherwise
 */
__bpf_kfunc struct bpf_key *bpf_lookup_system_key(u64 id)
{
	struct bpf_key *bkey;

	if (system_keyring_id_check(id) < 0)
		return NULL;

	bkey = kmalloc_obj(*bkey, GFP_ATOMIC);
	if (!bkey)
		return NULL;

	bkey->key = (struct key *)(unsigned long)id;
	bkey->has_ref = false;

	return bkey;
}

/**
 * bpf_key_put - decrement key reference count if key is valid and free bpf_key
 * @bkey: bpf_key structure
 *
 * Decrement the reference count of the key inside *bkey*, if the pointer
 * is valid, and free *bkey*.
 */
__bpf_kfunc void bpf_key_put(struct bpf_key *bkey)
{
	if (bkey->has_ref)
		key_put(bkey->key);

	kfree(bkey);
}

/**
 * bpf_verify_pkcs7_signature - verify a PKCS#7 signature
 * @data_p: data to verify
 * @sig_p: signature of the data
 * @trusted_keyring: keyring with keys trusted for signature verification
 *
 * Verify the PKCS#7 signature *sig_ptr* against the supplied *data_ptr*
 * with keys in a keyring referenced by *trusted_keyring*.
 *
 * Return: 0 on success, a negative value on error.
 */
__bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
			       struct bpf_dynptr *sig_p,
			       struct bpf_key *trusted_keyring)
{
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
	struct bpf_dynptr_kern *data_ptr = (struct bpf_dynptr_kern *)data_p;
	struct bpf_dynptr_kern *sig_ptr = (struct bpf_dynptr_kern *)sig_p;
	const void *data, *sig;
	u32 data_len, sig_len;
	int ret;

	if (trusted_keyring->has_ref) {
		/*
		 * Do the permission check deferred in bpf_lookup_user_key().
		 * See bpf_lookup_user_key() for more details.
		 *
		 * A call to key_task_permission() here would be redundant, as
		 * it is already done by keyring_search() called by
		 * find_asymmetric_key().
		 */
		ret = key_validate(trusted_keyring->key);
		if (ret < 0)
			return ret;
	}

	data_len = __bpf_dynptr_size(data_ptr);
	data = __bpf_dynptr_data(data_ptr, data_len);
	sig_len = __bpf_dynptr_size(sig_ptr);
	sig = __bpf_dynptr_data(sig_ptr, sig_len);

	return verify_pkcs7_signature(data, data_len, sig, sig_len,
				      trusted_keyring->key,
				      VERIFYING_BPF_SIGNATURE, NULL,
				      NULL);
#else
	return -EOPNOTSUPP;
#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
}
#endif /* CONFIG_KEYS */

typedef int (*bpf_task_work_callback_t)(struct bpf_map *map, void *key, void *value);

enum bpf_task_work_state {
	/* bpf_task_work is ready to be used */
	BPF_TW_STANDBY = 0,
	/* irq work scheduling in progress */
	BPF_TW_PENDING,
	/* task work scheduling in progress */
	BPF_TW_SCHEDULING,
	/* task work is scheduled successfully */
	BPF_TW_SCHEDULED,
	/* callback is running */
	BPF_TW_RUNNING,
	/* associated BPF map value is deleted */
	BPF_TW_FREED,
};

struct bpf_task_work_ctx {
	enum bpf_task_work_state state;
	refcount_t refcnt;
	struct callback_head work;
	struct irq_work irq_work;
	/* bpf_prog that schedules task work */
	struct bpf_prog *prog;
	/* task for which callback is scheduled */
	struct task_struct *task;
	/* the map and map value associated with this context */
	struct bpf_map *map;
	void *map_val;
	enum task_work_notify_mode mode;
	bpf_task_work_callback_t callback_fn;
	struct rcu_head rcu;
} __aligned(8);

/* Actual type for struct bpf_task_work */
struct bpf_task_work_kern {
	struct bpf_task_work_ctx *ctx;
};

static void bpf_task_work_ctx_reset(struct bpf_task_work_ctx *ctx)
{
	if (ctx->prog) {
		bpf_prog_put(ctx->prog);
		ctx->prog = NULL;
	}
	if (ctx->task) {
		bpf_task_release(ctx->task);
		ctx->task = NULL;
	}
}

static bool bpf_task_work_ctx_tryget(struct bpf_task_work_ctx *ctx)
{
	return refcount_inc_not_zero(&ctx->refcnt);
}

static void bpf_task_work_destroy(struct irq_work *irq_work)
{
	struct bpf_task_work_ctx *ctx = container_of(irq_work, struct bpf_task_work_ctx, irq_work);

	bpf_task_work_ctx_reset(ctx);
	kfree_rcu(ctx, rcu);
}

static void bpf_task_work_ctx_put(struct bpf_task_work_ctx *ctx)
{
	if (!refcount_dec_and_test(&ctx->refcnt))
		return;

	if (irqs_disabled()) {
		ctx->irq_work = IRQ_WORK_INIT(bpf_task_work_destroy);
		irq_work_queue(&ctx->irq_work);
	} else {
		bpf_task_work_destroy(&ctx->irq_work);
	}
}

static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
{
	/*
	 * Scheduled task_work callback holds ctx ref, so if we successfully
	 * cancelled, we put that ref on callback's behalf. If we couldn't
	 * cancel, callback will inevitably run or has already completed
	 * running, and it would have taken care of its ctx ref itself.
	 */
	if (task_work_cancel(ctx->task, &ctx->work))
		bpf_task_work_ctx_put(ctx);
}

static void bpf_task_work_callback(struct callback_head *cb)
{
	struct bpf_task_work_ctx *ctx = container_of(cb, struct bpf_task_work_ctx, work);
	enum bpf_task_work_state state;
	u32 idx;
	void *key;

	/* Read lock is needed to protect ctx and map key/value access */
	guard(rcu_tasks_trace)();
	/*
	 * This callback may start running before bpf_task_work_irq() switched to
	 * SCHEDULED state, so handle both transition variants SCHEDULING|SCHEDULED -> RUNNING.
	 */
	state = cmpxchg(&ctx->state, BPF_TW_SCHEDULING, BPF_TW_RUNNING);
	if (state == BPF_TW_SCHEDULED)
		state = cmpxchg(&ctx->state, BPF_TW_SCHEDULED, BPF_TW_RUNNING);
	if (state == BPF_TW_FREED) {
		bpf_task_work_ctx_put(ctx);
		return;
	}

	key = (void *)map_key_from_value(ctx->map, ctx->map_val, &idx);

	migrate_disable();
	ctx->callback_fn(ctx->map, key, ctx->map_val);
	migrate_enable();

	bpf_task_work_ctx_reset(ctx);
	(void)cmpxchg(&ctx->state, BPF_TW_RUNNING, BPF_TW_STANDBY);

	bpf_task_work_ctx_put(ctx);
}

static void bpf_task_work_irq(struct irq_work *irq_work)
{
	struct bpf_task_work_ctx *ctx = container_of(irq_work, struct bpf_task_work_ctx, irq_work);
	enum bpf_task_work_state state;
	int err;

	guard(rcu)();

	if (cmpxchg(&ctx->state, BPF_TW_PENDING, BPF_TW_SCHEDULING) != BPF_TW_PENDING) {
		bpf_task_work_ctx_put(ctx);
		return;
	}

	err = task_work_add(ctx->task, &ctx->work, ctx->mode);
	if (err) {
		bpf_task_work_ctx_reset(ctx);
		/*
		 * try to switch back to STANDBY for another task_work reuse, but we might have
		 * gone to FREED already, which is fine as we already cleaned up after ourselves
		 */
		(void)cmpxchg(&ctx->state, BPF_TW_SCHEDULING, BPF_TW_STANDBY);
		bpf_task_work_ctx_put(ctx);
		return;
	}

	/*
	 * It's technically possible for just scheduled task_work callback to
	 * complete running by now, going SCHEDULING -> RUNNING and then
	 * dropping its ctx refcount. Instead of capturing an extra ref just
	 * to protect below ctx->state access, we rely on rcu_read_lock
	 * above to prevent kfree_rcu from freeing ctx before we return.
	 */
	state = cmpxchg(&ctx->state, BPF_TW_SCHEDULING, BPF_TW_SCHEDULED);
	if (state == BPF_TW_FREED)
		bpf_task_work_cancel(ctx); /* clean up if we switched into FREED state */
}

static struct bpf_task_work_ctx *bpf_task_work_fetch_ctx(struct bpf_task_work *tw,
							 struct bpf_map *map)
{
	struct bpf_task_work_kern *twk = (void *)tw;
	struct bpf_task_work_ctx *ctx, *old_ctx;

	ctx = READ_ONCE(twk->ctx);
	if (ctx)
		return ctx;

	ctx = bpf_map_kmalloc_nolock(map, sizeof(*ctx), 0, NUMA_NO_NODE);
	if (!ctx)
		return ERR_PTR(-ENOMEM);

	memset(ctx, 0, sizeof(*ctx));
	refcount_set(&ctx->refcnt, 1); /* map's own ref */
	ctx->state = BPF_TW_STANDBY;

	old_ctx = cmpxchg(&twk->ctx, NULL, ctx);
	if (old_ctx) {
		/*
		 * tw->ctx is set by concurrent BPF program, release allocated
		 * memory and try to reuse already set context.
		 */
		kfree_nolock(ctx);
		return old_ctx;
	}

	return ctx; /* Success */
}

static struct bpf_task_work_ctx *bpf_task_work_acquire_ctx(struct bpf_task_work *tw,
							   struct bpf_map *map)
{
	struct bpf_task_work_ctx *ctx;

	/*
	 * Sleepable BPF programs hold rcu_read_lock_trace but not
	 * regular rcu_read_lock. Since kfree_rcu waits for regular
	 * RCU GP, the ctx can be freed while we're between reading
	 * the pointer and incrementing the refcount. Take regular
	 * rcu_read_lock to prevent kfree_rcu from freeing the ctx
	 * before we can tryget it.
	 */
	scoped_guard(rcu) {
		ctx = bpf_task_work_fetch_ctx(tw, map);
		if (IS_ERR(ctx))
			return ctx;

		/* try to get ref for task_work callback to hold */
		if (!bpf_task_work_ctx_tryget(ctx))
			return ERR_PTR(-EBUSY);
	}

	if (cmpxchg(&ctx->state, BPF_TW_STANDBY, BPF_TW_PENDING) != BPF_TW_STANDBY) {
		/* lost acquiring race or map_release_uref() stole it from us, put ref and bail */
		bpf_task_work_ctx_put(ctx);
		return ERR_PTR(-EBUSY);
	}

	/*
	 * If no process or bpffs is holding a reference to the map, no new callbacks should be
	 * scheduled. This does not address any race or correctness issue, but rather is a policy
	 * choice: dropping user references should stop everything.
	 */
	if (!atomic64_read(&map->usercnt)) {
		/* drop ref we just got for task_work callback itself */
		bpf_task_work_ctx_put(ctx);
		/* transfer map's ref into cancel_and_free() */
		bpf_task_work_cancel_and_free(tw);
		return ERR_PTR(-EBUSY);
	}

	return ctx;
}

static int bpf_task_work_schedule(struct task_struct *task, struct bpf_task_work *tw,
				  struct bpf_map *map, bpf_task_work_callback_t callback_fn,
				  struct bpf_prog_aux *aux, enum task_work_notify_mode mode)
{
	struct bpf_prog *prog;
	struct bpf_task_work_ctx *ctx;
	int err;

	BTF_TYPE_EMIT(struct bpf_task_work);

	prog = bpf_prog_inc_not_zero(aux->prog);
	if (IS_ERR(prog))
		return -EBADF;
	task = bpf_task_acquire(task);
	if (!task) {
		err = -EBADF;
		goto release_prog;
	}

	ctx = bpf_task_work_acquire_ctx(tw, map);
	if (IS_ERR(ctx)) {
		err = PTR_ERR(ctx);
		goto release_all;
	}

	ctx->task = task;
	ctx->callback_fn = callback_fn;
	ctx->prog = prog;
	ctx->mode = mode;
	ctx->map = map;
	ctx->map_val = (void *)tw - map->record->task_work_off;
	init_task_work(&ctx->work, bpf_task_work_callback);
	init_irq_work(&ctx->irq_work, bpf_task_work_irq);

	irq_work_queue(&ctx->irq_work);
	return 0;

release_all:
	bpf_task_release(task);
release_prog:
	bpf_prog_put(prog);
	return err;
}

/**
 * bpf_task_work_schedule_signal - Schedule BPF callback using task_work_add with TWA_SIGNAL
 * mode
 * @task: Task struct for which callback should be scheduled
 * @tw: Pointer to struct bpf_task_work in BPF map value for internal bookkeeping
 * @map__map: bpf_map that embeds struct bpf_task_work in the values
 * @callback: pointer to BPF subprogram to call
 * @aux: pointer to bpf_prog_aux of the caller BPF program, implicitly set by the verifier
 *
 * Return: 0 if task work has been scheduled successfully, negative error code otherwise
 */
__bpf_kfunc int bpf_task_work_schedule_signal(struct task_struct *task, struct bpf_task_work *tw,
					      void *map__map, bpf_task_work_callback_t callback,
					      struct bpf_prog_aux *aux)
{
	return bpf_task_work_schedule(task, tw, map__map, callback, aux, TWA_SIGNAL);
}

/**
 * bpf_task_work_schedule_resume - Schedule BPF callback using task_work_add with TWA_RESUME
 * mode
 * @task: Task struct for which callback should be scheduled
 * @tw: Pointer to struct bpf_task_work in BPF map value for internal bookkeeping
 * @map__map: bpf_map that embeds struct bpf_task_work in the values
 * @callback: pointer to BPF subprogram to call
 * @aux: pointer to bpf_prog_aux of the caller BPF program, implicitly set by the verifier
 *
 * Return: 0 if task work has been scheduled successfully, negative error code otherwise
 */
__bpf_kfunc int bpf_task_work_schedule_resume(struct task_struct *task, struct bpf_task_work *tw,
					      void *map__map, bpf_task_work_callback_t callback,
					      struct bpf_prog_aux *aux)
{
	return bpf_task_work_schedule(task, tw, map__map, callback, aux, TWA_RESUME);
}

static int make_file_dynptr(struct file *file, u32 flags, bool may_sleep,
			    struct bpf_dynptr_kern *ptr)
{
	struct bpf_dynptr_file_impl *state;

	/* flags is currently unsupported */
	if (flags) {
		bpf_dynptr_set_null(ptr);
		return -EINVAL;
	}

	state = kmalloc_nolock(sizeof(*state), 0, NUMA_NO_NODE);
	if (!state) {
		bpf_dynptr_set_null(ptr);
		return -ENOMEM;
	}
	state->offset = 0;
	state->size = U64_MAX; /* Don't restrict size, as file may change anyways */
	freader_init_from_file(&state->freader, NULL, 0, file, may_sleep);
	bpf_dynptr_init(ptr, state, BPF_DYNPTR_TYPE_FILE, 0, 0);
	bpf_dynptr_set_rdonly(ptr);
	return 0;
}

__bpf_kfunc int bpf_dynptr_from_file(struct file *file, u32 flags, struct bpf_dynptr *ptr__uninit)
{
	return make_file_dynptr(file, flags, false, (struct bpf_dynptr_kern *)ptr__uninit);
}

int bpf_dynptr_from_file_sleepable(struct file *file, u32 flags, struct bpf_dynptr *ptr__uninit)
{
	return make_file_dynptr(file, flags, true, (struct bpf_dynptr_kern *)ptr__uninit);
}

__bpf_kfunc int bpf_dynptr_file_discard(struct bpf_dynptr *dynptr)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)dynptr;
	struct bpf_dynptr_file_impl *df = ptr->data;

	if (!df)
		return 0;

	freader_cleanup(&df->freader);
	kfree_nolock(df);
	bpf_dynptr_set_null(ptr);
	return 0;
}

/**
 * bpf_timer_cancel_async - try to deactivate a timer
 * @timer:	bpf_timer to stop
 *
 * Returns:
 *
 *  *  0 when the timer was not active
 *  *  1 when the timer was active
 *  * -1 when the timer is currently executing the callback function and
 *       cannot be stopped
 *  * -ECANCELED when the timer will be cancelled asynchronously
 *  * -ENOMEM when out of memory
 *  * -EINVAL when the timer was not initialized
 *  * -ENOENT when this kfunc is racing with timer deletion
 */
__bpf_kfunc int bpf_timer_cancel_async(struct bpf_timer *timer)
{
	struct bpf_async_kern *async = (void *)timer;
	struct bpf_async_cb *cb;
	int ret;

	cb = READ_ONCE(async->cb);
	if (!cb)
		return -EINVAL;

	/*
	 * Unlike hrtimer_start() it's ok to synchronously call
	 * hrtimer_try_to_cancel() when refcnt reached zero, but deferring to
	 * irq_work is not, since irq callback may execute after RCU GP and
	 * cb could be freed at that time. Check for refcnt zero for
	 * consistency.
	 */
	if (!refcount_inc_not_zero(&cb->refcnt))
		return -ENOENT;

	if (!defer_timer_wq_op()) {
		struct bpf_hrtimer *t = container_of(cb, struct bpf_hrtimer, cb);

		ret = hrtimer_try_to_cancel(&t->timer);
		bpf_async_refcount_put(cb);
		return ret;
	} else {
		ret = bpf_async_schedule_op(cb, BPF_ASYNC_CANCEL, 0, 0);
		return ret ? ret : -ECANCELED;
	}
}

__bpf_kfunc_end_defs();

static void bpf_task_work_cancel_scheduled(struct irq_work *irq_work)
{
	struct bpf_task_work_ctx *ctx = container_of(irq_work, struct bpf_task_work_ctx, irq_work);

	bpf_task_work_cancel(ctx); /* this might put task_work callback's ref */
	bpf_task_work_ctx_put(ctx); /* and here we put map's own ref that was transferred to us */
}

void bpf_task_work_cancel_and_free(void *val)
{
	struct bpf_task_work_kern *twk = val;
	struct bpf_task_work_ctx *ctx;
	enum bpf_task_work_state state;

	ctx = xchg(&twk->ctx, NULL);
	if (!ctx)
		return;

	state = xchg(&ctx->state, BPF_TW_FREED);
	if (state == BPF_TW_SCHEDULED) {
		/* run in irq_work to avoid locks in NMI */
		init_irq_work(&ctx->irq_work, bpf_task_work_cancel_scheduled);
		irq_work_queue(&ctx->irq_work);
		return;
	}

	bpf_task_work_ctx_put(ctx); /* put bpf map's ref */
}

BTF_KFUNCS_START(generic_btf_ids)
#ifdef CONFIG_CRASH_DUMP
BTF_ID_FLAGS(func, crash_kexec, KF_DESTRUCTIVE)
#endif
BTF_ID_FLAGS(func, bpf_obj_new, KF_ACQUIRE | KF_RET_NULL | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_percpu_obj_new, KF_ACQUIRE | KF_RET_NULL | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_percpu_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_percpu_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_refcount_acquire, KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL | KF_RCU)
BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_list_push_front_impl)
BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_list_push_back_impl)
BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_rbtree_add_impl)
BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL)

#ifdef CONFIG_CGROUPS
BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_cgroup_release, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_cgroup_ancestor, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_cgroup_from_id, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_under_cgroup, KF_RCU)
BTF_ID_FLAGS(func, bpf_task_get_cgroup1, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
#endif
BTF_ID_FLAGS(func, bpf_task_from_pid, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_from_vpid, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_throw)
#ifdef CONFIG_BPF_EVENTS
BTF_ID_FLAGS(func, bpf_send_signal_task)
#endif
#ifdef CONFIG_KEYS
BTF_ID_FLAGS(func, bpf_lookup_user_key, KF_ACQUIRE | KF_RET_NULL | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE)
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE)
#endif
#endif
#ifdef CONFIG_S390
BTF_ID_FLAGS(func, bpf_get_lowcore)
#endif
BTF_KFUNCS_END(generic_btf_ids)

static const struct btf_kfunc_id_set generic_kfunc_set = {
	.owner = THIS_MODULE,
	.set   = &generic_btf_ids,
};


BTF_ID_LIST(generic_dtor_ids)
BTF_ID(struct, task_struct)
BTF_ID(func, bpf_task_release_dtor)
#ifdef CONFIG_CGROUPS
BTF_ID(struct, cgroup)
BTF_ID(func, bpf_cgroup_release_dtor)
#endif

BTF_KFUNCS_START(common_btf_ids)
BTF_ID_FLAGS(func, bpf_cast_to_kern_ctx, KF_FASTCALL)
BTF_ID_FLAGS(func, bpf_rdonly_cast, KF_FASTCALL)
BTF_ID_FLAGS(func, bpf_rcu_read_lock)
BTF_ID_FLAGS(func, bpf_rcu_read_unlock)
BTF_ID_FLAGS(func, bpf_dynptr_slice, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW)
BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_iter_task_vma_new, KF_ITER_NEW | KF_RCU)
BTF_ID_FLAGS(func, bpf_iter_task_vma_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_task_vma_destroy, KF_ITER_DESTROY)
#ifdef CONFIG_CGROUPS
BTF_ID_FLAGS(func, bpf_iter_css_task_new, KF_ITER_NEW)
BTF_ID_FLAGS(func, bpf_iter_css_task_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_css_task_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_iter_css_new, KF_ITER_NEW | KF_RCU_PROTECTED)
BTF_ID_FLAGS(func, bpf_iter_css_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_css_destroy, KF_ITER_DESTROY)
#endif
BTF_ID_FLAGS(func, bpf_iter_task_new, KF_ITER_NEW | KF_RCU_PROTECTED)
BTF_ID_FLAGS(func, bpf_iter_task_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_task_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_dynptr_adjust)
BTF_ID_FLAGS(func, bpf_dynptr_is_null)
BTF_ID_FLAGS(func, bpf_dynptr_is_rdonly)
BTF_ID_FLAGS(func, bpf_dynptr_size)
BTF_ID_FLAGS(func, bpf_dynptr_clone)
BTF_ID_FLAGS(func, bpf_dynptr_copy)
BTF_ID_FLAGS(func, bpf_dynptr_memset)
#ifdef CONFIG_NET
BTF_ID_FLAGS(func, bpf_modify_return_test_tp)
#endif
BTF_ID_FLAGS(func, bpf_wq_init)
BTF_ID_FLAGS(func, bpf_wq_set_callback, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_wq_start)
BTF_ID_FLAGS(func, bpf_preempt_disable)
BTF_ID_FLAGS(func, bpf_preempt_enable)
BTF_ID_FLAGS(func, bpf_iter_bits_new, KF_ITER_NEW)
BTF_ID_FLAGS(func, bpf_iter_bits_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_bits_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_copy_from_user_str, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_task_str, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_get_kmem_cache)
BTF_ID_FLAGS(func, bpf_iter_kmem_cache_new, KF_ITER_NEW | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_kmem_cache_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_kmem_cache_destroy, KF_ITER_DESTROY | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_local_irq_save)
BTF_ID_FLAGS(func, bpf_local_irq_restore)
#ifdef CONFIG_BPF_EVENTS
BTF_ID_FLAGS(func, bpf_probe_read_user_dynptr)
BTF_ID_FLAGS(func, bpf_probe_read_kernel_dynptr)
BTF_ID_FLAGS(func, bpf_probe_read_user_str_dynptr)
BTF_ID_FLAGS(func, bpf_probe_read_kernel_str_dynptr)
BTF_ID_FLAGS(func, bpf_copy_from_user_dynptr, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_str_dynptr, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_task_dynptr, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_task_str_dynptr, KF_SLEEPABLE)
#endif
#ifdef CONFIG_DMA_SHARED_BUFFER
BTF_ID_FLAGS(func, bpf_iter_dmabuf_new, KF_ITER_NEW | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_dmabuf_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_dmabuf_destroy, KF_ITER_DESTROY | KF_SLEEPABLE)
#endif
BTF_ID_FLAGS(func, __bpf_trap)
BTF_ID_FLAGS(func, bpf_strcmp);
BTF_ID_FLAGS(func, bpf_strcasecmp);
BTF_ID_FLAGS(func, bpf_strncasecmp);
BTF_ID_FLAGS(func, bpf_strchr);
BTF_ID_FLAGS(func, bpf_strchrnul);
BTF_ID_FLAGS(func, bpf_strnchr);
BTF_ID_FLAGS(func, bpf_strrchr);
BTF_ID_FLAGS(func, bpf_strlen);
BTF_ID_FLAGS(func, bpf_strnlen);
BTF_ID_FLAGS(func, bpf_strspn);
BTF_ID_FLAGS(func, bpf_strcspn);
BTF_ID_FLAGS(func, bpf_strstr);
BTF_ID_FLAGS(func, bpf_strcasestr);
BTF_ID_FLAGS(func, bpf_strnstr);
BTF_ID_FLAGS(func, bpf_strncasestr);
#if defined(CONFIG_BPF_LSM) && defined(CONFIG_CGROUPS)
BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU)
#endif
BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_dynptr_from_file)
BTF_ID_FLAGS(func, bpf_dynptr_file_discard)
BTF_ID_FLAGS(func, bpf_timer_cancel_async)
BTF_KFUNCS_END(common_btf_ids)

static const struct btf_kfunc_id_set common_kfunc_set = {
	.owner = THIS_MODULE,
	.set   = &common_btf_ids,
};

static int __init kfunc_init(void)
{
	int ret;
	const struct btf_id_dtor_kfunc generic_dtors[] = {
		{
			.btf_id       = generic_dtor_ids[0],
			.kfunc_btf_id = generic_dtor_ids[1]
		},
#ifdef CONFIG_CGROUPS
		{
			.btf_id       = generic_dtor_ids[2],
			.kfunc_btf_id = generic_dtor_ids[3]
		},
#endif
	};

	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &generic_kfunc_set);
	ret = ret ?: register_btf_id_dtor_kfuncs(generic_dtors,
						  ARRAY_SIZE(generic_dtors),
						  THIS_MODULE);
	return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_UNSPEC, &common_kfunc_set);
}

late_initcall(kfunc_init);

/* Get a pointer to dynptr data up to len bytes for read only access. If
 * the dynptr doesn't have continuous data up to len bytes, return NULL.
 */
const void *__bpf_dynptr_data(const struct bpf_dynptr_kern *ptr, u64 len)
{
	const struct bpf_dynptr *p = (struct bpf_dynptr *)ptr;

	return bpf_dynptr_slice(p, 0, NULL, len);
}

/* Get a pointer to dynptr data up to len bytes for read write access. If
 * the dynptr doesn't have continuous data up to len bytes, or the dynptr
 * is read only, return NULL.
 */
void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u64 len)
{
	if (__bpf_dynptr_is_rdonly(ptr))
		return NULL;
	return (void *)__bpf_dynptr_data(ptr, len);
}

void bpf_map_free_internal_structs(struct bpf_map *map, void *val)
{
	if (btf_record_has_field(map->record, BPF_TIMER))
		bpf_obj_free_timer(map->record, val);
	if (btf_record_has_field(map->record, BPF_WORKQUEUE))
		bpf_obj_free_workqueue(map->record, val);
	if (btf_record_has_field(map->record, BPF_TASK_WORK))
		bpf_obj_free_task_work(map->record, val);
}
]

gemini-3.1-pro-preview

							input: 99076
							output: 36
							thoughts: 251
						

**Analyzing the BPF Tracepoint Formatting Logic**

Okay, so I'm looking at how `bpf_snprintf` works, and I see it delegates the core formatting to `bpf_bprintf_prepare`.  That's standard, good abstraction. Let me look at that function. Aha, inside `bpf_bprintf_prepare`, I'm seeing a section dedicated to handling the format specifier `%pB`. This is interesting; I need to understand what this is. From the code, it looks like it does a `snprintf` to a temporary buffer, in the case that `tmp_buf` exists. Okay, so now I am thinking that `%pB` is going to be for `print_symbol`.

Now, the format specifier `%pB` is unfamiliar. I recall that I am going to have to look it up in `lib/vsprintf.c` to see what is going on. This is likely related to displaying something symbolic, perhaps a backtrace or some kind of symbolic representation, given the "B" and the "p" (pointer).

map[ContextFile:lib/vsprintf.c IncludeLines:true Name:pointer]

map[SourceCode:2388:	/*
2389:	 * Show a '%p' thing.  A kernel extension is that the '%p' is followed
2390:	 * by an extra set of alphanumeric characters that are extended format
2391:	 * specifiers.
2392:	 *
2393:	 * Please update scripts/checkpatch.pl when adding/removing conversion
2394:	 * characters.  (Search for "check for vsprintf extension").
2395:	 *
2396:	 * Right now we handle:
2397:	 *
2398:	 * - 'S' For symbolic direct pointers (or function descriptors) with offset
2399:	 * - 's' For symbolic direct pointers (or function descriptors) without offset
2400:	 * - '[Ss]R' as above with __builtin_extract_return_addr() translation
2401:	 * - 'S[R]b' as above with module build ID (for use in backtraces)
2402:	 * - '[Ff]' %pf and %pF were obsoleted and later removed in favor of
2403:	 *	    %ps and %pS. Be careful when re-using these specifiers.
2404:	 * - 'B' For backtraced symbolic direct pointers with offset
2405:	 * - 'Bb' as above with module build ID (for use in backtraces)
2406:	 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
2407:	 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
2408:	 * - 'ra' For struct ranges, e.g., [range 0x0000000000000000 - 0x00000000000000ff]
2409:	 * - 'b[l]' For a bitmap, the number of bits is determined by the field
2410:	 *       width which must be explicitly specified either as part of the
2411:	 *       format string '%32b[l]' or through '%*b[l]', [l] selects
2412:	 *       range-list format instead of hex format
2413:	 * - 'M' For a 6-byte MAC address, it prints the address in the
2414:	 *       usual colon-separated hex notation
2415:	 * - 'm' For a 6-byte MAC address, it prints the hex address without colons
2416:	 * - 'MF' For a 6-byte MAC FDDI address, it prints the address
2417:	 *       with a dash-separated hex notation
2418:	 * - '[mM]R' For a 6-byte MAC address, Reverse order (Bluetooth)
2419:	 * - 'I' [46] for IPv4/IPv6 addresses printed in the usual way
2420:	 *       IPv4 uses dot-separated decimal without leading 0's (1.2.3.4)
2421:	 *       IPv6 uses colon separated network-order 16 bit hex with leading 0's
2422:	 *       [S][pfs]
2423:	 *       Generic IPv4/IPv6 address (struct sockaddr *) that falls back to
2424:	 *       [4] or [6] and is able to print port [p], flowinfo [f], scope [s]
2425:	 * - 'i' [46] for 'raw' IPv4/IPv6 addresses
2426:	 *       IPv6 omits the colons (01020304...0f)
2427:	 *       IPv4 uses dot-separated decimal with leading 0's (010.123.045.006)
2428:	 *       [S][pfs]
2429:	 *       Generic IPv4/IPv6 address (struct sockaddr *) that falls back to
2430:	 *       [4] or [6] and is able to print port [p], flowinfo [f], scope [s]
2431:	 * - '[Ii][4S][hnbl]' IPv4 addresses in host, network, big or little endian order
2432:	 * - 'I[6S]c' for IPv6 addresses printed as specified by
2433:	 *       https://tools.ietf.org/html/rfc5952
2434:	 * - 'E[achnops]' For an escaped buffer, where rules are defined by combination
2435:	 *                of the following flags (see string_escape_mem() for the
2436:	 *                details):
2437:	 *                  a - ESCAPE_ANY
2438:	 *                  c - ESCAPE_SPECIAL
2439:	 *                  h - ESCAPE_HEX
2440:	 *                  n - ESCAPE_NULL
2441:	 *                  o - ESCAPE_OCTAL
2442:	 *                  p - ESCAPE_NP
2443:	 *                  s - ESCAPE_SPACE
2444:	 *                By default ESCAPE_ANY_NP is used.
2445:	 * - 'U' For a 16 byte UUID/GUID, it prints the UUID/GUID in the form
2446:	 *       "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
2447:	 *       Options for %pU are:
2448:	 *         b big endian lower case hex (default)
2449:	 *         B big endian UPPER case hex
2450:	 *         l little endian lower case hex
2451:	 *         L little endian UPPER case hex
2452:	 *           big endian output byte order is:
2453:	 *             [0][1][2][3]-[4][5]-[6][7]-[8][9]-[10][11][12][13][14][15]
2454:	 *           little endian output byte order is:
2455:	 *             [3][2][1][0]-[5][4]-[7][6]-[8][9]-[10][11][12][13][14][15]
2456:	 * - 'V' For a struct va_format which contains a format string * and va_list *,
2457:	 *       call vsnprintf(->format, *->va_list).
2458:	 *       Implements a "recursive vsnprintf".
2459:	 *       Do not use this feature without some mechanism to verify the
2460:	 *       correctness of the format string and va_list arguments.
2461:	 * - 'K' For a kernel pointer that should be hidden from unprivileged users.
2462:	 *       Use only for procfs, sysfs and similar files, not printk(); please
2463:	 *       read the documentation (path below) first.
2464:	 * - 'NF' For a netdev_features_t
2465:	 * - '4cc' V4L2 or DRM FourCC code, with endianness and raw numerical value.
2466:	 * - '4c[h[R]lb]' For generic FourCC code with raw numerical value. Both are
2467:	 *	 displayed in the big-endian format. This is the opposite of V4L2 or
2468:	 *	 DRM FourCCs.
2469:	 *	 The additional specifiers define what endianness is used to load
2470:	 *	 the stored bytes. The data might be interpreted using the host,
2471:	 *	 reversed host byte order, little-endian, or big-endian.
2472:	 * - 'h[CDN]' For a variable-length buffer, it prints it as a hex string with
2473:	 *            a certain separator (' ' by default):
2474:	 *              C colon
2475:	 *              D dash
2476:	 *              N no separator
2477:	 *            The maximum supported length is 64 bytes of the input. Consider
2478:	 *            to use print_hex_dump() for the larger input.
2479:	 * - 'a[pd]' For address types [p] phys_addr_t, [d] dma_addr_t and derivatives
2480:	 *           (default assumed to be phys_addr_t, passed by reference)
2481:	 * - 'd[234]' For a dentry name (optionally 2-4 last components)
2482:	 * - 'D[234]' Same as 'd' but for a struct file
2483:	 * - 'g' For block_device name (gendisk + partition number)
2484:	 * - 't[RST][dt][r][s]' For time and date as represented by:
2485:	 *      R    struct rtc_time
2486:	 *      S    struct timespec64
2487:	 *      T    time64_t
2488:	 * - 'tSp' For time represented by struct timespec64 printed as <seconds>.<nanoseconds>
2489:	 * - 'C' For a clock, it prints the name (Common Clock Framework) or address
2490:	 *       (legacy clock framework) of the clock
2491:	 * - 'G' For flags to be printed as a collection of symbolic strings that would
2492:	 *       construct the specific value. Supported flags given by option:
2493:	 *       p page flags (see struct page) given as pointer to unsigned long
2494:	 *       g gfp flags (GFP_* and __GFP_*) given as pointer to gfp_t
2495:	 *       v vma flags (VM_*) given as pointer to unsigned long
2496:	 * - 'OF[fnpPcCF]'  For a device tree object
2497:	 *                  Without any optional arguments prints the full_name
2498:	 *                  f device node full_name
2499:	 *                  n device node name
2500:	 *                  p device node phandle
2501:	 *                  P device node path spec (name + @unit)
2502:	 *                  F device node flags
2503:	 *                  c major compatible string
2504:	 *                  C full compatible string
2505:	 * - 'fw[fP]'	For a firmware node (struct fwnode_handle) pointer
2506:	 *		Without an option prints the full name of the node
2507:	 *		f full name
2508:	 *		P node name, including a possible unit address
2509:	 * - 'x' For printing the address unmodified. Equivalent to "%lx".
2510:	 *       Please read the documentation (path below) before using!
2511:	 * - '[ku]s' For a BPF/tracing related format specifier, e.g. used out of
2512:	 *           bpf_trace_printk() where [ku] prefix specifies either kernel (k)
2513:	 *           or user (u) memory to probe, and:
2514:	 *              s a string, equivalent to "%s" on direct vsnprintf() use
2515:	 *
2516:	 * ** When making changes please also update:
2517:	 *	Documentation/core-api/printk-formats.rst
2518:	 *
2519:	 * Note: The default behaviour (unadorned %p) is to hash the address,
2520:	 * rendering it useful as a unique identifier.
2521:	 *
2522:	 * There is also a '%pA' format specifier, but it is only intended to be used
2523:	 * from Rust code to format core::fmt::Arguments. Do *not* use it from C.
2524:	 * See rust/kernel/print.rs for details.
2525:	 */
2526:	static noinline_for_stack
2527:	char *pointer(const char *fmt, char *buf, char *end, void *ptr,
2528:		      struct printf_spec spec)
2529:	{
2530:		switch (*fmt) {
2531:		case 'S':
2532:		case 's':
2533:			ptr = dereference_symbol_descriptor(ptr);
2534:			fallthrough;
2535:		case 'B':
2536:			return symbol_string(buf, end, ptr, spec, fmt);
2537:		case 'R':
2538:		case 'r':
2539:			return resource_or_range(fmt, buf, end, ptr, spec);
2540:		case 'h':
2541:			return hex_string(buf, end, ptr, spec, fmt);
2542:		case 'b':
2543:			switch (fmt[1]) {
2544:			case 'l':
2545:				return bitmap_list_string(buf, end, ptr, spec, fmt);
2546:			default:
2547:				return bitmap_string(buf, end, ptr, spec, fmt);
2548:			}
2549:		case 'M':			/* Colon separated: 00:01:02:03:04:05 */
2550:		case 'm':			/* Contiguous: 000102030405 */
2551:						/* [mM]F (FDDI) */
2552:						/* [mM]R (Reverse order; Bluetooth) */
2553:			return mac_address_string(buf, end, ptr, spec, fmt);
2554:		case 'I':			/* Formatted IP supported
2555:						 * 4:	1.2.3.4
2556:						 * 6:	0001:0203:...:0708
2557:						 * 6c:	1::708 or 1::1.2.3.4
2558:						 */
2559:		case 'i':			/* Contiguous:
2560:						 * 4:	001.002.003.004
2561:						 * 6:   000102...0f
2562:						 */
2563:			return ip_addr_string(buf, end, ptr, spec, fmt);
2564:		case 'E':
2565:			return escaped_string(buf, end, ptr, spec, fmt);
2566:		case 'U':
2567:			return uuid_string(buf, end, ptr, spec, fmt);
2568:		case 'V':
2569:			return va_format(buf, end, ptr, spec);
2570:		case 'K':
2571:			return restricted_pointer(buf, end, ptr, spec);
2572:		case 'N':
2573:			return netdev_bits(buf, end, ptr, spec, fmt);
2574:		case '4':
2575:			return fourcc_string(buf, end, ptr, spec, fmt);
2576:		case 'a':
2577:			return address_val(buf, end, ptr, spec, fmt);
2578:		case 'd':
2579:			return dentry_name(buf, end, ptr, spec, fmt);
2580:		case 't':
2581:			return time_and_date(buf, end, ptr, spec, fmt);
2582:		case 'C':
2583:			return clock(buf, end, ptr, spec, fmt);
2584:		case 'D':
2585:			return file_dentry_name(buf, end, ptr, spec, fmt);
2586:	#ifdef CONFIG_BLOCK
2587:		case 'g':
2588:			return bdev_name(buf, end, ptr, spec, fmt);
2589:	#endif
2590:	
2591:		case 'G':
2592:			return flags_string(buf, end, ptr, spec, fmt);
2593:		case 'O':
2594:			return device_node_string(buf, end, ptr, spec, fmt + 1);
2595:		case 'f':
2596:			return fwnode_string(buf, end, ptr, spec, fmt + 1);
2597:		case 'A':
2598:			if (!IS_ENABLED(CONFIG_RUST)) {
2599:				WARN_ONCE(1, "Please remove %%pA from non-Rust code\n");
2600:				return error_string(buf, end, "(%pA?)", spec);
2601:			}
2602:			return rust_fmt_argument(buf, end, ptr);
2603:		case 'x':
2604:			return pointer_string(buf, end, ptr, spec);
2605:		case 'e':
2606:			/* %pe with a non-ERR_PTR gets treated as plain %p */
2607:			if (!IS_ERR(ptr))
2608:				return default_pointer(buf, end, ptr, spec);
2609:			return err_ptr(buf, end, ptr, spec);
2610:		case 'u':
2611:		case 'k':
2612:			switch (fmt[1]) {
2613:			case 's':
2614:				return string(buf, end, ptr, spec);
2615:			default:
2616:				return error_string(buf, end, "(einval)", spec);
2617:			}
2618:		default:
2619:			return default_pointer(buf, end, ptr, spec);
2620:		}
2621:	}
 SourceFile:lib/vsprintf.c]

gemini-3.1-pro-preview

							input: 104235
							output: 38
							thoughts: 272
						

**Decoding the `%pB` Format Specifier**

Okay, so `%pB`... that's for backtraced symbolic direct pointers with an offset. It's calling `symbol_string(buf, end, ptr, spec, fmt);` - so, it's clearly related to symbolic representation of memory addresses. Let me think... what exactly is the flow here?

Right, `bpf_bprintf_prepare` does some work on the format string. Ah, here it is:

```c
			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}

				i++;
				num_spec++;
				continue;
			}
```

So, if it encounters `%pB`, and `tmp_buf` isn't NULL, it's using `snprintf` with `%pB`. Interesting. It's using `raw_args[num_spec]` as the address. And, if `tmp_buf` is filled with `%pB`, it is calling `snprintf` with `%pB` using `raw_args[num_spec]`. I was almost thinking that `snprintf` with `%pB` would print the backtrace of the *current* task - but no. It's printing the symbol name of the address `raw_args[num_spec]`.

Now, does `symbol_string` use `sprint_backtrace` or `sprint_symbol`? That's the key. I should look into `symbol_string` function located in `lib/vsprintf.c` and see what it does.

map[ContextFile:lib/vsprintf.c IncludeLines:true Name:symbol_string]

map[SourceCode: 990:	static noinline_for_stack
 991:	char *symbol_string(char *buf, char *end, void *ptr,
 992:			    struct printf_spec spec, const char *fmt)
 993:	{
 994:		unsigned long value;
 995:	#ifdef CONFIG_KALLSYMS
 996:		char sym[KSYM_SYMBOL_LEN];
 997:	#endif
 998:	
 999:		if (fmt[1] == 'R')
1000:			ptr = __builtin_extract_return_addr(ptr);
1001:		value = (unsigned long)ptr;
1002:	
1003:	#ifdef CONFIG_KALLSYMS
1004:		if (*fmt == 'B' && fmt[1] == 'b')
1005:			sprint_backtrace_build_id(sym, value);
1006:		else if (*fmt == 'B')
1007:			sprint_backtrace(sym, value);
1008:		else if (*fmt == 'S' && (fmt[1] == 'b' || (fmt[1] == 'R' && fmt[2] == 'b')))
1009:			sprint_symbol_build_id(sym, value);
1010:		else if (*fmt != 's')
1011:			sprint_symbol(sym, value);
1012:		else
1013:			sprint_symbol_no_offset(sym, value);
1014:	
1015:		return string_nocheck(buf, end, sym, spec);
1016:	#else
1017:		return special_hex_number(buf, end, value, sizeof(void *));
1018:	#endif
1019:	}
 SourceFile:lib/vsprintf.c]

gemini-3.1-pro-preview

							input: 105467
							output: 46
							thoughts: 1918
						

**Analyzing a Potential Kernel Bug**

Okay, here's what I'm thinking as I dissect this reproducer. First, I noticed `sprint_backtrace` in the call stack and immediately considered whether it's taking a lock that might be causing a deadlock, especially if it's being called within a BPF context. The reproducer seems to be using `bpf_prog_run` or something similar to execute the BPF program. It attaches the program to a tracepoint or kprobe. The system call being used is `sendmsg` with a `RTM_NEWQDISC` message. That seems like an odd trigger.

I saw the BPF program is loaded but isn't explicitly attached in the reproducer, and that it has an `ifindex` field set even though the type is `BPF_PROG_TYPE_TRACEPOINT`. That's odd because tracepoints don't typically use `ifindex`. The reproducer doesn't seem to be using `BPF_PROG_ATTACH` and its type is explicitly set to 5, which is a tracepoint. I checked if `bpf_prog_load` can auto-attach the program, but that doesn't seem to be the case unless it's a `BPF_PROG_TYPE_TRACING` or `BPF_PROG_TYPE_EXT` program, or perhaps I'm missing something about the program loading mechanism. Tracepoints need `perf_event_open` and `ioctl(PERF_EVENT_IOC_SET_BPF)`, which are not present here.

Next, I looked at the BPF program itself, specifically the instructions. I was looking for any indication of how the program is executed. It has several `bpf_helpers_ringbuf_*` instructions and `bpf_snprintf`. It's definitely not a straightforward BPF program. I saw that the `BPF_PROG_TYPE_TRACEPOINT` isn't supposed to have an `ifindex` attached to it, but the type is `BPF_PROG_TYPE_TRACEPOINT`.

The reproducer calls `sendmsg`, which sends a `RTM_NEWQDISC` message. I'm thinking the `qdisc_create` might trigger a tracepoint. The question is, if the BPF program isn't explicitly attached, will it be executed by the tracepoint? Probably not. The type is 5, a tracepoint. So how is it being executed? Perhaps `bpf_prog_load` is somehow auto-attaching it, but that seems unlikely, and the reproducer doesn't use `perf_event_open`.

I began to wonder if the BPF program is even executed, or if the crash is caused just by loading it, by `bpf_prog_load`. It calls `bpf_check`, which simulates the execution, and that might be where the issue lies. `bpf_check` does call `bpf_snprintf`, but not directly. The crash is a soft lockup on CPU 0 in `csd_lock_wait`, and CPU 1 is in `__remove_hrtimer`. This is starting to look like a timer-related issue, and it's looking like a corrupted rbtree. I thought about how the rbtree of timers could be corrupted and if a BPF program can cause that corruption.

I checked the BPF program's helpers again, specifically the `bpf_timer_*` helpers, but the program is not directly using them. I looked at the BPF instructions. It uses `bpf_ringbuf_*` helpers, which seems odd because the program's type is a tracepoint.

Let's check `include/uapi/linux/bpf.h` for the helper IDs.

map[ContextFile:include/uapi/linux/bpf.h IncludeLines:true Name:bpf_func_id]

map[SourceCode:6132:	enum bpf_func_id {
6133:		___BPF_FUNC_MAPPER(__BPF_ENUM_FN)
6134:		__BPF_FUNC_MAX_ID,
6135:	};
 SourceFile:include/uapi/linux/bpf.h]

gemini-3.1-pro-preview

							input: 108342
							output: 22
							thoughts: 29
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the BPF Function Mapper**

Right, let's get down to it. I need to understand how the BPF function mapper is handled, so I'm going to kick things off by grepping for `___BPF_FUNC_MAPPER` within `include/uapi/linux/bpf.h`. That macro's almost certainly the key to understanding the underlying implementation and how the available BPF helpers are defined and exposed to user-space programs. By starting with that macro, I should be able to trace through the definitions, understand how the helper function numbers are assigned, and ideally, identify any potential areas of concern or changes that I need to be aware of. I'm expecting this to lead me to other relevant macro definitions and structures – likely some complex bit-field manipulations and type definitions – that dictate the available BPF helper functions, their associated arguments, and their return types. Understanding this mapper is crucial for anything related to BPF introspection, security analysis, or custom BPF program development, so this is a good place to begin. Time to get to it.

map[Expression:___BPF_FUNC_MAPPER]

map[Output:include/uapi/linux/bpf.h=1510=union bpf_attr {
--
include/uapi/linux/bpf.h-5903- */
include/uapi/linux/bpf.h:5904:#define ___BPF_FUNC_MAPPER(FN, ctx...)			\
include/uapi/linux/bpf.h-5905-	FN(unspec, 0, ##ctx)				\
--
include/uapi/linux/bpf.h-6125-#define __BPF_FUNC_MAPPER_APPLY(name, value, FN) FN(name),
include/uapi/linux/bpf.h:6126:#define __BPF_FUNC_MAPPER(FN) ___BPF_FUNC_MAPPER(__BPF_FUNC_MAPPER_APPLY, FN)
include/uapi/linux/bpf.h-6127-
--
include/uapi/linux/bpf.h=6132=enum bpf_func_id {
include/uapi/linux/bpf.h:6133:	___BPF_FUNC_MAPPER(__BPF_ENUM_FN)
include/uapi/linux/bpf.h-6134-	__BPF_FUNC_MAX_ID,
--
scripts/bpf_doc.py=104=class HeaderParser(object):
--
scripts/bpf_doc.py-299-    def parse_define_helpers(self):
scripts/bpf_doc.py:300:        # Parse FN(...) in #define ___BPF_FUNC_MAPPER to compare later with the
scripts/bpf_doc.py-301-        # number of unique function names present in description and use the
--
scripts/bpf_doc.py-305-        # self.define_unique_helpers.
scripts/bpf_doc.py:306:        self.seek_to('#define ___BPF_FUNC_MAPPER(FN, ctx...)',
scripts/bpf_doc.py-307-                     'Could not find start of eBPF helper definition list')
--
scripts/bpf_doc.py=478=class PrinterHelpersRST(PrinterRST):
--
scripts/bpf_doc.py-486-        self.elements = parser.helpers
scripts/bpf_doc.py:487:        self.elem_number_check(parser.desc_unique_helpers, parser.define_unique_helpers, 'helper', '___BPF_FUNC_MAPPER')
scripts/bpf_doc.py-488-
--
scripts/bpf_doc.py=692=class PrinterHelpersHeader(Printer):
--
scripts/bpf_doc.py-699-        self.elements = parser.helpers
scripts/bpf_doc.py:700:        self.elem_number_check(parser.desc_unique_helpers, parser.define_unique_helpers, 'helper', '___BPF_FUNC_MAPPER')
scripts/bpf_doc.py-701-
--
scripts/bpf_doc.py=915=class PrinterHelpersJSON(Printer):
--
scripts/bpf_doc.py-926-            "helper",
scripts/bpf_doc.py:927:            "___BPF_FUNC_MAPPER",
scripts/bpf_doc.py-928-        )
--
tools/include/uapi/linux/bpf.h=1510=union bpf_attr {
--
tools/include/uapi/linux/bpf.h-5903- */
tools/include/uapi/linux/bpf.h:5904:#define ___BPF_FUNC_MAPPER(FN, ctx...)			\
tools/include/uapi/linux/bpf.h-5905-	FN(unspec, 0, ##ctx)				\
--
tools/include/uapi/linux/bpf.h-6125-#define __BPF_FUNC_MAPPER_APPLY(name, value, FN) FN(name),
tools/include/uapi/linux/bpf.h:6126:#define __BPF_FUNC_MAPPER(FN) ___BPF_FUNC_MAPPER(__BPF_FUNC_MAPPER_APPLY, FN)
tools/include/uapi/linux/bpf.h-6127-
--
tools/include/uapi/linux/bpf.h=6132=enum bpf_func_id {
tools/include/uapi/linux/bpf.h:6133:	___BPF_FUNC_MAPPER(__BPF_ENUM_FN)
tools/include/uapi/linux/bpf.h-6134-	__BPF_FUNC_MAX_ID,
]

gemini-3.1-pro-preview

							input: 109817
							output: 20
							thoughts: 30
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Examining BPF Helper IDs in `bpf.h`**

Right, let's dive into the core. I need to refresh my memory on the helper function IDs available for BPF. Specifically, I'm thinking I'll head straight to `include/uapi/linux/bpf.h` and take a look around line 5904. That's usually where the macro definitions for the helper IDs start popping up. I know there have been updates recently, and I want to make sure I'm using the latest available. I need to quickly cross-reference a few of the newer ones to see if there's any differences, especially concerning the experimental ones, and what the latest additions are. This is going to be quick; I'm expecting some specific helpers, but I know I'll likely find a few gems I've overlooked. No need for a lengthy scan; I'm after something very specific to inform a little code I'm about to write.

map[Expression:FN\(ringbuf_reserve]

map[Output:include/uapi/linux/bpf.h=1510=union bpf_attr {
--
include/uapi/linux/bpf.h-6035-	FN(ringbuf_output, 130, ##ctx)			\
include/uapi/linux/bpf.h:6036:	FN(ringbuf_reserve, 131, ##ctx)			\
include/uapi/linux/bpf.h-6037-	FN(ringbuf_submit, 132, ##ctx)			\
--
include/uapi/linux/bpf.h-6102-	FN(dynptr_from_mem, 197, ##ctx)			\
include/uapi/linux/bpf.h:6103:	FN(ringbuf_reserve_dynptr, 198, ##ctx)		\
include/uapi/linux/bpf.h-6104-	FN(ringbuf_submit_dynptr, 199, ##ctx)		\
--
tools/include/uapi/linux/bpf.h=1510=union bpf_attr {
--
tools/include/uapi/linux/bpf.h-6035-	FN(ringbuf_output, 130, ##ctx)			\
tools/include/uapi/linux/bpf.h:6036:	FN(ringbuf_reserve, 131, ##ctx)			\
tools/include/uapi/linux/bpf.h-6037-	FN(ringbuf_submit, 132, ##ctx)			\
--
tools/include/uapi/linux/bpf.h-6102-	FN(dynptr_from_mem, 197, ##ctx)			\
tools/include/uapi/linux/bpf.h:6103:	FN(ringbuf_reserve_dynptr, 198, ##ctx)		\
tools/include/uapi/linux/bpf.h-6104-	FN(ringbuf_submit_dynptr, 199, ##ctx)		\
]

gemini-3.1-pro-preview

							input: 110627
							output: 44
							thoughts: 2594
						

**Analyzing the BPF Snprintf Reproducer**

Okay, so I'm looking at this reproducer and tracing its logic. I see the BPF helper function `bpf_snprintf` being called (0xa5, as indicated by the constants). The reproducer sets up arguments: a string buffer at `r10 - 8`, a size of 8 (R2), a format string (`bpf_frozen_const_str` which is register R3), an argument array pointer at `r10 - 16` which contains the value of `9` (R4), and a length of 8 (R5).

The crucial part is understanding what happens when `bpf_snprintf` uses this `fmt` string and the argument. I can tell that the format string `fmt` (R3) must be a map value since it is of type `bpf_frozen_const_str`. The reproducer uses `%pB`. This means the code inside `bpf_snprintf` calls `snprintf` with `%pB` and 9. Now, `%pB` is problematic. I'm pretty sure it calls the `sprint_backtrace` function.

`sprint_backtrace` itself then calls `__sprint_symbol`, which in turn calls `kallsyms_lookup` with this address 9. But does `kallsyms_lookup` take a lock? No, I believe it uses RCU or a similar mechanism. The question is, can this be exploited? If we can control the `fmt` string to `%pB` and then provide a valid address in `raw_args[num_spec]`, and what context the program executes in. What can we do with that?

I need to confirm the conditions for triggering `bpf_snprintf` with `%pB`. It seems `bpf_bprintf_prepare` does the actual `snprintf` if the `fmt` string uses `%pB`. This suggests that the format string is prepared within the `bpf_snprintf` function. So it looks like `bpf_bprintf_prepare` is safe to call from BPF.

I need to figure out *how* this BPF program gets executed. The reproducer calls `sendmsg` which sends `RTM_NEWQDISC` to netlink, triggering `tc_modify_qdisc`. Does `tc_modify_qdisc` trigger BPF execution? The reproducer loads a BPF program but doesn't attach it! This is very suspicious. `bpf_prog_load` is called using the BPF syscall (command 5). I see a `BPF_PROG_RUN` command which I need to investigate. So, how does this BPF program run? I need to analyze this further.

map[ContextFile:include/uapi/linux/bpf.h IncludeLines:true Name:bpf_cmd]

map[SourceCode: 155:	/* BPF syscall commands, see bpf(2) man-page for more details. */
 156:	/**
 157:	 * DOC: eBPF Syscall Preamble
 158:	 *
 159:	 * The operation to be performed by the **bpf**\ () system call is determined
 160:	 * by the *cmd* argument. Each operation takes an accompanying argument,
 161:	 * provided via *attr*, which is a pointer to a union of type *bpf_attr* (see
 162:	 * below). The size argument is the size of the union pointed to by *attr*.
 163:	 */
 164:	/**
 165:	 * DOC: eBPF Syscall Commands
 166:	 *
 167:	 * BPF_MAP_CREATE
 168:	 *	Description
 169:	 *		Create a map and return a file descriptor that refers to the
 170:	 *		map. The close-on-exec file descriptor flag (see **fcntl**\ (2))
 171:	 *		is automatically enabled for the new file descriptor.
 172:	 *
 173:	 *		Applying **close**\ (2) to the file descriptor returned by
 174:	 *		**BPF_MAP_CREATE** will delete the map (but see NOTES).
 175:	 *
 176:	 *	Return
 177:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 178:	 *		error occurred (in which case, *errno* is set appropriately).
 179:	 *
 180:	 * BPF_MAP_LOOKUP_ELEM
 181:	 *	Description
 182:	 *		Look up an element with a given *key* in the map referred to
 183:	 *		by the file descriptor *map_fd*.
 184:	 *
 185:	 *		The *flags* argument may be specified as one of the
 186:	 *		following:
 187:	 *
 188:	 *		**BPF_F_LOCK**
 189:	 *			Look up the value of a spin-locked map without
 190:	 *			returning the lock. This must be specified if the
 191:	 *			elements contain a spinlock.
 192:	 *
 193:	 *	Return
 194:	 *		Returns zero on success. On error, -1 is returned and *errno*
 195:	 *		is set appropriately.
 196:	 *
 197:	 * BPF_MAP_UPDATE_ELEM
 198:	 *	Description
 199:	 *		Create or update an element (key/value pair) in a specified map.
 200:	 *
 201:	 *		The *flags* argument should be specified as one of the
 202:	 *		following:
 203:	 *
 204:	 *		**BPF_ANY**
 205:	 *			Create a new element or update an existing element.
 206:	 *		**BPF_NOEXIST**
 207:	 *			Create a new element only if it did not exist.
 208:	 *		**BPF_EXIST**
 209:	 *			Update an existing element.
 210:	 *		**BPF_F_LOCK**
 211:	 *			Update a spin_lock-ed map element.
 212:	 *
 213:	 *	Return
 214:	 *		Returns zero on success. On error, -1 is returned and *errno*
 215:	 *		is set appropriately.
 216:	 *
 217:	 *		May set *errno* to **EINVAL**, **EPERM**, **ENOMEM**,
 218:	 *		**E2BIG**, **EEXIST**, or **ENOENT**.
 219:	 *
 220:	 *		**E2BIG**
 221:	 *			The number of elements in the map reached the
 222:	 *			*max_entries* limit specified at map creation time.
 223:	 *		**EEXIST**
 224:	 *			If *flags* specifies **BPF_NOEXIST** and the element
 225:	 *			with *key* already exists in the map.
 226:	 *		**ENOENT**
 227:	 *			If *flags* specifies **BPF_EXIST** and the element with
 228:	 *			*key* does not exist in the map.
 229:	 *
 230:	 * BPF_MAP_DELETE_ELEM
 231:	 *	Description
 232:	 *		Look up and delete an element by key in a specified map.
 233:	 *
 234:	 *	Return
 235:	 *		Returns zero on success. On error, -1 is returned and *errno*
 236:	 *		is set appropriately.
 237:	 *
 238:	 * BPF_MAP_GET_NEXT_KEY
 239:	 *	Description
 240:	 *		Look up an element by key in a specified map and return the key
 241:	 *		of the next element. Can be used to iterate over all elements
 242:	 *		in the map.
 243:	 *
 244:	 *	Return
 245:	 *		Returns zero on success. On error, -1 is returned and *errno*
 246:	 *		is set appropriately.
 247:	 *
 248:	 *		The following cases can be used to iterate over all elements of
 249:	 *		the map:
 250:	 *
 251:	 *		* If *key* is not found, the operation returns zero and sets
 252:	 *		  the *next_key* pointer to the key of the first element.
 253:	 *		* If *key* is found, the operation returns zero and sets the
 254:	 *		  *next_key* pointer to the key of the next element.
 255:	 *		* If *key* is the last element, returns -1 and *errno* is set
 256:	 *		  to **ENOENT**.
 257:	 *
 258:	 *		May set *errno* to **ENOMEM**, **EFAULT**, **EPERM**, or
 259:	 *		**EINVAL** on error.
 260:	 *
 261:	 * BPF_PROG_LOAD
 262:	 *	Description
 263:	 *		Verify and load an eBPF program, returning a new file
 264:	 *		descriptor associated with the program.
 265:	 *
 266:	 *		Applying **close**\ (2) to the file descriptor returned by
 267:	 *		**BPF_PROG_LOAD** will unload the eBPF program (but see NOTES).
 268:	 *
 269:	 *		The close-on-exec file descriptor flag (see **fcntl**\ (2)) is
 270:	 *		automatically enabled for the new file descriptor.
 271:	 *
 272:	 *	Return
 273:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 274:	 *		error occurred (in which case, *errno* is set appropriately).
 275:	 *
 276:	 * BPF_OBJ_PIN
 277:	 *	Description
 278:	 *		Pin an eBPF program or map referred by the specified *bpf_fd*
 279:	 *		to the provided *pathname* on the filesystem.
 280:	 *
 281:	 *		The *pathname* argument must not contain a dot (".").
 282:	 *
 283:	 *		On success, *pathname* retains a reference to the eBPF object,
 284:	 *		preventing deallocation of the object when the original
 285:	 *		*bpf_fd* is closed. This allow the eBPF object to live beyond
 286:	 *		**close**\ (\ *bpf_fd*\ ), and hence the lifetime of the parent
 287:	 *		process.
 288:	 *
 289:	 *		Applying **unlink**\ (2) or similar calls to the *pathname*
 290:	 *		unpins the object from the filesystem, removing the reference.
 291:	 *		If no other file descriptors or filesystem nodes refer to the
 292:	 *		same object, it will be deallocated (see NOTES).
 293:	 *
 294:	 *		The filesystem type for the parent directory of *pathname* must
 295:	 *		be **BPF_FS_MAGIC**.
 296:	 *
 297:	 *	Return
 298:	 *		Returns zero on success. On error, -1 is returned and *errno*
 299:	 *		is set appropriately.
 300:	 *
 301:	 * BPF_OBJ_GET
 302:	 *	Description
 303:	 *		Open a file descriptor for the eBPF object pinned to the
 304:	 *		specified *pathname*.
 305:	 *
 306:	 *	Return
 307:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 308:	 *		error occurred (in which case, *errno* is set appropriately).
 309:	 *
 310:	 * BPF_PROG_ATTACH
 311:	 *	Description
 312:	 *		Attach an eBPF program to a *target_fd* at the specified
 313:	 *		*attach_type* hook.
 314:	 *
 315:	 *		The *attach_type* specifies the eBPF attachment point to
 316:	 *		attach the program to, and must be one of *bpf_attach_type*
 317:	 *		(see below).
 318:	 *
 319:	 *		The *attach_bpf_fd* must be a valid file descriptor for a
 320:	 *		loaded eBPF program of a cgroup, flow dissector, LIRC, sockmap
 321:	 *		or sock_ops type corresponding to the specified *attach_type*.
 322:	 *
 323:	 *		The *target_fd* must be a valid file descriptor for a kernel
 324:	 *		object which depends on the attach type of *attach_bpf_fd*:
 325:	 *
 326:	 *		**BPF_PROG_TYPE_CGROUP_DEVICE**,
 327:	 *		**BPF_PROG_TYPE_CGROUP_SKB**,
 328:	 *		**BPF_PROG_TYPE_CGROUP_SOCK**,
 329:	 *		**BPF_PROG_TYPE_CGROUP_SOCK_ADDR**,
 330:	 *		**BPF_PROG_TYPE_CGROUP_SOCKOPT**,
 331:	 *		**BPF_PROG_TYPE_CGROUP_SYSCTL**,
 332:	 *		**BPF_PROG_TYPE_SOCK_OPS**
 333:	 *
 334:	 *			Control Group v2 hierarchy with the eBPF controller
 335:	 *			enabled. Requires the kernel to be compiled with
 336:	 *			**CONFIG_CGROUP_BPF**.
 337:	 *
 338:	 *		**BPF_PROG_TYPE_FLOW_DISSECTOR**
 339:	 *
 340:	 *			Network namespace (eg /proc/self/ns/net).
 341:	 *
 342:	 *		**BPF_PROG_TYPE_LIRC_MODE2**
 343:	 *
 344:	 *			LIRC device path (eg /dev/lircN). Requires the kernel
 345:	 *			to be compiled with **CONFIG_BPF_LIRC_MODE2**.
 346:	 *
 347:	 *		**BPF_PROG_TYPE_SK_SKB**,
 348:	 *		**BPF_PROG_TYPE_SK_MSG**
 349:	 *
 350:	 *			eBPF map of socket type (eg **BPF_MAP_TYPE_SOCKHASH**).
 351:	 *
 352:	 *	Return
 353:	 *		Returns zero on success. On error, -1 is returned and *errno*
 354:	 *		is set appropriately.
 355:	 *
 356:	 * BPF_PROG_DETACH
 357:	 *	Description
 358:	 *		Detach the eBPF program associated with the *target_fd* at the
 359:	 *		hook specified by *attach_type*. The program must have been
 360:	 *		previously attached using **BPF_PROG_ATTACH**.
 361:	 *
 362:	 *	Return
 363:	 *		Returns zero on success. On error, -1 is returned and *errno*
 364:	 *		is set appropriately.
 365:	 *
 366:	 * BPF_PROG_TEST_RUN
 367:	 *	Description
 368:	 *		Run the eBPF program associated with the *prog_fd* a *repeat*
 369:	 *		number of times against a provided program context *ctx_in* and
 370:	 *		data *data_in*, and return the modified program context
 371:	 *		*ctx_out*, *data_out* (for example, packet data), result of the
 372:	 *		execution *retval*, and *duration* of the test run.
 373:	 *
 374:	 *		The sizes of the buffers provided as input and output
 375:	 *		parameters *ctx_in*, *ctx_out*, *data_in*, and *data_out* must
 376:	 *		be provided in the corresponding variables *ctx_size_in*,
 377:	 *		*ctx_size_out*, *data_size_in*, and/or *data_size_out*. If any
 378:	 *		of these parameters are not provided (ie set to NULL), the
 379:	 *		corresponding size field must be zero.
 380:	 *
 381:	 *		Some program types have particular requirements:
 382:	 *
 383:	 *		**BPF_PROG_TYPE_SK_LOOKUP**
 384:	 *			*data_in* and *data_out* must be NULL.
 385:	 *
 386:	 *		**BPF_PROG_TYPE_RAW_TRACEPOINT**,
 387:	 *		**BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE**
 388:	 *
 389:	 *			*ctx_out*, *data_in* and *data_out* must be NULL.
 390:	 *			*repeat* must be zero.
 391:	 *
 392:	 *		BPF_PROG_RUN is an alias for BPF_PROG_TEST_RUN.
 393:	 *
 394:	 *	Return
 395:	 *		Returns zero on success. On error, -1 is returned and *errno*
 396:	 *		is set appropriately.
 397:	 *
 398:	 *		**ENOSPC**
 399:	 *			Either *data_size_out* or *ctx_size_out* is too small.
 400:	 *		**ENOTSUPP**
 401:	 *			This command is not supported by the program type of
 402:	 *			the program referred to by *prog_fd*.
 403:	 *
 404:	 * BPF_PROG_GET_NEXT_ID
 405:	 *	Description
 406:	 *		Fetch the next eBPF program currently loaded into the kernel.
 407:	 *
 408:	 *		Looks for the eBPF program with an id greater than *start_id*
 409:	 *		and updates *next_id* on success. If no other eBPF programs
 410:	 *		remain with ids higher than *start_id*, returns -1 and sets
 411:	 *		*errno* to **ENOENT**.
 412:	 *
 413:	 *	Return
 414:	 *		Returns zero on success. On error, or when no id remains, -1
 415:	 *		is returned and *errno* is set appropriately.
 416:	 *
 417:	 * BPF_MAP_GET_NEXT_ID
 418:	 *	Description
 419:	 *		Fetch the next eBPF map currently loaded into the kernel.
 420:	 *
 421:	 *		Looks for the eBPF map with an id greater than *start_id*
 422:	 *		and updates *next_id* on success. If no other eBPF maps
 423:	 *		remain with ids higher than *start_id*, returns -1 and sets
 424:	 *		*errno* to **ENOENT**.
 425:	 *
 426:	 *	Return
 427:	 *		Returns zero on success. On error, or when no id remains, -1
 428:	 *		is returned and *errno* is set appropriately.
 429:	 *
 430:	 * BPF_PROG_GET_FD_BY_ID
 431:	 *	Description
 432:	 *		Open a file descriptor for the eBPF program corresponding to
 433:	 *		*prog_id*.
 434:	 *
 435:	 *	Return
 436:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 437:	 *		error occurred (in which case, *errno* is set appropriately).
 438:	 *
 439:	 * BPF_MAP_GET_FD_BY_ID
 440:	 *	Description
 441:	 *		Open a file descriptor for the eBPF map corresponding to
 442:	 *		*map_id*.
 443:	 *
 444:	 *	Return
 445:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 446:	 *		error occurred (in which case, *errno* is set appropriately).
 447:	 *
 448:	 * BPF_OBJ_GET_INFO_BY_FD
 449:	 *	Description
 450:	 *		Obtain information about the eBPF object corresponding to
 451:	 *		*bpf_fd*.
 452:	 *
 453:	 *		Populates up to *info_len* bytes of *info*, which will be in
 454:	 *		one of the following formats depending on the eBPF object type
 455:	 *		of *bpf_fd*:
 456:	 *
 457:	 *		* **struct bpf_prog_info**
 458:	 *		* **struct bpf_map_info**
 459:	 *		* **struct bpf_btf_info**
 460:	 *		* **struct bpf_link_info**
 461:	 *		* **struct bpf_token_info**
 462:	 *
 463:	 *	Return
 464:	 *		Returns zero on success. On error, -1 is returned and *errno*
 465:	 *		is set appropriately.
 466:	 *
 467:	 * BPF_PROG_QUERY
 468:	 *	Description
 469:	 *		Obtain information about eBPF programs associated with the
 470:	 *		specified *attach_type* hook.
 471:	 *
 472:	 *		The *target_fd* must be a valid file descriptor for a kernel
 473:	 *		object which depends on the attach type of *attach_bpf_fd*:
 474:	 *
 475:	 *		**BPF_PROG_TYPE_CGROUP_DEVICE**,
 476:	 *		**BPF_PROG_TYPE_CGROUP_SKB**,
 477:	 *		**BPF_PROG_TYPE_CGROUP_SOCK**,
 478:	 *		**BPF_PROG_TYPE_CGROUP_SOCK_ADDR**,
 479:	 *		**BPF_PROG_TYPE_CGROUP_SOCKOPT**,
 480:	 *		**BPF_PROG_TYPE_CGROUP_SYSCTL**,
 481:	 *		**BPF_PROG_TYPE_SOCK_OPS**
 482:	 *
 483:	 *			Control Group v2 hierarchy with the eBPF controller
 484:	 *			enabled. Requires the kernel to be compiled with
 485:	 *			**CONFIG_CGROUP_BPF**.
 486:	 *
 487:	 *		**BPF_PROG_TYPE_FLOW_DISSECTOR**
 488:	 *
 489:	 *			Network namespace (eg /proc/self/ns/net).
 490:	 *
 491:	 *		**BPF_PROG_TYPE_LIRC_MODE2**
 492:	 *
 493:	 *			LIRC device path (eg /dev/lircN). Requires the kernel
 494:	 *			to be compiled with **CONFIG_BPF_LIRC_MODE2**.
 495:	 *
 496:	 *		**BPF_PROG_QUERY** always fetches the number of programs
 497:	 *		attached and the *attach_flags* which were used to attach those
 498:	 *		programs. Additionally, if *prog_ids* is nonzero and the number
 499:	 *		of attached programs is less than *prog_cnt*, populates
 500:	 *		*prog_ids* with the eBPF program ids of the programs attached
 501:	 *		at *target_fd*.
 502:	 *
 503:	 *		The following flags may alter the result:
 504:	 *
 505:	 *		**BPF_F_QUERY_EFFECTIVE**
 506:	 *			Only return information regarding programs which are
 507:	 *			currently effective at the specified *target_fd*.
 508:	 *
 509:	 *	Return
 510:	 *		Returns zero on success. On error, -1 is returned and *errno*
 511:	 *		is set appropriately.
 512:	 *
 513:	 * BPF_RAW_TRACEPOINT_OPEN
 514:	 *	Description
 515:	 *		Attach an eBPF program to a tracepoint *name* to access kernel
 516:	 *		internal arguments of the tracepoint in their raw form.
 517:	 *
 518:	 *		The *prog_fd* must be a valid file descriptor associated with
 519:	 *		a loaded eBPF program of type **BPF_PROG_TYPE_RAW_TRACEPOINT**.
 520:	 *
 521:	 *		No ABI guarantees are made about the content of tracepoint
 522:	 *		arguments exposed to the corresponding eBPF program.
 523:	 *
 524:	 *		Applying **close**\ (2) to the file descriptor returned by
 525:	 *		**BPF_RAW_TRACEPOINT_OPEN** will delete the map (but see NOTES).
 526:	 *
 527:	 *	Return
 528:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 529:	 *		error occurred (in which case, *errno* is set appropriately).
 530:	 *
 531:	 * BPF_BTF_LOAD
 532:	 *	Description
 533:	 *		Verify and load BPF Type Format (BTF) metadata into the kernel,
 534:	 *		returning a new file descriptor associated with the metadata.
 535:	 *		BTF is described in more detail at
 536:	 *		https://www.kernel.org/doc/html/latest/bpf/btf.html.
 537:	 *
 538:	 *		The *btf* parameter must point to valid memory providing
 539:	 *		*btf_size* bytes of BTF binary metadata.
 540:	 *
 541:	 *		The returned file descriptor can be passed to other **bpf**\ ()
 542:	 *		subcommands such as **BPF_PROG_LOAD** or **BPF_MAP_CREATE** to
 543:	 *		associate the BTF with those objects.
 544:	 *
 545:	 *		Similar to **BPF_PROG_LOAD**, **BPF_BTF_LOAD** has optional
 546:	 *		parameters to specify a *btf_log_buf*, *btf_log_size* and
 547:	 *		*btf_log_level* which allow the kernel to return freeform log
 548:	 *		output regarding the BTF verification process.
 549:	 *
 550:	 *	Return
 551:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 552:	 *		error occurred (in which case, *errno* is set appropriately).
 553:	 *
 554:	 * BPF_BTF_GET_FD_BY_ID
 555:	 *	Description
 556:	 *		Open a file descriptor for the BPF Type Format (BTF)
 557:	 *		corresponding to *btf_id*.
 558:	 *
 559:	 *	Return
 560:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 561:	 *		error occurred (in which case, *errno* is set appropriately).
 562:	 *
 563:	 * BPF_TASK_FD_QUERY
 564:	 *	Description
 565:	 *		Obtain information about eBPF programs associated with the
 566:	 *		target process identified by *pid* and *fd*.
 567:	 *
 568:	 *		If the *pid* and *fd* are associated with a tracepoint, kprobe
 569:	 *		or uprobe perf event, then the *prog_id* and *fd_type* will
 570:	 *		be populated with the eBPF program id and file descriptor type
 571:	 *		of type **bpf_task_fd_type**. If associated with a kprobe or
 572:	 *		uprobe, the  *probe_offset* and *probe_addr* will also be
 573:	 *		populated. Optionally, if *buf* is provided, then up to
 574:	 *		*buf_len* bytes of *buf* will be populated with the name of
 575:	 *		the tracepoint, kprobe or uprobe.
 576:	 *
 577:	 *		The resulting *prog_id* may be introspected in deeper detail
 578:	 *		using **BPF_PROG_GET_FD_BY_ID** and **BPF_OBJ_GET_INFO_BY_FD**.
 579:	 *
 580:	 *	Return
 581:	 *		Returns zero on success. On error, -1 is returned and *errno*
 582:	 *		is set appropriately.
 583:	 *
 584:	 * BPF_MAP_LOOKUP_AND_DELETE_ELEM
 585:	 *	Description
 586:	 *		Look up an element with the given *key* in the map referred to
 587:	 *		by the file descriptor *fd*, and if found, delete the element.
 588:	 *
 589:	 *		For **BPF_MAP_TYPE_QUEUE** and **BPF_MAP_TYPE_STACK** map
 590:	 *		types, the *flags* argument needs to be set to 0, but for other
 591:	 *		map types, it may be specified as:
 592:	 *
 593:	 *		**BPF_F_LOCK**
 594:	 *			Look up and delete the value of a spin-locked map
 595:	 *			without returning the lock. This must be specified if
 596:	 *			the elements contain a spinlock.
 597:	 *
 598:	 *		The **BPF_MAP_TYPE_QUEUE** and **BPF_MAP_TYPE_STACK** map types
 599:	 *		implement this command as a "pop" operation, deleting the top
 600:	 *		element rather than one corresponding to *key*.
 601:	 *		The *key* and *key_len* parameters should be zeroed when
 602:	 *		issuing this operation for these map types.
 603:	 *
 604:	 *		This command is only valid for the following map types:
 605:	 *		* **BPF_MAP_TYPE_QUEUE**
 606:	 *		* **BPF_MAP_TYPE_STACK**
 607:	 *		* **BPF_MAP_TYPE_HASH**
 608:	 *		* **BPF_MAP_TYPE_PERCPU_HASH**
 609:	 *		* **BPF_MAP_TYPE_LRU_HASH**
 610:	 *		* **BPF_MAP_TYPE_LRU_PERCPU_HASH**
 611:	 *
 612:	 *	Return
 613:	 *		Returns zero on success. On error, -1 is returned and *errno*
 614:	 *		is set appropriately.
 615:	 *
 616:	 * BPF_MAP_FREEZE
 617:	 *	Description
 618:	 *		Freeze the permissions of the specified map.
 619:	 *
 620:	 *		Write permissions may be frozen by passing zero *flags*.
 621:	 *		Upon success, no future syscall invocations may alter the
 622:	 *		map state of *map_fd*. Write operations from eBPF programs
 623:	 *		are still possible for a frozen map.
 624:	 *
 625:	 *		Not supported for maps of type **BPF_MAP_TYPE_STRUCT_OPS**.
 626:	 *
 627:	 *	Return
 628:	 *		Returns zero on success. On error, -1 is returned and *errno*
 629:	 *		is set appropriately.
 630:	 *
 631:	 * BPF_BTF_GET_NEXT_ID
 632:	 *	Description
 633:	 *		Fetch the next BPF Type Format (BTF) object currently loaded
 634:	 *		into the kernel.
 635:	 *
 636:	 *		Looks for the BTF object with an id greater than *start_id*
 637:	 *		and updates *next_id* on success. If no other BTF objects
 638:	 *		remain with ids higher than *start_id*, returns -1 and sets
 639:	 *		*errno* to **ENOENT**.
 640:	 *
 641:	 *	Return
 642:	 *		Returns zero on success. On error, or when no id remains, -1
 643:	 *		is returned and *errno* is set appropriately.
 644:	 *
 645:	 * BPF_MAP_LOOKUP_BATCH
 646:	 *	Description
 647:	 *		Iterate and fetch multiple elements in a map.
 648:	 *
 649:	 *		Two opaque values are used to manage batch operations,
 650:	 *		*in_batch* and *out_batch*. Initially, *in_batch* must be set
 651:	 *		to NULL to begin the batched operation. After each subsequent
 652:	 *		**BPF_MAP_LOOKUP_BATCH**, the caller should pass the resultant
 653:	 *		*out_batch* as the *in_batch* for the next operation to
 654:	 *		continue iteration from the current point. Both *in_batch* and
 655:	 *		*out_batch* must point to memory large enough to hold a key,
 656:	 *		except for maps of type **BPF_MAP_TYPE_{HASH, PERCPU_HASH,
 657:	 *		LRU_HASH, LRU_PERCPU_HASH}**, for which batch parameters
 658:	 *		must be at least 4 bytes wide regardless of key size.
 659:	 *
 660:	 *		The *keys* and *values* are output parameters which must point
 661:	 *		to memory large enough to hold *count* items based on the key
 662:	 *		and value size of the map *map_fd*. The *keys* buffer must be
 663:	 *		of *key_size* * *count*. The *values* buffer must be of
 664:	 *		*value_size* * *count*.
 665:	 *
 666:	 *		The *elem_flags* argument may be specified as one of the
 667:	 *		following:
 668:	 *
 669:	 *		**BPF_F_LOCK**
 670:	 *			Look up the value of a spin-locked map without
 671:	 *			returning the lock. This must be specified if the
 672:	 *			elements contain a spinlock.
 673:	 *
 674:	 *		On success, *count* elements from the map are copied into the
 675:	 *		user buffer, with the keys copied into *keys* and the values
 676:	 *		copied into the corresponding indices in *values*.
 677:	 *
 678:	 *		If an error is returned and *errno* is not **EFAULT**, *count*
 679:	 *		is set to the number of successfully processed elements.
 680:	 *
 681:	 *	Return
 682:	 *		Returns zero on success. On error, -1 is returned and *errno*
 683:	 *		is set appropriately.
 684:	 *
 685:	 *		May set *errno* to **ENOSPC** to indicate that *keys* or
 686:	 *		*values* is too small to dump an entire bucket during
 687:	 *		iteration of a hash-based map type.
 688:	 *
 689:	 * BPF_MAP_LOOKUP_AND_DELETE_BATCH
 690:	 *	Description
 691:	 *		Iterate and delete all elements in a map.
 692:	 *
 693:	 *		This operation has the same behavior as
 694:	 *		**BPF_MAP_LOOKUP_BATCH** with two exceptions:
 695:	 *
 696:	 *		* Every element that is successfully returned is also deleted
 697:	 *		  from the map. This is at least *count* elements. Note that
 698:	 *		  *count* is both an input and an output parameter.
 699:	 *		* Upon returning with *errno* set to **EFAULT**, up to
 700:	 *		  *count* elements may be deleted without returning the keys
 701:	 *		  and values of the deleted elements.
 702:	 *
 703:	 *	Return
 704:	 *		Returns zero on success. On error, -1 is returned and *errno*
 705:	 *		is set appropriately.
 706:	 *
 707:	 * BPF_MAP_UPDATE_BATCH
 708:	 *	Description
 709:	 *		Update multiple elements in a map by *key*.
 710:	 *
 711:	 *		The *keys* and *values* are input parameters which must point
 712:	 *		to memory large enough to hold *count* items based on the key
 713:	 *		and value size of the map *map_fd*. The *keys* buffer must be
 714:	 *		of *key_size* * *count*. The *values* buffer must be of
 715:	 *		*value_size* * *count*.
 716:	 *
 717:	 *		Each element specified in *keys* is sequentially updated to the
 718:	 *		value in the corresponding index in *values*. The *in_batch*
 719:	 *		and *out_batch* parameters are ignored and should be zeroed.
 720:	 *
 721:	 *		The *elem_flags* argument should be specified as one of the
 722:	 *		following:
 723:	 *
 724:	 *		**BPF_ANY**
 725:	 *			Create new elements or update a existing elements.
 726:	 *		**BPF_NOEXIST**
 727:	 *			Create new elements only if they do not exist.
 728:	 *		**BPF_EXIST**
 729:	 *			Update existing elements.
 730:	 *		**BPF_F_LOCK**
 731:	 *			Update spin_lock-ed map elements. This must be
 732:	 *			specified if the map value contains a spinlock.
 733:	 *
 734:	 *		On success, *count* elements from the map are updated.
 735:	 *
 736:	 *		If an error is returned and *errno* is not **EFAULT**, *count*
 737:	 *		is set to the number of successfully processed elements.
 738:	 *
 739:	 *	Return
 740:	 *		Returns zero on success. On error, -1 is returned and *errno*
 741:	 *		is set appropriately.
 742:	 *
 743:	 *		May set *errno* to **EINVAL**, **EPERM**, **ENOMEM**, or
 744:	 *		**E2BIG**. **E2BIG** indicates that the number of elements in
 745:	 *		the map reached the *max_entries* limit specified at map
 746:	 *		creation time.
 747:	 *
 748:	 *		May set *errno* to one of the following error codes under
 749:	 *		specific circumstances:
 750:	 *
 751:	 *		**EEXIST**
 752:	 *			If *flags* specifies **BPF_NOEXIST** and the element
 753:	 *			with *key* already exists in the map.
 754:	 *		**ENOENT**
 755:	 *			If *flags* specifies **BPF_EXIST** and the element with
 756:	 *			*key* does not exist in the map.
 757:	 *
 758:	 * BPF_MAP_DELETE_BATCH
 759:	 *	Description
 760:	 *		Delete multiple elements in a map by *key*.
 761:	 *
 762:	 *		The *keys* parameter is an input parameter which must point
 763:	 *		to memory large enough to hold *count* items based on the key
 764:	 *		size of the map *map_fd*, that is, *key_size* * *count*.
 765:	 *
 766:	 *		Each element specified in *keys* is sequentially deleted. The
 767:	 *		*in_batch*, *out_batch*, and *values* parameters are ignored
 768:	 *		and should be zeroed.
 769:	 *
 770:	 *		The *elem_flags* argument may be specified as one of the
 771:	 *		following:
 772:	 *
 773:	 *		**BPF_F_LOCK**
 774:	 *			Look up the value of a spin-locked map without
 775:	 *			returning the lock. This must be specified if the
 776:	 *			elements contain a spinlock.
 777:	 *
 778:	 *		On success, *count* elements from the map are updated.
 779:	 *
 780:	 *		If an error is returned and *errno* is not **EFAULT**, *count*
 781:	 *		is set to the number of successfully processed elements. If
 782:	 *		*errno* is **EFAULT**, up to *count* elements may be been
 783:	 *		deleted.
 784:	 *
 785:	 *	Return
 786:	 *		Returns zero on success. On error, -1 is returned and *errno*
 787:	 *		is set appropriately.
 788:	 *
 789:	 * BPF_LINK_CREATE
 790:	 *	Description
 791:	 *		Attach an eBPF program to a *target_fd* at the specified
 792:	 *		*attach_type* hook and return a file descriptor handle for
 793:	 *		managing the link.
 794:	 *
 795:	 *	Return
 796:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 797:	 *		error occurred (in which case, *errno* is set appropriately).
 798:	 *
 799:	 * BPF_LINK_UPDATE
 800:	 *	Description
 801:	 *		Update the eBPF program in the specified *link_fd* to
 802:	 *		*new_prog_fd*.
 803:	 *
 804:	 *	Return
 805:	 *		Returns zero on success. On error, -1 is returned and *errno*
 806:	 *		is set appropriately.
 807:	 *
 808:	 * BPF_LINK_GET_FD_BY_ID
 809:	 *	Description
 810:	 *		Open a file descriptor for the eBPF Link corresponding to
 811:	 *		*link_id*.
 812:	 *
 813:	 *	Return
 814:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 815:	 *		error occurred (in which case, *errno* is set appropriately).
 816:	 *
 817:	 * BPF_LINK_GET_NEXT_ID
 818:	 *	Description
 819:	 *		Fetch the next eBPF link currently loaded into the kernel.
 820:	 *
 821:	 *		Looks for the eBPF link with an id greater than *start_id*
 822:	 *		and updates *next_id* on success. If no other eBPF links
 823:	 *		remain with ids higher than *start_id*, returns -1 and sets
 824:	 *		*errno* to **ENOENT**.
 825:	 *
 826:	 *	Return
 827:	 *		Returns zero on success. On error, or when no id remains, -1
 828:	 *		is returned and *errno* is set appropriately.
 829:	 *
 830:	 * BPF_ENABLE_STATS
 831:	 *	Description
 832:	 *		Enable eBPF runtime statistics gathering.
 833:	 *
 834:	 *		Runtime statistics gathering for the eBPF runtime is disabled
 835:	 *		by default to minimize the corresponding performance overhead.
 836:	 *		This command enables statistics globally.
 837:	 *
 838:	 *		Multiple programs may independently enable statistics.
 839:	 *		After gathering the desired statistics, eBPF runtime statistics
 840:	 *		may be disabled again by calling **close**\ (2) for the file
 841:	 *		descriptor returned by this function. Statistics will only be
 842:	 *		disabled system-wide when all outstanding file descriptors
 843:	 *		returned by prior calls for this subcommand are closed.
 844:	 *
 845:	 *	Return
 846:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 847:	 *		error occurred (in which case, *errno* is set appropriately).
 848:	 *
 849:	 * BPF_ITER_CREATE
 850:	 *	Description
 851:	 *		Create an iterator on top of the specified *link_fd* (as
 852:	 *		previously created using **BPF_LINK_CREATE**) and return a
 853:	 *		file descriptor that can be used to trigger the iteration.
 854:	 *
 855:	 *		If the resulting file descriptor is pinned to the filesystem
 856:	 *		using  **BPF_OBJ_PIN**, then subsequent **read**\ (2) syscalls
 857:	 *		for that path will trigger the iterator to read kernel state
 858:	 *		using the eBPF program attached to *link_fd*.
 859:	 *
 860:	 *	Return
 861:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 862:	 *		error occurred (in which case, *errno* is set appropriately).
 863:	 *
 864:	 * BPF_LINK_DETACH
 865:	 *	Description
 866:	 *		Forcefully detach the specified *link_fd* from its
 867:	 *		corresponding attachment point.
 868:	 *
 869:	 *	Return
 870:	 *		Returns zero on success. On error, -1 is returned and *errno*
 871:	 *		is set appropriately.
 872:	 *
 873:	 * BPF_PROG_BIND_MAP
 874:	 *	Description
 875:	 *		Bind a map to the lifetime of an eBPF program.
 876:	 *
 877:	 *		The map identified by *map_fd* is bound to the program
 878:	 *		identified by *prog_fd* and only released when *prog_fd* is
 879:	 *		released. This may be used in cases where metadata should be
 880:	 *		associated with a program which otherwise does not contain any
 881:	 *		references to the map (for example, embedded in the eBPF
 882:	 *		program instructions).
 883:	 *
 884:	 *	Return
 885:	 *		Returns zero on success. On error, -1 is returned and *errno*
 886:	 *		is set appropriately.
 887:	 *
 888:	 * BPF_TOKEN_CREATE
 889:	 *	Description
 890:	 *		Create BPF token with embedded information about what
 891:	 *		BPF-related functionality it allows:
 892:	 *		- a set of allowed bpf() syscall commands;
 893:	 *		- a set of allowed BPF map types to be created with
 894:	 *		BPF_MAP_CREATE command, if BPF_MAP_CREATE itself is allowed;
 895:	 *		- a set of allowed BPF program types and BPF program attach
 896:	 *		types to be loaded with BPF_PROG_LOAD command, if
 897:	 *		BPF_PROG_LOAD itself is allowed.
 898:	 *
 899:	 *		BPF token is created (derived) from an instance of BPF FS,
 900:	 *		assuming it has necessary delegation mount options specified.
 901:	 *		This BPF token can be passed as an extra parameter to various
 902:	 *		bpf() syscall commands to grant BPF subsystem functionality to
 903:	 *		unprivileged processes.
 904:	 *
 905:	 *		When created, BPF token is "associated" with the owning
 906:	 *		user namespace of BPF FS instance (super block) that it was
 907:	 *		derived from, and subsequent BPF operations performed with
 908:	 *		BPF token would be performing capabilities checks (i.e.,
 909:	 *		CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_ADMIN) within
 910:	 *		that user namespace. Without BPF token, such capabilities
 911:	 *		have to be granted in init user namespace, making bpf()
 912:	 *		syscall incompatible with user namespace, for the most part.
 913:	 *
 914:	 *	Return
 915:	 *		A new file descriptor (a nonnegative integer), or -1 if an
 916:	 *		error occurred (in which case, *errno* is set appropriately).
 917:	 *
 918:	 * BPF_PROG_STREAM_READ_BY_FD
 919:	 *	Description
 920:	 *		Read data of a program's BPF stream. The program is identified
 921:	 *		by *prog_fd*, and the stream is identified by the *stream_id*.
 922:	 *		The data is copied to a buffer pointed to by *stream_buf*, and
 923:	 *		filled less than or equal to *stream_buf_len* bytes.
 924:	 *
 925:	 *	Return
 926:	 *		Number of bytes read from the stream on success, or -1 if an
 927:	 *		error occurred (in which case, *errno* is set appropriately).
 928:	 *
 929:	 * BPF_PROG_ASSOC_STRUCT_OPS
 930:	 * 	Description
 931:	 * 		Associate a BPF program with a struct_ops map. The struct_ops
 932:	 * 		map is identified by *map_fd* and the BPF program is
 933:	 * 		identified by *prog_fd*.
 934:	 *
 935:	 * 	Return
 936:	 * 		0 on success or -1 if an error occurred (in which case,
 937:	 * 		*errno* is set appropriately).
 938:	 *
 939:	 * NOTES
 940:	 *	eBPF objects (maps and programs) can be shared between processes.
 941:	 *
 942:	 *	* After **fork**\ (2), the child inherits file descriptors
 943:	 *	  referring to the same eBPF objects.
 944:	 *	* File descriptors referring to eBPF objects can be transferred over
 945:	 *	  **unix**\ (7) domain sockets.
 946:	 *	* File descriptors referring to eBPF objects can be duplicated in the
 947:	 *	  usual way, using **dup**\ (2) and similar calls.
 948:	 *	* File descriptors referring to eBPF objects can be pinned to the
 949:	 *	  filesystem using the **BPF_OBJ_PIN** command of **bpf**\ (2).
 950:	 *
 951:	 *	An eBPF object is deallocated only after all file descriptors referring
 952:	 *	to the object have been closed and no references remain pinned to the
 953:	 *	filesystem or attached (for example, bound to a program or device).
 954:	 */
 955:	enum bpf_cmd {
 956:		BPF_MAP_CREATE,
 957:		BPF_MAP_LOOKUP_ELEM,
 958:		BPF_MAP_UPDATE_ELEM,
 959:		BPF_MAP_DELETE_ELEM,
 960:		BPF_MAP_GET_NEXT_KEY,
 961:		BPF_PROG_LOAD,
 962:		BPF_OBJ_PIN,
 963:		BPF_OBJ_GET,
 964:		BPF_PROG_ATTACH,
 965:		BPF_PROG_DETACH,
 966:		BPF_PROG_TEST_RUN,
 967:		BPF_PROG_RUN = BPF_PROG_TEST_RUN,
 968:		BPF_PROG_GET_NEXT_ID,
 969:		BPF_MAP_GET_NEXT_ID,
 970:		BPF_PROG_GET_FD_BY_ID,
 971:		BPF_MAP_GET_FD_BY_ID,
 972:		BPF_OBJ_GET_INFO_BY_FD,
 973:		BPF_PROG_QUERY,
 974:		BPF_RAW_TRACEPOINT_OPEN,
 975:		BPF_BTF_LOAD,
 976:		BPF_BTF_GET_FD_BY_ID,
 977:		BPF_TASK_FD_QUERY,
 978:		BPF_MAP_LOOKUP_AND_DELETE_ELEM,
 979:		BPF_MAP_FREEZE,
 980:		BPF_BTF_GET_NEXT_ID,
 981:		BPF_MAP_LOOKUP_BATCH,
 982:		BPF_MAP_LOOKUP_AND_DELETE_BATCH,
 983:		BPF_MAP_UPDATE_BATCH,
 984:		BPF_MAP_DELETE_BATCH,
 985:		BPF_LINK_CREATE,
 986:		BPF_LINK_UPDATE,
 987:		BPF_LINK_GET_FD_BY_ID,
 988:		BPF_LINK_GET_NEXT_ID,
 989:		BPF_ENABLE_STATS,
 990:		BPF_ITER_CREATE,
 991:		BPF_LINK_DETACH,
 992:		BPF_PROG_BIND_MAP,
 993:		BPF_TOKEN_CREATE,
 994:		BPF_PROG_STREAM_READ_BY_FD,
 995:		BPF_PROG_ASSOC_STRUCT_OPS,
 996:		__MAX_BPF_CMD,
 997:	};
 SourceFile:include/uapi/linux/bpf.h]

gemini-3.1-pro-preview

							input: 128314
							output: 46
							thoughts: 647
						

**Analyzing the BPF Reproducer**

Okay, let's break this down. First, `BPF_PROG_LOAD` is 5, noted. The reproducer focuses only on this. If it's *just* a load, how does the crash happen? The type is `BPF_PROG_TYPE_TRACEPOINT`, which aren't executed on load directly. That's a key observation.

Now, I'm seeing `prog_ifindex` in the reproducer, and that screams hardware offload. But then I remember that `ioctl` call:

```c
//  ioctl$ifreq_SIOCGIFINDEX_team arguments: [
//    fd: sock (resource)
//    cmd: const = 0x8933 (4 bytes)
//    arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
//      ifreq_dev_t["team0", ifindex_team] {
//        ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        elem: ifindex_team (resource)
//        pad = 0x0 (20 bytes)
//      }
//    }
//  ]
memcpy((void*)0x200000000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
	syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000600ul);
```

Wait, it's getting the `ifindex` of `team0`. But wait! the reproducer does the `BPF_PROG_LOAD` *before* the `ioctl`. Then I see that `prog_ifindex` is set to 0.

So, if the program isn't *executed*, how does it crash? I'm thinking the crash is in `__remove_hrtimer`. This is starting to look like a verification issue. Could `bpf_snprintf` be executed in `bpf_check`? I know `bpf_check` doesn't *run* the program, but I need to investigate further whether it *evaluates* the format string of `bpf_snprintf`. I'll go look at `check_bpf_snprintf_call` in `kernel/bpf/verifier.c`.

map[ContextFile:kernel/bpf/verifier.c IncludeLines:true Name:check_bpf_snprintf_call]

map[SourceCode:10118:	static int check_bpf_snprintf_call(struct bpf_verifier_env *env,
10119:					   struct bpf_reg_state *regs)
10120:	{
10121:		struct bpf_reg_state *fmt_reg = &regs[BPF_REG_3];
10122:		struct bpf_reg_state *data_len_reg = &regs[BPF_REG_5];
10123:		struct bpf_map *fmt_map = fmt_reg->map_ptr;
10124:		struct bpf_bprintf_data data = {};
10125:		int err, fmt_map_off, num_args;
10126:		u64 fmt_addr;
10127:		char *fmt;
10128:	
10129:		/* data must be an array of u64 */
10130:		if (data_len_reg->var_off.value % 8)
10131:			return -EINVAL;
10132:		num_args = data_len_reg->var_off.value / 8;
10133:	
10134:		/* fmt being ARG_PTR_TO_CONST_STR guarantees that var_off is const
10135:		 * and map_direct_value_addr is set.
10136:		 */
10137:		fmt_map_off = fmt_reg->var_off.value;
10138:		err = fmt_map->ops->map_direct_value_addr(fmt_map, &fmt_addr,
10139:							  fmt_map_off);
10140:		if (err) {
10141:			verbose(env, "failed to retrieve map value address\n");
10142:			return -EFAULT;
10143:		}
10144:		fmt = (char *)(long)fmt_addr + fmt_map_off;
10145:	
10146:		/* We are also guaranteed that fmt+fmt_map_off is NULL terminated, we
10147:		 * can focus on validating the format specifiers.
10148:		 */
10149:		err = bpf_bprintf_prepare(fmt, UINT_MAX, NULL, num_args, &data);
10150:		if (err < 0)
10151:			verbose(env, "Invalid format string\n");
10152:	
10153:		return err;
10154:	}
 SourceFile:kernel/bpf/verifier.c]

gemini-3.1-pro-preview

							input: 130345
							output: 42
							thoughts: 961
						

**BPF, Qdiscs, and a Soft Lockup - A Thread of Inquiry**

Okay, hold on a second. I need to trace this `bpf_snprintf_call` because it's calling `bpf_bprintf_prepare` with `args = NULL`. Let's re-examine that `bpf_bprintf_prepare` function. Right, in `check_bpf_snprintf_call`, the `data` struct is initialized as empty. This means `data->get_bin_args` and `data->get_buf` are both false, making `get_buffers` false as well.

Now, within the `bpf_bprintf_prepare` function, if `tmp_buf` is NULL due to `get_buffers` being false, the code simply increments `i` and `num_spec`. That means `bpf_bprintf_prepare` *isn't* actually calling `snprintf` during the verification stage, which is crucial.

Wait, but the reproducer is doing something else. It's using `sendmsg$nl_route_sched` with arguments pointing to `RTM_NEWQDISC`. That's the key: it creates a new qdisc! Is there a BPF program attached to it?

The reproducer shows a `prog_token_fd`, and it loads a BPF program. But, does it actually attach it? No, `bpf_prog_load` by itself *doesn't* attach. Unless it's a `BPF_PROG_TYPE_STRUCT_OPS` which is not the case here. It's a `BPF_PROG_TYPE_TRACEPOINT` (type 5).

So, if that's not the issue, what's causing the soft lockup? Let's trace it out. The lockup is within `toggle_allocation_gate` which goes through `static_key_enable`, then through `arch_jump_label_transform_apply`, `smp_text_poke_batch_finish`, `smp_text_poke_sync_each_cpu`, `on_each_cpu_cond_mask`, `smp_call_function_many_cond`, finally stuck in `csd_lock_wait`. CPU 1 is in `__remove_hrtimer`. Okay, and `toggle_allocation_gate` is in `mm/kfence/core.c`. I need to inspect that `toggle_allocation_gate` function more closely now.

map[ContextFile:mm/kfence/core.c IncludeLines:true Name:toggle_allocation_gate]

map[SourceCode: 887:	/*
 888:	 * Set up delayed work, which will enable and disable the static key. We need to
 889:	 * use a work queue (rather than a simple timer), since enabling and disabling a
 890:	 * static key cannot be done from an interrupt.
 891:	 *
 892:	 * Note: Toggling a static branch currently causes IPIs, and here we'll end up
 893:	 * with a total of 2 IPIs to all CPUs. If this ends up a problem in future (with
 894:	 * more aggressive sampling intervals), we could get away with a variant that
 895:	 * avoids IPIs, at the cost of not immediately capturing allocations if the
 896:	 * instructions remain cached.
 897:	 */
 898:	static void toggle_allocation_gate(struct work_struct *work)
 899:	{
 900:		if (!READ_ONCE(kfence_enabled))
 901:			return;
 902:	
 903:		atomic_set(&kfence_allocation_gate, -kfence_burst);
 904:	#ifdef CONFIG_KFENCE_STATIC_KEYS
 905:		/* Enable static key, and await allocation to happen. */
 906:		static_branch_enable(&kfence_allocation_key);
 907:	
 908:		wait_event_idle(allocation_wait,
 909:				atomic_read(&kfence_allocation_gate) > 0 ||
 910:				!READ_ONCE(kfence_enabled));
 911:	
 912:		/* Disable static key and reset timer. */
 913:		static_branch_disable(&kfence_allocation_key);
 914:	#endif
 915:		queue_delayed_work(system_dfl_wq, &kfence_timer,
 916:				   msecs_to_jiffies(kfence_sample_interval));
 917:	}
 SourceFile:mm/kfence/core.c]

gemini-3.1-pro-preview

							input: 132447
							output: 182
							thoughts: 685
						

**Debugging a KFENCE Inter-Processor Interrupt (IPI) Stall**

Okay, so `toggle_allocation_gate` – that’s a KFENCE delayed work item, right? It sets up a static key, and that's kicking off an IPI to all the CPUs. CPU 0 is sitting here, waiting on CPU 1 to acknowledge the interrupt, but CPU 1 is hung up in `__remove_hrtimer`. That's the core of the problem, why is CPU 1 stalling?

First thought was to re-examine the assembly of `__remove_hrtimer`. But, that assembly I pulled up earlier... that *isn’t* `__remove_hrtimer`! That’s throwing me off. I need to get the real assembly from the kernel.

Aha! `__remove_hrtimer` has `lockdep_assert_held(&cpu_base->lock);`. Could this assembly be *from* a `lockdep_assert_held` call? That seems likely.

Let's look at the crash dump to get a better look at what is going on, and re-disassemble the code there.

map[Question:Disassemble this x86_64 code snippet:
ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 45 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d
]

map[Answer:The provided hex string represents a sequence of x86_64 machine code instructions. Below is the step-by-step disassembly and analysis of the code:

### Disassembly

| Offset | Hex Bytes | Instruction | Description |
| :--- | :--- | :--- | :--- |
| 0x00 | `ee` | `out %al, (%dx)` | Output byte in `AL` to I/O port in `DX`. |
| 0x01 | `e8 f6 fd 11 00` | `call 0x11fdfc` | Relative call to a function (let's call it `func1`). |
| 0x06 | `45 85 ed` | `test %r13d, %r13d` | Test the lower 32 bits of `R13`. |
| 0x09 | `48 89 5c 24 08` | `mov %rbx, 0x8(%rsp)` | Save `RBX` to the stack at `[RSP + 8]`. |
| 0x0e | `74 2a` | `je 0x3a` | Jump to offset `0x3a` if `R13D` is zero. |
| 0x10 | `48 8d 7b 18` | `lea 0x18(%rbx), %rdi` | Load effective address of `[RBX + 24]` into `RDI`. |
| 0x14 | `be ff ff ff ff` | `mov $0xffffffff, %esi` | Move `-1` (32-bit) into `ESI`. |
| 0x19 | `e8 ce a2 21 0a` | `call 0xa21a2ec` | Call another function (let's call it `func2`). |
| 0x1e | `41 89 c5` | `mov %eax, %r13d` | Move return value from `EAX` to `R13D`. |
| 0x21 | `31 ff` | `xor %edi, %edi` | Zero out `EDI` (first argument = 0). |
| 0x23 | `89 c6` | `mov %eax, %esi` | Move `EAX` to `ESI` (second argument = status). |
| 0x25 | `e8 d2 fd 11 00` | `call 0x11fdfc` | Call `func1` again with arguments `(0, status)`. |
| 0x2a | `45 85 ed` | `test %r13d, %r13d` | Test the new value of `R13D`. |
| 0x2d | `0f 84 33 02 00 00` | `je 0x266` | Long jump if `R13D` is zero (likely an error or exit path). |
| 0x33 | `e8 84 f9 11 00` | `call 0x11f9bc` | Call a third function (let's call it `func3`). |
| 0x38 | `eb 05` | `jmp 0x3f` | Jump over the next instruction. |
| 0x3a | `e8 7d f9 11 00` | `call 0x11f9bc` | Call `func3` (target of the `je` at `0x0e`). |
| 0x3f | `4d` | `rex.WRB` | REX prefix (likely part of the next instruction). |

### Analysis

1.  **I/O and Synchronization**: The code starts with an `out` instruction, which is often used in low-level drivers or for hardware synchronization/signaling.
2.  **Function Logic**:
    *   It calls `func1` (possibly a trace point or a lock acquisition).
    *   It checks a status in `R13D`.
    *   If `R13D` is non-zero, it performs an operation on a structure pointed to by `RBX`. Specifically, it passes the address at offset 24 (`0x18`) to `func2` along with `-1`. This pattern is highly characteristic of an **atomic decrement** (e.g., `atomic_dec_return` or `refcount_dec_and_test`).
    *   After the decrement, it calls `func1` again, this time passing the new status/refcount.
    *   If the resulting value is zero, it jumps to a distant cleanup/destructor block (`0x266`).
    *   Otherwise, it proceeds to call `func3` (possibly a "put" or "release" completion).
3.  **Context**: This snippet appears to be part of a reference counting or locking mechanism in the Linux kernel, possibly related to networking (skb) or memory management, where `RBX` holds a pointer to a tracked object. The `ee` byte at the start might also be the tail end of a `VMLAUNCH` instruction (`0F 01 EE`) if this code is from a hypervisor (KVM) error path.]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

Disassemble this x86_64 code snippet:
ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 45 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d

The provided hex string represents a sequence of x86_64 machine code instructions. Below is the step-by-step disassembly and analysis of the code:

### Disassembly

| Offset | Hex Bytes | Instruction | Description |
| :--- | :--- | :--- | :--- |
| 0x00 | `ee` | `out %al, (%dx)` | Output byte in `AL` to I/O port in `DX`. |
| 0x01 | `e8 f6 fd 11 00` | `call 0x11fdfc` | Relative call to a function (let's call it `func1`). |
| 0x06 | `45 85 ed` | `test %r13d, %r13d` | Test the lower 32 bits of `R13`. |
| 0x09 | `48 89 5c 24 08` | `mov %rbx, 0x8(%rsp)` | Save `RBX` to the stack at `[RSP + 8]`. |
| 0x0e | `74 2a` | `je 0x3a` | Jump to offset `0x3a` if `R13D` is zero. |
| 0x10 | `48 8d 7b 18` | `lea 0x18(%rbx), %rdi` | Load effective address of `[RBX + 24]` into `RDI`. |
| 0x14 | `be ff ff ff ff` | `mov $0xffffffff, %esi` | Move `-1` (32-bit) into `ESI`. |
| 0x19 | `e8 ce a2 21 0a` | `call 0xa21a2ec` | Call another function (let's call it `func2`). |
| 0x1e | `41 89 c5` | `mov %eax, %r13d` | Move return value from `EAX` to `R13D`. |
| 0x21 | `31 ff` | `xor %edi, %edi` | Zero out `EDI` (first argument = 0). |
| 0x23 | `89 c6` | `mov %eax, %esi` | Move `EAX` to `ESI` (second argument = status). |
| 0x25 | `e8 d2 fd 11 00` | `call 0x11fdfc` | Call `func1` again with arguments `(0, status)`. |
| 0x2a | `45 85 ed` | `test %r13d, %r13d` | Test the new value of `R13D`. |
| 0x2d | `0f 84 33 02 00 00` | `je 0x266` | Long jump if `R13D` is zero (likely an error or exit path). |
| 0x33 | `e8 84 f9 11 00` | `call 0x11f9bc` | Call a third function (let's call it `func3`). |
| 0x38 | `eb 05` | `jmp 0x3f` | Jump over the next instruction. |
| 0x3a | `e8 7d f9 11 00` | `call 0x11f9bc` | Call `func3` (target of the `je` at `0x0e`). |
| 0x3f | `4d` | `rex.WRB` | REX prefix (likely part of the next instruction). |

### Analysis

1.  **I/O and Synchronization**: The code starts with an `out` instruction, which is often used in low-level drivers or for hardware synchronization/signaling.
2.  **Function Logic**:
    *   It calls `func1` (possibly a trace point or a lock acquisition).
    *   It checks a status in `R13D`.
    *   If `R13D` is non-zero, it performs an operation on a structure pointed to by `RBX`. Specifically, it passes the address at offset 24 (`0x18`) to `func2` along with `-1`. This pattern is highly characteristic of an **atomic decrement** (e.g., `atomic_dec_return` or `refcount_dec_and_test`).
    *   After the decrement, it calls `func1` again, this time passing the new status/refcount.
    *   If the resulting value is zero, it jumps to a distant cleanup/destructor block (`0x266`).
    *   Otherwise, it proceeds to call `func3` (possibly a "put" or "release" completion).
3.  **Context**: This snippet appears to be part of a reference counting or locking mechanism in the Linux kernel, possibly related to networking (skb) or memory management, where `RBX` holds a pointer to a tracked object. The `ee` byte at the start might also be the tail end of a `VMLAUNCH` instruction (`0F 01 EE`) if this code is from a hypervisor (KVM) error path.

gemini-3-flash-preview

							input: 2420
							output: 21
							thoughts: 9523
						

**Dissecting the X86_64 Hex Code**

Alright, the task is to essentially reverse engineer this x86_64 hex string.  It appears I need to figure out what this code does.  I've been instructed to use tools, but I don't have direct access to a dedicated disassembler.  So, I'm going to rely on my knowledge of x86_64 and see if I can figure this out manually by piecing together instructions and looking for recognizable patterns within the provided byte sequence. My initial thought is to try and match byte sequences to known x86_64 instructions.  I'll start by breaking down the hex string into individual instructions and figuring out what they *could* represent, and then hopefully be able to recognize some higher-level patterns.

I notice the first two bytes, `ee e8`, and that's immediately throwing me for a loop. `ee` usually translates to `out dx, al`, an I/O instruction, but that seems unusual for a standard kernel code sequence. It might be a red herring, or it might indicate something specific about the system. I also see a series of relative `call` instructions, which are pretty common.  There are a few `test` instructions, and a lot of `mov` operations. The `lea` instruction with a relative offset looks interesting, as it is pointing to an offset of the `rbx` register, and could be a struct field. The presence of `0xffffffff` (which is -1) as an immediate value is another clue.

I am looking for potentially common x86_64 patterns that I am familiar with. I am on the lookout for function prologues (saving registers), common library functions, and control flow structures. I also realize that the `e8` prefix is for a `call` instruction, which might be the start of a function. I'm going to look at the calls to see if I can determine if they share similar destinations.

The presence of multiple calls to the same function (relative to the offset of this snippet) seems important. The fact that the jump instruction's target seems to be within this snippet makes me think it's a loop or conditional block. I am going to see if I can match the addresses.

After some analysis, I found a possible pattern in how the calls are relative to each other:
1. `call func1`
2. `test r13d`
3. conditional jump
4. `call func2`
5. `mov`, `xor`, `mov`
6. `call func1`

This looks like a conditional block where a call happens if a certain status is true. But the code does something else if it is false.

I have come to a conclusion that `func1` is called twice, and the second call takes in `func2`'s return.

The structure looks like:
```c
status = func1(...);
if (status != 0) {
    status = func2(&obj->field, -1);
    func1(0, status); // Calling func1 again using the status
    if (status != 0) {
        func3(); // calls func3 if the status != 0
    }
} else {
    func3();
}
```

If the first `func1` returns a non-zero value, `func2` is called. `func1` is called with the return value of `func2`.

The functions are likely using r13d as an int. `0x18(%rbx)` is likely a member of a struct pointed by `rbx`. I am now going to focus on finding `func2`, because it seems like the most interesting part. `0x0a21a2ce` looks like a function that is located at a very distant address compared to the others. I also realize that the last instruction is a REX prefix, `4d`. This is a clue that the next instruction is also likely part of a function.

This is where I am right now. I need to figure out what `func1`, `func2`, and `func3` represent. And also what `r13d` is.

map[Name:task_struct]

map[Fields:[map[Name:thread_info OffsetBits:0 SizeBits:192] map[Name:__state OffsetBits:192 SizeBits:32] map[Name:saved_state OffsetBits:224 SizeBits:32] map[Name:stack OffsetBits:256 SizeBits:64] map[Name:usage OffsetBits:320 SizeBits:32] map[Name:flags OffsetBits:352 SizeBits:32] map[Name:ptrace OffsetBits:384 SizeBits:32] map[Name:on_cpu OffsetBits:416 SizeBits:32] map[Name:wake_entry OffsetBits:448 SizeBits:128] map[Name:wakee_flips OffsetBits:576 SizeBits:32] map[Name:wakee_flip_decay_ts OffsetBits:640 SizeBits:64] map[Name:last_wakee OffsetBits:704 SizeBits:64] map[Name:recent_used_cpu OffsetBits:768 SizeBits:32] map[Name:wake_cpu OffsetBits:800 SizeBits:32] map[Name:on_rq OffsetBits:832 SizeBits:32] map[Name:prio OffsetBits:864 SizeBits:32] map[Name:static_prio OffsetBits:896 SizeBits:32] map[Name:normal_prio OffsetBits:928 SizeBits:32] map[Name:rt_priority OffsetBits:960 SizeBits:32] map[Name:se OffsetBits:1024 SizeBits:2560] map[Name:rt OffsetBits:3584 SizeBits:384] map[Name:dl OffsetBits:3968 SizeBits:2176] map[Name:dl_server OffsetBits:6144 SizeBits:64] map[Name:sched_class OffsetBits:6208 SizeBits:64] map[Name:sched_task_group OffsetBits:6272 SizeBits:64] map[Name:sched_throttle_work OffsetBits:6336 SizeBits:128] map[Name:throttle_node OffsetBits:6464 SizeBits:128] map[Name:throttled OffsetBits:6592 SizeBits:8] map[Name:stats OffsetBits:6656 SizeBits:2048] map[Name:policy OffsetBits:8704 SizeBits:32] map[Name:max_allowed_capacity OffsetBits:8768 SizeBits:64] map[Name:nr_cpus_allowed OffsetBits:8832 SizeBits:32] map[Name:cpus_ptr OffsetBits:8896 SizeBits:64] map[Name:user_cpus_ptr OffsetBits:8960 SizeBits:64] map[Name:cpus_mask OffsetBits:9024 SizeBits:64] map[Name:migration_pending OffsetBits:9088 SizeBits:64] map[Name:migration_disabled OffsetBits:9152 SizeBits:16] map[Name:migration_flags OffsetBits:9168 SizeBits:16] map[Name:rcu_read_lock_nesting OffsetBits:9184 SizeBits:32] map[Name:rcu_read_unlock_special OffsetBits:9216 SizeBits:32] map[Name:rcu_node_entry OffsetBits:9280 SizeBits:128] map[Name:rcu_blocked_node OffsetBits:9408 SizeBits:64] map[Name:rcu_tasks_nvcsw OffsetBits:9472 SizeBits:64] map[Name:rcu_tasks_holdout OffsetBits:9536 SizeBits:8] map[Name:rcu_tasks_idx OffsetBits:9544 SizeBits:8] map[Name:rcu_tasks_idle_cpu OffsetBits:9568 SizeBits:32] map[Name:rcu_tasks_holdout_list OffsetBits:9600 SizeBits:128] map[Name:rcu_tasks_exit_cpu OffsetBits:9728 SizeBits:32] map[Name:rcu_tasks_exit_list OffsetBits:9792 SizeBits:128] map[Name:trc_reader_nesting OffsetBits:9920 SizeBits:32] map[Name:trc_reader_scp OffsetBits:9984 SizeBits:64] map[Name:sched_info OffsetBits:10048 SizeBits:512] map[Name:tasks OffsetBits:10560 SizeBits:128] map[Name:pushable_tasks OffsetBits:10688 SizeBits:320] map[Name:pushable_dl_tasks OffsetBits:11008 SizeBits:192] map[Name:mm OffsetBits:11200 SizeBits:64] map[Name:active_mm OffsetBits:11264 SizeBits:64] map[Name:exit_state OffsetBits:11328 SizeBits:32] map[Name:exit_code OffsetBits:11360 SizeBits:32] map[Name:exit_signal OffsetBits:11392 SizeBits:32] map[Name:pdeath_signal OffsetBits:11424 SizeBits:32] map[Name:jobctl OffsetBits:11456 SizeBits:64] map[Name:personality OffsetBits:11520 SizeBits:32] map[Name:sched_reset_on_fork OffsetBits:11552 SizeBits:1] map[Name:sched_contributes_to_load OffsetBits:11553 SizeBits:1] map[Name:sched_migrated OffsetBits:11554 SizeBits:1] map[Name:sched_task_hot OffsetBits:11555 SizeBits:1] map[Name: OffsetBits:11584 SizeBits:0] map[Name:sched_remote_wakeup OffsetBits:11584 SizeBits:1] map[Name:sched_rt_mutex OffsetBits:11585 SizeBits:1] map[Name:user_dumpable OffsetBits:11586 SizeBits:1] map[Name:in_execve OffsetBits:11587 SizeBits:1] map[Name:in_iowait OffsetBits:11588 SizeBits:1] map[Name:restore_sigmask OffsetBits:11589 SizeBits:1] map[Name:no_cgroup_migration OffsetBits:11590 SizeBits:1] map[Name:frozen OffsetBits:11591 SizeBits:1] map[Name:use_memdelay OffsetBits:11592 SizeBits:1] map[Name:in_memstall OffsetBits:11593 SizeBits:1] map[Name:in_page_owner OffsetBits:11594 SizeBits:1] map[Name:in_eventfd OffsetBits:11595 SizeBits:1] map[Name:reported_split_lock OffsetBits:11596 SizeBits:1] map[Name:in_nf_duplicate OffsetBits:11597 SizeBits:1] map[Name:atomic_flags OffsetBits:11648 SizeBits:64] map[Name:restart_block OffsetBits:11712 SizeBits:448] map[Name:pid OffsetBits:12160 SizeBits:32] map[Name:tgid OffsetBits:12192 SizeBits:32] map[Name:stack_canary OffsetBits:12224 SizeBits:64] map[Name:real_parent OffsetBits:12288 SizeBits:64] map[Name:parent OffsetBits:12352 SizeBits:64] map[Name:children OffsetBits:12416 SizeBits:128] map[Name:sibling OffsetBits:12544 SizeBits:128] map[Name:group_leader OffsetBits:12672 SizeBits:64] map[Name:ptraced OffsetBits:12736 SizeBits:128] map[Name:ptrace_entry OffsetBits:12864 SizeBits:128] map[Name:thread_pid OffsetBits:12992 SizeBits:64] map[Name:pid_links OffsetBits:13056 SizeBits:512] map[Name:thread_node OffsetBits:13568 SizeBits:128] map[Name:vfork_done OffsetBits:13696 SizeBits:64] map[Name:set_child_tid OffsetBits:13760 SizeBits:64] map[Name:clear_child_tid OffsetBits:13824 SizeBits:64] map[Name:worker_private OffsetBits:13888 SizeBits:64] map[Name:utime OffsetBits:13952 SizeBits:64] map[Name:stime OffsetBits:14016 SizeBits:64] map[Name:gtime OffsetBits:14080 SizeBits:64] map[Name:prev_cputime OffsetBits:14144 SizeBits:640] map[Name:vtime OffsetBits:14784 SizeBits:704] map[Name:nvcsw OffsetBits:15488 SizeBits:64] map[Name:nivcsw OffsetBits:15552 SizeBits:64] map[Name:start_time OffsetBits:15616 SizeBits:64] map[Name:start_boottime OffsetBits:15680 SizeBits:64] map[Name:min_flt OffsetBits:15744 SizeBits:64] map[Name:maj_flt OffsetBits:15808 SizeBits:64] map[Name:posix_cputimers OffsetBits:15872 SizeBits:640] map[Name:posix_cputimers_work OffsetBits:16512 SizeBits:1280] map[Name:ptracer_cred OffsetBits:17792 SizeBits:64] map[Name:real_cred OffsetBits:17856 SizeBits:64] map[Name:cred OffsetBits:17920 SizeBits:64] map[Name:cached_requested_key OffsetBits:17984 SizeBits:64] map[Name:comm OffsetBits:18048 SizeBits:128] map[Name:nameidata OffsetBits:18176 SizeBits:64] map[Name:sysvsem OffsetBits:18240 SizeBits:64] map[Name:sysvshm OffsetBits:18304 SizeBits:128] map[Name:last_switch_count OffsetBits:18432 SizeBits:64] map[Name:last_switch_time OffsetBits:18496 SizeBits:64] map[Name:fs OffsetBits:18560 SizeBits:64] map[Name:files OffsetBits:18624 SizeBits:64] map[Name:io_uring OffsetBits:18688 SizeBits:64] map[Name:io_uring_restrict OffsetBits:18752 SizeBits:64] map[Name:nsproxy OffsetBits:18816 SizeBits:64] map[Name:signal OffsetBits:18880 SizeBits:64] map[Name:sighand OffsetBits:18944 SizeBits:64] map[Name:blocked OffsetBits:19008 SizeBits:64] map[Name:real_blocked OffsetBits:19072 SizeBits:64] map[Name:saved_sigmask OffsetBits:19136 SizeBits:64] map[Name:pending OffsetBits:19200 SizeBits:192] map[Name:sas_ss_sp OffsetBits:19392 SizeBits:64] map[Name:sas_ss_size OffsetBits:19456 SizeBits:64] map[Name:sas_ss_flags OffsetBits:19520 SizeBits:32] map[Name:task_works OffsetBits:19584 SizeBits:64] map[Name:audit_context OffsetBits:19648 SizeBits:64] map[Name:loginuid OffsetBits:19712 SizeBits:32] map[Name:sessionid OffsetBits:19744 SizeBits:32] map[Name:seccomp OffsetBits:19776 SizeBits:128] map[Name:syscall_dispatch OffsetBits:19904 SizeBits:256] map[Name:parent_exec_id OffsetBits:20160 SizeBits:64] map[Name:self_exec_id OffsetBits:20224 SizeBits:64] map[Name:alloc_lock OffsetBits:20288 SizeBits:512] map[Name:pi_lock OffsetBits:20800 SizeBits:512] map[Name:wake_q OffsetBits:21312 SizeBits:64] map[Name:pi_waiters OffsetBits:21376 SizeBits:128] map[Name:pi_top_task OffsetBits:21504 SizeBits:64] map[Name:pi_blocked_on OffsetBits:21568 SizeBits:64] map[Name:blocked_on OffsetBits:21632 SizeBits:64] map[Name:blocked_lock OffsetBits:21696 SizeBits:512] map[Name:blocker OffsetBits:22208 SizeBits:64] map[Name:non_block_count OffsetBits:22272 SizeBits:32] map[Name:irqtrace OffsetBits:22336 SizeBits:448] map[Name:hardirq_threaded OffsetBits:22784 SizeBits:32] map[Name:hardirq_chain_key OffsetBits:22848 SizeBits:64] map[Name:softirqs_enabled OffsetBits:22912 SizeBits:32] map[Name:softirq_context OffsetBits:22944 SizeBits:32] map[Name:irq_config OffsetBits:22976 SizeBits:32] map[Name:curr_chain_key OffsetBits:23040 SizeBits:64] map[Name:lockdep_depth OffsetBits:23104 SizeBits:32] map[Name:lockdep_recursion OffsetBits:23136 SizeBits:32] map[Name:held_locks OffsetBits:23168 SizeBits:15360] map[Name:in_ubsan OffsetBits:38528 SizeBits:32] map[Name:journal_info OffsetBits:38592 SizeBits:64] map[Name:bio_list OffsetBits:38656 SizeBits:64] map[Name:plug OffsetBits:38720 SizeBits:64] map[Name:reclaim_state OffsetBits:38784 SizeBits:64] map[Name:io_context OffsetBits:38848 SizeBits:64] map[Name:capture_control OffsetBits:38912 SizeBits:64] map[Name:ptrace_message OffsetBits:38976 SizeBits:64] map[Name:last_siginfo OffsetBits:39040 SizeBits:64] map[Name:ioac OffsetBits:39104 SizeBits:448] map[Name:psi_flags OffsetBits:39552 SizeBits:32] map[Name:acct_rss_mem1 OffsetBits:39616 SizeBits:64] map[Name:acct_vm_mem1 OffsetBits:39680 SizeBits:64] map[Name:acct_timexpd OffsetBits:39744 SizeBits:64] map[Name:mems_allowed OffsetBits:39808 SizeBits:64] map[Name:mems_allowed_seq OffsetBits:39872 SizeBits:448] map[Name:cpuset_mem_spread_rotor OffsetBits:40320 SizeBits:32] map[Name:cgroups OffsetBits:40384 SizeBits:64] map[Name:cg_list OffsetBits:40448 SizeBits:128] map[Name:robust_list OffsetBits:40576 SizeBits:64] map[Name:pi_state_list OffsetBits:40640 SizeBits:128] map[Name:pi_state_cache OffsetBits:40768 SizeBits:64] map[Name:futex_exit_mutex OffsetBits:40832 SizeBits:1088] map[Name:futex_state OffsetBits:41920 SizeBits:32] map[Name:perf_recursion OffsetBits:41952 SizeBits:32] map[Name:perf_event_ctxp OffsetBits:41984 SizeBits:64] map[Name:perf_event_mutex OffsetBits:42048 SizeBits:1088] map[Name:perf_event_list OffsetBits:43136 SizeBits:128] map[Name:perf_ctx_data OffsetBits:43264 SizeBits:64] map[Name:preempt_disable_ip OffsetBits:43328 SizeBits:64] map[Name:mempolicy OffsetBits:43392 SizeBits:64] map[Name:il_prev OffsetBits:43456 SizeBits:16] map[Name:il_weight OffsetBits:43472 SizeBits:8] map[Name:pref_node_fork OffsetBits:43488 SizeBits:16] map[Name:numa_scan_seq OffsetBits:43520 SizeBits:32] map[Name:numa_scan_period OffsetBits:43552 SizeBits:32] map[Name:numa_scan_period_max OffsetBits:43584 SizeBits:32] map[Name:numa_preferred_nid OffsetBits:43616 SizeBits:32] map[Name:numa_migrate_retry OffsetBits:43648 SizeBits:64] map[Name:node_stamp OffsetBits:43712 SizeBits:64] map[Name:last_task_numa_placement OffsetBits:43776 SizeBits:64] map[Name:last_sum_exec_runtime OffsetBits:43840 SizeBits:64] map[Name:numa_work OffsetBits:43904 SizeBits:128] map[Name:numa_group OffsetBits:44032 SizeBits:64] map[Name:numa_faults OffsetBits:44096 SizeBits:64] map[Name:total_numa_faults OffsetBits:44160 SizeBits:64] map[Name:numa_faults_locality OffsetBits:44224 SizeBits:192] map[Name:numa_pages_migrated OffsetBits:44416 SizeBits:64] map[Name:rseq OffsetBits:44480 SizeBits:320] map[Name:mm_cid OffsetBits:44800 SizeBits:192] map[Name:tlb_ubc OffsetBits:44992 SizeBits:192] map[Name:splice_pipe OffsetBits:45184 SizeBits:64] map[Name:task_frag OffsetBits:45248 SizeBits:128] map[Name:make_it_fail OffsetBits:45376 SizeBits:32] map[Name:fail_nth OffsetBits:45408 SizeBits:32] map[Name:nr_dirtied OffsetBits:45440 SizeBits:32] map[Name:nr_dirtied_pause OffsetBits:45472 SizeBits:32] map[Name:dirty_paused_when OffsetBits:45504 SizeBits:64] map[Name:timer_slack_ns OffsetBits:45568 SizeBits:64] map[Name:default_timer_slack_ns OffsetBits:45632 SizeBits:64] map[Name:kasan_depth OffsetBits:45696 SizeBits:32] map[Name:trace_recursion OffsetBits:45760 SizeBits:64] map[Name:kcov_mode OffsetBits:45824 SizeBits:32] map[Name:kcov_size OffsetBits:45856 SizeBits:32] map[Name:kcov_area OffsetBits:45888 SizeBits:64] map[Name:kcov OffsetBits:45952 SizeBits:64] map[Name:kcov_handle OffsetBits:46016 SizeBits:64] map[Name:kcov_sequence OffsetBits:46080 SizeBits:32] map[Name:kcov_softirq OffsetBits:46112 SizeBits:32] map[Name:memcg_nr_pages_over_high OffsetBits:46144 SizeBits:32] map[Name:active_memcg OffsetBits:46208 SizeBits:64] map[Name:objcg OffsetBits:46272 SizeBits:64] map[Name:throttle_disk OffsetBits:46336 SizeBits:64] map[Name:sequential_io OffsetBits:46400 SizeBits:32] map[Name:sequential_io_avg OffsetBits:46432 SizeBits:32] map[Name:kmap_ctrl OffsetBits:46464 SizeBits:0] map[Name:task_state_change OffsetBits:46464 SizeBits:64] map[Name:rcu OffsetBits:46528 SizeBits:128] map[Name:rcu_users OffsetBits:46656 SizeBits:32] map[Name:pagefault_disabled OffsetBits:46688 SizeBits:32] map[Name:oom_reaper_list OffsetBits:46720 SizeBits:64] map[Name:oom_reaper_timer OffsetBits:46784 SizeBits:640] map[Name:stack_vm_area OffsetBits:47424 SizeBits:64] map[Name:stack_refcount OffsetBits:47488 SizeBits:32] map[Name:security OffsetBits:47552 SizeBits:64] map[Name:bpf_storage OffsetBits:47616 SizeBits:64] map[Name:bpf_ctx OffsetBits:47680 SizeBits:64] map[Name:bpf_net_context OffsetBits:47744 SizeBits:64] map[Name:mce_vaddr OffsetBits:47808 SizeBits:64] map[Name:mce_kflags OffsetBits:47872 SizeBits:64] map[Name:mce_addr OffsetBits:47936 SizeBits:64] map[Name:mce_ripv OffsetBits:48000 SizeBits:1] map[Name:mce_whole_page OffsetBits:48001 SizeBits:1] map[Name:__mce_reserved OffsetBits:48002 SizeBits:62] map[Name:mce_kill_me OffsetBits:48064 SizeBits:128] map[Name:mce_count OffsetBits:48192 SizeBits:32] map[Name:l1d_flush_kill OffsetBits:48256 SizeBits:128] map[Name:unwind_info OffsetBits:48384 SizeBits:320] map[Name:thread OffsetBits:48704 SizeBits:1216]]]

gemini-3-flash-preview

							input: 19212
							output: 19
							thoughts: 2903
						

**Analyzing a Snippet of Assembly Code**

Okay, here's the deal. I'm looking at this assembly, and it's got me thinking in circles a bit. First off, it's immediately throwing me off with that `out %al, %dx` instruction at the beginning. It's unusual, but my immediate thought is that it could be related to some hardware interaction, maybe some kind of lock/unlock sequence, or even a very specific part of the kernel initializing a hardware state. But, it could also be padding or an `alternative` instruction - so I am not sure.

Initially, I looked at offsets and assumed something was wrong with the `task_struct`, specifically with `__state`. The address calculation was spot on, `192 bits = 24 bytes`, but `__state` is just a `unsigned int` which is only 32 bits, which felt wrong. This wasn't the correct path. So I discarded this thought.

I'm seeing `func2` being called with what looks like a pointer to a field at offset 0x18 from `rbx`, and `-1`. This looks like some sort of atomic operation or modification. I initially thought it might be something like `atomic_add_return` or something similar, maybe `atomic_dec_return` but this is unlikely because `__state` is probably modified through `set_current_state`.

Then I got fixated on figuring out what those functions, `func1` and `func2` and `func3`, are. I was trying to map these calls to some common kernel locking primitives. I considered `preempt_disable/enable` because of the `test %r13d, %r13d` and conditional jump, and that `func1` is called twice. Initially, I thought that `func1` may be a form of `__preempt_count_add/sub`, perhaps through a macro like `preempt_count_add(-val)`. However, it felt like the arguments didn't quite line up. My thoughts then pivoted to `spin_lock` and `spin_unlock`. If `func1` is `local_irq_restore`, then what's that initial call? No arguments. This felt confusing.

The offsets from the dis-assembly don't line up, so I am going to recalculate those.

*   `func1` = `0x11fdfc`
*   `func2` = `0x0a21a2ec`
*   `func3` = `0x11f9bc`

These are my current thoughts: I see a pattern: `status = func1()` ; `if (status) { status = func2(...); func1(0, status); }` ; `func3()`

It looks like we are dealing with a nested operation. Some status is checked, and a function is called conditional, and then another function is called.

The `lea 0x18(%rbx), %rdi` is the key. I need to identify what struct `rbx` points to. Offset 0x18 is 24 bytes. I thought of `struct task_struct`, `struct file`, `struct inode`, `struct rq`, `struct lock_class`, but no certain struct felt right. Perhaps, I am looking for `__state` which is `unsigned int`.

I want to search the source for those instructions, which will hopefully reveal the struct being used. I will search for `test %r13d, %r13d` ; `mov %rbx, 0x8(%rsp)` ; `je ...` and also search for `lea 0x18(%rbx), %rdi` with `mov $-1, %esi`. Perhaps, I can use the `-1` to narrow the search. Maybe, I should try to search for `atomic_dec_return`, as that fits the call pattern with a `-1` argument.

I am not sure what the purpose of the `ee` instruction is. It is unusual.

map[Name:rq]

map[Fields:[map[Name:nr_running OffsetBits:0 SizeBits:32] map[Name:nr_numa_running OffsetBits:32 SizeBits:32] map[Name:nr_preferred_running OffsetBits:64 SizeBits:32] map[Name:ttwu_pending OffsetBits:96 SizeBits:32] map[Name:cpu_capacity OffsetBits:128 SizeBits:64] map[Name: OffsetBits:192 SizeBits:64] map[Name:idle OffsetBits:256 SizeBits:64] map[Name:nr_switches OffsetBits:512 SizeBits:64] map[Name:__lock OffsetBits:576 SizeBits:512] map[Name:nohz_tick_stopped OffsetBits:1088 SizeBits:32] map[Name:nohz_flags OffsetBits:1120 SizeBits:32] map[Name:has_blocked_load OffsetBits:1152 SizeBits:32] map[Name:last_blocked_load_update_tick OffsetBits:1216 SizeBits:64] map[Name:nohz_csd OffsetBits:1280 SizeBits:256] map[Name:cfs OffsetBits:1536 SizeBits:4608] map[Name:rt OffsetBits:6144 SizeBits:13376] map[Name:dl OffsetBits:19520 SizeBits:832] map[Name:fair_server OffsetBits:20352 SizeBits:2176] map[Name:leaf_cfs_rq_list OffsetBits:22528 SizeBits:128] map[Name:tmp_alone_branch OffsetBits:22656 SizeBits:64] map[Name:numa_migrate_on OffsetBits:22720 SizeBits:32] map[Name:nr_uninterruptible OffsetBits:22784 SizeBits:64] map[Name:dl_server OffsetBits:22848 SizeBits:64] map[Name:stop OffsetBits:22912 SizeBits:64] map[Name:next_class OffsetBits:22976 SizeBits:64] map[Name:next_balance OffsetBits:23040 SizeBits:64] map[Name:prev_mm OffsetBits:23104 SizeBits:64] map[Name:clock_task OffsetBits:23552 SizeBits:64] map[Name:clock_pelt OffsetBits:23616 SizeBits:64] map[Name:clock OffsetBits:23680 SizeBits:64] map[Name:lost_idle_time OffsetBits:23744 SizeBits:64] map[Name:clock_update_flags OffsetBits:23808 SizeBits:32] map[Name:clock_pelt_idle OffsetBits:23872 SizeBits:64] map[Name:clock_idle OffsetBits:23936 SizeBits:64] map[Name:last_seen_need_resched_ns OffsetBits:24000 SizeBits:64] map[Name:ticks_without_resched OffsetBits:24064 SizeBits:32] map[Name:membarrier_state OffsetBits:24096 SizeBits:32] map[Name:rd OffsetBits:24128 SizeBits:64] map[Name:sd OffsetBits:24192 SizeBits:64] map[Name:balance_callback OffsetBits:24256 SizeBits:64] map[Name:nohz_idle_balance OffsetBits:24320 SizeBits:8] map[Name:idle_balance OffsetBits:24328 SizeBits:8] map[Name:misfit_task_load OffsetBits:24384 SizeBits:64] map[Name:active_balance OffsetBits:24448 SizeBits:32] map[Name:push_cpu OffsetBits:24480 SizeBits:32] map[Name:active_balance_work OffsetBits:24512 SizeBits:384] map[Name:cpu OffsetBits:24896 SizeBits:32] map[Name:online OffsetBits:24928 SizeBits:32] map[Name:cfs_tasks OffsetBits:24960 SizeBits:128] map[Name:avg_rt OffsetBits:25088 SizeBits:512] map[Name:avg_dl OffsetBits:25600 SizeBits:512] map[Name:avg_irq OffsetBits:26112 SizeBits:512] map[Name:idle_stamp OffsetBits:26624 SizeBits:64] map[Name:avg_idle OffsetBits:26688 SizeBits:64] map[Name:max_idle_balance_cost OffsetBits:26752 SizeBits:64] map[Name:hotplug_wait OffsetBits:26816 SizeBits:64] map[Name:prev_irq_time OffsetBits:26880 SizeBits:64] map[Name:psi_irq_time OffsetBits:26944 SizeBits:64] map[Name:calc_load_update OffsetBits:27008 SizeBits:64] map[Name:calc_load_active OffsetBits:27072 SizeBits:64] map[Name:hrtick_csd OffsetBits:27136 SizeBits:256] map[Name:hrtick_timer OffsetBits:27392 SizeBits:640] map[Name:hrtick_time OffsetBits:28032 SizeBits:64] map[Name:hrtick_delay OffsetBits:28096 SizeBits:64] map[Name:hrtick_sched OffsetBits:28160 SizeBits:32] map[Name:rq_sched_info OffsetBits:28224 SizeBits:512] map[Name:rq_cpu_time OffsetBits:28736 SizeBits:64] map[Name:yld_count OffsetBits:28800 SizeBits:32] map[Name:sched_count OffsetBits:28832 SizeBits:32] map[Name:sched_goidle OffsetBits:28864 SizeBits:32] map[Name:ttwu_count OffsetBits:28896 SizeBits:32] map[Name:ttwu_local OffsetBits:28928 SizeBits:32] map[Name:idle_state OffsetBits:28992 SizeBits:64] map[Name:nr_pinned OffsetBits:29056 SizeBits:32] map[Name:push_busy OffsetBits:29088 SizeBits:32] map[Name:push_work OffsetBits:29120 SizeBits:384] map[Name:scratch_mask OffsetBits:29504 SizeBits:64] map[Name:cfsb_csd OffsetBits:29696 SizeBits:256] map[Name:cfsb_csd_list OffsetBits:29952 SizeBits:128] map[Name:nr_iowait OffsetBits:30080 SizeBits:32]]]

gemini-3-flash-preview

							input: 24938
							output: 21
							thoughts: 67
						

Here's my summary, as the expert:

**Deep Dive into Kernel Data Structures**

Okay, so I'm digging into `struct rq` again, specifically the memory layout. I'm focusing on offsets and sizes. I'm seeing a bit of a wrinkle at offset 24, which translates to 192 bits. It's an unnamed field, so I suspect it's either padding for alignment or possibly a union. Hmm, the size of that field, as reported, is 64 bits. Now, that's interesting and I need to be sure of my interpretation. That section warrants a second look; I'll need to double check the struct definition to be 100% on the purpose of that field. Further, I see `idle` at 256 bits, which means that field begins at a different offset.

Let's switch gears and investigate `struct mm_struct` next. I need to get a broader view of how these structures relate and how memory is actually mapped. This is where the real complexity begins, and understanding the MMU is crucial. I need to understand the implications of these offsets for performance and potential cache line effects, as well as possible security considerations.

map[Name:mm_struct]

map[Fields:[map[Name: OffsetBits:0 SizeBits:22528] map[Name:flexible_array OffsetBits:22528 SizeBits:0]]]

gemini-3-flash-preview

							input: 25339
							output: 21
							thoughts: 1847
						

**Deconstructing the Assembly**

Okay, this is interesting. I'm looking at this assembly sequence, and my initial thought is, it's not immediately obvious what this is doing. Let's break it down methodically.

First, I need to get a grip on the assembly pattern. I see `xor %edi, %edi`, followed by `mov %eax, %esi`, and then a `call` instruction. This strongly suggests a function call with arguments. Specifically, it's very likely `func(0, eax)`.  If that's the case and the function is `__raw_spin_unlock_irqrestore`, which seems plausible, the code is likely related to handling interrupts. And the function after that might be `local_irq_restore`, which is itself likely a macro that calls `native_irq_restore`.  Hang on... the `ee` instruction throws a wrench in this. It's `out %al, %dx`, which usually has to do with direct hardware access.  That's unexpected in an interrupt-handling context, so I'll put a pin in that for now.

Wait, what if the `ee` instruction is a marker, like `0xee` for `__this_cpu_...`? No, that doesn't make sense.

I'm now focusing on a specific sequence:  `0: ee`,  `1: e8 f6 fd 11 00`. This looks like an `out` instruction followed by a `call`. This *could* be related to tracing, maybe a `trace_...` function, or some specific hardware interaction with `outb`.

I'm going to shift my focus and start looking at this `4d` instruction sequence, specifically `45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18` and look for this pattern inside the kernel.  The `48 89 5c 24 08` is `mov %rbx, 0x8(%rsp)` – saving a value on the stack. Saving `rbx` in the middle of a function could signal something important, maybe a "cold" path, or conditional execution, perhaps with some unusual stack management.

Okay, `74 2a` is a `je +0x2a` conditional jump. If the condition is met, it skips some code and calls another function, `func3`. The jump target is at offset 58.

So, if `r13d == 0`, the code jumps. Otherwise, the code executes some instructions.  Let's see: `48 8d 7b 18` is `lea 0x18(%rbx),%rdi`,  then `be ff ff ff ff` is `mov $0xffffffff,%esi`, then `e8 ce a2 21 0a` is `call func2`.  Then we have `mov %eax,%r13d`.  This sequence suggests that the return value of `func2` is being stored in `r13d`. Following that is `xor %edi,%edi`, `mov %eax,%esi`, then a call to `func1`. Following that is a conditional branch, the `test %r13d,%r13d`, `je 0x266` instruction. So it looks like `r13d` is tested, and if `r13d == 0`, a jump happens.

Wait, `func3` is called whether the jump occurs or not.

I think I see a pattern here:
```c
    if (r13d) {
        r13d = func2(&rbx->field, -1);
        func1(0, r13d);
        if (r13d == 0) goto label_far;
    }
    func3();
```

Let's re-check the jump. The call at address `3a` is also `func3`! So, yes, `func3()` is called in both cases. Now, the code is roughly equivalent to:
```c
    if (r13d) {
        r13d = func2(&rbx->field, -1);
        func1(0, r13d);
        if (r13d == 0) return; // or something
    }
    func3();
```
Aha! `func2` is called with `-1`. This looks like a decrement function.  Specifically, it very likely is `atomic_add_return

map[Name:sk_buff]

map[Fields:[map[Name: OffsetBits:0 SizeBits:192] map[Name:sk OffsetBits:192 SizeBits:64] map[Name: OffsetBits:256 SizeBits:64] map[Name:cb OffsetBits:320 SizeBits:384] map[Name: OffsetBits:704 SizeBits:128] map[Name:_nfct OffsetBits:832 SizeBits:64] map[Name:len OffsetBits:896 SizeBits:32] map[Name:data_len OffsetBits:928 SizeBits:32] map[Name:mac_len OffsetBits:960 SizeBits:16] map[Name:hdr_len OffsetBits:976 SizeBits:16] map[Name:queue_mapping OffsetBits:992 SizeBits:16] map[Name:__cloned_offset OffsetBits:1008 SizeBits:0] map[Name:cloned OffsetBits:1008 SizeBits:1] map[Name:nohdr OffsetBits:1009 SizeBits:1] map[Name:fclone OffsetBits:1010 SizeBits:2] map[Name:peeked OffsetBits:1012 SizeBits:1] map[Name:head_frag OffsetBits:1013 SizeBits:1] map[Name:pfmemalloc OffsetBits:1014 SizeBits:1] map[Name:pp_recycle OffsetBits:1015 SizeBits:1] map[Name:active_extensions OffsetBits:1016 SizeBits:8] map[Name: OffsetBits:1024 SizeBits:576] map[Name:tail OffsetBits:1600 SizeBits:32] map[Name:end OffsetBits:1632 SizeBits:32] map[Name:head OffsetBits:1664 SizeBits:64] map[Name:data OffsetBits:1728 SizeBits:64] map[Name:truesize OffsetBits:1792 SizeBits:32] map[Name:users OffsetBits:1824 SizeBits:32] map[Name:extensions OffsetBits:1856 SizeBits:64]]]

gemini-3-flash-preview

							input: 28812
							output: 19
							thoughts: 166
						

**Decoding a Memory Access Mystery**

Okay, so I'm looking at this code and something's just not clicking. At offset 24, which translates to 192 bits, I see `sk`. Alright, that's supposed to be a pointer, probably a `struct sock`. Then there's this call to `func2(&skb->sk, -1)`. Hmmm, I can't quite make sense of that; the function call's structure doesn't seem quite right to pass that to `atomic_dec_return`. 

Wait a minute, maybe I'm overlooking something about the `skb_shared_info`? That's always at the end of the `skb->head`. But the register being used, `rbx`, usually points to the main struct itself. This isn't adding up.

Okay, let's take a step back and shift focus. Let's look at `struct page` for a moment. If I remember correctly, the struct is 64 bytes in size. Offset 24 in `struct page`... what's there? Aha! I think offset 24 should be `_refcount`. But wait, *is* that actually the location of `_refcount` in `struct page`? I need to double-check that. Let's verify that's the correct offset.

map[Name:page]

map[Fields:[map[Name:flags OffsetBits:0 SizeBits:64] map[Name: OffsetBits:64 SizeBits:320] map[Name: OffsetBits:384 SizeBits:32] map[Name:_refcount OffsetBits:416 SizeBits:32] map[Name:memcg_data OffsetBits:448 SizeBits:64]]]

gemini-3-flash-preview

							input: 29403
							output: 30
							thoughts: 1670
						

**Dissecting a Kernel Code Snippet: A Journey Through Assembly and Logic**

Okay, so I'm looking at this assembly snippet, and initially, I was trying to make sense of the `_refcount` offset and comparing it to `struct bio` but quickly realized it wasn't the right track. My mind then jumped to looking at the `ee` byte, trying to figure out if it held a hidden meaning or was a prefix. I briefly entertained the thought of architecture differences but knew the prompt said x86_64 so I put that to the side. Searching for byte sequences led me to the `r13d` register and some possible function names but that seemed like it wasn't the best path. The thought process went towards possible function names, and the typical function call inlining scenarios, but nothing clicked.

Then, I went back to the `ee` byte. `out %al, %dx` was my initial interpretation, which didn't feel right. I started searching for the byte sequence `45 85 ed 48 89 5c 24 08 74 2a` in the kernel source, and thought I found a C code snippet which didn't look right. I noticed that the assembly was saving `rbx` to the stack which was odd because it was immediately used in the next instruction. I then realized the prologue would be at the start, and it was in the middle.

A glimmer of an idea struck: maybe the `ee` wasn't the *start* of anything, but the *end* of the *previous* instruction. That led me to consider `vmlaunch` which ends in `ee`. I knew that the `vmlaunch` instruction can only fail and return if it does not enter the guest and that the next instruction should be an error path!

Now I'm focusing on the KVM code. I'm checking `arch/x86/kvm/vmx/vmenter.S` and `arch/x86/kvm/vmx/vmx.c` to see if my hypothesis that this is a `vmlaunch` error handler is correct. In `vmenter.S`, I've got confirmation! `vmlaunch` is indeed `0x0f 0x01 0xee`, and the provided code snippet starts with `ee`. So, this is a handler for an error after a `vmlaunch` or `vmresume`! The `e8 f6 fd 11 00` instruction is a call to handle the error. I'm going to look deeper into `arch/x86/kvm/vmx/vmenter.S` to see the details of this error handling.

map[Dir:arch/x86/kvm/vmx/]

map[Files:[capabilities.h common.h hyperv.c hyperv.h hyperv_evmcs.c hyperv_evmcs.h main.c nested.c nested.h pmu_intel.c pmu_intel.h posted_intr.c posted_intr.h run_flags.h sgx.c sgx.h tdx.c tdx.h tdx_arch.h tdx_errno.h vmcs.h vmcs12.c vmcs12.h vmcs_shadow_fields.h vmenter.S vmx.c vmx.h vmx_onhyperv.c vmx_onhyperv.h vmx_ops.h x86_ops.h] Subdirs:<nil>]

gemini-3-flash-preview

							input: 31961
							output: 32
							thoughts: 23
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue:

**Diving into the VMX Entry Point**

Right, let's take a look at `arch/x86/kvm/vmx/vmenter.S`. I need to refresh my mental model of the VMX entry sequence. I know the high-level architecture: the host prepares the guest state, sets up the VMCS, and then triggers the `VM-Enter` instruction. But the nitty-gritty details of the assembly, the specific registers being manipulated, the shadow page tables, interrupt handling, and the control-flow within `vmenter.S` are what I'm interested in here. I want to understand how the processor transitions from host to guest execution, including the handling of preemption, nested virtualization considerations (if any), and any specific optimizations implemented by the KVM developers. It's time to map the documented behavior to the implemented instructions. I need to refresh my knowledge of the interaction between the VMX root and non-root modes, and the role each instruction plays. Specifically, I'll be looking to understand the mechanics that set the stage for the guest’s execution; memory permissions, register loading, and state saving.

map[File:arch/x86/kvm/vmx/vmenter.S]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 */
#include <linux/linkage.h>
#include <asm/asm.h>
#include <asm/bitsperlong.h>
#include <asm/kvm_vcpu_regs.h>
#include <asm/nospec-branch.h>
#include <asm/percpu.h>
#include <asm/segment.h>
#include "kvm-asm-offsets.h"
#include "run_flags.h"

#define WORD_SIZE (BITS_PER_LONG / 8)

#define VCPU_RAX	__VCPU_REGS_RAX * WORD_SIZE
#define VCPU_RCX	__VCPU_REGS_RCX * WORD_SIZE
#define VCPU_RDX	__VCPU_REGS_RDX * WORD_SIZE
#define VCPU_RBX	__VCPU_REGS_RBX * WORD_SIZE
/* Intentionally omit RSP as it's context switched by hardware */
#define VCPU_RBP	__VCPU_REGS_RBP * WORD_SIZE
#define VCPU_RSI	__VCPU_REGS_RSI * WORD_SIZE
#define VCPU_RDI	__VCPU_REGS_RDI * WORD_SIZE

#ifdef CONFIG_X86_64
#define VCPU_R8		__VCPU_REGS_R8  * WORD_SIZE
#define VCPU_R9		__VCPU_REGS_R9  * WORD_SIZE
#define VCPU_R10	__VCPU_REGS_R10 * WORD_SIZE
#define VCPU_R11	__VCPU_REGS_R11 * WORD_SIZE
#define VCPU_R12	__VCPU_REGS_R12 * WORD_SIZE
#define VCPU_R13	__VCPU_REGS_R13 * WORD_SIZE
#define VCPU_R14	__VCPU_REGS_R14 * WORD_SIZE
#define VCPU_R15	__VCPU_REGS_R15 * WORD_SIZE
#endif

.macro VMX_DO_EVENT_IRQOFF call_insn call_target
	/*
	 * Unconditionally create a stack frame, getting the correct RSP on the
	 * stack (for x86-64) would take two instructions anyways, and RBP can
	 * be used to restore RSP to make objtool happy (see below).
	 */
	push %_ASM_BP
	mov %_ASM_SP, %_ASM_BP

#ifdef CONFIG_X86_64
	/*
	 * Align RSP to a 16-byte boundary (to emulate CPU behavior) before
	 * creating the synthetic interrupt stack frame for the IRQ/NMI.
	 */
	and  $-16, %rsp
	push $__KERNEL_DS
	push %rbp
#endif
	pushf
	push $__KERNEL_CS
	\call_insn \call_target

	/*
	 * "Restore" RSP from RBP, even though IRET has already unwound RSP to
	 * the correct value.  objtool doesn't know the callee will IRET and,
	 * without the explicit restore, thinks the stack is getting walloped.
	 * Using an unwind hint is problematic due to x86-64's dynamic alignment.
	 */
	leave
	RET
.endm

.section .noinstr.text, "ax"

/**
 * __vmx_vcpu_run - Run a vCPU via a transition to VMX guest mode
 * @vmx:	struct vcpu_vmx *
 * @regs:	unsigned long * (to guest registers)
 * @flags:	VMX_RUN_VMRESUME:	use VMRESUME instead of VMLAUNCH
 *		VMX_RUN_SAVE_SPEC_CTRL: save guest SPEC_CTRL into vmx->spec_ctrl
 *		VMX_RUN_CLEAR_CPU_BUFFERS_FOR_MMIO: vCPU can access host MMIO
 *
 * Returns:
 *	0 on VM-Exit, 1 on VM-Fail
 */
SYM_FUNC_START(__vmx_vcpu_run)
	push %_ASM_BP
	mov  %_ASM_SP, %_ASM_BP
#ifdef CONFIG_X86_64
	push %r15
	push %r14
	push %r13
	push %r12
#else
	push %edi
	push %esi
#endif
	push %_ASM_BX

	/* Save @vmx for SPEC_CTRL handling */
	push %_ASM_ARG1

	/* Save @flags (used for VMLAUNCH vs. VMRESUME and mitigations). */
	push %_ASM_ARG3

	/*
	 * Save @regs, _ASM_ARG2 may be modified by vmx_update_host_rsp() and
	 * @regs is needed after VM-Exit to save the guest's register values.
	 */
	push %_ASM_ARG2

	lea (%_ASM_SP), %_ASM_ARG2
	call vmx_update_host_rsp

	ALTERNATIVE "jmp .Lspec_ctrl_done", "", X86_FEATURE_MSR_SPEC_CTRL

	/*
	 * SPEC_CTRL handling: if the guest's SPEC_CTRL value differs from the
	 * host's, write the MSR.
	 *
	 * IMPORTANT: To avoid RSB underflow attacks and any other nastiness,
	 * there must not be any returns or indirect branches between this code
	 * and vmentry.
	 */
	mov 2*WORD_SIZE(%_ASM_SP), %_ASM_DI
#ifdef CONFIG_X86_64
	mov VMX_spec_ctrl(%rdi), %rdx
	cmp PER_CPU_VAR(x86_spec_ctrl_current), %rdx
	je .Lspec_ctrl_done
	movl %edx, %eax
	shr $32, %rdx
#else
	mov VMX_spec_ctrl(%edi), %eax
	mov PER_CPU_VAR(x86_spec_ctrl_current), %ecx
	xor %eax, %ecx
	mov VMX_spec_ctrl + 4(%edi), %edx
	mov PER_CPU_VAR(x86_spec_ctrl_current + 4), %edi
	xor %edx, %edi
	or %edi, %ecx
	je .Lspec_ctrl_done
#endif
	mov $MSR_IA32_SPEC_CTRL, %ecx
	wrmsr

.Lspec_ctrl_done:

	/*
	 * Since vmentry is serializing on affected CPUs, there's no need for
	 * an LFENCE to stop speculation from skipping the wrmsr.
	 */

	/* Load @regs to RAX. */
	mov (%_ASM_SP), %_ASM_AX

	/* Load guest registers.  Don't clobber flags. */
	mov VCPU_RCX(%_ASM_AX), %_ASM_CX
	mov VCPU_RDX(%_ASM_AX), %_ASM_DX
	mov VCPU_RBX(%_ASM_AX), %_ASM_BX
	mov VCPU_RBP(%_ASM_AX), %_ASM_BP
	mov VCPU_RSI(%_ASM_AX), %_ASM_SI
	mov VCPU_RDI(%_ASM_AX), %_ASM_DI
#ifdef CONFIG_X86_64
	mov VCPU_R8 (%_ASM_AX),  %r8
	mov VCPU_R9 (%_ASM_AX),  %r9
	mov VCPU_R10(%_ASM_AX), %r10
	mov VCPU_R11(%_ASM_AX), %r11
	mov VCPU_R12(%_ASM_AX), %r12
	mov VCPU_R13(%_ASM_AX), %r13
	mov VCPU_R14(%_ASM_AX), %r14
	mov VCPU_R15(%_ASM_AX), %r15
#endif
	/* Load guest RAX.  This kills the @regs pointer! */
	mov VCPU_RAX(%_ASM_AX), %_ASM_AX

	/*
	 * Note, ALTERNATIVE_2 works in reverse order.  If CLEAR_CPU_BUF_VM is
	 * enabled, do VERW unconditionally.  If CPU_BUF_VM_MMIO is enabled,
	 * check @flags to see if the vCPU has access to host MMIO, and if so,
	 * do VERW.  Else, do nothing (no mitigations needed/enabled).
	 */
	ALTERNATIVE_2 "",									  \
		      __stringify(testl $VMX_RUN_CLEAR_CPU_BUFFERS_FOR_MMIO, WORD_SIZE(%_ASM_SP); \
				  jz .Lskip_mmio_verw;						  \
				  VERW;								  \
				  .Lskip_mmio_verw:),					  	  \
		      X86_FEATURE_CLEAR_CPU_BUF_VM_MMIO,					  \
		      __stringify(VERW), X86_FEATURE_CLEAR_CPU_BUF_VM

	/* Check @flags to see if VMLAUNCH or VMRESUME is needed. */
	testl $VMX_RUN_VMRESUME, WORD_SIZE(%_ASM_SP)
	jz .Lvmlaunch

	/*
	 * After a successful VMRESUME/VMLAUNCH, control flow "magically"
	 * resumes below at 'vmx_vmexit' due to the VMCS HOST_RIP setting.
	 * So this isn't a typical function and objtool needs to be told to
	 * save the unwind state here and restore it below.
	 */
	UNWIND_HINT_SAVE

/*
 * If VMRESUME/VMLAUNCH and corresponding vmexit succeed, execution resumes at
 * the 'vmx_vmexit' label below.
 */
.Lvmresume:
	vmresume
	jmp .Lvmfail

.Lvmlaunch:
	vmlaunch
	jmp .Lvmfail

	_ASM_EXTABLE(.Lvmresume, .Lfixup)
	_ASM_EXTABLE(.Lvmlaunch, .Lfixup)

SYM_INNER_LABEL_ALIGN(vmx_vmexit, SYM_L_GLOBAL)

	/* Restore unwind state from before the VMRESUME/VMLAUNCH. */
	UNWIND_HINT_RESTORE
	ENDBR

	/* Temporarily save guest's RAX. */
	push %_ASM_AX

	/* Reload @regs to RAX. */
	mov WORD_SIZE(%_ASM_SP), %_ASM_AX

	/* Save all guest registers, including RAX from the stack */
	pop           VCPU_RAX(%_ASM_AX)
	mov %_ASM_CX, VCPU_RCX(%_ASM_AX)
	mov %_ASM_DX, VCPU_RDX(%_ASM_AX)
	mov %_ASM_BX, VCPU_RBX(%_ASM_AX)
	mov %_ASM_BP, VCPU_RBP(%_ASM_AX)
	mov %_ASM_SI, VCPU_RSI(%_ASM_AX)
	mov %_ASM_DI, VCPU_RDI(%_ASM_AX)
#ifdef CONFIG_X86_64
	mov %r8,  VCPU_R8 (%_ASM_AX)
	mov %r9,  VCPU_R9 (%_ASM_AX)
	mov %r10, VCPU_R10(%_ASM_AX)
	mov %r11, VCPU_R11(%_ASM_AX)
	mov %r12, VCPU_R12(%_ASM_AX)
	mov %r13, VCPU_R13(%_ASM_AX)
	mov %r14, VCPU_R14(%_ASM_AX)
	mov %r15, VCPU_R15(%_ASM_AX)
#endif

	/* Clear return value to indicate VM-Exit (as opposed to VM-Fail). */
	xor %ebx, %ebx

.Lclear_regs:
	/* Discard @regs.  The register is irrelevant, it just can't be RBX. */
	pop %_ASM_AX

	/*
	 * Clear all general purpose registers except RSP and RBX to prevent
	 * speculative use of the guest's values, even those that are reloaded
	 * via the stack.  In theory, an L1 cache miss when restoring registers
	 * could lead to speculative execution with the guest's values.
	 * Zeroing XORs are dirt cheap, i.e. the extra paranoia is essentially
	 * free.  RSP and RBX are exempt as RSP is restored by hardware during
	 * VM-Exit and RBX is explicitly loaded with 0 or 1 to hold the return
	 * value.
	 */
	xor %eax, %eax
	xor %ecx, %ecx
	xor %edx, %edx
	xor %ebp, %ebp
	xor %esi, %esi
	xor %edi, %edi
#ifdef CONFIG_X86_64
	xor %r8d,  %r8d
	xor %r9d,  %r9d
	xor %r10d, %r10d
	xor %r11d, %r11d
	xor %r12d, %r12d
	xor %r13d, %r13d
	xor %r14d, %r14d
	xor %r15d, %r15d
#endif

	/*
	 * IMPORTANT: RSB filling and SPEC_CTRL handling must be done before
	 * the first unbalanced RET after vmexit!
	 *
	 * For retpoline or IBRS, RSB filling is needed to prevent poisoned RSB
	 * entries and (in some cases) RSB underflow.
	 *
	 * eIBRS has its own protection against poisoned RSB, so it doesn't
	 * need the RSB filling sequence.  But it does need to be enabled, and a
	 * single call to retire, before the first unbalanced RET.
	 */

	FILL_RETURN_BUFFER %_ASM_CX, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_VMEXIT,\
			   X86_FEATURE_RSB_VMEXIT_LITE

	pop %_ASM_ARG2	/* @flags */
	pop %_ASM_ARG1	/* @vmx */

	call vmx_spec_ctrl_restore_host

	CLEAR_BRANCH_HISTORY_VMEXIT

	/* Put return value in AX */
	mov %_ASM_BX, %_ASM_AX

	pop %_ASM_BX
#ifdef CONFIG_X86_64
	pop %r12
	pop %r13
	pop %r14
	pop %r15
#else
	pop %esi
	pop %edi
#endif
	pop %_ASM_BP
	RET

.Lfixup:
	cmpb $0, _ASM_RIP(virt_rebooting)
	jne .Lvmfail
	ud2
.Lvmfail:
	/* VM-Fail: set return value to 1 */
	mov $1, %_ASM_BX
	jmp .Lclear_regs

SYM_FUNC_END(__vmx_vcpu_run)

SYM_FUNC_START(vmx_do_nmi_irqoff)
	VMX_DO_EVENT_IRQOFF call asm_exc_nmi_kvm_vmx
SYM_FUNC_END(vmx_do_nmi_irqoff)

#ifndef CONFIG_CC_HAS_ASM_GOTO_OUTPUT

/**
 * vmread_error_trampoline - Trampoline from inline asm to vmread_error()
 * @field:	VMCS field encoding that failed
 * @fault:	%true if the VMREAD faulted, %false if it failed
 *
 * Save and restore volatile registers across a call to vmread_error().  Note,
 * all parameters are passed on the stack.
 */
SYM_FUNC_START(vmread_error_trampoline)
	push %_ASM_BP
	mov  %_ASM_SP, %_ASM_BP

	push %_ASM_AX
	push %_ASM_CX
	push %_ASM_DX
#ifdef CONFIG_X86_64
	push %rdi
	push %rsi
	push %r8
	push %r9
	push %r10
	push %r11
#endif

	/* Load @field and @fault to arg1 and arg2 respectively. */
	mov 3*WORD_SIZE(%_ASM_BP), %_ASM_ARG2
	mov 2*WORD_SIZE(%_ASM_BP), %_ASM_ARG1

	call vmread_error_trampoline2

	/* Zero out @fault, which will be popped into the result register. */
	_ASM_MOV $0, 3*WORD_SIZE(%_ASM_BP)

#ifdef CONFIG_X86_64
	pop %r11
	pop %r10
	pop %r9
	pop %r8
	pop %rsi
	pop %rdi
#endif
	pop %_ASM_DX
	pop %_ASM_CX
	pop %_ASM_AX
	pop %_ASM_BP

	RET
SYM_FUNC_END(vmread_error_trampoline)
#endif

.section .text, "ax"

#ifndef CONFIG_X86_FRED

SYM_FUNC_START(vmx_do_interrupt_irqoff)
	VMX_DO_EVENT_IRQOFF CALL_NOSPEC _ASM_ARG1
SYM_FUNC_END(vmx_do_interrupt_irqoff)

#endif
]

gemini-3-flash-preview

							input: 36561
							output: 26
							thoughts: 423
						

**Discrepancies in VM Entry Analysis**

Okay, so I'm looking at this assembly and something's not quite right. The snippet I have doesn't seem to align with the `vmenter.S` code. Specifically, the snippet starts with `ee`, which I know is the last byte of `vmlaunch` ( `0x0f 0x01 0xee` ). But the `vmenter.S` code *after* `vmlaunch` is just a jump, `jmp .Lvmfail`. It uses `eb`, but the snippet has something completely different following the `ee`, specifically a `call` instruction.

Wait, maybe I'm looking at the wrong version, or a totally different file. Or maybe that `ee` isn't related to `vmlaunch` at all. Time to reconsider.

Let's refocus on that `45 85 ed` sequence. That's `test %r13d, %r13d`. I know `r13` is saved and restored in `vmenter.S`, but beyond that, it's not super important. It doesn't seem *that* distinctive.

Wait! I have an idea. Let me search for the whole sequence: `45 85 ed 48 89 5c 24 08 74 2a` in the kernel source. Since I can't search hex directly, I will translate it into its assembly equivalent.

So that's `test %r13d, %r13d` followed by `mov %rbx, 0x8(%rsp)` and then a `je`.

Hang on a second. That `mov %rbx, 0x8(%rsp)` is *really* specific. I'm saving a register, `rbx`, to a particular stack slot. That suggests compiler-generated code for a function that needs to save `rbx` before using it. This is probably a function with local variables, perhaps.

Now, let's try searching the kernel for `mov %rbx, 8(%rsp)` to pinpoint the code location. Let me use `codesearch-find-references` for this task.

log-in to see details

map[IncludeSnippetLines:1 Name:rbx]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 37517
							output: 19
							thoughts: 1449
						

**Dissecting the Assembly: A Kernel Deep Dive**

Okay, so I'm hitting a wall with my initial search terms. Trying to use `rbx` directly isn't working, so let's get creative. I'll pivot to searching for the instruction `lea 24(%rbx), %rdi` instead, and also try the slightly more general `&.*->.*` where the target field is at offset 24.

I need to quickly understand the sequence, so I'll try disassembling this snippet of code by hand.

I've identified these calls:
`call func1`
`call func2`
`call func1`
`call func3`

and noticed that `func1` is called twice with the values `(0, status)` and the second time. And `func2` is called with `(rbx + 24, -1)`.

This looks very strongly like an `atomic_dec_return` call to `func2`, given the negative one used as the second argument. I suspect that `func1` could be something like `preempt_count_sub`. However, `preempt_count_sub` doesn't take 2 arguments, so that feels unlikely.

So, let's look at possibilities. Is there a `spin_unlock_irqrestore` in the mix? That function is typically inlined, which would explain the lack of a direct call to it. The calling convention does look right for something related to tracing. Perhaps a `trace_preempt_off`? That function takes the appropriate number of arguments. I'll search for how that function is defined in a `preempt.h` file, or similar.

A better strategy might be to search for `atomic_dec_return` specifically in the kernel codebase. Then I'll check if those instances are followed by a call to the same function that was previously called. Alternatively, let me search for the common instruction sequence `lea 24(%rbx), %rdi` along with the instruction `mov $-1, %esi`.

Right, that points directly to a function like `atomic_add_return(-1, &obj->field)`, where `obj` is the register `rbx` and `field` is at offset 24 within the struct.

Now the question is, what struct is `rbx` pointing to? I was looking at `struct page` earlier, where `_refcount` is at offset 52. Let's not make that assumption and try to find structs that have fields at offset 24. It may be compiled with options that change the struct layout. Also, it might be a different struct entirely.

Okay, is it `struct kref`? No. Is it `struct rcu_head`? Usually that is at the end. Perhaps `struct list_head`, but that is 16 bytes. Let's go through the possible structs... Ah, if the register `rbx` is pointing at the beginning of a struct, then we're calculating the address of a member at offset 24.

Could `rbx` be a `struct sk_buff`? No.
How about `struct task_struct`? Checking, offset 24 is `__state`.
Is it `struct inode`? I'll check and see if that is a likely candidate.

map[Name:inode]

map[Fields:[map[Name:i_mode OffsetBits:0 SizeBits:16] map[Name:i_opflags OffsetBits:16 SizeBits:16] map[Name:i_flags OffsetBits:32 SizeBits:32] map[Name:i_acl OffsetBits:64 SizeBits:64] map[Name:i_default_acl OffsetBits:128 SizeBits:64] map[Name:i_uid OffsetBits:192 SizeBits:32] map[Name:i_gid OffsetBits:224 SizeBits:32] map[Name:i_op OffsetBits:256 SizeBits:64] map[Name:i_sb OffsetBits:320 SizeBits:64] map[Name:i_mapping OffsetBits:384 SizeBits:64] map[Name:i_security OffsetBits:448 SizeBits:64] map[Name:i_ino OffsetBits:512 SizeBits:64] map[Name: OffsetBits:576 SizeBits:32] map[Name:i_rdev OffsetBits:608 SizeBits:32] map[Name:i_size OffsetBits:640 SizeBits:64] map[Name:i_atime_sec OffsetBits:704 SizeBits:64] map[Name:i_mtime_sec OffsetBits:768 SizeBits:64] map[Name:i_ctime_sec OffsetBits:832 SizeBits:64] map[Name:i_atime_nsec OffsetBits:896 SizeBits:32] map[Name:i_mtime_nsec OffsetBits:928 SizeBits:32] map[Name:i_ctime_nsec OffsetBits:960 SizeBits:32] map[Name:i_generation OffsetBits:992 SizeBits:32] map[Name:i_lock OffsetBits:1024 SizeBits:512] map[Name:i_bytes OffsetBits:1536 SizeBits:16] map[Name:i_blkbits OffsetBits:1552 SizeBits:8] map[Name:i_write_hint OffsetBits:1560 SizeBits:8] map[Name:i_blocks OffsetBits:1600 SizeBits:64] map[Name:i_state OffsetBits:1664 SizeBits:32] map[Name:i_rwsem OffsetBits:1728 SizeBits:1152] map[Name:dirtied_when OffsetBits:2880 SizeBits:64] map[Name:dirtied_time_when OffsetBits:2944 SizeBits:64] map[Name:i_hash OffsetBits:3008 SizeBits:128] map[Name:i_io_list OffsetBits:3136 SizeBits:128] map[Name:i_wb OffsetBits:3264 SizeBits:64] map[Name:i_wb_frn_winner OffsetBits:3328 SizeBits:32] map[Name:i_wb_frn_avg_time OffsetBits:3360 SizeBits:16] map[Name:i_wb_frn_history OffsetBits:3376 SizeBits:16] map[Name:i_lru OffsetBits:3392 SizeBits:128] map[Name:i_sb_list OffsetBits:3520 SizeBits:128] map[Name:i_wb_list OffsetBits:3648 SizeBits:128] map[Name: OffsetBits:3776 SizeBits:128] map[Name:i_version OffsetBits:3904 SizeBits:64] map[Name:i_sequence OffsetBits:3968 SizeBits:64] map[Name:i_count OffsetBits:4032 SizeBits:32] map[Name:i_dio_count OffsetBits:4064 SizeBits:32] map[Name:i_writecount OffsetBits:4096 SizeBits:32] map[Name:i_readcount OffsetBits:4128 SizeBits:32] map[Name: OffsetBits:4160 SizeBits:64] map[Name:i_flctx OffsetBits:4224 SizeBits:64] map[Name:i_data OffsetBits:4288 SizeBits:4096] map[Name: OffsetBits:8384 SizeBits:128] map[Name: OffsetBits:8512 SizeBits:64] map[Name:i_fsnotify_mask OffsetBits:8576 SizeBits:32] map[Name:i_fsnotify_marks OffsetBits:8640 SizeBits:64] map[Name:i_private OffsetBits:8704 SizeBits:64]]]

gemini-3-flash-preview

							input: 40967
							output: 19
							thoughts: 1861
						

**Dissecting the Assembly: A Kernel Deep Dive**

Okay, so I'm looking at this snippet of assembly, and something doesn't feel right about how `i_uid` is being handled. I see this `func2` call, and the address manipulation around `i_uid`'s memory location is making me think, "that can't be right".

My first instinct is to try and search for the byte sequence in the kernel source, but since I don't have that option, I need to try some other methods.

I get the idea to look at the assembly, so I start decoding. The `mov %rbx, 0x8(%rsp)` instruction is interesting because it means `rbx` is being saved on the stack. I then start searching for patterns, looking for `r13d` and related assembly instructions, but I get blocked.

Then I get a better handle on the assembly with `lea 24(%rbx), %rdi` and start searching for `&.*->.*` at offset 24.
I see the call to `0x0a21a2ec` and recognize this might be a call to a function in a different section of the kernel, like `.init.text` or a module.

I go back to decoding the assembly more precisely. I see this pattern:
*   `call func1`
*   `call func2`
*   `call func1`
*   `call func3`

and that `func2` is being called with `(rbx + 24, -1)`.

This looks like an `atomic_dec_return` for `func2`!

Then the light bulb goes off. It is `atomic_add_return(-1, &obj->field)` where `obj` is `rbx` and `field` is at offset 24.

Then I start thinking about which struct the offset points to. I initially consider `struct page`, but I remember that layout can change based on kernel options or even be a different struct.
I think about `struct kref`, `struct rcu_head`, and `struct list_head`, but I discard them as not matching the memory layout I see. I keep the possibility of the layout changing open.

Then I look at `struct task_struct`, and offset 24 is `__state`.
I check the layout and consider `struct inode` and `struct file`.

map[Name:file]

map[Fields:[map[Name:f_lock OffsetBits:0 SizeBits:512] map[Name:f_mode OffsetBits:512 SizeBits:32] map[Name:f_op OffsetBits:576 SizeBits:64] map[Name:f_mapping OffsetBits:640 SizeBits:64] map[Name:private_data OffsetBits:704 SizeBits:64] map[Name:f_inode OffsetBits:768 SizeBits:64] map[Name:f_flags OffsetBits:832 SizeBits:32] map[Name:f_iocb_flags OffsetBits:864 SizeBits:32] map[Name:f_cred OffsetBits:896 SizeBits:64] map[Name:f_owner OffsetBits:960 SizeBits:64] map[Name: OffsetBits:1024 SizeBits:128] map[Name: OffsetBits:1152 SizeBits:1088] map[Name:f_pos OffsetBits:2240 SizeBits:64] map[Name:f_security OffsetBits:2304 SizeBits:64] map[Name:f_wb_err OffsetBits:2368 SizeBits:32] map[Name:f_sb_err OffsetBits:2400 SizeBits:32] map[Name:f_ep OffsetBits:2432 SizeBits:64] map[Name: OffsetBits:2496 SizeBits:256] map[Name:f_ref OffsetBits:2752 SizeBits:64]]]

gemini-3-flash-preview

							input: 43799
							output: 1241
							thoughts: 62915
						

gemini-3.1-pro-preview

							input: 134813
							output: 40
							thoughts: 294
						

**Dissecting This Code Snippet**

Okay, first things first, that initial `ee` byte is throwing me off. Could it be a remnant from a `VMLAUNCH` instruction's tail end? No, hold on, `0F 01 EE` is a `bndstx` or something similar, right? Wait, could that `ee` be the last byte of a `call` instruction?

Alright, moving on. I see `48 8d 7b 18`, which I'm fairly certain is an `lea 0x18(%rbx), %rdi` instruction. And then `be ff ff ff ff`, that's a straightforward `mov $0xffffffff, %esi`. Okay, and `e8 ce a2 21 0a` is a `call` instruction to some address... need to look that up.

Wait a second. I recognize `timerqueue_linked_del`, and that function calls `rb_erase_linked`. Aha, is there a direct `call` to `rb_erase_linked` somewhere? I should check the assembly of `__remove_hrtimer` in my local kernel or, if I had it, via objdump.

Oh, wait a minute, `timerqueue_linked_del` is inline, isn't it? Okay, that changes things. So, `rb_erase_linked` is in `lib/rbtree.c`. Is it exported, though? It's in `lib/rbtree.c`, but maybe it's not inline. Let me check. Nope, `rb_erase_linked` is not inline.

Okay, time to consult `lib/rbtree.c` and figure out what exactly `rb_erase_linked` is doing.

map[ContextFile:lib/rbtree.c IncludeLines:true Name:rb_erase_linked]

map[SourceCode: 449:	bool rb_erase_linked(struct rb_node_linked *node, struct rb_root_linked *root)
 450:	{
 451:		if (node->prev)
 452:			node->prev->next = node->next;
 453:		else
 454:			root->rb_leftmost = node->next;
 455:	
 456:		if (node->next)
 457:			node->next->prev = node->prev;
 458:	
 459:		rb_erase(&node->node, &root->rb_root);
 460:		RB_CLEAR_LINKED_NODE(node);
 461:	
 462:		return !!root->rb_leftmost;
 463:	}
 SourceFile:lib/rbtree.c]

gemini-3.1-pro-preview

							input: 135773
							output: 20
							thoughts: 332
						

**Debugging a Kernel Crash: The Rabbit Hole of `rb_erase_linked`**

Okay, so I've got a crash, and it's happening inside `__remove_hrtimer` – specifically at `0x8e/0x3e0`. The trace is pointing me towards `lib/rbtree.c`, which makes me think this might be rbtree related. Let's dig into the `__remove_hrtimer` code. I see a `timerqueue_linked_del` call in there, and that rings a bell... I remember that function ultimately calls `rb_erase_linked` to remove an entry.

The real question is, is `rb_erase_linked` being called directly here? The assembly is the key now. I see a `call 0xa21a2ec`, and I'm betting that's `rb_erase_linked`. Let's confirm with the arguments. Okay, I see `lea 0x18(%rbx), %rdi` and `mov $0xffffffff, %esi`. Okay, the arguments to `rb_erase_linked` are `node` and `root`, respectively. `rdi` is holding the first argument, and it looks like that is `&timer->node` and the timer data itself is in `rbx`. The offset to `node` is `0x18` from the start of the `hrtimer` structure. I'll need to double-check `struct hrtimer` to be sure, but this looks promising. This could be the source of the crash! Time to go back and verify the structure layout.

map[Name:hrtimer]

map[Fields:[map[Name:node OffsetBits:0 SizeBits:384] map[Name:base OffsetBits:384 SizeBits:64] map[Name:is_queued OffsetBits:448 SizeBits:8] map[Name:is_rel OffsetBits:456 SizeBits:8] map[Name:is_soft OffsetBits:464 SizeBits:8] map[Name:is_hard OffsetBits:472 SizeBits:8] map[Name:is_lazy OffsetBits:480 SizeBits:8] map[Name:_softexpires OffsetBits:512 SizeBits:64] map[Name:function OffsetBits:576 SizeBits:64]]]

gemini-3.1-pro-preview

							input: 136668
							output: 22
							thoughts: 104
						

**Dissecting the Memory Layout**

Okay, so I'm looking at this assembly, and the first thing that jumps out is that `node` member. It's at offset 0, which means `&timer->node` is essentially just `timer` itself, right? That simplifies things a bit. I need to figure out what's happening in this `lea 0x18(%rbx), %rdi` instruction.

Offset 0x18... that's 24 bytes. Now I remember we're dealing with a timerqueue. Hang on... `struct timerqueue_linked_node` has that embedded `rb_node_linked node;` member. Let me double-check the definitions of `struct timerqueue_node` and `struct timerqueue_linked_node`. I need to confirm the exact layout and sizes. I'm suspecting that instruction is grabbing a pointer to something in the timer structure, likely related to its linked node aspect. Need to clarify the relation between these two structs.

map[Name:timerqueue_node]

map[Fields:[map[Name:node OffsetBits:0 SizeBits:192] map[Name:expires OffsetBits:192 SizeBits:64]]]

gemini-3.1-pro-preview

							input: 137065
							output: 24
							thoughts: 42
						

Here's my attempt at summarizing those thoughts, tailored for an expert audience and written in the first person:

**Navigating Timer Queue Data Structures**

Okay, let's see... *struct timerqueue_node*. Right, so it starts with a `node` field at offset zero. That's a classic approach to make embedding nodes easier. Size... 24 bytes, or 192 bits. Makes sense; probably includes a few pointers for the queue linkage and some associated timer data. Now, what's this? *struct timerqueue_linked_node*? I wonder why it's using a linked node structure. It will be interesting to see if it is used with the primary timer queue or an auxiliary structure.

map[Name:timerqueue_linked_node]

map[Fields:[map[Name:node OffsetBits:0 SizeBits:320] map[Name:expires OffsetBits:320 SizeBits:64]]]

gemini-3.1-pro-preview

							input: 137337
							output: 41
							thoughts: 105
						

**Dissecting the Timer Structures**

Okay, let's break this down. First, I'm taking a look at `struct timerqueue_linked_node`. I see that the `node` field, whatever it's defining, starts at offset zero and is 40 bytes in size, which is quite significant.  That gives me an immediate context. Now, I'm immediately trying to see where this all fits in a larger context, and I need to start asking some questions.

Now I'm trying to figure out where that `timerqueue_linked_node` is used within `struct hrtimer`, so, let me see... I need to find what's at offset `0x18` (which is 24 bytes) in the `struct hrtimer`. Okay, it looks like it does.

Hold on, let me double-check this. I was on the right track initially, but I need to make absolutely sure. Is `hrtimer` using a `timerqueue_node` or a `timerqueue_linked_node` within its structure? Better to confirm my original assumption and check `struct hrtimer` again to make sure I'm precise with my thinking.

map[ContextFile:include/linux/hrtimer_defs.h IncludeLines:true Name:hrtimer]

map[SourceCode:  18:	/**
  19:	 * struct hrtimer - the basic hrtimer structure
  20:	 * @node:	Linked timerqueue node, which also manages node.expires,
  21:	 *		the absolute expiry time in the hrtimers internal
  22:	 *		representation. The time is related to the clock on
  23:	 *		which the timer is based. Is setup by adding
  24:	 *		slack to the _softexpires value. For non range timers
  25:	 *		identical to _softexpires.
  26:	 * @_softexpires: the absolute earliest expiry time of the hrtimer.
  27:	 *		The time which was given as expiry time when the timer
  28:	 *		was armed.
  29:	 * @function:	timer expiry callback function
  30:	 * @base:	pointer to the timer base (per cpu and per clock)
  31:	 * @is_queued:	Indicates whether a timer is enqueued or not
  32:	 * @is_rel:	Set if the timer was armed relative
  33:	 * @is_soft:	Set if hrtimer will be expired in soft interrupt context.
  34:	 * @is_hard:	Set if hrtimer will be expired in hard interrupt context
  35:	 *		even on RT.
  36:	 * @is_lazy:	Set if the timer is frequently rearmed to avoid updates
  37:	 *		of the clock event device
  38:	 *
  39:	 * The hrtimer structure must be initialized by hrtimer_setup()
  40:	 */
  41:	struct hrtimer {
  42:		struct timerqueue_linked_node	node;
  43:		struct hrtimer_clock_base	*base;
  44:		bool				is_queued;
  45:		bool				is_rel;
  46:		bool				is_soft;
  47:		bool				is_hard;
  48:		bool				is_lazy;
  49:		ktime_t				_softexpires;
  50:		enum hrtimer_restart		(*__private function)(struct hrtimer *);
  51:	};
 SourceFile:include/linux/hrtimer_types.h]

gemini-3.1-pro-preview

							input: 138333
							output: 23
							thoughts: 38
						

Here's my thought process, as if I were considering this code:

**Diving into the Timer Queue Structure**

Okay, so I'm looking at this `struct timerqueue_linked_node`, and my initial thought is, "Aha! This thing has a `node` member, and it's of type `struct rb_node_linked`."  My spider senses are tingling. Given the names, I'm guessing this might be related to a red-black tree implementation or something similar. Time to dig deeper and confirm that suspicion. Let's see what `struct rb_node_linked` *actually* is. I need to understand how this `node` fits into the overall timer queue structure and how its `rb_node_linked` is used. This is likely the key to understanding how these timers are organized and managed. I'm expecting this to be the backbone of efficient insertion, deletion, and searching of timers within this queue.

map[Name:rb_node_linked]

map[Fields:[map[Name:node OffsetBits:0 SizeBits:192] map[Name:prev OffsetBits:192 SizeBits:64] map[Name:next OffsetBits:256 SizeBits:64]]]

gemini-3.1-pro-preview

							input: 138667
							output: 24
							thoughts: 625
						

**Dissecting a Kernel Crash: From Assembly to Lockdep**

Okay, let's break this down. I'm looking at a crash that's pointing to `__remove_hrtimer` in the kernel. The crash dump gives me a RIP at `kernel/time/hrtimer.c:1145`. I see some assembly related to memory access and calling a function, so my immediate thought is to trace the execution flow and try to see where things are failing.

First, I note the structure `rb_node_linked` and its members, realizing the offset math for `prev` and `next`. I was initially confused by the `lea` instruction, assuming it was accessing the `prev` member. I quickly corrected that thought: It's getting the *address* of something. I recall `timerqueue_linked_prev` function, which, I remember, uses `rb_entry_safe` to get the address.

I started down a path that I quickly realized was wrong. Then, I step back and examine the assembly again, noticing a `call` instruction and a parameter setup, `rdi` and `esi`. I remember that if it was calling `rb_erase_linked`, then it would call a function directly; this isn't `__remove_hrtimer`. This changes my train of thought.

My thoughts drifted toward a possible BPF JIT issue since I was looking at a call to an unknown function. But the crash dump clearly says the RIP is in `__remove_hrtimer`. So, let's step back and consider the possibility that something is being missed about the function call.

I then check `__remove_hrtimer` at the line number in the backtrace. Line 1145 is `lockdep_assert_held(&cpu_base->lock)`. I remember that this is a lock debugging assertion and calls `lock_is_held` function, which takes a `struct lockdep_map *`. Okay, I think I'm on the right track; let's check `struct hrtimer_cpu_base` to understand how the lock is used and see if there's a problem with the lock.

map[Name:hrtimer_cpu_base]

map[Fields:[map[Name:lock OffsetBits:0 SizeBits:512] map[Name:cpu OffsetBits:512 SizeBits:32] map[Name:active_bases OffsetBits:544 SizeBits:32] map[Name:clock_was_set_seq OffsetBits:576 SizeBits:32] map[Name:hres_active OffsetBits:608 SizeBits:8] map[Name:deferred_rearm OffsetBits:616 SizeBits:8] map[Name:deferred_needs_update OffsetBits:624 SizeBits:8] map[Name:hang_detected OffsetBits:632 SizeBits:8] map[Name:softirq_activated OffsetBits:640 SizeBits:8] map[Name:online OffsetBits:648 SizeBits:8] map[Name:nr_events OffsetBits:672 SizeBits:32] map[Name:nr_retries OffsetBits:704 SizeBits:16] map[Name:nr_hangs OffsetBits:720 SizeBits:16] map[Name:max_hang_time OffsetBits:736 SizeBits:32] map[Name:expires_next OffsetBits:768 SizeBits:64] map[Name:next_timer OffsetBits:832 SizeBits:64] map[Name:softirq_expires_next OffsetBits:896 SizeBits:64] map[Name:softirq_next_timer OffsetBits:960 SizeBits:64] map[Name:deferred_expires_next OffsetBits:1024 SizeBits:64] map[Name:clock_base OffsetBits:1536 SizeBits:8192] map[Name:csd OffsetBits:9728 SizeBits:256]]]

gemini-3.1-pro-preview

							input: 140251
							output: 21
							thoughts: 62
						

**Verifying Lock Structure and Offset**

Okay, first things first, the `lock` variable - that's sitting right at offset 0. No surprises there. It's defined as a `raw_spinlock_t`. Now, the important bit. Inside this `raw_spinlock_t`, I *know* there's a `struct lockdep_map dep_map` involved, and I'm pretty sure it's at offset 24, which is `0x18` in hex. But I need to confirm this absolutely. Let's double-check the structure to make sure that offset is correct. Can't trust my memory for something this critical.

map[Name:raw_spinlock]

map[Fields:[map[Name:raw_lock OffsetBits:0 SizeBits:32] map[Name:magic OffsetBits:32 SizeBits:32] map[Name:owner_cpu OffsetBits:64 SizeBits:32] map[Name:owner OffsetBits:128 SizeBits:64] map[Name:dep_map OffsetBits:192 SizeBits:320]]]

gemini-3.1-pro-preview

							input: 140591
							output: 45
							thoughts: 1298
						

**Analyzing a Multi-CPU Stall in the Kernel**

Okay, let's break this down. First, I see an assembly snippet. Ah! The offset `0x18` in `lea 0x18(%rbx), %rdi` corresponds to `cpu_base->lock.dep_map`, which makes sense. The code's using `lock_is_held` to check a lock, with `-1` as the argument. That looks like a call to `lockdep_assert_held`. And, I know that `lockdep_assert_held` is a `WARN_ON` based on whether `lockdep_is_held` returns true or false.

Now, I understand the relevant code segment: It appears to test if a lock is currently held, and if it's not, it will jump to `WARN_ON`. I'm concerned about a multi-CPU stall, and this code segment doesn't look like it would loop; it either continues or it hits a warning.

The core issue seems to be CPU 1 hanging in `__remove_hrtimer`. The crash dump shows the RIP at `__remove_hrtimer+0x8e`, which lines up with the instruction `test r13d, r13d`. This means the NMI likely interrupted CPU 1 at that instruction! It seems like CPU 1 _wasn't_ stuck in `__remove_hrtimer` in the primary sense, but was _interrupted_ there by the NMI.

Then, from the NMI backtrace, CPU 1 was in `default_idle` when it received a timer interrupt. That interrupt triggered a sequence: `sysvec_apic_timer_interrupt` -> `hrtimer_interrupt` -> `__hrtimer_run_queues` -> `__run_hrtimer` -> `__remove_hrtimer`. So, now CPU 1 is handling the timer interrupt within `__remove_hrtimer`.

However, the problem is that CPU 0 is stuck in `csd_lock_wait` waiting for an IPI from CPU 1. If CPU 1 is in `default_idle` and got a timer interrupt, it now has IRQs disabled, so it *cannot* process the IPI from CPU 0. CPU 1 is stuck in the timer interrupt handler because it cannot receive interrupts, and CPU 0 is waiting on the IPI that will never come. But what specifically in the interrupt handler is causing CPU 1 to get stuck? Is it looping in `__hrtimer_run_queues`? I'll need to check the code in `__hrtimer_run_queues`.

map[ContextFile:kernel/time/hrtimer.c IncludeLines:true Name:__hrtimer_run_queues]

map[SourceCode:1968:	static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now,
1969:					 unsigned long flags, unsigned int active_mask)
1970:	{
1971:		unsigned int active = cpu_base->active_bases & active_mask;
1972:		struct hrtimer_clock_base *base;
1973:	
1974:		for_each_active_base(base, cpu_base, active) {
1975:			ktime_t basenow = ktime_add(now, base->offset);
1976:			struct hrtimer *timer;
1977:	
1978:			while ((timer = clock_base_next_timer(base))) {
1979:				/*
1980:				 * The immediate goal for using the softexpires is
1981:				 * minimizing wakeups, not running timers at the
1982:				 * earliest interrupt after their soft expiration.
1983:				 * This allows us to avoid using a Priority Search
1984:				 * Tree, which can answer a stabbing query for
1985:				 * overlapping intervals and instead use the simple
1986:				 * BST we already have.
1987:				 * We don't add extra wakeups by delaying timers that
1988:				 * are right-of a not yet expired timer, because that
1989:				 * timer will have to trigger a wakeup anyway.
1990:				 */
1991:				if (basenow < hrtimer_get_softexpires(timer))
1992:					break;
1993:	
1994:				__run_hrtimer(cpu_base, base, timer, basenow, flags);
1995:				if (active_mask == HRTIMER_ACTIVE_SOFT)
1996:					hrtimer_sync_wait_running(cpu_base, flags);
1997:			}
1998:		}
1999:	}
 SourceFile:kernel/time/hrtimer.c]

gemini-3.1-pro-preview

							input: 143060
							output: 42
							thoughts: 1283
						

**Analyzing a Potential Kernel Timer Infinite Loop**

Okay, here's what I'm thinking. I'm seeing that `__hrtimer_run_queues` seems to have a vulnerability. It loops as long as the timer's soft expiry time is in the past, meaning if `__run_hrtimer` doesn't remove the timer or it's re-enqueued with a past expiration time, we're looking at an infinite loop, a classic denial-of-service vector.

The key is in `__run_hrtimer`: It calls a function pointer, `fn`, and then checks its return value. If `fn` consistently returns `HRTIMER_RESTART` *without* advancing the timer, the loop condition persists, leading to an infinite loop within `__hrtimer_run_queues`. So, what timer is it? What's the context?

Looking at the reproducer, it's setting up `sendmsg` with `RTM_NEWQDISC`. Okay, so we're creating a new queueing discipline, a qdisc. My mind immediately jumps to "is there a qdisc that has a timer in it that could be buggy?" That's a definite possibility.

The reproducer also involves loading a BPF program. But wait, it doesn't *attach* the BPF program, as far as I can see! It's loading it, which *could* be using `BPF_PROG_TYPE_STRUCT_OPS` or something similar to get it attached. But no, the reproducer sets the type to `BPF_PROG_TYPE_TRACEPOINT`.

The reproducer is doing `BPF_PROG_LOAD`, command 5. Does the load function execute the BPF program? No, not directly.

But, the BPF program uses `bpf_snprintf`. However, it may be irrelevant. What if the BPF program *isn't* the root cause?

Let's step back. What if the `RTM_NEWQDISC` itself creates a qdisc that has a built-in timer flaw? Let's analyze the qdisc that's being created.

Inspecting the `netlink_msg_route_sched`, I see `attrs` array is empty. This is interesting. If `attrs` is empty and `TCA_KIND` isn't specified, `qdisc_create` should fail, shouldn't it? Let me confirm that by checking `qdisc_create` in `net/sched/sch_api.c`.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:qdisc_create]

map[SourceCode:1244:	static struct Qdisc *qdisc_create(struct net_device *dev,
1245:					  struct netdev_queue *dev_queue,
1246:					  u32 parent, u32 handle,
1247:					  struct nlattr **tca, int *errp,
1248:					  struct netlink_ext_ack *extack)
1249:	{
1250:		int err;
1251:		struct nlattr *kind = tca[TCA_KIND];
1252:		struct Qdisc *sch;
1253:		struct Qdisc_ops *ops;
1254:		struct qdisc_size_table *stab;
1255:	
1256:		ops = qdisc_lookup_ops(kind);
1257:		if (!ops) {
1258:			err = -ENOENT;
1259:			NL_SET_ERR_MSG(extack, "Specified qdisc kind is unknown");
1260:			goto err_out;
1261:		}
1262:	
1263:		sch = qdisc_alloc(dev_queue, ops, extack);
1264:		if (IS_ERR(sch)) {
1265:			err = PTR_ERR(sch);
1266:			goto err_out2;
1267:		}
1268:	
1269:		sch->parent = parent;
1270:	
1271:		if (handle == TC_H_INGRESS) {
1272:			if (!(sch->flags & TCQ_F_INGRESS)) {
1273:				NL_SET_ERR_MSG(extack,
1274:					       "Specified parent ID is reserved for ingress and clsact Qdiscs");
1275:				err = -EINVAL;
1276:				goto err_out3;
1277:			}
1278:			handle = TC_H_MAKE(TC_H_INGRESS, 0);
1279:		} else {
1280:			if (handle == 0) {
1281:				handle = qdisc_alloc_handle(dev);
1282:				if (handle == 0) {
1283:					NL_SET_ERR_MSG(extack, "Maximum number of qdisc handles was exceeded");
1284:					err = -ENOSPC;
1285:					goto err_out3;
1286:				}
1287:			}
1288:			if (!netif_is_multiqueue(dev))
1289:				sch->flags |= TCQ_F_ONETXQUEUE;
1290:		}
1291:	
1292:		sch->handle = handle;
1293:	
1294:		/* This exist to keep backward compatible with a userspace
1295:		 * loophole, what allowed userspace to get IFF_NO_QUEUE
1296:		 * facility on older kernels by setting tx_queue_len=0 (prior
1297:		 * to qdisc init), and then forgot to reinit tx_queue_len
1298:		 * before again attaching a qdisc.
1299:		 */
1300:		if ((dev->priv_flags & IFF_NO_QUEUE) && (dev->tx_queue_len == 0)) {
1301:			WRITE_ONCE(dev->tx_queue_len, DEFAULT_TX_QUEUE_LEN);
1302:			netdev_info(dev, "Caught tx_queue_len zero misconfig\n");
1303:		}
1304:	
1305:		err = qdisc_block_indexes_set(sch, tca, extack);
1306:		if (err)
1307:			goto err_out3;
1308:	
1309:		if (tca[TCA_STAB]) {
1310:			stab = qdisc_get_stab(tca[TCA_STAB], extack);
1311:			if (IS_ERR(stab)) {
1312:				err = PTR_ERR(stab);
1313:				goto err_out3;
1314:			}
1315:			rcu_assign_pointer(sch->stab, stab);
1316:		}
1317:	
1318:		if (ops->init) {
1319:			err = ops->init(sch, tca[TCA_OPTIONS], extack);
1320:			if (err != 0)
1321:				goto err_out4;
1322:		}
1323:	
1324:		if (tca[TCA_RATE]) {
1325:			err = -EOPNOTSUPP;
1326:			if (sch->flags & TCQ_F_MQROOT) {
1327:				NL_SET_ERR_MSG(extack, "Cannot attach rate estimator to a multi-queue root qdisc");
1328:				goto err_out4;
1329:			}
1330:	
1331:			err = gen_new_estimator(&sch->bstats,
1332:						sch->cpu_bstats,
1333:						&sch->rate_est,
1334:						NULL,
1335:						true,
1336:						tca[TCA_RATE]);
1337:			if (err) {
1338:				NL_SET_ERR_MSG(extack, "Failed to generate new estimator");
1339:				goto err_out4;
1340:			}
1341:		}
1342:	
1343:		qdisc_hash_add(sch, false);
1344:		trace_qdisc_create(ops, dev, parent);
1345:	
1346:		return sch;
1347:	
1348:	err_out4:
1349:		/* Even if ops->init() failed, we call ops->destroy()
1350:		 * like qdisc_create_dflt().
1351:		 */
1352:		if (ops->destroy)
1353:			ops->destroy(sch);
1354:		qdisc_put_stab(rtnl_dereference(sch->stab));
1355:	err_out3:
1356:		qdisc_lock_uninit(sch, ops);
1357:		netdev_put(dev, &sch->dev_tracker);
1358:		qdisc_free(sch);
1359:	err_out2:
1360:		bpf_module_put(ops, ops->owner);
1361:	err_out:
1362:		*errp = err;
1363:		return NULL;
1364:	}
 SourceFile:net/sched/sch_api.c]

gemini-3.1-pro-preview

							input: 146774
							output: 44
							thoughts: 67
						

Here's my summary, as though I'm thinking through this process:

**Diving into the Qdisc Lookup**

Alright, let's break this down. We're looking at a function call: `qdisc_lookup_ops(kind)`. Okay, and the input `kind` is actually `tca[TCA_KIND]`. My initial thought is: if this `tca[TCA_KIND]` is pointing to nothing—if it's NULL—then wouldn't `qdisc_lookup_ops` likely return NULL as well? Seems logical. But, I don't want to rely on assumptions.

Best to confirm this behavior and understand how it handles a NULL `kind` input. I'm going to have to check the implementation of `qdisc_lookup_ops` itself. That's the only way to be completely certain.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:qdisc_lookup_ops]

map[SourceCode: 360:	static struct Qdisc_ops *qdisc_lookup_ops(struct nlattr *kind)
 361:	{
 362:		struct Qdisc_ops *q = NULL;
 363:	
 364:		if (kind) {
 365:			read_lock(&qdisc_mod_lock);
 366:			for (q = qdisc_base; q; q = q->next) {
 367:				if (nla_strcmp(kind, q->id) == 0) {
 368:					if (!bpf_try_module_get(q, q->owner))
 369:						q = NULL;
 370:					break;
 371:				}
 372:			}
 373:			read_unlock(&qdisc_mod_lock);
 374:		}
 375:		return q;
 376:	}
 SourceFile:net/sched/sch_api.c]

gemini-3.1-pro-preview

							input: 147349
							output: 43
							thoughts: 1046
						

**Analyzing the Kernel Crash: A Deep Dive into Netlink, Qdiscs, and BPF Programs**

Okay, let's break this down. My initial thought is that if the `kind` field is NULL, `qdisc_lookup_ops` returns NULL. Consequently, `qdisc_create` returns NULL with `-ENOENT`. Then, I look at the reproducer, and it defines a `netlink_msg_t` structure with an empty `attrs` array. Thus, `tca[TCA_KIND]` becomes NULL, causing `qdisc_create` to fail. Since `tc_modify_qdisc` calls `qdisc_create`, I expect an error to be returned from the `RTM_NEWQDISC` message.  So, why the crash?

`RTM_NEWQDISC` is 36 (0x24). The reproducer does a `syscall(__NR_sendmsg, ...)` sending a netlink message. Is there any tracepoint that is triggered by `RTM_NEWQDISC`? Yes, `trace_qdisc_create` is called in `qdisc_create`. But `qdisc_create` fails before calling `trace_qdisc_create` because `ops` is NULL! Let's think, what other tracepoints are triggered? Perhaps `kfree_skb`?

Now, the BPF program... it's loaded as `BPF_PROG_TYPE_TRACEPOINT`. However, it's NOT attached to any tracepoint. Wait, `bpf_prog_load` *does not* attach the program. The reproducer also sets `flags = BPF_F_SLEEPABLE` in the `bpf_prog_load` call.

This is where things get interesting. `BPF_PROG_TYPE_TRACEPOINT` is used along with `BPF_F_SLEEPABLE`. Is that permitted? I'll need to double-check `bpf_prog_load` in `kernel/bpf/syscall.c` to understand the implications of this combination. The fact that `flags = 2` is set to `BPF_F_SLEEPABLE` with `BPF_PROG_TYPE_TRACEPOINT` definitely warrants further investigation. This smells like a subtle bug, possibly a race condition or an uninitialized state, triggered by the unusual combination of these BPF flags and a failed Qdisc creation.

map[ContextFile:kernel/bpf/syscall.c IncludeLines:true Name:bpf_prog_load]

map[SourceCode:2864:	static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
2865:	{
2866:		enum bpf_prog_type type = attr->prog_type;
2867:		struct bpf_prog *prog, *dst_prog = NULL;
2868:		struct btf *attach_btf = NULL;
2869:		struct bpf_token *token = NULL;
2870:		bool bpf_cap;
2871:		int err;
2872:		char license[128];
2873:	
2874:		if (CHECK_ATTR(BPF_PROG_LOAD))
2875:			return -EINVAL;
2876:	
2877:		if (attr->prog_flags & ~(BPF_F_STRICT_ALIGNMENT |
2878:					 BPF_F_ANY_ALIGNMENT |
2879:					 BPF_F_TEST_STATE_FREQ |
2880:					 BPF_F_SLEEPABLE |
2881:					 BPF_F_TEST_RND_HI32 |
2882:					 BPF_F_XDP_HAS_FRAGS |
2883:					 BPF_F_XDP_DEV_BOUND_ONLY |
2884:					 BPF_F_TEST_REG_INVARIANTS |
2885:					 BPF_F_TOKEN_FD))
2886:			return -EINVAL;
2887:	
2888:		bpf_prog_load_fixup_attach_type(attr);
2889:	
2890:		if (attr->prog_flags & BPF_F_TOKEN_FD) {
2891:			token = bpf_token_get_from_fd(attr->prog_token_fd);
2892:			if (IS_ERR(token))
2893:				return PTR_ERR(token);
2894:			/* if current token doesn't grant prog loading permissions,
2895:			 * then we can't use this token, so ignore it and rely on
2896:			 * system-wide capabilities checks
2897:			 */
2898:			if (!bpf_token_allow_cmd(token, BPF_PROG_LOAD) ||
2899:			    !bpf_token_allow_prog_type(token, attr->prog_type,
2900:						       attr->expected_attach_type)) {
2901:				bpf_token_put(token);
2902:				token = NULL;
2903:			}
2904:		}
2905:	
2906:		bpf_cap = bpf_token_capable(token, CAP_BPF);
2907:		err = -EPERM;
2908:	
2909:		if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) &&
2910:		    (attr->prog_flags & BPF_F_ANY_ALIGNMENT) &&
2911:		    !bpf_cap)
2912:			goto put_token;
2913:	
2914:		/* Intent here is for unprivileged_bpf_disabled to block BPF program
2915:		 * creation for unprivileged users; other actions depend
2916:		 * on fd availability and access to bpffs, so are dependent on
2917:		 * object creation success. Even with unprivileged BPF disabled,
2918:		 * capability checks are still carried out for these
2919:		 * and other operations.
2920:		 */
2921:		if (sysctl_unprivileged_bpf_disabled && !bpf_cap)
2922:			goto put_token;
2923:	
2924:		if (attr->insn_cnt == 0 ||
2925:		    attr->insn_cnt > (bpf_cap ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS)) {
2926:			err = -E2BIG;
2927:			goto put_token;
2928:		}
2929:		if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
2930:		    type != BPF_PROG_TYPE_CGROUP_SKB &&
2931:		    !bpf_cap)
2932:			goto put_token;
2933:	
2934:		if (is_net_admin_prog_type(type) && !bpf_token_capable(token, CAP_NET_ADMIN))
2935:			goto put_token;
2936:		if (is_perfmon_prog_type(type) && !bpf_token_capable(token, CAP_PERFMON))
2937:			goto put_token;
2938:	
2939:		/* attach_prog_fd/attach_btf_obj_fd can specify fd of either bpf_prog
2940:		 * or btf, we need to check which one it is
2941:		 */
2942:		if (attr->attach_prog_fd) {
2943:			dst_prog = bpf_prog_get(attr->attach_prog_fd);
2944:			if (IS_ERR(dst_prog)) {
2945:				dst_prog = NULL;
2946:				attach_btf = btf_get_by_fd(attr->attach_btf_obj_fd);
2947:				if (IS_ERR(attach_btf)) {
2948:					err = -EINVAL;
2949:					goto put_token;
2950:				}
2951:				if (!btf_is_kernel(attach_btf)) {
2952:					/* attaching through specifying bpf_prog's BTF
2953:					 * objects directly might be supported eventually
2954:					 */
2955:					btf_put(attach_btf);
2956:					err = -ENOTSUPP;
2957:					goto put_token;
2958:				}
2959:			}
2960:		} else if (attr->attach_btf_id) {
2961:			/* fall back to vmlinux BTF, if BTF type ID is specified */
2962:			attach_btf = bpf_get_btf_vmlinux();
2963:			if (IS_ERR(attach_btf)) {
2964:				err = PTR_ERR(attach_btf);
2965:				goto put_token;
2966:			}
2967:			if (!attach_btf) {
2968:				err = -EINVAL;
2969:				goto put_token;
2970:			}
2971:			btf_get(attach_btf);
2972:		}
2973:	
2974:		if (bpf_prog_load_check_attach(type, attr->expected_attach_type,
2975:					       attach_btf, attr->attach_btf_id,
2976:					       dst_prog)) {
2977:			if (dst_prog)
2978:				bpf_prog_put(dst_prog);
2979:			if (attach_btf)
2980:				btf_put(attach_btf);
2981:			err = -EINVAL;
2982:			goto put_token;
2983:		}
2984:	
2985:		/* plain bpf_prog allocation */
2986:		prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
2987:		if (!prog) {
2988:			if (dst_prog)
2989:				bpf_prog_put(dst_prog);
2990:			if (attach_btf)
2991:				btf_put(attach_btf);
2992:			err = -EINVAL;
2993:			goto put_token;
2994:		}
2995:	
2996:		prog->expected_attach_type = attr->expected_attach_type;
2997:		prog->sleepable = !!(attr->prog_flags & BPF_F_SLEEPABLE);
2998:		prog->aux->attach_btf = attach_btf;
2999:		prog->aux->attach_btf_id = attr->attach_btf_id;
3000:		prog->aux->dst_prog = dst_prog;
3001:		prog->aux->dev_bound = !!attr->prog_ifindex;
3002:		prog->aux->xdp_has_frags = attr->prog_flags & BPF_F_XDP_HAS_FRAGS;
3003:	
3004:		/* move token into prog->aux, reuse taken refcnt */
3005:		prog->aux->token = token;
3006:		token = NULL;
3007:	
3008:		prog->aux->user = get_current_user();
3009:		prog->len = attr->insn_cnt;
3010:	
3011:		err = -EFAULT;
3012:		if (copy_from_bpfptr(prog->insns,
3013:				     make_bpfptr(attr->insns, uattr.is_kernel),
3014:				     bpf_prog_insn_size(prog)) != 0)
3015:			goto free_prog;
3016:		/* copy eBPF program license from user space */
3017:		if (strncpy_from_bpfptr(license,
3018:					make_bpfptr(attr->license, uattr.is_kernel),
3019:					sizeof(license) - 1) < 0)
3020:			goto free_prog;
3021:		license[sizeof(license) - 1] = 0;
3022:	
3023:		/* eBPF programs must be GPL compatible to use GPL-ed functions */
3024:		prog->gpl_compatible = license_is_gpl_compatible(license) ? 1 : 0;
3025:	
3026:		if (attr->signature) {
3027:			err = bpf_prog_verify_signature(prog, attr, uattr.is_kernel);
3028:			if (err)
3029:				goto free_prog;
3030:		}
3031:	
3032:		prog->orig_prog = NULL;
3033:		prog->jited = 0;
3034:	
3035:		atomic64_set(&prog->aux->refcnt, 1);
3036:	
3037:		if (bpf_prog_is_dev_bound(prog->aux)) {
3038:			err = bpf_prog_dev_bound_init(prog, attr);
3039:			if (err)
3040:				goto free_prog;
3041:		}
3042:	
3043:		if (type == BPF_PROG_TYPE_EXT && dst_prog &&
3044:		    bpf_prog_is_dev_bound(dst_prog->aux)) {
3045:			err = bpf_prog_dev_bound_inherit(prog, dst_prog);
3046:			if (err)
3047:				goto free_prog;
3048:		}
3049:	
3050:		/*
3051:		 * Bookkeeping for managing the program attachment chain.
3052:		 *
3053:		 * It might be tempting to set attach_tracing_prog flag at the attachment
3054:		 * time, but this will not prevent from loading bunch of tracing prog
3055:		 * first, then attach them one to another.
3056:		 *
3057:		 * The flag attach_tracing_prog is set for the whole program lifecycle, and
3058:		 * doesn't have to be cleared in bpf_tracing_link_release, since tracing
3059:		 * programs cannot change attachment target.
3060:		 */
3061:		if (type == BPF_PROG_TYPE_TRACING && dst_prog &&
3062:		    dst_prog->type == BPF_PROG_TYPE_TRACING) {
3063:			prog->aux->attach_tracing_prog = true;
3064:		}
3065:	
3066:		/* find program type: socket_filter vs tracing_filter */
3067:		err = find_prog_type(type, prog);
3068:		if (err < 0)
3069:			goto free_prog;
3070:	
3071:		prog->aux->load_time = ktime_get_boottime_ns();
3072:		err = bpf_obj_name_cpy(prog->aux->name, attr->prog_name,
3073:				       sizeof(attr->prog_name));
3074:		if (err < 0)
3075:			goto free_prog;
3076:	
3077:		err = security_bpf_prog_load(prog, attr, token, uattr.is_kernel);
3078:		if (err)
3079:			goto free_prog_sec;
3080:	
3081:		/* run eBPF verifier */
3082:		err = bpf_check(&prog, attr, uattr, uattr_size);
3083:		if (err < 0)
3084:			goto free_used_maps;
3085:	
3086:		err = bpf_prog_mark_insn_arrays_ready(prog);
3087:		if (err < 0)
3088:			goto free_used_maps;
3089:	
3090:		err = bpf_prog_alloc_id(prog);
3091:		if (err)
3092:			goto free_used_maps;
3093:	
3094:		/* Upon success of bpf_prog_alloc_id(), the BPF prog is
3095:		 * effectively publicly exposed. However, retrieving via
3096:		 * bpf_prog_get_fd_by_id() will take another reference,
3097:		 * therefore it cannot be gone underneath us.
3098:		 *
3099:		 * Only for the time /after/ successful bpf_prog_new_fd()
3100:		 * and before returning to userspace, we might just hold
3101:		 * one reference and any parallel close on that fd could
3102:		 * rip everything out. Hence, below notifications must
3103:		 * happen before bpf_prog_new_fd().
3104:		 *
3105:		 * Also, any failure handling from this point onwards must
3106:		 * be using bpf_prog_put() given the program is exposed.
3107:		 */
3108:		bpf_prog_kallsyms_add(prog);
3109:		perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);
3110:		bpf_audit_prog(prog, BPF_AUDIT_LOAD);
3111:	
3112:		err = bpf_prog_new_fd(prog);
3113:		if (err < 0)
3114:			bpf_prog_put(prog);
3115:		return err;
3116:	
3117:	free_used_maps:
3118:		/* In case we have subprogs, we need to wait for a grace
3119:		 * period before we can tear down JIT memory since symbols
3120:		 * are already exposed under kallsyms.
3121:		 */
3122:		__bpf_prog_put_noref(prog, prog->aux->real_func_cnt);
3123:		return err;
3124:	
3125:	free_prog_sec:
3126:		security_bpf_prog_free(prog);
3127:	free_prog:
3128:		free_uid(prog->aux->user);
3129:		if (prog->aux->attach_btf)
3130:			btf_put(prog->aux->attach_btf);
3131:		bpf_prog_free(prog);
3132:	put_token:
3133:		bpf_token_put(token);
3134:		return err;
3135:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.1-pro-preview

							input: 153449
							output: 44
							thoughts: 638
						

**Analyzing the BPF Program and QDisc Interactions**

Okay, let's break this down. First, `bpf_prog_load` is the entry point, and it calls `bpf_check`. Within `bpf_check` we have `bpf_prog_mark_insn_arrays_ready`, then `bpf_prog_alloc_id`, and then `bpf_prog_kallsyms_add`. Finally, a `perf_event_bpf_event` is generated for the load. That perf event doesn't execute the program, just logs the load. The `bpf_check` itself calls `do_check`, which is static analysis. So, it appears the BPF program isn't executed during the load process.

Now, I need to figure out how it *could* be executed. Could it be triggered by `RTM_NEWQDISC` and attached to a tracepoint? But the reproducer *doesn't* attach the BPF program, so that's out. I see that `bpf_prog_load` returns `fd_bpf_prog`. However, the reproducer's system call: `syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000c40ul, /*size=*/0x90ul)` doesn't even save that file descriptor! This means the BPF program *shouldn't* be executed at all.

This means the BPF program isn't the cause of the infinite loop. Then, could `RTM_NEWQDISC` itself be the problem? Looking at the `RTM_NEWQDISC` parameters, the `ifindex` is `ifindex_team` (for `team0`). The `tcm_parent` is 0, `tcm_handle` is 0, and the `tca` is empty. The `qdisc_create` call will fail with `-ENOENT` because `tca[TCA_KIND]` is NULL.

Let me think. With the empty `tca`, `tc_modify_qdisc` might update an existing qdisc? The `tcm_handle` is 0, so `qdisc_lookup(dev, 0)` is returning the root qdisc! It seems like there's an issue with the root qdisc. I should check `tc_modify_qdisc` in `net/sched/sch_api.c`.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:tc_modify_qdisc]

map[SourceCode:1792:	/*
1793:	 * Create/change qdisc.
1794:	 */
1795:	static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
1796:				   struct netlink_ext_ack *extack)
1797:	{
1798:		struct net *net = sock_net(skb->sk);
1799:		struct nlattr *tca[TCA_MAX + 1];
1800:		struct net_device *dev;
1801:		struct tcmsg *tcm;
1802:		int err;
1803:	
1804:		err = nlmsg_parse_deprecated(n, sizeof(*tcm), tca, TCA_MAX,
1805:					     rtm_tca_policy, extack);
1806:		if (err < 0)
1807:			return err;
1808:	
1809:		request_qdisc_module(tca[TCA_KIND]);
1810:	
1811:		tcm = nlmsg_data(n);
1812:		dev = __dev_get_by_index(net, tcm->tcm_ifindex);
1813:		if (!dev)
1814:			return -ENODEV;
1815:	
1816:		netdev_lock_ops(dev);
1817:		err = __tc_modify_qdisc(skb, n, extack, dev, tca, tcm);
1818:		netdev_unlock_ops(dev);
1819:	
1820:		return err;
1821:	}
 SourceFile:net/sched/sch_api.c]

gemini-3.1-pro-preview

							input: 155161
							output: 45
							thoughts: 13
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the `__tc_modify_qdisc` Function**

Alright, let's dive into this `__tc_modify_qdisc` function. I need to refresh my mental model here. My initial thought is to quickly analyze the core purpose and how it fits into the broader traffic control landscape. This is likely the workhorse for actually modifying a queuing discipline, which means understanding what parameters it takes, what data structures it manipulates, and the locking implications are paramount. I need to think about potential race conditions. Is this a critical section? Does it handle concurrency appropriately? Are there potential deadlocks lurking? Specifically, I'm thinking about the interactions between different threads or processes modifying the same qdisc or related objects. What are the dependencies?

Next, I need to understand its relationship to the broader qdisc manipulation workflow. Where is it called from? Is it part of the user-space interaction via `tc` or is it more of a kernel-internal function? What's the context? Is it called during qdisc addition, deletion, or simply configuration updates? It must interface with the netlink socket, so I need to keep that in mind.

A quick check for potential error handling is also crucial. What are the common error codes this function can return? What are the potential failure points (memory allocation, invalid parameters, locking conflicts)? I need to understand the implications of different failure paths and if it handles these gracefully or if it leaves things in an inconsistent state. Are there potential security vulnerabilities here? Any place for a race condition for a crafted packet?

Lastly, I need to evaluate its impact on performance. Is this a heavily used function? Does it contribute to any bottlenecks in the traffic control pipeline? Profiling data could be valuable if I'm trying to optimize traffic control.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:__tc_modify_qdisc]

map[SourceCode:1581:	static int __tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
1582:				     struct netlink_ext_ack *extack,
1583:				     struct net_device *dev,
1584:				     struct nlattr *tca[TCA_MAX + 1],
1585:				     struct tcmsg *tcm)
1586:	{
1587:		struct Qdisc *q = NULL;
1588:		struct Qdisc *p = NULL;
1589:		u32 clid;
1590:		int err;
1591:	
1592:		clid = tcm->tcm_parent;
1593:	
1594:		if (clid) {
1595:			if (clid != TC_H_ROOT) {
1596:				if (clid != TC_H_INGRESS) {
1597:					p = qdisc_lookup(dev, TC_H_MAJ(clid));
1598:					if (!p) {
1599:						NL_SET_ERR_MSG(extack, "Failed to find specified qdisc");
1600:						return -ENOENT;
1601:					}
1602:					if (p->flags & TCQ_F_INGRESS) {
1603:						NL_SET_ERR_MSG(extack,
1604:							       "Cannot add children to ingress/clsact qdisc");
1605:						return -EOPNOTSUPP;
1606:					}
1607:					q = qdisc_leaf(p, clid, extack);
1608:					if (IS_ERR(q))
1609:						return PTR_ERR(q);
1610:				} else if (dev_ingress_queue_create(dev)) {
1611:					q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
1612:				}
1613:			} else {
1614:				q = rtnl_dereference(dev->qdisc);
1615:			}
1616:	
1617:			/* It may be default qdisc, ignore it */
1618:			if (q && q->handle == 0)
1619:				q = NULL;
1620:	
1621:			if (!q || !tcm->tcm_handle || q->handle != tcm->tcm_handle) {
1622:				if (tcm->tcm_handle) {
1623:					if (q && !(n->nlmsg_flags & NLM_F_REPLACE)) {
1624:						NL_SET_ERR_MSG(extack, "NLM_F_REPLACE needed to override");
1625:						return -EEXIST;
1626:					}
1627:					if (TC_H_MIN(tcm->tcm_handle)) {
1628:						NL_SET_ERR_MSG(extack, "Invalid minor handle");
1629:						return -EINVAL;
1630:					}
1631:					q = qdisc_lookup(dev, tcm->tcm_handle);
1632:					if (!q)
1633:						goto create_n_graft;
1634:					if (q->parent != tcm->tcm_parent) {
1635:						NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent");
1636:						return -EINVAL;
1637:					}
1638:					if (n->nlmsg_flags & NLM_F_EXCL) {
1639:						NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override");
1640:						return -EEXIST;
1641:					}
1642:					if (tca[TCA_KIND] &&
1643:					    nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1644:						NL_SET_ERR_MSG(extack, "Invalid qdisc name: must match existing qdisc");
1645:						return -EINVAL;
1646:					}
1647:					if (q->flags & TCQ_F_INGRESS) {
1648:						NL_SET_ERR_MSG(extack,
1649:							       "Cannot regraft ingress or clsact Qdiscs");
1650:						return -EINVAL;
1651:					}
1652:					if (q == p ||
1653:					    (p && check_loop(q, p, 0))) {
1654:						NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected");
1655:						return -ELOOP;
1656:					}
1657:					if (clid == TC_H_INGRESS) {
1658:						NL_SET_ERR_MSG(extack, "Ingress cannot graft directly");
1659:						return -EINVAL;
1660:					}
1661:					qdisc_refcount_inc(q);
1662:					goto graft;
1663:				} else {
1664:					if (!q)
1665:						goto create_n_graft;
1666:	
1667:					/* This magic test requires explanation.
1668:					 *
1669:					 *   We know, that some child q is already
1670:					 *   attached to this parent and have choice:
1671:					 *   1) change it or 2) create/graft new one.
1672:					 *   If the requested qdisc kind is different
1673:					 *   than the existing one, then we choose graft.
1674:					 *   If they are the same then this is "change"
1675:					 *   operation - just let it fallthrough..
1676:					 *
1677:					 *   1. We are allowed to create/graft only
1678:					 *   if the request is explicitly stating
1679:					 *   "please create if it doesn't exist".
1680:					 *
1681:					 *   2. If the request is to exclusive create
1682:					 *   then the qdisc tcm_handle is not expected
1683:					 *   to exist, so that we choose create/graft too.
1684:					 *
1685:					 *   3. The last case is when no flags are set.
1686:					 *   This will happen when for example tc
1687:					 *   utility issues a "change" command.
1688:					 *   Alas, it is sort of hole in API, we
1689:					 *   cannot decide what to do unambiguously.
1690:					 *   For now we select create/graft.
1691:					 */
1692:					if (tca[TCA_KIND] &&
1693:					    nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1694:						if (req_create_or_replace(n) ||
1695:						    req_create_exclusive(n))
1696:							goto create_n_graft;
1697:						else if (req_change(n))
1698:							goto create_n_graft2;
1699:					}
1700:				}
1701:			}
1702:		} else {
1703:			if (!tcm->tcm_handle) {
1704:				NL_SET_ERR_MSG(extack, "Handle cannot be zero");
1705:				return -EINVAL;
1706:			}
1707:			q = qdisc_lookup(dev, tcm->tcm_handle);
1708:		}
1709:	
1710:		/* Change qdisc parameters */
1711:		if (!q) {
1712:			NL_SET_ERR_MSG(extack, "Specified qdisc not found");
1713:			return -ENOENT;
1714:		}
1715:		if (n->nlmsg_flags & NLM_F_EXCL) {
1716:			NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot modify");
1717:			return -EEXIST;
1718:		}
1719:		if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1720:			NL_SET_ERR_MSG(extack, "Invalid qdisc name: must match existing qdisc");
1721:			return -EINVAL;
1722:		}
1723:		err = qdisc_change(q, tca, extack);
1724:		if (err == 0)
1725:			qdisc_notify(sock_net(skb->sk), skb, n, clid, NULL, q, extack);
1726:		return err;
1727:	
1728:	create_n_graft:
1729:		if (!(n->nlmsg_flags & NLM_F_CREATE)) {
1730:			NL_SET_ERR_MSG(extack, "Qdisc not found. To create specify NLM_F_CREATE flag");
1731:			return -ENOENT;
1732:		}
1733:	create_n_graft2:
1734:		if (clid == TC_H_INGRESS) {
1735:			if (dev_ingress_queue(dev)) {
1736:				q = qdisc_create(dev, dev_ingress_queue(dev),
1737:						 tcm->tcm_parent, tcm->tcm_parent,
1738:						 tca, &err, extack);
1739:			} else {
1740:				NL_SET_ERR_MSG(extack, "Cannot find ingress queue for specified device");
1741:				err = -ENOENT;
1742:			}
1743:		} else {
1744:			struct netdev_queue *dev_queue;
1745:	
1746:			if (p && p->ops->cl_ops && p->ops->cl_ops->select_queue)
1747:				dev_queue = p->ops->cl_ops->select_queue(p, tcm);
1748:			else if (p)
1749:				dev_queue = p->dev_queue;
1750:			else
1751:				dev_queue = netdev_get_tx_queue(dev, 0);
1752:	
1753:			q = qdisc_create(dev, dev_queue,
1754:					 tcm->tcm_parent, tcm->tcm_handle,
1755:					 tca, &err, extack);
1756:		}
1757:		if (!q)
1758:			return err;
1759:	
1760:	graft:
1761:		err = qdisc_graft(dev, p, skb, n, clid, q, NULL, extack);
1762:		if (err) {
1763:			if (q)
1764:				qdisc_put(q);
1765:			return err;
1766:		}
1767:	
1768:		return 0;
1769:	}
 SourceFile:net/sched/sch_api.c]

gemini-3.1-pro-preview

							input: 158692
							output: 22
							thoughts: 896
						

**Debugging a Kernel Soft Lockup: A BPF Conundrum**

Okay, so I'm looking at this crash, and it's a soft lockup. The reproducer seems straightforward, but I'm getting confused. Initially, I saw that `tcm_parent` is zero, which means `clid` is also zero. This triggers the `else` branch, and the code checks for `tcm->tcm_handle`. If that's zero, it should return `-EINVAL`. Right? And if it returns `-EINVAL`, the `RTM_NEWQDISC` call should do nothing. So, why the crash?

Then I notice the reproducer calls `mmap` multiple times. That's unusual, but the critical part is the presence of a BPF program with `BPF_PROG_TYPE_TRACEPOINT`. Okay, I know that's something to investigate. Hold on, the `flags` field is set to 2, which is `BPF_F_SLEEPABLE`. Wait a second... `BPF_PROG_TYPE_TRACEPOINT` doesn't support the `BPF_F_SLEEPABLE` flag! I need to re-examine the `bpf_prog_load` function.

Let's see... within `bpf_prog_load`, there's a check: if `BPF_F_SLEEPABLE` is set, the program type has to be one of a limited number of types. And here's the kicker: `BPF_PROG_TYPE_TRACEPOINT` isn't one of them. So, `bpf_prog_load` *should* return `-EINVAL`! In that case, the BPF program *wouldn't* be loaded. The reproducer then calls `ioctl(SIOCGIFINDEX)` and `sendmsg(RTM_NEWQDISC)`, which also end up returning `-EINVAL`.

But... the reproducer then exits! So why the crash? Is the `-EINVAL` somehow being missed? The whole thing is being run by syzkaller. Does syzkaller run the reproducer in a loop? Could the crash be caused by something else?

The fact that the crash is a soft lockup is throwing me off. I'm starting to think that the BPF program *is* getting loaded somehow. I need to re-check `bpf_prog_load` in `kernel/bpf/syscall.c` and focus on how it handles `BPF_F_SLEEPABLE`. There's something I'm missing here, and the soft lockup is the key.

map[Expression:BPF_F_SLEEPABLE]

map[Output:Documentation/bpf/kfuncs.rst=304=The KF_SLEEPABLE flag is used for kfuncs that may sleep. Such kfuncs can only
Documentation/bpf/kfuncs.rst:305:be called by sleepable BPF programs (BPF_F_SLEEPABLE).
Documentation/bpf/kfuncs.rst-306-
--
include/uapi/linux/bpf.h=1186=enum bpf_perf_event_type {
--
include/uapi/linux/bpf.h-1291-
include/uapi/linux/bpf.h:1292:/* If BPF_F_SLEEPABLE is used in BPF_PROG_LOAD command, the verifier will
include/uapi/linux/bpf.h-1293- * restrict map and helper usage for such programs. Sleepable BPF programs can
--
include/uapi/linux/bpf.h-1297- */
include/uapi/linux/bpf.h:1298:#define BPF_F_SLEEPABLE		(1U << 4)
include/uapi/linux/bpf.h-1299-
--
kernel/bpf/syscall.c=2864=static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
--
kernel/bpf/syscall.c-2879-				 BPF_F_TEST_STATE_FREQ |
kernel/bpf/syscall.c:2880:				 BPF_F_SLEEPABLE |
kernel/bpf/syscall.c-2881-				 BPF_F_TEST_RND_HI32 |
--
kernel/bpf/syscall.c-2996-	prog->expected_attach_type = attr->expected_attach_type;
kernel/bpf/syscall.c:2997:	prog->sleepable = !!(attr->prog_flags & BPF_F_SLEEPABLE);
kernel/bpf/syscall.c-2998-	prog->aux->attach_btf = attach_btf;
--
tools/include/uapi/linux/bpf.h=1186=enum bpf_perf_event_type {
--
tools/include/uapi/linux/bpf.h-1291-
tools/include/uapi/linux/bpf.h:1292:/* If BPF_F_SLEEPABLE is used in BPF_PROG_LOAD command, the verifier will
tools/include/uapi/linux/bpf.h-1293- * restrict map and helper usage for such programs. Sleepable BPF programs can
--
tools/include/uapi/linux/bpf.h-1297- */
tools/include/uapi/linux/bpf.h:1298:#define BPF_F_SLEEPABLE		(1U << 4)
tools/include/uapi/linux/bpf.h-1299-
--
tools/lib/bpf/libbpf.c=7771=static int libbpf_prepare_prog_load(struct bpf_program *prog,
--
tools/lib/bpf/libbpf.c-7780-	if (def & SEC_SLEEPABLE)
tools/lib/bpf/libbpf.c:7781:		opts->prog_flags |= BPF_F_SLEEPABLE;
tools/lib/bpf/libbpf.c-7782-
--
tools/lib/bpf/libbpf_probes.c=103=static int probe_prog_load(enum bpf_prog_type prog_type,
--
tools/lib/bpf/libbpf_probes.c-155-	case BPF_PROG_TYPE_SYSCALL:
tools/lib/bpf/libbpf_probes.c:156:		opts.prog_flags = BPF_F_SLEEPABLE;
tools/lib/bpf/libbpf_probes.c-157-		break;
--
tools/lib/bpf/skel_internal.h=353=static inline int bpf_load_and_run(struct bpf_load_and_run_opts *opts)
--
tools/lib/bpf/skel_internal.h-407-	attr.log_buf = opts->ctx->log_buf;
tools/lib/bpf/skel_internal.h:408:	attr.prog_flags = BPF_F_SLEEPABLE;
tools/lib/bpf/skel_internal.h-409-	err = prog_fd = skel_sys_bpf(BPF_PROG_LOAD, &attr, prog_load_attr_sz);
--
tools/testing/selftests/bpf/prog_tests/attach_probe.c=537=static void test_kprobe_sleepable(void)
--
tools/testing/selftests/bpf/prog_tests/attach_probe.c-546-	if (!ASSERT_OK(bpf_program__set_flags(skel->progs.handle_kprobe_sleepable,
tools/testing/selftests/bpf/prog_tests/attach_probe.c:547:		BPF_F_SLEEPABLE), "kprobe_sleepable_flags"))
tools/testing/selftests/bpf/prog_tests/attach_probe.c-548-		goto cleanup;
--
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c=21=static int custom_prepare_load_prog(struct bpf_program *prog,
--
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c-24-	if (cookie == COOKIE_FALLBACK)
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c:25:		opts->prog_flags |= BPF_F_SLEEPABLE;
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c-26-	else if (cookie == COOKIE_ABC1)
--
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c=94=void test_custom_sec_handlers(void)
--
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c-114-	/* fallback treats everything as BPF_PROG_TYPE_SYSCALL program to test
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c:115:	 * setting custom BPF_F_SLEEPABLE bit in preload handler
tools/testing/selftests/bpf/prog_tests/custom_sec_handlers.c-116-	 */
--
tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c=221=static void test_attach_api_fails(void)
--
tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c-364-	err = bpf_program__set_flags(sl_skel->progs.handle_kprobe_multi_sleepable,
tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c:365:				     BPF_F_SLEEPABLE);
tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c-366-	if (!ASSERT_OK(err, "sleep_skel_set_flags"))
--
tools/testing/selftests/bpf/progs/bpf_misc.h-114- *                   - BPF_F_TEST_STATE_FREQ;
tools/testing/selftests/bpf/progs/bpf_misc.h:115: *                   - BPF_F_SLEEPABLE;
tools/testing/selftests/bpf/progs/bpf_misc.h-116- *                   - BPF_F_XDP_HAS_FRAGS;
--
tools/testing/selftests/bpf/test_loader.c=399=static int parse_test_spec(struct test_loader *tester,
--
tools/testing/selftests/bpf/test_loader.c-560-				update_flags(&spec->prog_flags, BPF_F_TEST_STATE_FREQ, clear);
tools/testing/selftests/bpf/test_loader.c:561:			} else if (strcmp(val, "BPF_F_SLEEPABLE") == 0) {
tools/testing/selftests/bpf/test_loader.c:562:				update_flags(&spec->prog_flags, BPF_F_SLEEPABLE, clear);
tools/testing/selftests/bpf/test_loader.c-563-			} else if (strcmp(val, "BPF_F_XDP_HAS_FRAGS") == 0) {
--
tools/testing/selftests/bpf/verifier/sleepable.c-10-	.result = ACCEPT,
tools/testing/selftests/bpf/verifier/sleepable.c:11:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-12-	.runs = -1,
--
tools/testing/selftests/bpf/verifier/sleepable.c-23-	.result = ACCEPT,
tools/testing/selftests/bpf/verifier/sleepable.c:24:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-25-	.runs = -1,
--
tools/testing/selftests/bpf/verifier/sleepable.c-36-	.result = ACCEPT,
tools/testing/selftests/bpf/verifier/sleepable.c:37:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-38-	.runs = -1,
--
tools/testing/selftests/bpf/verifier/sleepable.c-49-	.result = ACCEPT,
tools/testing/selftests/bpf/verifier/sleepable.c:50:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-51-	.runs = -1,
--
tools/testing/selftests/bpf/verifier/sleepable.c-62-	.result = ACCEPT,
tools/testing/selftests/bpf/verifier/sleepable.c:63:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-64-	.runs = -1,
--
tools/testing/selftests/bpf/verifier/sleepable.c-74-	.result = ACCEPT,
tools/testing/selftests/bpf/verifier/sleepable.c:75:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-76-	.runs = -1,
--
tools/testing/selftests/bpf/verifier/sleepable.c-88-	.errstr = "Only fentry/fexit/fsession/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
tools/testing/selftests/bpf/verifier/sleepable.c:89:	.flags = BPF_F_SLEEPABLE,
tools/testing/selftests/bpf/verifier/sleepable.c-90-	.runs = -1,
]

gemini-3.1-pro-preview

							input: 163105
							output: 20
							thoughts: 3640
						

**The Puzzle of the Infinite hrtimer Loop**

Okay, so here's what I've got. The initial BPF program loading is a red herring. It *succeeds* in loading, despite my initial concerns about the flags or the invalid map file descriptor (-1), so it's not the root cause. This seemed suspicious, but the crash occurs *after* the BPF load, meaning it is probably not the core of the problem. Also, the BPF program's code, even if loaded, never runs as `bpf_prog_load` is successful, but the program is not attached.

My focus, initially, was the `hrtimer` corruption, the `rb_erase_linked` loop, and the map file descriptor. The code does some mmap calls which look suspicious, which could potentially explain data corruption. However, that line of inquiry seems like it's leading nowhere.

The kernel is crashing in `__remove_hrtimer`, specifically, the issue has something to do with `timerqueue_linked_del`, and by extension the rbtree. After revisiting the crash dump and the code, I see that the important part is actually that CPU 1 *appears* to be stuck in `__remove_hrtimer`, but this is wrong. CPU 1 is NOT stuck, it is just interrupted by the NMI at that exact point. It is in `default_idle`, waiting for an interrupt, and the backtrace points to a timer interrupt. That interrupt's handler, `__hrtimer_run_queues`, is looping infinitely.

The infinite loop is the real issue. `__hrtimer_run_queues` is looping, and thus, processing the *same* timer over and over again. The timer is likely returning `HRTIMER_RESTART` but *not* advancing its expiration time.

The reproducer includes the creation of a netlink socket and sending a `RTM_NEWQDISC` message. `tcm_ifindex`, the interface index in the `tcmsg` struct, is set to 0. This is the key. While the system appears to correctly handle an ifindex of 0 and return `-ENODEV`, perhaps there is something in how this affects an hrtimer associated with a QDISC? The fact that a non-existent device is specified could be the root cause.

map[Name:tcmsg]

map[Fields:[map[Name:tcm_family OffsetBits:0 SizeBits:8] map[Name:tcm__pad1 OffsetBits:8 SizeBits:8] map[Name:tcm__pad2 OffsetBits:16 SizeBits:16] map[Name:tcm_ifindex OffsetBits:32 SizeBits:32] map[Name:tcm_handle OffsetBits:64 SizeBits:32] map[Name:tcm_parent OffsetBits:96 SizeBits:32] map[Name:tcm_info OffsetBits:128 SizeBits:32]]]

gemini-3.1-pro-preview

							input: 167427
							output: 22
							thoughts: 351
						

**Analyzing the Netlink Message Header**

Okay, so I'm trying to pinpoint where `tcm_ifindex` is within this Netlink message structure. I remember from somewhere that it's located at an offset of 32 bits, which translates to 4 bytes. Let me just confirm that quickly.

Right, let's look at this C code snippet. It looks like it's trying to write specific values to memory addresses. Okay, `*(uint64_t*)0x200000000780 = 0x200000000000;` - this appears to be setting up an address. Then, `*(uint32_t*)0x200000000000 = 0;`... Aha, `0x200000000000` is being used as the base address. And the subsequent lines show data being written to offsets from that base address.

Let me think… `0x200000000000`… That address looks suspiciously like the start of an `nlmsghdr` structure. I need to be sure; let me quickly double check the definition of the `struct nlmsghdr` itself.

map[Name:nlmsghdr]

map[Fields:[map[Name:nlmsg_len OffsetBits:0 SizeBits:32] map[Name:nlmsg_type OffsetBits:32 SizeBits:16] map[Name:nlmsg_flags OffsetBits:48 SizeBits:16] map[Name:nlmsg_seq OffsetBits:64 SizeBits:32] map[Name:nlmsg_pid OffsetBits:96 SizeBits:32]]]

gemini-3.1-pro-preview

							input: 168199
							output: 22
							thoughts: 636
						

**Analyzing the Kernel Crash: A Deep Dive**

Okay, so I'm looking at this crash and trying to piece together what's happening. `nlmsghdr` is 16 bytes, that's clear. `struct tcmsg` then starts at offset 16, which means `tcm_family` is at `0x10`. And `tcm_ifindex` should follow at `0x14`.

But then I see this C code: `*(uint32_t*)0x200000000014 = 0;` which sets `tcm_ifindex` to 0. Hmm, if `tcm_ifindex` is 0, then `__dev_get_by_index(net, 0)` will return NULL. That means `tc_modify_qdisc` will return `-ENODEV`, indicating a device not found, making this `sendmsg` potentially fail silently.

Let's look at the full syscall sequence. There's a `bpf` call, a `memcpy` to "team0", and then an `ioctl` call with `SIOCGIFINDEX` (0x8933). This part, getting the ifindex of `team0`, is where things get interesting. But, WAIT! The reproduced code **doesn't actually use** the index after getting it. That's odd. Syzkaller usually handles the resources.

The Syzkaller description indicates an `ifindex` resource, but the generated C code might be failing to pass it correctly. If `tcm_ifindex` is 0, the `sendmsg` would effectively do nothing. But then, how is the kernel crashing?

Hold on. The BPF program... Let's check `prog_ifindex` offset at 0xcd0.
Let's confirm the `union bpf_attr` structure to fully understand `BPF_PROG_LOAD`. It seems the crash must be coming from the `BPF` and not the `tc` side of this. This is where I need to focus my analysis.

map[Name:bpf_attr]

map[Fields:[map[Name: OffsetBits:0 SizeBits:768] map[Name: OffsetBits:0 SizeBits:256] map[Name:batch OffsetBits:0 SizeBits:448] map[Name: OffsetBits:0 SizeBits:1344] map[Name: OffsetBits:0 SizeBits:192] map[Name: OffsetBits:0 SizeBits:256] map[Name:test OffsetBits:0 SizeBits:640] map[Name: OffsetBits:0 SizeBits:128] map[Name:info OffsetBits:0 SizeBits:128] map[Name:query OffsetBits:0 SizeBits:512] map[Name:raw_tracepoint OffsetBits:0 SizeBits:192] map[Name: OffsetBits:0 SizeBits:320] map[Name:task_fd_query OffsetBits:0 SizeBits:384] map[Name:link_create OffsetBits:0 SizeBits:512] map[Name:link_update OffsetBits:0 SizeBits:128] map[Name:link_detach OffsetBits:0 SizeBits:32] map[Name:enable_stats OffsetBits:0 SizeBits:32] map[Name:iter_create OffsetBits:0 SizeBits:64] map[Name:prog_bind_map OffsetBits:0 SizeBits:96] map[Name:token_create OffsetBits:0 SizeBits:64] map[Name:prog_stream_read OffsetBits:0 SizeBits:192] map[Name:prog_assoc_struct_ops OffsetBits:0 SizeBits:96]]]

gemini-3.1-pro-preview

							input: 169746
							output: 44
							thoughts: 33
						

Okay, let's see...

**Deconstructing the bpf_attr Union for BPF_PROG_LOAD**

Hmm, right, *`bpf_attr` is a union.* That's important. I need to make sure I'm using the right member depending on the BPF system call I'm making. I'm focusing on `BPF_PROG_LOAD` right now. So, I need to go back and explicitly check the `bpf_attr` structure definition for how the arguments are laid out for *that specific* `BPF` command. I need to be precise here; one misaligned field and the kernel will probably have kittens. Time to dive into the kernel headers and refresh my memory on the layout. No room for assumptions, even on something I *think* I know well. Best to go straight to the source.

map[ContextFile:include/uapi/linux/bpf.h IncludeLines:true Name:bpf_attr]

map[SourceCode:1510:	union bpf_attr {
1511:		struct { /* anonymous struct used by BPF_MAP_CREATE command */
1512:			__u32	map_type;	/* one of enum bpf_map_type */
1513:			__u32	key_size;	/* size of key in bytes */
1514:			__u32	value_size;	/* size of value in bytes */
1515:			__u32	max_entries;	/* max number of entries in a map */
1516:			__u32	map_flags;	/* BPF_MAP_CREATE related
1517:						 * flags defined above.
1518:						 */
1519:			__u32	inner_map_fd;	/* fd pointing to the inner map */
1520:			__u32	numa_node;	/* numa node (effective only if
1521:						 * BPF_F_NUMA_NODE is set).
1522:						 */
1523:			char	map_name[BPF_OBJ_NAME_LEN];
1524:			__u32	map_ifindex;	/* ifindex of netdev to create on */
1525:			__u32	btf_fd;		/* fd pointing to a BTF type data */
1526:			__u32	btf_key_type_id;	/* BTF type_id of the key */
1527:			__u32	btf_value_type_id;	/* BTF type_id of the value */
1528:			__u32	btf_vmlinux_value_type_id;/* BTF type_id of a kernel-
1529:							   * struct stored as the
1530:							   * map value
1531:							   */
1532:			/* Any per-map-type extra fields
1533:			 *
1534:			 * BPF_MAP_TYPE_BLOOM_FILTER - the lowest 4 bits indicate the
1535:			 * number of hash functions (if 0, the bloom filter will default
1536:			 * to using 5 hash functions).
1537:			 *
1538:			 * BPF_MAP_TYPE_ARENA - contains the address where user space
1539:			 * is going to mmap() the arena. It has to be page aligned.
1540:			 */
1541:			__u64	map_extra;
1542:	
1543:			__s32   value_type_btf_obj_fd;	/* fd pointing to a BTF
1544:							 * type data for
1545:							 * btf_vmlinux_value_type_id.
1546:							 */
1547:			/* BPF token FD to use with BPF_MAP_CREATE operation.
1548:			 * If provided, map_flags should have BPF_F_TOKEN_FD flag set.
1549:			 */
1550:			__s32	map_token_fd;
1551:	
1552:			/* Hash of the program that has exclusive access to the map.
1553:			 */
1554:			__aligned_u64 excl_prog_hash;
1555:			/* Size of the passed excl_prog_hash. */
1556:			__u32 excl_prog_hash_size;
1557:		};
1558:	
1559:		struct { /* anonymous struct used by BPF_MAP_*_ELEM and BPF_MAP_FREEZE commands */
1560:			__u32		map_fd;
1561:			__aligned_u64	key;
1562:			union {
1563:				__aligned_u64 value;
1564:				__aligned_u64 next_key;
1565:			};
1566:			__u64		flags;
1567:		};
1568:	
1569:		struct { /* struct used by BPF_MAP_*_BATCH commands */
1570:			__aligned_u64	in_batch;	/* start batch,
1571:							 * NULL to start from beginning
1572:							 */
1573:			__aligned_u64	out_batch;	/* output: next start batch */
1574:			__aligned_u64	keys;
1575:			__aligned_u64	values;
1576:			__u32		count;		/* input/output:
1577:							 * input: # of key/value
1578:							 * elements
1579:							 * output: # of filled elements
1580:							 */
1581:			__u32		map_fd;
1582:			__u64		elem_flags;
1583:			__u64		flags;
1584:		} batch;
1585:	
1586:		struct { /* anonymous struct used by BPF_PROG_LOAD command */
1587:			__u32		prog_type;	/* one of enum bpf_prog_type */
1588:			__u32		insn_cnt;
1589:			__aligned_u64	insns;
1590:			__aligned_u64	license;
1591:			__u32		log_level;	/* verbosity level of verifier */
1592:			__u32		log_size;	/* size of user buffer */
1593:			__aligned_u64	log_buf;	/* user supplied buffer */
1594:			__u32		kern_version;	/* not used */
1595:			__u32		prog_flags;
1596:			char		prog_name[BPF_OBJ_NAME_LEN];
1597:			__u32		prog_ifindex;	/* ifindex of netdev to prep for */
1598:			/* For some prog types expected attach type must be known at
1599:			 * load time to verify attach type specific parts of prog
1600:			 * (context accesses, allowed helpers, etc).
1601:			 */
1602:			__u32		expected_attach_type;
1603:			__u32		prog_btf_fd;	/* fd pointing to BTF type data */
1604:			__u32		func_info_rec_size;	/* userspace bpf_func_info size */
1605:			__aligned_u64	func_info;	/* func info */
1606:			__u32		func_info_cnt;	/* number of bpf_func_info records */
1607:			__u32		line_info_rec_size;	/* userspace bpf_line_info size */
1608:			__aligned_u64	line_info;	/* line info */
1609:			__u32		line_info_cnt;	/* number of bpf_line_info records */
1610:			__u32		attach_btf_id;	/* in-kernel BTF type id to attach to */
1611:			union {
1612:				/* valid prog_fd to attach to bpf prog */
1613:				__u32		attach_prog_fd;
1614:				/* or valid module BTF object fd or 0 to attach to vmlinux */
1615:				__u32		attach_btf_obj_fd;
1616:			};
1617:			__u32		core_relo_cnt;	/* number of bpf_core_relo */
1618:			__aligned_u64	fd_array;	/* array of FDs */
1619:			__aligned_u64	core_relos;
1620:			__u32		core_relo_rec_size; /* sizeof(struct bpf_core_relo) */
1621:			/* output: actual total log contents size (including termintaing zero).
1622:			 * It could be both larger than original log_size (if log was
1623:			 * truncated), or smaller (if log buffer wasn't filled completely).
1624:			 */
1625:			__u32		log_true_size;
1626:			/* BPF token FD to use with BPF_PROG_LOAD operation.
1627:			 * If provided, prog_flags should have BPF_F_TOKEN_FD flag set.
1628:			 */
1629:			__s32		prog_token_fd;
1630:			/* The fd_array_cnt can be used to pass the length of the
1631:			 * fd_array array. In this case all the [map] file descriptors
1632:			 * passed in this array will be bound to the program, even if
1633:			 * the maps are not referenced directly. The functionality is
1634:			 * similar to the BPF_PROG_BIND_MAP syscall, but maps can be
1635:			 * used by the verifier during the program load. If provided,
1636:			 * then the fd_array[0,...,fd_array_cnt-1] is expected to be
1637:			 * continuous.
1638:			 */
1639:			__u32		fd_array_cnt;
1640:			/* Pointer to a buffer containing the signature of the BPF
1641:			 * program.
1642:			 */
1643:			__aligned_u64   signature;
1644:			/* Size of the signature buffer in bytes. */
1645:			__u32 		signature_size;
1646:			/* ID of the kernel keyring to be used for signature
1647:			 * verification.
1648:			 */
1649:			__s32		keyring_id;
1650:		};
1651:	
1652:		struct { /* anonymous struct used by BPF_OBJ_* commands */
1653:			__aligned_u64	pathname;
1654:			__u32		bpf_fd;
1655:			__u32		file_flags;
1656:			/* Same as dirfd in openat() syscall; see openat(2)
1657:			 * manpage for details of path FD and pathname semantics;
1658:			 * path_fd should accompanied by BPF_F_PATH_FD flag set in
1659:			 * file_flags field, otherwise it should be set to zero;
1660:			 * if BPF_F_PATH_FD flag is not set, AT_FDCWD is assumed.
1661:			 */
1662:			__s32		path_fd;
1663:		};
1664:	
1665:		struct { /* anonymous struct used by BPF_PROG_ATTACH/DETACH commands */
1666:			union {
1667:				__u32	target_fd;	/* target object to attach to or ... */
1668:				__u32	target_ifindex;	/* target ifindex */
1669:			};
1670:			__u32		attach_bpf_fd;
1671:			__u32		attach_type;
1672:			__u32		attach_flags;
1673:			__u32		replace_bpf_fd;
1674:			union {
1675:				__u32	relative_fd;
1676:				__u32	relative_id;
1677:			};
1678:			__u64		expected_revision;
1679:		};
1680:	
1681:		struct { /* anonymous struct used by BPF_PROG_TEST_RUN command */
1682:			__u32		prog_fd;
1683:			__u32		retval;
1684:			__u32		data_size_in;	/* input: len of data_in */
1685:			__u32		data_size_out;	/* input/output: len of data_out
1686:							 *   returns ENOSPC if data_out
1687:							 *   is too small.
1688:							 */
1689:			__aligned_u64	data_in;
1690:			__aligned_u64	data_out;
1691:			__u32		repeat;
1692:			__u32		duration;
1693:			__u32		ctx_size_in;	/* input: len of ctx_in */
1694:			__u32		ctx_size_out;	/* input/output: len of ctx_out
1695:							 *   returns ENOSPC if ctx_out
1696:							 *   is too small.
1697:							 */
1698:			__aligned_u64	ctx_in;
1699:			__aligned_u64	ctx_out;
1700:			__u32		flags;
1701:			__u32		cpu;
1702:			__u32		batch_size;
1703:		} test;
1704:	
1705:		struct { /* anonymous struct used by BPF_*_GET_*_ID */
1706:			union {
1707:				__u32		start_id;
1708:				__u32		prog_id;
1709:				__u32		map_id;
1710:				__u32		btf_id;
1711:				__u32		link_id;
1712:			};
1713:			__u32		next_id;
1714:			__u32		open_flags;
1715:			__s32		fd_by_id_token_fd;
1716:		};
1717:	
1718:		struct { /* anonymous struct used by BPF_OBJ_GET_INFO_BY_FD */
1719:			__u32		bpf_fd;
1720:			__u32		info_len;
1721:			__aligned_u64	info;
1722:		} info;
1723:	
1724:		struct { /* anonymous struct used by BPF_PROG_QUERY command */
1725:			union {
1726:				__u32	target_fd;	/* target object to query or ... */
1727:				__u32	target_ifindex;	/* target ifindex */
1728:			};
1729:			__u32		attach_type;
1730:			__u32		query_flags;
1731:			__u32		attach_flags;
1732:			__aligned_u64	prog_ids;
1733:			union {
1734:				__u32	prog_cnt;
1735:				__u32	count;
1736:			};
1737:			__u32		:32;
1738:			/* output: per-program attach_flags.
1739:			 * not allowed to be set during effective query.
1740:			 */
1741:			__aligned_u64	prog_attach_flags;
1742:			__aligned_u64	link_ids;
1743:			__aligned_u64	link_attach_flags;
1744:			__u64		revision;
1745:		} query;
1746:	
1747:		struct { /* anonymous struct used by BPF_RAW_TRACEPOINT_OPEN command */
1748:			__u64		name;
1749:			__u32		prog_fd;
1750:			__u32		:32;
1751:			__aligned_u64	cookie;
1752:		} raw_tracepoint;
1753:	
1754:		struct { /* anonymous struct for BPF_BTF_LOAD */
1755:			__aligned_u64	btf;
1756:			__aligned_u64	btf_log_buf;
1757:			__u32		btf_size;
1758:			__u32		btf_log_size;
1759:			__u32		btf_log_level;
1760:			/* output: actual total log contents size (including termintaing zero).
1761:			 * It could be both larger than original log_size (if log was
1762:			 * truncated), or smaller (if log buffer wasn't filled completely).
1763:			 */
1764:			__u32		btf_log_true_size;
1765:			__u32		btf_flags;
1766:			/* BPF token FD to use with BPF_BTF_LOAD operation.
1767:			 * If provided, btf_flags should have BPF_F_TOKEN_FD flag set.
1768:			 */
1769:			__s32		btf_token_fd;
1770:		};
1771:	
1772:		struct {
1773:			__u32		pid;		/* input: pid */
1774:			__u32		fd;		/* input: fd */
1775:			__u32		flags;		/* input: flags */
1776:			__u32		buf_len;	/* input/output: buf len */
1777:			__aligned_u64	buf;		/* input/output:
1778:							 *   tp_name for tracepoint
1779:							 *   symbol for kprobe
1780:							 *   filename for uprobe
1781:							 */
1782:			__u32		prog_id;	/* output: prod_id */
1783:			__u32		fd_type;	/* output: BPF_FD_TYPE_* */
1784:			__u64		probe_offset;	/* output: probe_offset */
1785:			__u64		probe_addr;	/* output: probe_addr */
1786:		} task_fd_query;
1787:	
1788:		struct { /* struct used by BPF_LINK_CREATE command */
1789:			union {
1790:				__u32		prog_fd;	/* eBPF program to attach */
1791:				__u32		map_fd;		/* struct_ops to attach */
1792:			};
1793:			union {
1794:				__u32	target_fd;	/* target object to attach to or ... */
1795:				__u32	target_ifindex; /* target ifindex */
1796:			};
1797:			__u32		attach_type;	/* attach type */
1798:			__u32		flags;		/* extra flags */
1799:			union {
1800:				__u32	target_btf_id;	/* btf_id of target to attach to */
1801:				struct {
1802:					__aligned_u64	iter_info;	/* extra bpf_iter_link_info */
1803:					__u32		iter_info_len;	/* iter_info length */
1804:				};
1805:				struct {
1806:					/* black box user-provided value passed through
1807:					 * to BPF program at the execution time and
1808:					 * accessible through bpf_get_attach_cookie() BPF helper
1809:					 */
1810:					__u64		bpf_cookie;
1811:				} perf_event;
1812:				struct {
1813:					__u32		flags;
1814:					__u32		cnt;
1815:					__aligned_u64	syms;
1816:					__aligned_u64	addrs;
1817:					__aligned_u64	cookies;
1818:				} kprobe_multi;
1819:				struct {
1820:					/* this is overlaid with the target_btf_id above. */
1821:					__u32		target_btf_id;
1822:					/* black box user-provided value passed through
1823:					 * to BPF program at the execution time and
1824:					 * accessible through bpf_get_attach_cookie() BPF helper
1825:					 */
1826:					__u64		cookie;
1827:				} tracing;
1828:				struct {
1829:					__u32		pf;
1830:					__u32		hooknum;
1831:					__s32		priority;
1832:					__u32		flags;
1833:				} netfilter;
1834:				struct {
1835:					union {
1836:						__u32	relative_fd;
1837:						__u32	relative_id;
1838:					};
1839:					__u64		expected_revision;
1840:				} tcx;
1841:				struct {
1842:					__aligned_u64	path;
1843:					__aligned_u64	offsets;
1844:					__aligned_u64	ref_ctr_offsets;
1845:					__aligned_u64	cookies;
1846:					__u32		cnt;
1847:					__u32		flags;
1848:					__u32		pid;
1849:				} uprobe_multi;
1850:				struct {
1851:					union {
1852:						__u32	relative_fd;
1853:						__u32	relative_id;
1854:					};
1855:					__u64		expected_revision;
1856:				} netkit;
1857:				struct {
1858:					union {
1859:						__u32	relative_fd;
1860:						__u32	relative_id;
1861:					};
1862:					__u64		expected_revision;
1863:				} cgroup;
1864:			};
1865:		} link_create;
1866:	
1867:		struct { /* struct used by BPF_LINK_UPDATE command */
1868:			__u32		link_fd;	/* link fd */
1869:			union {
1870:				/* new program fd to update link with */
1871:				__u32		new_prog_fd;
1872:				/* new struct_ops map fd to update link with */
1873:				__u32           new_map_fd;
1874:			};
1875:			__u32		flags;		/* extra flags */
1876:			union {
1877:				/* expected link's program fd; is specified only if
1878:				 * BPF_F_REPLACE flag is set in flags.
1879:				 */
1880:				__u32		old_prog_fd;
1881:				/* expected link's map fd; is specified only
1882:				 * if BPF_F_REPLACE flag is set.
1883:				 */
1884:				__u32           old_map_fd;
1885:			};
1886:		} link_update;
1887:	
1888:		struct {
1889:			__u32		link_fd;
1890:		} link_detach;
1891:	
1892:		struct { /* struct used by BPF_ENABLE_STATS command */
1893:			__u32		type;
1894:		} enable_stats;
1895:	
1896:		struct { /* struct used by BPF_ITER_CREATE command */
1897:			__u32		link_fd;
1898:			__u32		flags;
1899:		} iter_create;
1900:	
1901:		struct { /* struct used by BPF_PROG_BIND_MAP command */
1902:			__u32		prog_fd;
1903:			__u32		map_fd;
1904:			__u32		flags;		/* extra flags */
1905:		} prog_bind_map;
1906:	
1907:		struct { /* struct used by BPF_TOKEN_CREATE command */
1908:			__u32		flags;
1909:			__u32		bpffs_fd;
1910:		} token_create;
1911:	
1912:		struct {
1913:			__aligned_u64	stream_buf;
1914:			__u32		stream_buf_len;
1915:			__u32		stream_id;
1916:			__u32		prog_fd;
1917:		} prog_stream_read;
1918:	
1919:		struct {
1920:			__u32		map_fd;
1921:			__u32		prog_fd;
1922:			__u32		flags;
1923:		} prog_assoc_struct_ops;
1924:	
1925:	} __attribute__((aligned(8)));
 SourceFile:include/uapi/linux/bpf.h]

gemini-3.1-pro-preview

							input: 176833
							output: 48
							thoughts: 1182
						

**Analyzing the BPF Program Loader Reproducer**

Okay, let's break this down. First thing I notice is the memory layout being defined by this reproducer code. I immediately key in on the structure offsets – especially the one for `prog_ifindex` at offset `0x28` (40 bytes). I've got to keep track of this memory layout while working. I need to be sure the reproducer is correctly crafting the `bpf_attr` structure for the `bpf_prog_load` syscall.

Looking at the C code, I see the reproducer is populating the `bpf_attr` struct, field by field. I'm focusing on the field initializations. Okay, so we're setting `prog_type`, `insn_cnt`, and providing the instructions. Then there's the `license`, and some logging parameters. We're setting `kern_version`, `prog_flags` (which is `BPF_F_ANY_ALIGNMENT` = 2, so `BPF_F_SLEEPABLE` isn't enabled), a `prog_name`,  `prog_ifindex` (which is zero), and various other fields related to BTF, function information, line information, attachments, and core relocations. I'm going through each initialization to make sure it's valid.

Then I get to the end of the structure setup, and I focus on the value provided for `prog_token_fd` at `0xcd0`, or 144, which must be the struct member offset. Then I remembered the size of `sizeof(union bpf_attr)` = 192 bytes. Now I see that the reproducer has passed a size of 144 bytes, so there is something truncated here.

Okay, so I have to confirm the `bpf_prog_load` call will succeed if the program is valid. The `prog_flags` were set with  `BPF_F_ANY_ALIGNMENT`. Then, it hits me that the program has `ringbuf_map_fd` set to `-1`. I recognize that as an invalid file descriptor.

Now, I understand! The reproducer's intention is to fail the verifier! I see that `-1` is in the `imm` field of `insn1` in the `ringbuf_reserve` BPF instruction. So I know this instruction is `bpf_insn_map_fd_t`. If `imm` is `-1`, then `bpf_check` should fail because `-1` is an invalid file descriptor. Therefore the verifier should have failed.

I am going to check `replace_map_fd_with_map_ptr` in the kernel at `kernel/bpf/verifier.c`. Let's see what is happening!

log-in to see details

map[ContextFile:kernel/bpf/verifier.c IncludeLines:true Name:replace_map_fd_with_map_ptr]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 178693
							output: 25
							thoughts: 18
						

Okay, here's my attempt at summarizing the thought process, as if it were my own, assuming I'm an expert in the field:

**Initial Investigation: The `replace_map_fd_with_map_ptr` Search**

Alright, time to dig in. I need to find all instances of `replace_map_fd_with_map_ptr`. This is likely a critical function or a piece of code that’s been flagged, or that I need to understand better. Given the naming convention, it suggests a transition or refactoring relating to file descriptors and memory pointers associated with memory mapped regions. Could be a significant change involving how we're handling memory mapped files. I’ll start with a comprehensive code search – I'll probably leverage my preferred tool (grep, ripgrep, or whatever is appropriate for this project) to get a broad overview. My initial search will target the exact string, with some wildcards to find variations or partial matches, in a wide search scope. Then, I’ll refine it based on what I find.

log-in to see details

map[Expression:replace_map_fd_with_map_ptr]

map[Output:]

gemini-3.1-pro-preview

							input: 178973
							output: 20
							thoughts: 25
						

Here's my thought process, summarized as you requested:

**Navigating the BPF Verifier**

Alright, let's dive into the BPF verifier code. I need to track down how `map_ptr` is handled, and my initial instinct is to focus on `fd` because it's a common identifier related to file descriptors and, by extension, BPF maps. I'm going to start by searching for instances of `fd` specifically within `kernel/bpf/verifier.c`. My thinking is that this file is the likely spot where the validation and access control around maps, and therefore their associated file descriptors, are checked during BPF program execution. I'll need to then see how `map_ptr` is used in that context.

map[Expression:bpf_map_get]

map[Output:
Full output is too long, showing 500 out of 1295 lines.
Use more precise expression if possible.

[Documentation/bpf/map_hash.rst=118=Userspace
 --
 Documentation/bpf/map_hash.rst-120-
 Documentation/bpf/map_hash.rst:121:bpf_map_get_next_key()
 Documentation/bpf/map_hash.rst-122-~~~~~~~~~~~~~~~~~~~~~~
 --
 Documentation/bpf/map_hash.rst-125-
 Documentation/bpf/map_hash.rst:126:   int bpf_map_get_next_key(int fd, const void *cur_key, void *next_key)
 Documentation/bpf/map_hash.rst-127-
 Documentation/bpf/map_hash.rst=128=In userspace, it is possible to iterate through the keys of a hash using
 Documentation/bpf/map_hash.rst:129:libbpf's ``bpf_map_get_next_key()`` function. The first key can be fetched by
 Documentation/bpf/map_hash.rst:130:calling ``bpf_map_get_next_key()`` with ``cur_key`` set to
 Documentation/bpf/map_hash.rst-131-``NULL``. Subsequent calls will fetch the next key that follows the
 Documentation/bpf/map_hash.rst:132:current key. ``bpf_map_get_next_key()`` returns 0 on success, -ENOENT if
 Documentation/bpf/map_hash.rst-133-cur_key is the last key in the hash, or negative error in case of
 Documentation/bpf/map_hash.rst=134=failure.
 Documentation/bpf/map_hash.rst-135-
 Documentation/bpf/map_hash.rst:136:Note that if ``cur_key`` gets deleted then ``bpf_map_get_next_key()``
 Documentation/bpf/map_hash.rst-137-will instead return the *first* key in the hash table which is
 Documentation/bpf/map_hash.rst=138=undesirable. It is recommended to use batched lookup if there is going
 Documentation/bpf/map_hash.rst:139:to be key deletion intermixed with ``bpf_map_get_next_key()``.
 Documentation/bpf/map_hash.rst-140-
 --
 Documentation/bpf/map_hash.rst=193=Userspace walking the map elements from the map declared above:
 --
 Documentation/bpf/map_hash.rst-207-            for (;;) {
 Documentation/bpf/map_hash.rst:208:                    err = bpf_map_get_next_key(map_fd, cur_key, &next_key);
 Documentation/bpf/map_hash.rst-209-                    if (err)
 --
 Documentation/bpf/map_lpm_trie.rst=87=the map identified by ``fd``.
 Documentation/bpf/map_lpm_trie.rst-88-
 Documentation/bpf/map_lpm_trie.rst:89:bpf_map_get_next_key()
 Documentation/bpf/map_lpm_trie.rst-90-~~~~~~~~~~~~~~~~~~~~~~
 --
 Documentation/bpf/map_lpm_trie.rst-93-
 Documentation/bpf/map_lpm_trie.rst:94:   int bpf_map_get_next_key (int fd, const void *cur_key, void *next_key)
 Documentation/bpf/map_lpm_trie.rst-95-
 Documentation/bpf/map_lpm_trie.rst=96=A userspace program can iterate through the entries in an LPM trie using
 Documentation/bpf/map_lpm_trie.rst:97:libbpf's ``bpf_map_get_next_key()`` function. The first key can be
 Documentation/bpf/map_lpm_trie.rst:98:fetched by calling ``bpf_map_get_next_key()`` with ``cur_key`` set to
 Documentation/bpf/map_lpm_trie.rst-99-``NULL``. Subsequent calls will fetch the next key that follows the
 Documentation/bpf/map_lpm_trie.rst:100:current key. ``bpf_map_get_next_key()`` returns ``0`` on success,
 Documentation/bpf/map_lpm_trie.rst-101-``-ENOENT`` if ``cur_key`` is the last key in the trie, or negative
 Documentation/bpf/map_lpm_trie.rst=102=error in case of failure.
 Documentation/bpf/map_lpm_trie.rst-103-
 Documentation/bpf/map_lpm_trie.rst:104:``bpf_map_get_next_key()`` will iterate through the LPM trie elements
 Documentation/bpf/map_lpm_trie.rst-105-from leftmost leaf first. This means that iteration will return more
 --
 Documentation/bpf/map_lpm_trie.rst=171=of an LPM trie:
 --
 Documentation/bpf/map_lpm_trie.rst-186-            for (;;) {
 Documentation/bpf/map_lpm_trie.rst:187:                    err = bpf_map_get_next_key(map_fd, cur_key, &next_key);
 Documentation/bpf/map_lpm_trie.rst-188-                    if (err)
 --
 drivers/net/ethernet/netronome/nfp/bpf/offload.c=305=static int
 drivers/net/ethernet/netronome/nfp/bpf/offload.c:306:nfp_bpf_map_get_next_key(struct bpf_offloaded_map *offmap,
 drivers/net/ethernet/netronome/nfp/bpf/offload.c-307-			 void *key, void *next_key)
 --
 drivers/net/ethernet/netronome/nfp/bpf/offload.c=322=static const struct bpf_map_dev_ops nfp_bpf_map_ops = {
 drivers/net/ethernet/netronome/nfp/bpf/offload.c:323:	.map_get_next_key	= nfp_bpf_map_get_next_key,
 drivers/net/ethernet/netronome/nfp/bpf/offload.c-324-	.map_lookup_elem	= nfp_bpf_map_lookup_entry,
 --
 include/linux/bpf.h=2599=void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu);
 include/linux/bpf.h-2600-
 include/linux/bpf.h:2601:struct bpf_map *bpf_map_get(u32 ufd);
 include/linux/bpf.h:2602:struct bpf_map *bpf_map_get_with_uref(u32 ufd);
 include/linux/bpf.h-2603-
 include/linux/bpf.h-2604-/*
 include/linux/bpf.h:2605: * The __bpf_map_get() and __btf_get_by_fd() functions parse a file
 include/linux/bpf.h-2606- * descriptor and return a corresponding map or btf object.
 --
 include/linux/bpf.h-2608- * do not increase refcnt. To also increase refcnt use corresponding
 include/linux/bpf.h:2609: * bpf_map_get() and btf_get_by_fd() functions.
 include/linux/bpf.h-2610- */
 include/linux/bpf.h-2611-
 include/linux/bpf.h:2612:static inline struct bpf_map *__bpf_map_get(struct fd f)
 include/linux/bpf.h-2613-{
 --
 include/linux/bpf.h=2647=int  generic_map_delete_batch(struct bpf_map *map,
 --
 include/linux/bpf.h-2649-			      union bpf_attr __user *uattr);
 include/linux/bpf.h:2650:struct bpf_map *bpf_map_get_curr_or_next(u32 *id);
 include/linux/bpf.h-2651-struct bpf_prog *bpf_prog_get_curr_or_next(u32 *id);
 --
 kernel/bpf/bpf_struct_ops.c=1311=static int bpf_struct_ops_map_link_detach(struct bpf_link *link)
 --
 kernel/bpf/bpf_struct_ops.c-1328-	RCU_INIT_POINTER(st_link->map, NULL);
 kernel/bpf/bpf_struct_ops.c:1329:	/* Pair with bpf_map_get() in bpf_struct_ops_link_create() or
 kernel/bpf/bpf_struct_ops.c-1330-	 * bpf_map_inc() in bpf_struct_ops_map_link_update().
 --
 kernel/bpf/bpf_struct_ops.c=1360=int bpf_struct_ops_link_create(union bpf_attr *attr)
 --
 kernel/bpf/bpf_struct_ops.c-1367-
 kernel/bpf/bpf_struct_ops.c:1368:	map = bpf_map_get(attr->link_create.map_fd);
 kernel/bpf/bpf_struct_ops.c-1369-	if (IS_ERR(map))
 --
 kernel/bpf/inode.c=71=static void *bpf_fd_probe_obj(u32 ufd, enum bpf_type *type)
 --
 kernel/bpf/inode.c-74-
 kernel/bpf/inode.c:75:	raw = bpf_map_get_with_uref(ufd);
 kernel/bpf/inode.c-76-	if (!IS_ERR(raw)) {
 --
 kernel/bpf/map_in_map.c=10=struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 --
 kernel/bpf/map_in_map.c-15-
 kernel/bpf/map_in_map.c:16:	inner_map = __bpf_map_get(f);
 kernel/bpf/map_in_map.c-17-	if (IS_ERR(inner_map))
 --
 kernel/bpf/map_in_map.c=94=void *bpf_map_fd_get_ptr(struct bpf_map *map,
 --
 kernel/bpf/map_in_map.c-100-
 kernel/bpf/map_in_map.c:101:	inner_map = __bpf_map_get(f);
 kernel/bpf/map_in_map.c-102-	if (IS_ERR(inner_map))
 --
 kernel/bpf/map_iter.c=13=static void *bpf_map_seq_start(struct seq_file *seq, loff_t *pos)
 --
 kernel/bpf/map_iter.c-17-
 kernel/bpf/map_iter.c:18:	map = bpf_map_get_curr_or_next(&info->map_id);
 kernel/bpf/map_iter.c-19-	if (!map)
 --
 kernel/bpf/map_iter.c=27=static void *bpf_map_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 --
 kernel/bpf/map_iter.c-33-	bpf_map_put((struct bpf_map *)v);
 kernel/bpf/map_iter.c:34:	return bpf_map_get_curr_or_next(&info->map_id);
 kernel/bpf/map_iter.c-35-}
 --
 kernel/bpf/map_iter.c=100=static int bpf_iter_attach_map(struct bpf_prog *prog,
 --
 kernel/bpf/map_iter.c-111-
 kernel/bpf/map_iter.c:112:	map = bpf_map_get_with_uref(linfo->map.map_fd);
 kernel/bpf/map_iter.c-113-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=497=static void bpf_map_release_memcg(struct bpf_map *map)
 --
 kernel/bpf/syscall.c-502-
 kernel/bpf/syscall.c:503:static struct mem_cgroup *bpf_map_get_memcg(const struct bpf_map *map)
 kernel/bpf/syscall.c-504-{
 --
 kernel/bpf/syscall.c=511=void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg,
 --
 kernel/bpf/syscall.c-513-{
 kernel/bpf/syscall.c:514:	*new_memcg = bpf_map_get_memcg(map);
 kernel/bpf/syscall.c-515-	*old_memcg = set_active_memcg(*new_memcg);
 --
 kernel/bpf/syscall.c=1625=EXPORT_SYMBOL_GPL(bpf_map_inc_with_uref);
 kernel/bpf/syscall.c-1626-
 kernel/bpf/syscall.c:1627:struct bpf_map *bpf_map_get(u32 ufd)
 kernel/bpf/syscall.c-1628-{
 kernel/bpf/syscall.c-1629-	CLASS(fd, f)(ufd);
 kernel/bpf/syscall.c:1630:	struct bpf_map *map = __bpf_map_get(f);
 kernel/bpf/syscall.c-1631-
 --
 kernel/bpf/syscall.c-1636-}
 kernel/bpf/syscall.c:1637:EXPORT_SYMBOL_NS(bpf_map_get, "BPF_INTERNAL");
 kernel/bpf/syscall.c-1638-
 kernel/bpf/syscall.c:1639:struct bpf_map *bpf_map_get_with_uref(u32 ufd)
 kernel/bpf/syscall.c-1640-{
 kernel/bpf/syscall.c-1641-	CLASS(fd, f)(ufd);
 kernel/bpf/syscall.c:1642:	struct bpf_map *map = __bpf_map_get(f);
 kernel/bpf/syscall.c-1643-
 --
 kernel/bpf/syscall.c=1704=static int map_lookup_elem(union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-1716-	CLASS(fd, f)(attr->map_fd);
 kernel/bpf/syscall.c:1717:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-1718-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=1766=static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr)
 --
 kernel/bpf/syscall.c-1778-	CLASS(fd, f)(attr->map_fd);
 kernel/bpf/syscall.c:1779:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-1780-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=1819=static int map_delete_elem(union bpf_attr *attr, bpfptr_t uattr)
 --
 kernel/bpf/syscall.c-1829-	CLASS(fd, f)(attr->map_fd);
 kernel/bpf/syscall.c:1830:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-1831-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=1872=static int map_get_next_key(union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-1883-	CLASS(fd, f)(attr->map_fd);
 kernel/bpf/syscall.c:1884:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-1885-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=2135=static int map_lookup_and_delete_elem(union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-2150-	CLASS(fd, f)(attr->map_fd);
 kernel/bpf/syscall.c:2151:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-2152-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=2226=static int map_freeze(const union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-2234-	CLASS(fd, f)(attr->map_fd);
 kernel/bpf/syscall.c:2235:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-2236-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=4750=static int bpf_obj_get_next_id(const union bpf_attr *attr,
 --
 kernel/bpf/syscall.c-4775-
 kernel/bpf/syscall.c:4776:struct bpf_map *bpf_map_get_curr_or_next(u32 *id)
 kernel/bpf/syscall.c-4777-{
 --
 kernel/bpf/syscall.c=4833=static int bpf_prog_get_fd_by_id(const union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-4857-
 kernel/bpf/syscall.c:4858:static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
 kernel/bpf/syscall.c-4859-{
 --
 kernel/bpf/syscall.c=5011=static int bpf_prog_get_info_by_fd(struct file *file,
 --
 kernel/bpf/syscall.c-5299-
 kernel/bpf/syscall.c:5300:static int bpf_map_get_info_by_fd(struct file *file,
 kernel/bpf/syscall.c-5301-				  struct bpf_map *map,
 --
 kernel/bpf/syscall.c=5443=static int bpf_obj_get_info_by_fd(const union bpf_attr *attr,
 --
 kernel/bpf/syscall.c-5456-	else if (fd_file(f)->f_op == &bpf_map_fops)
 kernel/bpf/syscall.c:5457:		return bpf_map_get_info_by_fd(fd_file(f), fd_file(f)->private_data, attr,
 kernel/bpf/syscall.c-5458-					     uattr);
 --
 kernel/bpf/syscall.c=5655=static int bpf_map_do_batch(const union bpf_attr *attr,
 --
 kernel/bpf/syscall.c-5669-
 kernel/bpf/syscall.c:5670:	map = __bpf_map_get(f);
 kernel/bpf/syscall.c-5671-	if (IS_ERR(map))
 --
 kernel/bpf/syscall.c=5805=static int link_update_map(struct bpf_link *link, union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-5809-
 kernel/bpf/syscall.c:5810:	new_map = bpf_map_get(attr->link_update.new_map_fd);
 kernel/bpf/syscall.c-5811-	if (IS_ERR(new_map))
 --
 kernel/bpf/syscall.c-5814-	if (attr->link_update.flags & BPF_F_REPLACE) {
 kernel/bpf/syscall.c:5815:		old_map = bpf_map_get(attr->link_update.old_map_fd);
 kernel/bpf/syscall.c-5816-		if (IS_ERR(old_map)) {
 --
 kernel/bpf/syscall.c=6066=static int bpf_prog_bind_map(union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-6082-
 kernel/bpf/syscall.c:6083:	map = bpf_map_get(attr->prog_bind_map.map_fd);
 kernel/bpf/syscall.c-6084-	if (IS_ERR(map)) {
 --
 kernel/bpf/syscall.c=6168=static int prog_assoc_struct_ops(union bpf_attr *attr)
 --
 kernel/bpf/syscall.c-6188-
 kernel/bpf/syscall.c:6189:	map = bpf_map_get(attr->prog_assoc_struct_ops.map_fd);
 kernel/bpf/syscall.c-6190-	if (IS_ERR(map)) {
 --
 kernel/bpf/syscall.c=6209=static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size)
 --
 kernel/bpf/syscall.c-6283-	case BPF_MAP_GET_FD_BY_ID:
 kernel/bpf/syscall.c:6284:		err = bpf_map_get_fd_by_id(&attr);
 kernel/bpf/syscall.c-6285-		break;
 --
 kernel/bpf/verifier.c=18210=static int add_used_map(struct bpf_verifier_env *env, int fd)
 --
 kernel/bpf/verifier.c-18214-
 kernel/bpf/verifier.c:18215:	map = __bpf_map_get(f);
 kernel/bpf/verifier.c-18216-	if (IS_ERR(map)) {
 --
 kernel/bpf/verifier.c=19635=static int add_fd_from_fd_array(struct bpf_verifier_env *env, int fd)
 --
 kernel/bpf/verifier.c-19641-
 kernel/bpf/verifier.c:19642:	map = __bpf_map_get(f);
 kernel/bpf/verifier.c-19643-	if (!IS_ERR(map)) {
 --
 net/core/bpf_sk_storage.c=480=bpf_sk_storage_diag_alloc(const struct nlattr *nla_stgs)
 --
 net/core/bpf_sk_storage.c-506-		int map_fd = nla_get_u32(nla);
 net/core/bpf_sk_storage.c:507:		struct bpf_map *map = bpf_map_get(map_fd);
 net/core/bpf_sk_storage.c-508-
 --
 net/core/bpf_sk_storage.c=851=static int bpf_iter_attach_map(struct bpf_prog *prog,
 --
 net/core/bpf_sk_storage.c-860-
 net/core/bpf_sk_storage.c:861:	map = bpf_map_get_with_uref(linfo->map.map_fd);
 net/core/bpf_sk_storage.c-862-	if (IS_ERR(map))
 --
 net/core/sock_map.c=68=int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog)
 --
 net/core/sock_map.c-76-	CLASS(fd, f)(attr->target_fd);
 net/core/sock_map.c:77:	map = __bpf_map_get(f);
 net/core/sock_map.c-78-	if (IS_ERR(map))
 --
 net/core/sock_map.c=86=int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype)
 --
 net/core/sock_map.c-95-	CLASS(fd, f)(attr->target_fd);
 net/core/sock_map.c:96:	map = __bpf_map_get(f);
 net/core/sock_map.c-97-	if (IS_ERR(map))
 --
 net/core/sock_map.c=1555=int sock_map_bpf_prog_query(const union bpf_attr *attr,
 --
 net/core/sock_map.c-1569-	CLASS(fd, f)(attr->target_fd);
 net/core/sock_map.c:1570:	map = __bpf_map_get(f);
 net/core/sock_map.c-1571-	if (IS_ERR(map))
 --
 net/core/sock_map.c=1853=int sock_map_link_create(const union bpf_attr *attr, struct bpf_prog *prog)
 --
 net/core/sock_map.c-1863-
 net/core/sock_map.c:1864:	map = bpf_map_get_with_uref(attr->link_create.target_fd);
 net/core/sock_map.c-1865-	if (IS_ERR(map))
 --
 net/core/sock_map.c=1913=static int sock_map_iter_attach_target(struct bpf_prog *prog,
 --
 net/core/sock_map.c-1922-
 net/core/sock_map.c:1923:	map = bpf_map_get_with_uref(linfo->map.map_fd);
 net/core/sock_map.c-1924-	if (IS_ERR(map))
 --
 samples/bpf/cookie_uid_helper_example.c=196=static void print_table(void)
 --
 samples/bpf/cookie_uid_helper_example.c-202-
 samples/bpf/cookie_uid_helper_example.c:203:	while (bpf_map_get_next_key(map_fd, &curN, &nextN) > -1) {
 samples/bpf/cookie_uid_helper_example.c-204-		curN = nextN;
 --
 samples/bpf/lwt_len_hist_user.c=29=int main(int argc, char **argv)
 --
 samples/bpf/lwt_len_hist_user.c-44-
 samples/bpf/lwt_len_hist_user.c:45:	while (bpf_map_get_next_key(map_fd, &key, &next_key) == 0) {
 samples/bpf/lwt_len_hist_user.c-46-		if (next_key >= MAX_INDEX) {
 --
 samples/bpf/offwaketime_user.c=77=static void print_stacks(int fd)
 --
 samples/bpf/offwaketime_user.c-81-
 samples/bpf/offwaketime_user.c:82:	while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
 samples/bpf/offwaketime_user.c-83-		bpf_map_lookup_elem(fd, &next_key, &value);
 --
 samples/bpf/sampleip_user.c=89=static void print_ip_map(int fd)
 --
 samples/bpf/sampleip_user.c-99-	key = 0, i = 0;
 samples/bpf/sampleip_user.c:100:	while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
 samples/bpf/sampleip_user.c-101-		bpf_map_lookup_elem(fd, &next_key, &value);
 --
 samples/bpf/sockex2_user.c=16=int main(int ac, char **argv)
 --
 samples/bpf/sockex2_user.c-51-
 samples/bpf/sockex2_user.c:52:		while (bpf_map_get_next_key(map_fd, &key, &next_key) == 0) {
 samples/bpf/sockex2_user.c-53-			bpf_map_lookup_elem(map_fd, &next_key, &value);
 --
 samples/bpf/sockex3_user.c=25=int main(int argc, char **argv)
 --
 samples/bpf/sockex3_user.c-84-		printf("IP     src.port -> dst.port               bytes      packets\n");
 samples/bpf/sockex3_user.c:85:		while (bpf_map_get_next_key(hash_map_fd, &key, &next_key) == 0) {
 samples/bpf/sockex3_user.c-86-			bpf_map_lookup_elem(hash_map_fd, &next_key, &value);
 --
 samples/bpf/spintest_user.c=10=int main(int ac, char **argv)
 --
 samples/bpf/spintest_user.c-57-		printf("kprobing funcs:");
 samples/bpf/spintest_user.c:58:		while (bpf_map_get_next_key(map_fd, &key, &next_key) == 0) {
 samples/bpf/spintest_user.c-59-			bpf_map_lookup_elem(map_fd, &next_key, &value);
 --
 samples/bpf/spintest_user.c-72-		key = 0;
 samples/bpf/spintest_user.c:73:		while (bpf_map_get_next_key(map_fd, &key, &next_key) == 0)
 samples/bpf/spintest_user.c-74-			bpf_map_delete_elem(map_fd, &next_key);
 --
 samples/bpf/test_map_in_map_user.c=35=static void check_map_id(int inner_map_fd, int map_in_map_fd, uint32_t key)
 --
 samples/bpf/test_map_in_map_user.c-40-
 samples/bpf/test_map_in_map_user.c:41:	ret = bpf_map_get_info_by_fd(inner_map_fd, &info, &info_len);
 samples/bpf/test_map_in_map_user.c-42-	assert(!ret);
 --
 samples/bpf/trace_event_user.c=100=static void print_stacks(void)
 --
 samples/bpf/trace_event_user.c-107-	sys_read_seen = sys_write_seen = false;
 samples/bpf/trace_event_user.c:108:	while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
 samples/bpf/trace_event_user.c-109-		bpf_map_lookup_elem(fd, &next_key, &value);
 --
 samples/bpf/trace_event_user.c-120-	/* clear stack map */
 samples/bpf/trace_event_user.c:121:	while (bpf_map_get_next_key(stack_map, &stackid, &next_id) == 0) {
 samples/bpf/trace_event_user.c-122-		bpf_map_delete_elem(stack_map, &next_id);
 --
 samples/bpf/tracex4_user.c=28=static void print_old_objects(int fd)
 --
 samples/bpf/tracex4_user.c-36-	key = -1;
 samples/bpf/tracex4_user.c:37:	while (bpf_map_get_next_key(fd, &key, &next_key) == 0) {
 samples/bpf/tracex4_user.c-38-		bpf_map_lookup_elem(fd, &next_key, &v);
 --
 samples/bpf/tracex6_user.c=25=static void check_on_cpu(int cpu, struct perf_event_attr *attr)
 --
 samples/bpf/tracex6_user.c-45-	/* Trigger the kprobe */
 samples/bpf/tracex6_user.c:46:	bpf_map_get_next_key(map_fd[1], &cpu, NULL);
 samples/bpf/tracex6_user.c-47-	/* Check the value */
 --
 tools/bpf/bpftool/btf.c=1210=build_btf_type_table(struct hashmap *tab, enum bpf_obj_type type,
 --
 tools/bpf/bpftool/btf.c-1230-		case BPF_OBJ_MAP:
 tools/bpf/bpftool/btf.c:1231:			err = bpf_map_get_next_id(id, &id);
 tools/bpf/bpftool/btf.c-1232-			break;
 --
 tools/bpf/bpftool/btf.c-1253-		case BPF_OBJ_MAP:
 tools/bpf/bpftool/btf.c:1254:			fd = bpf_map_get_fd_by_id_opts(id, &opts_ro);
 tools/bpf/bpftool/btf.c-1255-			break;
 --
 tools/bpf/bpftool/btf.c-1273-		else
 tools/bpf/bpftool/btf.c:1274:			err = bpf_map_get_info_by_fd(fd, info, len);
 tools/bpf/bpftool/btf.c-1275-		close(fd);
 --
 tools/bpf/bpftool/common.c=973=static int map_fd_by_name(char *name, int **fds,
 --
 tools/bpf/bpftool/common.c-985-
 tools/bpf/bpftool/common.c:986:		err = bpf_map_get_next_id(id, &id);
 tools/bpf/bpftool/common.c-987-		if (err) {
 --
 tools/bpf/bpftool/common.c-996-		opts_ro.open_flags = BPF_F_RDONLY;
 tools/bpf/bpftool/common.c:997:		fd = bpf_map_get_fd_by_id_opts(id, &opts_ro);
 tools/bpf/bpftool/common.c-998-		if (fd < 0) {
 --
 tools/bpf/bpftool/common.c-1003-
 tools/bpf/bpftool/common.c:1004:		err = bpf_map_get_info_by_fd(fd, &info, &len);
 tools/bpf/bpftool/common.c-1005-		if (err) {
 --
 tools/bpf/bpftool/common.c-1020-			close(fd);
 tools/bpf/bpftool/common.c:1021:			fd = bpf_map_get_fd_by_id_opts(id, opts);
 tools/bpf/bpftool/common.c-1022-			if (fd < 0) {
 --
 tools/bpf/bpftool/common.c=1048=int map_parse_fds(int *argc, char ***argv, int **fds, __u32 open_flags)
 --
 tools/bpf/bpftool/common.c-1067-
 tools/bpf/bpftool/common.c:1068:		(*fds)[0] = bpf_map_get_fd_by_id_opts(id, &opts);
 tools/bpf/bpftool/common.c-1069-		if ((*fds)[0] < 0) {
 --
 tools/bpf/bpftool/common.c=1134=int map_parse_fd_and_info(int *argc, char ***argv, struct bpf_map_info *info,
 --
 tools/bpf/bpftool/common.c-1143-
 tools/bpf/bpftool/common.c:1144:	err = bpf_map_get_info_by_fd(fd, info, info_len);
 tools/bpf/bpftool/common.c-1145-	if (err) {
 --
 tools/bpf/bpftool/map.c=629=static int do_show_subset(int argc, char **argv)
 --
 tools/bpf/bpftool/map.c-648-	for (i = 0; i < nb_fds; i++) {
 tools/bpf/bpftool/map.c:649:		err = bpf_map_get_info_by_fd(fds[i], &info, &len);
 tools/bpf/bpftool/map.c-650-		if (err) {
 --
 tools/bpf/bpftool/map.c=673=static int do_show(int argc, char **argv)
 --
 tools/bpf/bpftool/map.c-703-	while (true) {
 tools/bpf/bpftool/map.c:704:		err = bpf_map_get_next_id(id, &id);
 tools/bpf/bpftool/map.c-705-		if (err) {
 --
 tools/bpf/bpftool/map.c-712-
 tools/bpf/bpftool/map.c:713:		fd = bpf_map_get_fd_by_id_opts(id, &opts);
 tools/bpf/bpftool/map.c-714-		if (fd < 0) {
 --
 tools/bpf/bpftool/map.c-721-
 tools/bpf/bpftool/map.c:722:		err = bpf_map_get_info_by_fd(fd, &info, &len);
 tools/bpf/bpftool/map.c-723-		if (err) {
 --
 tools/bpf/bpftool/map.c=771=static int maps_have_btf(int *fds, int nb_fds)
 --
 tools/bpf/bpftool/map.c-777-	for (i = 0; i < nb_fds; i++) {
 tools/bpf/bpftool/map.c:778:		err = bpf_map_get_info_by_fd(fds[i], &info, &len);
 tools/bpf/bpftool/map.c-779-		if (err) {
 --
 tools/bpf/bpftool/map.c=826=map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 --
 tools/bpf/bpftool/map.c-868-	while (true) {
 tools/bpf/bpftool/map.c:869:		err = bpf_map_get_next_key(fd, prev_key, key);
 tools/bpf/bpftool/map.c-870-		if (err) {
 --
 tools/bpf/bpftool/map.c=898=static int do_dump(int argc, char **argv)
 --
 tools/bpf/bpftool/map.c-938-	for (i = 0; i < nb_fds; i++) {
 tools/bpf/bpftool/map.c:939:		if (bpf_map_get_info_by_fd(fds[i], &info, &len)) {
 tools/bpf/bpftool/map.c-940-			p_err("can't get map info: %s", strerror(errno));
 --
 tools/bpf/bpftool/map.c=1123=static int do_getnext(int argc, char **argv)
 --
 tools/bpf/bpftool/map.c-1155-
 tools/bpf/bpftool/map.c:1156:	err = bpf_map_get_next_key(fd, key, nextkey);
 tools/bpf/bpftool/map.c-1157-	if (err) {
 --
 tools/bpf/bpftool/prog.c=220=static void *find_metadata(int prog_fd, struct bpf_map_info *map_info)
 --
 tools/bpf/bpftool/prog.c-256-	for (i = 0; i < prog_info.nr_map_ids; i++) {
 tools/bpf/bpftool/prog.c:257:		map_fd = bpf_map_get_fd_by_id(map_ids[i]);
 tools/bpf/bpftool/prog.c-258-		if (map_fd < 0)
 --
 tools/bpf/bpftool/prog.c-262-		map_info_len = sizeof(*map_info);
 tools/bpf/bpftool/prog.c:263:		ret = bpf_map_get_info_by_fd(map_fd, map_info, &map_info_len);
 tools/bpf/bpftool/prog.c-264-		if (ret < 0) {
 --
 tools/bpf/bpftool/struct_ops.c=130=static int get_next_struct_ops_map(const char *name, int *res_fd,
 --
 tools/bpf/bpftool/struct_ops.c-136-	while (true) {
 tools/bpf/bpftool/struct_ops.c:137:		err = bpf_map_get_next_id(id, &id);
 tools/bpf/bpftool/struct_ops.c-138-		if (err) {
 --
 tools/bpf/bpftool/struct_ops.c-144-
 tools/bpf/bpftool/struct_ops.c:145:		fd = bpf_map_get_fd_by_id(id);
 tools/bpf/bpftool/struct_ops.c-146-		if (fd < 0) {
 --
 tools/bpf/bpftool/struct_ops.c-153-
 tools/bpf/bpftool/struct_ops.c:154:		err = bpf_map_get_info_by_fd(fd, info, &info_len);
 tools/bpf/bpftool/struct_ops.c-155-		if (err) {
 --
 tools/bpf/bpftool/struct_ops.c=235=static struct res do_one_id(const char *id_str, work_func func, void *data,
 --
 tools/bpf/bpftool/struct_ops.c-251-
 tools/bpf/bpftool/struct_ops.c:252:	fd = bpf_map_get_fd_by_id(id);
 tools/bpf/bpftool/struct_ops.c-253-	if (fd < 0) {
]
]

gemini-3.1-pro-preview

							input: 190492
							output: 45
							thoughts: 158
						

**BPF Verification Puzzles**

Okay, so I'm trying to wrap my head around this BPF verification process. I was under the impression that `bpf_prog_load` would fail if `ringbuf_map_fd` was set to `-1` under certain circumstances, but I'm questioning that now. Does the verifier only flag errors based on executed instructions? No, that's not right. The verifier, `bpf_check`, examines *all* instructions.

Right, I'm remembering `bpf_insn_map_fd_t`. The immediate value, `imm`, *is* supposed to hold the file descriptor. So, if `imm` is `-1`, then `replace_map_fd_with_map_ptr` in `bpf_check` should fail, shouldn't it? That makes sense.

Aha! `replace_map_fd_with_map_ptr` is defined within `kernel/bpf/verifier.c`. Let's dig deeper. The critical piece here is the `resolve_pseudo_ldimm64` function, also in that file. That's the likely key area to examine. Gotta understand how it handles the `-1` file descriptor and potential failures.

log-in to see details

map[ContextFile:kernel/bpf/verifier.c IncludeLines:true Name:resolve_pseudo_ldimm64]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 190986
							output: 22
							thoughts: 15
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating `resolve_pseudo_ldimm64`**

Right, let's get down to brass tacks. My initial thought is to zero in on `resolve_pseudo_ldimm64`. It's a common pattern, and I've likely encountered it countless times, so it's a good place to start my investigation. It has all the hallmarks of something I've dealt with before, so I feel I can apply my expertise to determine a starting point to diagnose the issue. There could be any number of reasons why I'm prompted to search this way, but this is the appropriate first line of investigation. Let's see what the code reveals.

log-in to see details

map[Expression:resolve_pseudo_ldimm64]

map[Output:]

gemini-3.1-pro-preview

							input: 191198
							output: 24
							thoughts: 37
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating Potential BPF Verifier Weakness**

Right, let's get down to brass tacks. I need to dive into the BPF verifier in the kernel. My immediate focus is on potential vulnerabilities or interesting behaviors related to `pseudo_ldimm64` and, more generally, `BPF_PSEUDO_MAP_FD`. I suspect these might be key areas to examine for unintended side effects or, let's say, *creative* uses. Specifically, `kernel/bpf/verifier.c` is the obvious place to start digging. That file is the heart of the verifier, so it'll have the crucial logic. I'm thinking specifically about how these pseudo-instructions and map file descriptors interact with the control flow and data validation checks. I want to see how the verifier handles them; does it account for all possible edge cases and combinations? Does it properly track and restrict their uses? It's a hunch, but these often-overlooked components are where the juiciest issues are. My hope is to discover something new, a gap in the armor.

map[Expression:BPF_PSEUDO_MAP_FD]

map[Output:drivers/net/ethernet/netronome/nfp/bpf/jit.c=4401=static int nfp_bpf_replace_map_ptrs(struct nfp_prog *nfp_prog)
--
drivers/net/ethernet/netronome/nfp/bpf/jit.c-4413-		if (meta1->insn.code != (BPF_LD | BPF_IMM | BPF_DW) ||
drivers/net/ethernet/netronome/nfp/bpf/jit.c:4414:		    meta1->insn.src_reg != BPF_PSEUDO_MAP_FD)
drivers/net/ethernet/netronome/nfp/bpf/jit.c-4415-			continue;
--
include/linux/filter.h=258=static inline bool insn_is_cast_user(const struct bpf_insn *insn)
--
include/linux/filter.h-284-#define BPF_LD_MAP_FD(DST, MAP_FD)				\
include/linux/filter.h:285:	BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD)
include/linux/filter.h-286-
--
include/uapi/linux/bpf.h=1323=enum {
--
include/uapi/linux/bpf.h-1342- */
include/uapi/linux/bpf.h:1343:#define BPF_PSEUDO_MAP_FD	1
include/uapi/linux/bpf.h-1344-#define BPF_PSEUDO_MAP_IDX	5
--
kernel/bpf/const_fold.c=50=static void const_reg_xfer(struct bpf_verifier_env *env, struct const_arg_info *ci_out,
--
kernel/bpf/const_fold.c-153-			dst->val = env->insn_aux_data[idx].map_off;
kernel/bpf/const_fold.c:154:		} else if (insn->src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/const_fold.c-155-			   insn->src_reg == BPF_PSEUDO_MAP_IDX) {
--
kernel/bpf/core.c=300=int bpf_prog_calc_tag(struct bpf_prog *fp)
--
kernel/bpf/core.c-317-		    dst[i].code == (BPF_LD | BPF_IMM | BPF_DW) &&
kernel/bpf/core.c:318:		    (dst[i].src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/core.c-319-		     dst[i].src_reg == BPF_PSEUDO_MAP_VALUE)) {
--
kernel/bpf/disasm.c=186=void print_bpf_insn(const struct bpf_insn_cbs *cbs,
--
kernel/bpf/disasm.c-324-			u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
kernel/bpf/disasm.c:325:			bool is_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/disasm.c-326-				      insn->src_reg == BPF_PSEUDO_MAP_VALUE;
--
kernel/bpf/syscall.c=4894=static const struct bpf_map *bpf_map_from_imm(const struct bpf_prog *prog,
--
kernel/bpf/syscall.c-4904-		if (map == (void *)addr) {
kernel/bpf/syscall.c:4905:			*type = BPF_PSEUDO_MAP_FD;
kernel/bpf/syscall.c-4906-			goto out;
--
kernel/bpf/verifier.c=16524=static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
--
kernel/bpf/verifier.c-16606-		/* We want reg->id to be same (0) as map_value is not distinct */
kernel/bpf/verifier.c:16607:	} else if (insn->src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/verifier.c-16608-		   insn->src_reg == BPF_PSEUDO_MAP_IDX) {
--
kernel/bpf/verifier.c=18416=static int check_and_resolve_insns(struct bpf_verifier_env *env)
--
kernel/bpf/verifier.c-18478-				break;
kernel/bpf/verifier.c:18479:			case BPF_PSEUDO_MAP_FD:
kernel/bpf/verifier.c-18480-			case BPF_PSEUDO_MAP_IDX:
--
kernel/bpf/verifier.c-18513-
kernel/bpf/verifier.c:18514:			if (insn[0].src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/verifier.c-18515-			    insn[0].src_reg == BPF_PSEUDO_MAP_IDX) {
--
samples/bpf/bpf_insn.h=6=struct bpf_insn;
--
samples/bpf/bpf_insn.h-97-
samples/bpf/bpf_insn.h:98:#ifndef BPF_PSEUDO_MAP_FD
samples/bpf/bpf_insn.h:99:# define BPF_PSEUDO_MAP_FD	1
samples/bpf/bpf_insn.h-100-#endif
--
samples/bpf/bpf_insn.h-103-#define BPF_LD_MAP_FD(DST, MAP_FD)				\
samples/bpf/bpf_insn.h:104:	BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD)
samples/bpf/bpf_insn.h-105-
--
tools/bpf/bpftool/xlated_dumper.c=194=static const char *print_imm(void *private_data,
--
tools/bpf/bpftool/xlated_dumper.c-199-
tools/bpf/bpftool/xlated_dumper.c:200:	if (insn->src_reg == BPF_PSEUDO_MAP_FD)
tools/bpf/bpftool/xlated_dumper.c-201-		snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
--
tools/include/linux/filter.h-341-#define BPF_LD_MAP_FD(DST, MAP_FD)				\
tools/include/linux/filter.h:342:	BPF_LD_IMM64_RAW_FULL(DST, BPF_PSEUDO_MAP_FD, 0, 0,	\
tools/include/linux/filter.h-343-			      MAP_FD, 0)
--
tools/include/uapi/linux/bpf.h=1323=enum {
--
tools/include/uapi/linux/bpf.h-1342- */
tools/include/uapi/linux/bpf.h:1343:#define BPF_PSEUDO_MAP_FD	1
tools/include/uapi/linux/bpf.h-1344-#define BPF_PSEUDO_MAP_IDX	5
--
tools/lib/bpf/libbpf.c=4572=static int bpf_prog_compute_hash(struct bpf_program *prog)
--
tools/lib/bpf/libbpf.c-4586-		if (purged[i].code == (BPF_LD | BPF_IMM | BPF_DW) &&
tools/lib/bpf/libbpf.c:4587:		    (purged[i].src_reg == BPF_PSEUDO_MAP_FD ||
tools/lib/bpf/libbpf.c-4588-		     purged[i].src_reg == BPF_PSEUDO_MAP_VALUE)) {
--
tools/lib/bpf/libbpf.c=6411=bpf_object__relocate_data(struct bpf_object *obj, struct bpf_program *prog)
--
tools/lib/bpf/libbpf.c-6427-			} else if (map->autocreate) {
tools/lib/bpf/libbpf.c:6428:				insn[0].src_reg = BPF_PSEUDO_MAP_FD;
tools/lib/bpf/libbpf.c-6429-				insn[0].imm = map->fd;
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c=73=__naked void invalid_cgroup_storage_access_2(void)
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-83-	: __imm(bpf_get_local_storage),
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c:84:	  __imm_insn(ld_map_fd, BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 1))
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-85-	: __clobber_all);
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c=212=__naked void cpu_cgroup_storage_access_2(void)
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-222-	: __imm(bpf_get_local_storage),
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c:223:	  __imm_insn(ld_map_fd, BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 1))
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-224-	: __clobber_all);
--
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c=20=__naked void map_fd_for_function_call(void)
--
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c-32-	: __imm(bpf_map_delete_elem),
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c:33:	  __imm_insn(ld_map_fd, BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0))
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c-34-	: __clobber_all);
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-310-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:311:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
tools/testing/selftests/bpf/verifier/direct_value_access.c-312-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-321-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:322:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
tools/testing/selftests/bpf/verifier/direct_value_access.c-323-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-332-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:333:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
tools/testing/selftests/bpf/verifier/direct_value_access.c-334-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-343-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:344:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
tools/testing/selftests/bpf/verifier/direct_value_access.c-345-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/ld_imm64.c-138-	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_1,
tools/testing/selftests/bpf/verifier/ld_imm64.c:139:		     BPF_PSEUDO_MAP_FD, 0, 0),
tools/testing/selftests/bpf/verifier/ld_imm64.c-140-	BPF_RAW_INSN(0, 0, 0, 0, 0xfefefe),
]

gemini-3.1-pro-preview

							input: 195232
							output: 48
							thoughts: 307
						

**Analyzing the BPF Instruction**

Okay, first things first, I need to confirm that `BPF_PSEUDO_MAP_FD` is indeed assigned the value 1. Now, let's dive into the reproducer's `insn1`. Examining the instruction directly:

```c
//                insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], ringbuf_map_fd] {
//                  code: const = 0x18 (1 bytes)
//                  dst: const = 0x1 (0 bytes)
//                  src: const = 0x1 (1 bytes)
//                  off: const = 0x0 (2 bytes)
//                  imm: ringbuf_map_fd (resource)
//                  code2: const = 0x0 (1 bytes)
//                  regs2: const = 0x0 (1 bytes)
//                  off2: const = 0x0 (2 bytes)
//                  imm2: const = 0x0 (4 bytes)
//                }
```

Okay, the crucial part here is that `src` is set to 1. Which, as I've confirmed, corresponds to `BPF_PSEUDO_MAP_FD`.  Also, and this is important, `imm` is -1. This means, the `bpf_check` function will subsequently call the `replace_map_fd_with_map_ptr` function. Now, I need to check the logic behind that function. Time to consult `kernel/bpf/verifier.c`.

log-in to see details

map[ContextFile:kernel/bpf/verifier.c IncludeLines:true Name:replace_map_fd_with_map_ptr]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 195969
							output: 24
							thoughts: 28
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Diving into BPF Verification for Pseudo-Map File Descriptors**

Alright, time to dig into the BPF verifier's handling of pseudo-map file descriptors. Specifically, I need to understand how the `BPF_PSEUDO_MAP_FD` pseudo-instruction is evaluated within the `kernel/bpf/verifier.c` file. I'm assuming there's some interesting logic there regarding how these special file descriptors are treated during program verification. I expect to see the usual checks on map types, access permissions, bounds, and potentially some unique verification rules given the pseudo-nature of this FD. Probably something to do with sanitizing the file descriptor early, and making sure that all subsequent accesses are valid. I'll need to pay close attention to the data flow analysis surrounding any uses of that pseudo-instruction to understand if there are any potential vulnerabilities or nuances in its implementation that could be exploited. Let's see what the code reveals.

map[Expression:BPF_PSEUDO_MAP_FD]

map[Output:drivers/net/ethernet/netronome/nfp/bpf/jit.c=4401=static int nfp_bpf_replace_map_ptrs(struct nfp_prog *nfp_prog)
--
drivers/net/ethernet/netronome/nfp/bpf/jit.c-4413-		if (meta1->insn.code != (BPF_LD | BPF_IMM | BPF_DW) ||
drivers/net/ethernet/netronome/nfp/bpf/jit.c:4414:		    meta1->insn.src_reg != BPF_PSEUDO_MAP_FD)
drivers/net/ethernet/netronome/nfp/bpf/jit.c-4415-			continue;
--
include/linux/filter.h=258=static inline bool insn_is_cast_user(const struct bpf_insn *insn)
--
include/linux/filter.h-284-#define BPF_LD_MAP_FD(DST, MAP_FD)				\
include/linux/filter.h:285:	BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD)
include/linux/filter.h-286-
--
include/uapi/linux/bpf.h=1323=enum {
--
include/uapi/linux/bpf.h-1342- */
include/uapi/linux/bpf.h:1343:#define BPF_PSEUDO_MAP_FD	1
include/uapi/linux/bpf.h-1344-#define BPF_PSEUDO_MAP_IDX	5
--
kernel/bpf/const_fold.c=50=static void const_reg_xfer(struct bpf_verifier_env *env, struct const_arg_info *ci_out,
--
kernel/bpf/const_fold.c-153-			dst->val = env->insn_aux_data[idx].map_off;
kernel/bpf/const_fold.c:154:		} else if (insn->src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/const_fold.c-155-			   insn->src_reg == BPF_PSEUDO_MAP_IDX) {
--
kernel/bpf/core.c=300=int bpf_prog_calc_tag(struct bpf_prog *fp)
--
kernel/bpf/core.c-317-		    dst[i].code == (BPF_LD | BPF_IMM | BPF_DW) &&
kernel/bpf/core.c:318:		    (dst[i].src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/core.c-319-		     dst[i].src_reg == BPF_PSEUDO_MAP_VALUE)) {
--
kernel/bpf/disasm.c=186=void print_bpf_insn(const struct bpf_insn_cbs *cbs,
--
kernel/bpf/disasm.c-324-			u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
kernel/bpf/disasm.c:325:			bool is_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/disasm.c-326-				      insn->src_reg == BPF_PSEUDO_MAP_VALUE;
--
kernel/bpf/syscall.c=4894=static const struct bpf_map *bpf_map_from_imm(const struct bpf_prog *prog,
--
kernel/bpf/syscall.c-4904-		if (map == (void *)addr) {
kernel/bpf/syscall.c:4905:			*type = BPF_PSEUDO_MAP_FD;
kernel/bpf/syscall.c-4906-			goto out;
--
kernel/bpf/verifier.c=16524=static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
--
kernel/bpf/verifier.c-16606-		/* We want reg->id to be same (0) as map_value is not distinct */
kernel/bpf/verifier.c:16607:	} else if (insn->src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/verifier.c-16608-		   insn->src_reg == BPF_PSEUDO_MAP_IDX) {
--
kernel/bpf/verifier.c=18416=static int check_and_resolve_insns(struct bpf_verifier_env *env)
--
kernel/bpf/verifier.c-18478-				break;
kernel/bpf/verifier.c:18479:			case BPF_PSEUDO_MAP_FD:
kernel/bpf/verifier.c-18480-			case BPF_PSEUDO_MAP_IDX:
--
kernel/bpf/verifier.c-18513-
kernel/bpf/verifier.c:18514:			if (insn[0].src_reg == BPF_PSEUDO_MAP_FD ||
kernel/bpf/verifier.c-18515-			    insn[0].src_reg == BPF_PSEUDO_MAP_IDX) {
--
samples/bpf/bpf_insn.h=6=struct bpf_insn;
--
samples/bpf/bpf_insn.h-97-
samples/bpf/bpf_insn.h:98:#ifndef BPF_PSEUDO_MAP_FD
samples/bpf/bpf_insn.h:99:# define BPF_PSEUDO_MAP_FD	1
samples/bpf/bpf_insn.h-100-#endif
--
samples/bpf/bpf_insn.h-103-#define BPF_LD_MAP_FD(DST, MAP_FD)				\
samples/bpf/bpf_insn.h:104:	BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD)
samples/bpf/bpf_insn.h-105-
--
tools/bpf/bpftool/xlated_dumper.c=194=static const char *print_imm(void *private_data,
--
tools/bpf/bpftool/xlated_dumper.c-199-
tools/bpf/bpftool/xlated_dumper.c:200:	if (insn->src_reg == BPF_PSEUDO_MAP_FD)
tools/bpf/bpftool/xlated_dumper.c-201-		snprintf(dd->scratch_buff, sizeof(dd->scratch_buff),
--
tools/include/linux/filter.h-341-#define BPF_LD_MAP_FD(DST, MAP_FD)				\
tools/include/linux/filter.h:342:	BPF_LD_IMM64_RAW_FULL(DST, BPF_PSEUDO_MAP_FD, 0, 0,	\
tools/include/linux/filter.h-343-			      MAP_FD, 0)
--
tools/include/uapi/linux/bpf.h=1323=enum {
--
tools/include/uapi/linux/bpf.h-1342- */
tools/include/uapi/linux/bpf.h:1343:#define BPF_PSEUDO_MAP_FD	1
tools/include/uapi/linux/bpf.h-1344-#define BPF_PSEUDO_MAP_IDX	5
--
tools/lib/bpf/libbpf.c=4572=static int bpf_prog_compute_hash(struct bpf_program *prog)
--
tools/lib/bpf/libbpf.c-4586-		if (purged[i].code == (BPF_LD | BPF_IMM | BPF_DW) &&
tools/lib/bpf/libbpf.c:4587:		    (purged[i].src_reg == BPF_PSEUDO_MAP_FD ||
tools/lib/bpf/libbpf.c-4588-		     purged[i].src_reg == BPF_PSEUDO_MAP_VALUE)) {
--
tools/lib/bpf/libbpf.c=6411=bpf_object__relocate_data(struct bpf_object *obj, struct bpf_program *prog)
--
tools/lib/bpf/libbpf.c-6427-			} else if (map->autocreate) {
tools/lib/bpf/libbpf.c:6428:				insn[0].src_reg = BPF_PSEUDO_MAP_FD;
tools/lib/bpf/libbpf.c-6429-				insn[0].imm = map->fd;
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c=73=__naked void invalid_cgroup_storage_access_2(void)
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-83-	: __imm(bpf_get_local_storage),
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c:84:	  __imm_insn(ld_map_fd, BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 1))
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-85-	: __clobber_all);
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c=212=__naked void cpu_cgroup_storage_access_2(void)
--
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-222-	: __imm(bpf_get_local_storage),
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c:223:	  __imm_insn(ld_map_fd, BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 1))
tools/testing/selftests/bpf/progs/verifier_cgroup_storage.c-224-	: __clobber_all);
--
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c=20=__naked void map_fd_for_function_call(void)
--
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c-32-	: __imm(bpf_map_delete_elem),
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c:33:	  __imm_insn(ld_map_fd, BPF_RAW_INSN(BPF_LD | BPF_DW | BPF_IMM, BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0))
tools/testing/selftests/bpf/progs/verifier_map_ret_val.c-34-	: __clobber_all);
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-310-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:311:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, 0, 0, 0),
tools/testing/selftests/bpf/verifier/direct_value_access.c-312-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-321-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:322:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, ~0, 0, 0),
tools/testing/selftests/bpf/verifier/direct_value_access.c-323-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-332-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:333:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, ~0, ~0, 0, 0),
tools/testing/selftests/bpf/verifier/direct_value_access.c-334-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/direct_value_access.c-343-	BPF_MOV64_IMM(BPF_REG_0, 1),
tools/testing/selftests/bpf/verifier/direct_value_access.c:344:	BPF_LD_IMM64_RAW_FULL(BPF_REG_1, BPF_PSEUDO_MAP_FD, 0, 0, 0, 47),
tools/testing/selftests/bpf/verifier/direct_value_access.c-345-	BPF_EXIT_INSN(),
--
tools/testing/selftests/bpf/verifier/ld_imm64.c-138-	BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_1,
tools/testing/selftests/bpf/verifier/ld_imm64.c:139:		     BPF_PSEUDO_MAP_FD, 0, 0),
tools/testing/selftests/bpf/verifier/ld_imm64.c-140-	BPF_RAW_INSN(0, 0, 0, 0, 0xfefefe),
]

gemini-3.1-pro-preview

							input: 199963
							output: 25
							thoughts: 54
						

Here's my thought process, as it stands:

**Tracing a Function Call Path**

Okay, so I'm trying to understand how `add_used_map` is being used, and the crucial piece is that it's called from `replace_map_fd_with_map_ptr` within `kernel/bpf/verifier.c`. My instinct is to zero in on that function, `replace_map_fd_with_map_ptr`. I need to figure out the context of that call. What's the purpose of `replace_map_fd_with_map_ptr`? What's *its* role in the broader verifier workflow? Understanding that will give me the necessary information to grasp what `add_used_map` is actually *doing* in this specific scenario. I need to refresh my memory on the interactions of these functions within the BPF verifier. Let's dig into that function and see what's what.

log-in to see details

map[Expression:replace_map_fd_with_map_ptr]

map[Output:]

gemini-3.1-pro-preview

							input: 200262
							output: 22
							thoughts: 16
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Hmm, The Function Name is Now Clear**

Right, so that function I was trying to recall... it's `resolve_pseudo_ldimm64`. That name finally clicks. It's a pseudo instruction, obviously, but now the whole thing makes more sense. I've encountered this before, and it was a small detail that I needed to remember.

log-in to see details

map[Expression:resolve_pseudo_ldimm64]

map[Output:]

gemini-3.1-pro-preview

							input: 200410
							output: 45
							thoughts: 25
						

Here's my take on those thoughts, tailored for an expert audience:

**Diving into the BPF Verifier: A Closer Look at `check_and_resolve_insns`**

Okay, so we're looking at something potentially fishy. Time to dig into `check_and_resolve_insns` within `kernel/bpf/verifier.c`. This is where the magic (or the problems) happen, right? This function's probably responsible for the heavy lifting of instruction analysis and any necessary resolutions before a BPF program gets a chance to run. I need to refresh my memory on exactly how it interacts with the instruction set and operand validation. I'm especially interested in how it handles control flow and jump targets; those are often the trickiest parts to get right securely. I'll need to figure out what are the edge-cases that it does or does not cover. I suspect this function touches the register state tracking too, it is essential to ensure that sensitive data isn't leaking. It's time to trace the control flow of this function; I wonder where that takes me.

map[ContextFile:kernel/bpf/verifier.c IncludeLines:true Name:check_and_resolve_insns]

map[SourceCode:18408:	/*
18409:	 * Check that insns are sane and rewrite pseudo imm in ld_imm64 instructions:
18410:	 *
18411:	 * 1. if it accesses map FD, replace it with actual map pointer.
18412:	 * 2. if it accesses btf_id of a VAR, replace it with pointer to the var.
18413:	 *
18414:	 * NOTE: btf_vmlinux is required for converting pseudo btf_id.
18415:	 */
18416:	static int check_and_resolve_insns(struct bpf_verifier_env *env)
18417:	{
18418:		struct bpf_insn *insn = env->prog->insnsi;
18419:		int insn_cnt = env->prog->len;
18420:		int i, err;
18421:	
18422:		err = bpf_prog_calc_tag(env->prog);
18423:		if (err)
18424:			return err;
18425:	
18426:		for (i = 0; i < insn_cnt; i++, insn++) {
18427:			if (insn->dst_reg >= MAX_BPF_REG) {
18428:				verbose(env, "R%d is invalid\n", insn->dst_reg);
18429:				return -EINVAL;
18430:			}
18431:			if (insn->src_reg >= MAX_BPF_REG) {
18432:				verbose(env, "R%d is invalid\n", insn->src_reg);
18433:				return -EINVAL;
18434:			}
18435:			if (insn[0].code == (BPF_LD | BPF_IMM | BPF_DW)) {
18436:				struct bpf_insn_aux_data *aux;
18437:				struct bpf_map *map;
18438:				int map_idx;
18439:				u64 addr;
18440:				u32 fd;
18441:	
18442:				if (i == insn_cnt - 1 || insn[1].code != 0 ||
18443:				    insn[1].dst_reg != 0 || insn[1].src_reg != 0 ||
18444:				    insn[1].off != 0) {
18445:					verbose(env, "invalid bpf_ld_imm64 insn\n");
18446:					return -EINVAL;
18447:				}
18448:	
18449:				if (insn[0].off != 0) {
18450:					verbose(env, "BPF_LD_IMM64 uses reserved fields\n");
18451:					return -EINVAL;
18452:				}
18453:	
18454:				if (insn[0].src_reg == 0)
18455:					/* valid generic load 64-bit imm */
18456:					goto next_insn;
18457:	
18458:				if (insn[0].src_reg == BPF_PSEUDO_BTF_ID) {
18459:					aux = &env->insn_aux_data[i];
18460:					err = check_pseudo_btf_id(env, insn, aux);
18461:					if (err)
18462:						return err;
18463:					goto next_insn;
18464:				}
18465:	
18466:				if (insn[0].src_reg == BPF_PSEUDO_FUNC) {
18467:					aux = &env->insn_aux_data[i];
18468:					aux->ptr_type = PTR_TO_FUNC;
18469:					goto next_insn;
18470:				}
18471:	
18472:				/* In final convert_pseudo_ld_imm64() step, this is
18473:				 * converted into regular 64-bit imm load insn.
18474:				 */
18475:				switch (insn[0].src_reg) {
18476:				case BPF_PSEUDO_MAP_VALUE:
18477:				case BPF_PSEUDO_MAP_IDX_VALUE:
18478:					break;
18479:				case BPF_PSEUDO_MAP_FD:
18480:				case BPF_PSEUDO_MAP_IDX:
18481:					if (insn[1].imm == 0)
18482:						break;
18483:					fallthrough;
18484:				default:
18485:					verbose(env, "unrecognized bpf_ld_imm64 insn\n");
18486:					return -EINVAL;
18487:				}
18488:	
18489:				switch (insn[0].src_reg) {
18490:				case BPF_PSEUDO_MAP_IDX_VALUE:
18491:				case BPF_PSEUDO_MAP_IDX:
18492:					if (bpfptr_is_null(env->fd_array)) {
18493:						verbose(env, "fd_idx without fd_array is invalid\n");
18494:						return -EPROTO;
18495:					}
18496:					if (copy_from_bpfptr_offset(&fd, env->fd_array,
18497:								    insn[0].imm * sizeof(fd),
18498:								    sizeof(fd)))
18499:						return -EFAULT;
18500:					break;
18501:				default:
18502:					fd = insn[0].imm;
18503:					break;
18504:				}
18505:	
18506:				map_idx = add_used_map(env, fd);
18507:				if (map_idx < 0)
18508:					return map_idx;
18509:				map = env->used_maps[map_idx];
18510:	
18511:				aux = &env->insn_aux_data[i];
18512:				aux->map_index = map_idx;
18513:	
18514:				if (insn[0].src_reg == BPF_PSEUDO_MAP_FD ||
18515:				    insn[0].src_reg == BPF_PSEUDO_MAP_IDX) {
18516:					addr = (unsigned long)map;
18517:				} else {
18518:					u32 off = insn[1].imm;
18519:	
18520:					if (!map->ops->map_direct_value_addr) {
18521:						verbose(env, "no direct value access support for this map type\n");
18522:						return -EINVAL;
18523:					}
18524:	
18525:					err = map->ops->map_direct_value_addr(map, &addr, off);
18526:					if (err) {
18527:						verbose(env, "invalid access to map value pointer, value_size=%u off=%u\n",
18528:							map->value_size, off);
18529:						return err;
18530:					}
18531:	
18532:					aux->map_off = off;
18533:					addr += off;
18534:				}
18535:	
18536:				insn[0].imm = (u32)addr;
18537:				insn[1].imm = addr >> 32;
18538:	
18539:	next_insn:
18540:				insn++;
18541:				i++;
18542:				continue;
18543:			}
18544:	
18545:			/* Basic sanity check before we invest more work here. */
18546:			if (!bpf_opcode_in_insntable(insn->code)) {
18547:				verbose(env, "unknown opcode %02x\n", insn->code);
18548:				return -EINVAL;
18549:			}
18550:	
18551:			err = check_insn_fields(env, insn);
18552:			if (err)
18553:				return err;
18554:		}
18555:	
18556:		/* now all pseudo BPF_LD_IMM64 instructions load valid
18557:		 * 'struct bpf_map *' into a register instead of user map_fd.
18558:		 * These pointers will be used later by verifier to validate map access.
18559:		 */
18560:		return 0;
18561:	}
 SourceFile:kernel/bpf/verifier.c]

gemini-3.1-pro-preview

							input: 203276
							output: 42
							thoughts: 3635
						

**Analyzing the Crash: A Deep Dive**

Okay, let's break this down. My initial thought was the BPF program, focusing on `add_used_map` and its potential for an invalid file descriptor (`fd = -1`) leading to an error path that might trigger the crash. The sequence seemed logical: `__bpf_map_get(-1)` returning `-EBADF`, which cascades through `add_used_map`, `check_and_resolve_insns`, `bpf_check`, `bpf_prog_load`, ultimately resulting in a failed program load, effectively making the BPF code irrelevant. But if the BPF program wasn't loaded, what *was* going on?

Then the focus shifted to the reproducer, specifically the `mmap` calls, followed by `socket` and `sendmsg`. My intuition honed in on `sendmsg` as a possible culprit for an infinite loop. The `tc_modify_qdisc` function came to mind, specifically examining the `tcm_ifindex`. I quickly confirmed that `tcm_ifindex` was set to zero, triggering a return of `-ENODEV` from `__dev_get_by_index`. This led to the conclusion that `sendmsg` itself would exit returning `-ENODEV`. This didn't seem to explain a soft lockup.

I started digging into the syzkaller log, and the crash dump, noticing a soft lockup on CPU 0 in a workqueue thread `kworker/u9:4` executing `toggle_allocation_gate`, while CPU 1, `swapper/1`, was stuck in `__remove_hrtimer`. This indicated a potential timer issue. The `toggle_allocation_gate` function, and the `kfence_timer` it adds, became the focus. I realized that a `hrtimer` being stuck in `__remove_hrtimer` would not be due to a workqueue timer (using `timer_list`).

The backtrace for CPU 1's NMI interrupt showed the core of the timer issue as being stuck within `__remove_hrtimer` and its reliance on the `hrtimer` tree. The function `timerqueue_linked_del` and subsequent calls to `rb_erase_linked` and `__rb_erase_augmented` made the possibility of rbtree corruption, perhaps due to concurrent modification or memory corruption, a likely explanation for the loop.

I considered a known `hrtimer` bug and went back to the BPF program, considering possible concurrent modification issues with the BPF code. I then looked at the generated C code, and I began to wonder whether the map was ever properly created given that there was a `-1` used for the `ringbuf_map_fd`. This meant the load would fail, and I would be back to wondering what was causing the soft lockup.

Then, I went back to the code, and realized that even if the `bpf_prog_load` fails, the BPF program might still be relevant if it was attached somewhere. However, since there was no `BPF_PROG_ATTACH` or `perf_event_open` it would not be. The `BPF_PROG_TYPE_TRACEPOINT` was also confirmed, but it wasn't attached. Also, the BPF program didn't have any `bpf_timer_init` calls.

This eliminated the BPF program as a direct cause, meaning the issue was external. I had to look at other code within the reproducer. The `ioctl(0x8933)` call (`SIOCGIFINDEX`) seemed important, along with `sendmsg`. I recalled that syzkaller likely handles the index and passed `team0`'s ifindex to `tcm_ifindex`. The generated C code bug would not have resulted in the `RTM_NEWQDISC` path being taken. That means `tc_modify_qdisc` would be called with `tcm_ifindex` as the ifindex of `team0`. This should work, since `tcm_parent` is 0. If `tcm_parent` is 0 then the code goes to the `else` condition, where handle is also zero, causing the return of `-EINVAL`, doing nothing. So `RTM_NEWQDISC` does nothing, and the reproducer does nothing. If this is true, then why the soft lockup?

Finally, the `Code` snippet with `lock_is_held` seemed important.

map[ContextFile:kernel/locking/lockdep.c IncludeLines:true Name:lock_is_held]

map[SourceCode: 247:	static inline int lock_is_held(const struct lockdep_map *lock)
 248:	{
 249:		return lock_is_held_type(lock, -1);
 250:	}
 SourceFile:include/linux/lockdep.h]

gemini-3.1-pro-preview

							input: 208014
							output: 44
							thoughts: 71
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Analyzing an Inline Function and Identifying a Call Site**

Alright, a-ha! I see that `lock_is_held` is defined as an inline function. This immediately tells me something about performance – it's likely optimized for speed. Digging deeper, it appears this inline function resolves to a call to `lock_is_held_type(lock, -1)`. Excellent. This confirms my suspicion.

So, the assembly instruction `call 0xa21a2ce`, which would be otherwise unclear, is, in fact, the invocation of `lock_is_held_type`. Now I've connected the dots between the high-level inline call and the actual runtime function call. Time to investigate `lock_is_held_type` to understand how the lock's held state is actually determined. This is where the real logic likely resides. Let's get to it.

map[ContextFile:kernel/locking/lockdep.c IncludeLines:true Name:lock_is_held_type]

map[SourceCode:5924:	noinstr int lock_is_held_type(const struct lockdep_map *lock, int read)
5925:	{
5926:		unsigned long flags;
5927:		int ret = LOCK_STATE_NOT_HELD;
5928:	
5929:		/*
5930:		 * Avoid false negative lockdep_assert_held() and
5931:		 * lockdep_assert_not_held().
5932:		 */
5933:		if (unlikely(!lockdep_enabled()))
5934:			return LOCK_STATE_UNKNOWN;
5935:	
5936:		raw_local_irq_save(flags);
5937:		check_flags(flags);
5938:	
5939:		lockdep_recursion_inc();
5940:		ret = __lock_is_held(lock, read);
5941:		lockdep_recursion_finish();
5942:		raw_local_irq_restore(flags);
5943:	
5944:		return ret;
5945:	}
 SourceFile:kernel/locking/lockdep.c]

gemini-3.1-pro-preview

							input: 208663
							output: 43
							thoughts: 862
						

**Dissecting the Assembly: A Deep Dive into RCU and Lockdep**

Okay, so I'm looking at this assembly, and it seems like `lock_is_held_type` isn't inlined, which is good to know. The initial code loads the address of `cpu_base->lock.dep_map` into `rdi` and sets `esi` to -1, which is a bit strange, but probably a flag of sorts. Then it calls `lock_is_held_type`, and the result is stored in `r13d`. Afterward, I see `edi` set to zero, and `esi` gets the value of `eax` (which is the result of `lock_is_held_type`). Then there's this call to `rcu_read_unlock`, and that's what's got me curious.

Wait a second...I am now calling `rcu_read_unlock` *after* calling `lock_is_held_type`? I need to figure out why. That makes me think of `lockdep_assert_held`. Looking at that definition, `WARN_ON` will be triggered if `debug_locks` is enabled and `lockdep_is_held(l)` returns false. `WARN_ON` is more complicated, but basically, it checks a condition and potentially calls `__WARN()`. But why the `rcu_read_unlock` call? This is likely related to RCU's mechanism, so let's look at that.

Hmm, `rcu_read_unlock` is inlined, so that's not the answer. What's this function that takes `0` and `lock_is_held_type()` as arguments? I need to figure out what's called with `edi=0` and `esi=eax`. Okay, looking at `lockdep_is_held` now, it just calls `lock_is_held`. So `lockdep_assert_held` and `debug_locks` are a factor here. `debug_locks` is a global variable; if it's set, this could be important. What about `rcu_read_unlock_strict`?

I noticed there are two nearby calls, `call 0x11fdfb` and then `call 0x11fdf9`. Now, since the calls are really close to each other, are we dealing with a lock and unlock pair? It's highly suggestive. But, `rcu_read_lock` and `rcu_read_unlock` don't take any arguments, so that can't be it, right? But the values that are being passed in as arguments are zero, and the result of the `lock_is_held_type()` call, which is passed in `edi=0` and `esi=eax`...

So, I need to figure out what function uses these arguments. Could it be `trace_rcu_utilization`? Or `rcu_lock_acquire`? Going to check `rcu_read_lock` again.

map[ContextFile:include/linux/rcupdate.h IncludeLines:true Name:rcu_read_lock]

map[SourceCode: 788:	/**
 789:	 * rcu_read_lock() - mark the beginning of an RCU read-side critical section
 790:	 *
 791:	 * When synchronize_rcu() is invoked on one CPU while other CPUs
 792:	 * are within RCU read-side critical sections, then the
 793:	 * synchronize_rcu() is guaranteed to block until after all the other
 794:	 * CPUs exit their critical sections.  Similarly, if call_rcu() is invoked
 795:	 * on one CPU while other CPUs are within RCU read-side critical
 796:	 * sections, invocation of the corresponding RCU callback is deferred
 797:	 * until after the all the other CPUs exit their critical sections.
 798:	 *
 799:	 * Both synchronize_rcu() and call_rcu() also wait for regions of code
 800:	 * with preemption disabled, including regions of code with interrupts or
 801:	 * softirqs disabled.
 802:	 *
 803:	 * Note, however, that RCU callbacks are permitted to run concurrently
 804:	 * with new RCU read-side critical sections.  One way that this can happen
 805:	 * is via the following sequence of events: (1) CPU 0 enters an RCU
 806:	 * read-side critical section, (2) CPU 1 invokes call_rcu() to register
 807:	 * an RCU callback, (3) CPU 0 exits the RCU read-side critical section,
 808:	 * (4) CPU 2 enters a RCU read-side critical section, (5) the RCU
 809:	 * callback is invoked.  This is legal, because the RCU read-side critical
 810:	 * section that was running concurrently with the call_rcu() (and which
 811:	 * therefore might be referencing something that the corresponding RCU
 812:	 * callback would free up) has completed before the corresponding
 813:	 * RCU callback is invoked.
 814:	 *
 815:	 * RCU read-side critical sections may be nested.  Any deferred actions
 816:	 * will be deferred until the outermost RCU read-side critical section
 817:	 * completes.
 818:	 *
 819:	 * You can avoid reading and understanding the next paragraph by
 820:	 * following this rule: don't put anything in an rcu_read_lock() RCU
 821:	 * read-side critical section that would block in a !PREEMPTION kernel.
 822:	 * But if you want the full story, read on!
 823:	 *
 824:	 * In non-preemptible RCU implementations (pure TREE_RCU and TINY_RCU),
 825:	 * it is illegal to block while in an RCU read-side critical section.
 826:	 * In preemptible RCU implementations (PREEMPT_RCU) in CONFIG_PREEMPTION
 827:	 * kernel builds, RCU read-side critical sections may be preempted,
 828:	 * but explicit blocking is illegal.  Finally, in preemptible RCU
 829:	 * implementations in real-time (with -rt patchset) kernel builds, RCU
 830:	 * read-side critical sections may be preempted and they may also block, but
 831:	 * only when acquiring spinlocks that are subject to priority inheritance.
 832:	 */
 833:	static __always_inline void rcu_read_lock(void)
 834:		__acquires_shared(RCU)
 835:	{
 836:		__rcu_read_lock();
 837:		__acquire_shared(RCU);
 838:		rcu_lock_acquire(&rcu_lock_map);
 839:		RCU_LOCKDEP_WARN(!rcu_is_watching(),
 840:				 "rcu_read_lock() used illegally while idle");
 841:	}
 SourceFile:include/linux/rcupdate.h]

gemini-3.1-pro-preview

							input: 211311
							output: 22
							thoughts: 3941
						

**A Deep Dive into a Soft Lockup and the Elusive Reproducer**

Okay, here's the breakdown of my thought process. I started by tracing through the assembly, attempting to understand the call stack leading up to the reported soft lockup. I see `rcu_lock_acquire`, which eventually lands me in `__remove_hrtimer`.  My initial concern was a potential lockdep issue, perhaps a missing `rcu_read_lock` or misapplication of `lockdep_assert_held`.  I dug into the macro definitions of `lockdep_assert_held` and `WARN_ON`, considering global variables like `debug_locks` and their implications on the execution path. I considered, what if the code is `rcu_read_lock_bh_held` or `trace_hrtimer_cancel`? Nope, it's just `__remove_hrtimer`.

I then analyzed the assembly, focusing on the `lock_is_held_type` call and the subsequent function call. I was puzzled by the jump to `WARN_ON` and tried to figure out what was happening on the call at `0x11fdf9`. I also wondered if `debug_locks` was checked before the `lock_is_held_type`.

Then came the realization: if CPU 1 is at `test r13d, r13d`, it isn't stuck in an infinite loop. It is just running `__remove_hrtimer`, but then it got an NMI! The NMI is sent by CPU 0 because CPU 0 detected a soft lockup. So, I figured CPU 1 isn't the root cause; CPU 0 is the stuck one. I shifted my focus to CPU 0's stack trace.

The stack trace of CPU 0 revealed that it was stuck in `csd_lock_wait`, waiting on CPU 1, which led me to think CPU 1 must be busy. The stack of CPU 1 shows `__remove_hrtimer` and then `__run_hrtimer`. Ah, I then thought, if CPU 1 is stuck in `__hrtimer_run_queues` for 26 seconds, it's an infinite loop in `__hrtimer_run_queues`!

I considered how the reproducer might fit, thinking a timer callback returning `HRTIMER_RESTART` without advancing the expiration time could be the problem. I had to look into how the system calls, specifically the `sendmsg` call, fit in. I went through the arguments of `sendmsg$nl_route_sched`, checking the `newqdisc` arguments and the attributes within. I identified potentially invalid attributes with a length of 0. If `tca` is empty, `nlmsg_parse_deprecated` would return `-EINVAL`. The reproducer writes only a few bytes in the `tcmsg`. The rest of the buffer is zeroed, which would make the parsing function return `-EINVAL`.

With the `sendmsg` syscall failing, I looked into the `bpf_prog_load` call. Analyzing the arguments, I noticed `license` is NULL, which means `strncpy_from_bpfptr` will fail, returning `-EFAULT`. I confirmed that the license is indeed zero in the reproducer, causing bpf load to not work. Then, I realized that, if the system calls do nothing, then the crash must be caused by something else. Since syzkaller says that the reproducer might be incomplete, I had to keep going. I considered searching for similar bugs.

map[Expression:__hrtimer_run_queues]

map[Output:Documentation/tools/rtla/rtla-timerlat-top.rst=49=higher is found::
--
Documentation/tools/rtla/rtla-timerlat-top.rst-86-                -> timerlat_irq
Documentation/tools/rtla/rtla-timerlat-top.rst:87:                -> __hrtimer_run_queues
Documentation/tools/rtla/rtla-timerlat-top.rst-88-                -> hrtimer_interrupt
--
Documentation/trace/timerlat-tracer.rst=142=irq disabled. For example::
--
Documentation/trace/timerlat-tracer.rst-155-  => timerlat_irq
Documentation/trace/timerlat-tracer.rst:156:  => __hrtimer_run_queues
Documentation/trace/timerlat-tracer.rst-157-  => hrtimer_interrupt
--
drivers/gpu/drm/ci/xfails/msm-sm8350-hdk-skips.txt=20=msm/msm_mapping@ring
--
drivers/gpu/drm/ci/xfails/msm-sm8350-hdk-skips.txt-162-# [  228.509826]  watchdog_timer_fn+0x254/0x2e4
drivers/gpu/drm/ci/xfails/msm-sm8350-hdk-skips.txt:163:# [  228.514087]  __hrtimer_run_queues+0x3b0/0x40c
drivers/gpu/drm/ci/xfails/msm-sm8350-hdk-skips.txt-164-# [  228.518612]  hrtimer_interrupt+0xe8/0x248
--
kernel/time/hrtimer.c=1961=static __always_inline struct hrtimer *clock_base_next_timer_safe(struct hrtimer_clock_base *base)
--
kernel/time/hrtimer.c-1967-
kernel/time/hrtimer.c:1968:static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now,
kernel/time/hrtimer.c-1969-				 unsigned long flags, unsigned int active_mask)
--
kernel/time/hrtimer.c=2001=static __latent_entropy void hrtimer_run_softirq(void)
--
kernel/time/hrtimer.c-2010-	now = hrtimer_update_base(cpu_base);
kernel/time/hrtimer.c:2011:	__hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_SOFT);
kernel/time/hrtimer.c-2012-
--
kernel/time/hrtimer.c=2083=void hrtimer_interrupt(struct clock_event_device *dev)
--
kernel/time/hrtimer.c-2100-	 * Set expires_next to KTIME_MAX, which prevents that remote CPUs queue
kernel/time/hrtimer.c:2101:	 * timers while __hrtimer_run_queues() is expiring the clock bases.
kernel/time/hrtimer.c-2102-	 * Timers which are re/enqueued on the local CPU are not affected by
--
kernel/time/hrtimer.c-2112-
kernel/time/hrtimer.c:2113:	__hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_HARD);
kernel/time/hrtimer.c-2114-
--
kernel/time/hrtimer.c=2147=void hrtimer_run_queues(void)
--
kernel/time/hrtimer.c-2176-
kernel/time/hrtimer.c:2177:	__hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_HARD);
kernel/time/hrtimer.c-2178-	raw_spin_unlock_irqrestore(&cpu_base->lock, flags);
]

gemini-3.1-pro-preview

							input: 217086
							output: 45
							thoughts: 978
						

**Debugging a Potential Infinite Loop in `__hrtimer_run_queues`**

Okay, so I'm staring at this reproducer, and it looks like `__hrtimer_run_queues` is looping indefinitely. The first question is always, which timer is stuck? Could there be a timer callback that returns `HRTIMER_RESTART` without actually advancing the expiration time? Time to start searching for instances of `HRTIMER_RESTART` in the kernel source.

Hmm, there are a lot of those. But, wait, the reproducer uses `bpf_timer_init`, right? No, I checked the BPF instructions and didn't find `bpf_timer_init`. Ah, the reproducer did have a `bpf_ringbuf_discard` call. 

Now wait, what if the BPF *actually* does use a BPF timer? I'd better double-check the BPF helper codes. Yep, `bpf_timer_init` is 170 (`0xaa`), `bpf_timer_set_callback` is 171 (`0xab`), `bpf_timer_start` is 172 (`0xac`), and `bpf_timer_cancel` is 173 (`0xad`). Let's scan the hex dump of the instructions in the reproducer:  `0x83`, `0xa5`, `0x86`, `0x82`, `0x85`. Nope, none of them match the BPF timer helper codes! The BPF program *definitely* doesn't use BPF timers.

So, if it's not a BPF timer, what *else* could trigger an infinite loop in `__hrtimer_run_queues`? Wait a minute... the reproducer sends an `RTM_NEWQDISC` message.  Could there be a bug *there* in `qdisc` that's messing with the hrtimer?  Thinking back, I know `qdisc` uses `qdisc_watchdog`, and that *itself* uses hrtimers! Looks like I need to dive into `qdisc_watchdog_schedule` in `net/sched/sch_api.c`. Time to see what's going on there.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:qdisc_watchdog_schedule]

map[SourceCode:  78:	static inline void qdisc_watchdog_schedule(struct qdisc_watchdog *wd,
  79:						   psched_time_t expires)
  80:	{
  81:		qdisc_watchdog_schedule_ns(wd, PSCHED_TICKS2NS(expires));
  82:	}
 SourceFile:include/net/pkt_sched.h]

gemini-3.1-pro-preview

							input: 218724
							output: 47
							thoughts: 27
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the qdisc Watchdog Scheduler**

Okay, time to get to the heart of the matter. I need to understand how the scheduling watchdog operates, and the place to start is definitely the core scheduler API. I'm going to jump into `net/sched/sch_api.c`. Specifically, I need to understand the mechanics of `qdisc_watchdog_schedule_ns`. My intuition tells me this function is the key to how the watchdog timers are set up and managed for quality-of-service disciplines. I'm anticipating this code will shed light on the timing mechanisms, the context switching, and any possible race conditions that might exist. I'm keen to dissect how it interacts with the underlying timer framework within the kernel, given its significance in maintaining predictable and timely network traffic shaping. Let's see what we find.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:qdisc_watchdog_schedule_ns]

map[SourceCode:  72:	static inline void qdisc_watchdog_schedule_ns(struct qdisc_watchdog *wd,
  73:						      u64 expires)
  74:	{
  75:		return qdisc_watchdog_schedule_range_ns(wd, expires, 0ULL);
  76:	}
 SourceFile:include/net/pkt_sched.h]

gemini-3.1-pro-preview

							input: 219106
							output: 49
							thoughts: 17
						

Okay, here's my take on those thoughts, framed as an expert's self-reflection:

**Deep Dive into `qdisc_watchdog_schedule_range_ns`**

Right, let's take a look at `qdisc_watchdog_schedule_range_ns`. I need to refresh my understanding of how this particular function fits into the overall queuing discipline watchdog mechanism. Specifically, I'm going to focus on its role in scheduling the watchdog timer within a specified time range, presumably to avoid issues with excessive timer latency or starvation. I’m thinking I'll want to quickly check the surrounding code and possibly related functions that call or are called by this one, as I'm interested in how it integrates with the rest of the scheduler core. It's likely involved in implementing some adaptive backoff or jittering strategy. Time to get the details!

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:qdisc_watchdog_schedule_range_ns]

map[SourceCode: 630:	void qdisc_watchdog_schedule_range_ns(struct qdisc_watchdog *wd, u64 expires,
 631:					      u64 delta_ns)
 632:	{
 633:		bool deactivated;
 634:	
 635:		rcu_read_lock();
 636:		deactivated = test_bit(__QDISC_STATE_DEACTIVATED,
 637:				       &qdisc_root_sleeping(wd->qdisc)->state);
 638:		rcu_read_unlock();
 639:		if (deactivated)
 640:			return;
 641:	
 642:		if (hrtimer_is_queued(&wd->timer)) {
 643:			u64 softexpires;
 644:	
 645:			softexpires = ktime_to_ns(hrtimer_get_softexpires(&wd->timer));
 646:			/* If timer is already set in [expires, expires + delta_ns],
 647:			 * do not reprogram it.
 648:			 */
 649:			if (softexpires - expires <= delta_ns)
 650:				return;
 651:		}
 652:	
 653:		hrtimer_start_range_ns(&wd->timer,
 654:				       ns_to_ktime(expires),
 655:				       delta_ns,
 656:				       HRTIMER_MODE_ABS_PINNED);
 657:	}
 SourceFile:net/sched/sch_api.c]

gemini-3.1-pro-preview

							input: 219799
							output: 43
							thoughts: 28
						

Okay, here's my interpretation of those thoughts, presented as my own mental process, given my expertise:

**Diving into the `qdisc_watchdog` Mechanism**

Alright, hang on a second... my mind just took a little detour. I was deep in this networking code, and I just realized something significant. The `qdisc_watchdog` – that's the scheduler watchdog timer – it relies on `hrtimer`, doesn't it? That's a key detail! I should have known this already, but it's always good to refresh.

Now the follow up question has to be: *what* is the specific callback function that `qdisc_watchdog` actually uses? That callback is the heart of the watchdog mechanism itself, so I need to understand it. I want to trace the code. I need to figure out what happens when the timer actually fires. This will tell me how the scheduler is actually being managed in the face of possible lockups, or other such failures. I have to understand the callback's role! Let's get to the bottom of this.

map[ContextFile:net/sched/sch_api.c IncludeLines:true Name:qdisc_watchdog]

map[SourceCode: 604:	static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 605:	{
 606:		struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
 607:							 timer);
 608:	
 609:		rcu_read_lock();
 610:		__netif_schedule(qdisc_root(wd->qdisc));
 611:		rcu_read_unlock();
 612:	
 613:		return HRTIMER_NORESTART;
 614:	}
 SourceFile:net/sched/sch_api.c]

gemini-3.1-pro-preview

							input: 220294
							output: 44
							thoughts: 869
						

**Debugging a Potential BPF-Related Kernel Panic**

Okay, so `qdisc_watchdog` returns `HRTIMER_NORESTART`, which means it shouldn't be the direct cause of an infinite loop in `__hrtimer_run_queues`. That rules that out as the immediate problem. But... could the BPF program *indirectly* be involved? The reproducer uses `BPF_PROG_LOAD`, so let's dig deeper into what it is doing.

I was trying to consider which other BPF helpers use `hrtimer`. Hmm, let me check `bpf_timer_init` again, just in case. Wait, that's helper 170... but the reproducer is using others – `bpf_ringbuf_reserve` (131), `bpf_snprintf` (165), `bpf_ringbuf_query` (134), `bpf_ringbuf_output` (130), `bpf_ringbuf_discard` (133). Maybe the BPF program is causing some sort of memory corruption within a different helper.

Wait, `bpf_snprintf` is at helper number 165. Let's look closely at `bpf_snprintf` in `kernel/bpf/helpers.c`. Here it is:

```c
BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
	   const void *, args, u32, data_len)
{
	struct bpf_bprintf_data data = {
		.get_bin_args	= true,
	};
	int err, num_args;

	if (data_len % 8 || data_len > MAX_BPRINTF_VARARGS * 8 ||
	    (data_len && !args))
		return -EINVAL;
	num_args = data_len / 8;

	/* ARG_PTR_TO_CONST_STR guarantees that fmt is zero-terminated so we
	 * can safely give an unbounded size.
	 */
	err = bpf_bprintf_prepare(fmt, UINT_MAX, args, num_args, &data);
	if (err < 0)
		return err;

	err = bstr_printf(str, str_size, fmt, data.bin_args);

	bpf_bprintf_cleanup(&data);

	return err + 1;
}
```

Okay, the crucial part seems to be the `bpf_bprintf_prepare` function. Let's analyze its code:

```c
	if (get_buffers && bpf_try_get_buffers(&buffers))
		return -EBUSY;

	if (data->get_bin_args) {
		if (num_args)
			tmp_buf = buffers->bin_args;
		tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
		data->bin_args = (u32 *)tmp_buf;
	}
```

Wait, `MAX_BPRINTF_BIN_ARGS` is defined as 512. Now I remember.

Let's look at the `snprintf` use:

```c
			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}

				i++;
				num_spec++;
				continue;
			}
```

Aha! `snprintf` returns the number of characters that *would* have been written if the buffer was large enough. If `err` is larger than `tmp_buf_end - tmp_buf`, the line `tmp_buf += (err + 1)` will advance `tmp_buf` *past* `tmp_buf_end`! Then, the *next* argument will be written *out of bounds*! This could lead to a memory corruption. Let me examine `bpf_bprintf_prepare` one more time.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_bprintf_prepare]

map[SourceCode: 804:	/*
 805:	 * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
 806:	 *
 807:	 * Returns a negative value if fmt is an invalid format string or 0 otherwise.
 808:	 *
 809:	 * This can be used in two ways:
 810:	 * - Format string verification only: when data->get_bin_args is false
 811:	 * - Arguments preparation: in addition to the above verification, it writes in
 812:	 *   data->bin_args a binary representation of arguments usable by bstr_printf
 813:	 *   where pointers from BPF have been sanitized.
 814:	 *
 815:	 * In argument preparation mode, if 0 is returned, safe temporary buffers are
 816:	 * allocated and bpf_bprintf_cleanup should be called to free them after use.
 817:	 */
 818:	int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 819:				u32 num_args, struct bpf_bprintf_data *data)
 820:	{
 821:		bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
 822:		char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
 823:		struct bpf_bprintf_buffers *buffers = NULL;
 824:		size_t sizeof_cur_arg, sizeof_cur_ip;
 825:		int err, i, num_spec = 0;
 826:		u64 cur_arg;
 827:		char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
 828:	
 829:		fmt_end = strnchr(fmt, fmt_size, 0);
 830:		if (!fmt_end)
 831:			return -EINVAL;
 832:		fmt_size = fmt_end - fmt;
 833:	
 834:		if (get_buffers && bpf_try_get_buffers(&buffers))
 835:			return -EBUSY;
 836:	
 837:		if (data->get_bin_args) {
 838:			if (num_args)
 839:				tmp_buf = buffers->bin_args;
 840:			tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
 841:			data->bin_args = (u32 *)tmp_buf;
 842:		}
 843:	
 844:		if (data->get_buf)
 845:			data->buf = buffers->buf;
 846:	
 847:		for (i = 0; i < fmt_size; i++) {
 848:			unsigned char c = fmt[i];
 849:	
 850:			/*
 851:			 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
 852:			 * through unchanged, while still rejecting ASCII control bytes.
 853:			 */
 854:			if (isascii(c) && !isprint(c) && !isspace(c)) {
 855:				err = -EINVAL;
 856:				goto out;
 857:			}
 858:	
 859:			if (fmt[i] != '%')
 860:				continue;
 861:	
 862:			if (fmt[i + 1] == '%') {
 863:				i++;
 864:				continue;
 865:			}
 866:	
 867:			if (num_spec >= num_args) {
 868:				err = -EINVAL;
 869:				goto out;
 870:			}
 871:	
 872:			/* The string is zero-terminated so if fmt[i] != 0, we can
 873:			 * always access fmt[i + 1], in the worst case it will be a 0
 874:			 */
 875:			i++;
 876:			c = fmt[i];
 877:			/*
 878:			 * The format parser below only understands ASCII conversion
 879:			 * specifiers and modifiers, so reject non-ASCII after '%'.
 880:			 */
 881:			if (!isascii(c)) {
 882:				err = -EINVAL;
 883:				goto out;
 884:			}
 885:	
 886:			/* skip optional "[0 +-][num]" width formatting field */
 887:			while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
 888:			       fmt[i] == ' ')
 889:				i++;
 890:			if (fmt[i] >= '1' && fmt[i] <= '9') {
 891:				i++;
 892:				while (fmt[i] >= '0' && fmt[i] <= '9')
 893:					i++;
 894:			}
 895:	
 896:			if (fmt[i] == 'p') {
 897:				sizeof_cur_arg = sizeof(long);
 898:	
 899:				if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
 900:				    ispunct(fmt[i + 1])) {
 901:					if (tmp_buf)
 902:						cur_arg = raw_args[num_spec];
 903:					goto nocopy_fmt;
 904:				}
 905:	
 906:				if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 907:				    fmt[i + 2] == 's') {
 908:					fmt_ptype = fmt[i + 1];
 909:					i += 2;
 910:					goto fmt_str;
 911:				}
 912:	
 913:				if (fmt[i + 1] == 'K' ||
 914:				    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 915:				    fmt[i + 1] == 'S') {
 916:					if (tmp_buf)
 917:						cur_arg = raw_args[num_spec];
 918:					i++;
 919:					goto nocopy_fmt;
 920:				}
 921:	
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
 930:	
 931:					i++;
 932:					num_spec++;
 933:					continue;
 934:				}
 935:	
 936:				/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
 937:				if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
 938:				    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
 939:					err = -EINVAL;
 940:					goto out;
 941:				}
 942:	
 943:				i += 2;
 944:				if (!tmp_buf)
 945:					goto nocopy_fmt;
 946:	
 947:				sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
 948:				if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
 949:					err = -ENOSPC;
 950:					goto out;
 951:				}
 952:	
 953:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 954:				err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 955:							       sizeof_cur_ip);
 956:				if (err < 0)
 957:					memset(cur_ip, 0, sizeof_cur_ip);
 958:	
 959:				/* hack: bstr_printf expects IP addresses to be
 960:				 * pre-formatted as strings, ironically, the easiest way
 961:				 * to do that is to call snprintf.
 962:				 */
 963:				ip_spec[2] = fmt[i - 1];
 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
 967:	
 968:				tmp_buf += err + 1;
 969:				num_spec++;
 970:	
 971:				continue;
 972:			} else if (fmt[i] == 's') {
 973:				fmt_ptype = fmt[i];
 974:	fmt_str:
 975:				if (fmt[i + 1] != 0 &&
 976:				    !isspace(fmt[i + 1]) &&
 977:				    !ispunct(fmt[i + 1])) {
 978:					err = -EINVAL;
 979:					goto out;
 980:				}
 981:	
 982:				if (!tmp_buf)
 983:					goto nocopy_fmt;
 984:	
 985:				if (tmp_buf_end == tmp_buf) {
 986:					err = -ENOSPC;
 987:					goto out;
 988:				}
 989:	
 990:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 991:				err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
 992:							    fmt_ptype,
 993:							    tmp_buf_end - tmp_buf);
 994:				if (err < 0) {
 995:					tmp_buf[0] = '\0';
 996:					err = 1;
 997:				}
 998:	
 999:				tmp_buf += err;
1000:				num_spec++;
1001:	
1002:				continue;
1003:			} else if (fmt[i] == 'c') {
1004:				if (!tmp_buf)
1005:					goto nocopy_fmt;
1006:	
1007:				if (tmp_buf_end == tmp_buf) {
1008:					err = -ENOSPC;
1009:					goto out;
1010:				}
1011:	
1012:				*tmp_buf = raw_args[num_spec];
1013:				tmp_buf++;
1014:				num_spec++;
1015:	
1016:				continue;
1017:			}
1018:	
1019:			sizeof_cur_arg = sizeof(int);
1020:	
1021:			if (fmt[i] == 'l') {
1022:				sizeof_cur_arg = sizeof(long);
1023:				i++;
1024:			}
1025:			if (fmt[i] == 'l') {
1026:				sizeof_cur_arg = sizeof(long long);
1027:				i++;
1028:			}
1029:	
1030:			if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
1031:			    fmt[i] != 'x' && fmt[i] != 'X') {
1032:				err = -EINVAL;
1033:				goto out;
1034:			}
1035:	
1036:			if (tmp_buf)
1037:				cur_arg = raw_args[num_spec];
1038:	nocopy_fmt:
1039:			if (tmp_buf) {
1040:				tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
1041:				if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
1042:					err = -ENOSPC;
1043:					goto out;
1044:				}
1045:	
1046:				if (sizeof_cur_arg == 8) {
1047:					*(u32 *)tmp_buf = *(u32 *)&cur_arg;
1048:					*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
1049:				} else {
1050:					*(u32 *)tmp_buf = (u32)(long)cur_arg;
1051:				}
1052:				tmp_buf += sizeof_cur_arg;
1053:			}
1054:			num_spec++;
1055:		}
1056:	
1057:		err = 0;
1058:	out:
1059:		if (err)
1060:			bpf_bprintf_cleanup(data);
1061:		return err;
1062:	}
 SourceFile:kernel/bpf/helpers.c]

gemini-3.1-pro-preview

							input: 226006
							output: 68
							thoughts: 6172
						

**Analysis of the BPF Buffer Overflow Vulnerability**

Okay, so I've been digging into this kernel crash, and I've got a pretty solid handle on what's going on. It boils down to a buffer overflow in the `bpf_bprintf_prepare` function, specifically when it's handling format strings used by the `bpf_snprintf` family of helpers. The crash manifests as a soft lockup, but the root cause is a memory corruption issue that ultimately damages kernel data structures, specifically `hrtimer` related data, leading to the infinite loop. Here's the breakdown:

The first thing I realized is that `snprintf` returns the number of *characters that would have been written*. This is a critical detail. The code then uses this return value to advance the output buffer pointer, `tmp_buf`. If the formatted string is longer than the remaining space in the buffer, `tmp_buf` will be advanced beyond its allocated end, `tmp_buf_end`. This is problem #1.

Now, for problem #2, there's a sneaky signedness bug in the bounds checking. The code compares `tmp_buf_end - tmp_buf` (a signed `ptrdiff_t`) with a size requirement (`sizeof_cur_arg`, a `size_t`). The C compiler will cast the signed `ptrdiff_t` to `size_t`. If `tmp_buf` has already gone past `tmp_buf_end` (because of the `snprintf` issue above), then `tmp_buf_end - tmp_buf` becomes negative. When it's cast to `size_t`, it turns into a HUGE positive number. This means that if it encounters an unaligned access, it won't check if the buffer is big enough, and it will bypass the error check and continue writing to the buffer. If it encounters aligned access it won't notice the overflow, and it will write out of bounds.

Now, because of the overflow, let's suppose `tmp_buf` ends up past `tmp_buf_end`. When this happens, there is a `bpf_trace_copy_string` function call and `tmp_buf_end - tmp_buf` is passed to the size parameter of this function. Since `tmp_buf_end - tmp_buf` ends up being negative (due to our overflow), the signed integer will cast to unsigned, which is a HUGE positive number. Then `bpf_trace_copy_string` starts copying a large amount of memory into `tmp_buf`, corrupting memory. This corrupted the `hrtimer` structures.

The exploit works by using `%c` to consume bytes, misaligning the buffer, then a specifier such as `%d` that consumes a chunk of memory that will advance the buffer pointer out of bounds. The overflow then overwrites adjacent kernel memory. The fact that the timer code was affected makes sense because it's sensitive to even slight memory corruption.

Therefore, the vulnerability stems from these two bugs, allowing the overwrite of critical kernel data and leading to a crash. To fix this, we need to ensure the code does not advance the pointer beyond the remaining buffer size. The checks need to use the size, as opposed to the signed-to-unsigned conversion, to make sure there's enough space.

map[Question:Is `tmp_buf_end - tmp_buf < sizeof_cur_arg` an unsigned comparison in C when `tmp_buf_end` and `tmp_buf` are pointers and `sizeof_cur_arg` is `size_t`?]

map[Answer:In C, the expression `tmp_buf_end - tmp_buf < sizeof_cur_arg` is indeed an **unsigned comparison** given the types specified.

Here is the detailed breakdown of why:

1.  **Pointer Subtraction**: When you subtract two pointers (`tmp_buf_end - tmp_buf`), the result is of type `ptrdiff_t`. According to the C standard (e.g., C11 §6.5.6), `ptrdiff_t` is a **signed integer type**.
2.  **Type of `sizeof_cur_arg`**: The variable `sizeof_cur_arg` is stated to be of type `size_t`. According to the C standard, `size_t` is an **unsigned integer type**.
3.  **Usual Arithmetic Conversions**: When an operator (like the `<` comparison operator) has operands of different types, C applies "usual arithmetic conversions" (C11 §6.3.1.8). 
    *   If the operand with the unsigned integer type has a rank greater than or equal to the rank of the type of the other operand, the operand with the signed integer type is converted to the type of the operand with the unsigned integer type.
4.  **Ranks in the Linux Kernel**: In the Linux kernel, `size_t` and `ptrdiff_t` are defined to have the same width as a pointer (32 bits on 32-bit architectures and 64 bits on 64-bit architectures). Consequently, they have the same integer conversion rank.
5.  **Conversion**: Because they have the same rank and one is unsigned (`size_t`), the signed operand (`ptrdiff_t`) is converted to the unsigned type (`size_t`).

### Consequences of Unsigned Comparison
This can lead to subtle bugs if `tmp_buf_end` is actually less than `tmp_buf`. In a signed comparison, `tmp_buf_end - tmp_buf` would be negative (e.g., `-1`), and `-1 < sizeof_cur_arg` would be true (assuming `sizeof_cur_arg > 0`). 

However, in an **unsigned comparison**:
*   The negative `ptrdiff_t` value is converted to a very large `size_t` value (e.g., `-1` becomes `SIZE_MAX`).
*   The comparison `SIZE_MAX < sizeof_cur_arg` will be **false** for any typical value of `sizeof_cur_arg`.

This specific pattern has been the source of security vulnerabilities in various software (including the Linux kernel in the past), where a bounds check was bypassed because a negative offset was treated as a very large positive value during an unsigned comparison.]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

Is `tmp_buf_end - tmp_buf < sizeof_cur_arg` an unsigned comparison in C when `tmp_buf_end` and `tmp_buf` are pointers and `sizeof_cur_arg` is `size_t`?

In C, the expression `tmp_buf_end - tmp_buf < sizeof_cur_arg` is indeed an **unsigned comparison** given the types specified.

Here is the detailed breakdown of why:

1.  **Pointer Subtraction**: When you subtract two pointers (`tmp_buf_end - tmp_buf`), the result is of type `ptrdiff_t`. According to the C standard (e.g., C11 §6.5.6), `ptrdiff_t` is a **signed integer type**.
2.  **Type of `sizeof_cur_arg`**: The variable `sizeof_cur_arg` is stated to be of type `size_t`. According to the C standard, `size_t` is an **unsigned integer type**.
3.  **Usual Arithmetic Conversions**: When an operator (like the `<` comparison operator) has operands of different types, C applies "usual arithmetic conversions" (C11 §6.3.1.8). 
    *   If the operand with the unsigned integer type has a rank greater than or equal to the rank of the type of the other operand, the operand with the signed integer type is converted to the type of the operand with the unsigned integer type.
4.  **Ranks in the Linux Kernel**: In the Linux kernel, `size_t` and `ptrdiff_t` are defined to have the same width as a pointer (32 bits on 32-bit architectures and 64 bits on 64-bit architectures). Consequently, they have the same integer conversion rank.
5.  **Conversion**: Because they have the same rank and one is unsigned (`size_t`), the signed operand (`ptrdiff_t`) is converted to the unsigned type (`size_t`).

### Consequences of Unsigned Comparison
This can lead to subtle bugs if `tmp_buf_end` is actually less than `tmp_buf`. In a signed comparison, `tmp_buf_end - tmp_buf` would be negative (e.g., `-1`), and `-1 < sizeof_cur_arg` would be true (assuming `sizeof_cur_arg > 0`). 

However, in an **unsigned comparison**:
*   The negative `ptrdiff_t` value is converted to a very large `size_t` value (e.g., `-1` becomes `SIZE_MAX`).
*   The comparison `SIZE_MAX < sizeof_cur_arg` will be **false** for any typical value of `sizeof_cur_arg`.

This specific pattern has been the source of security vulnerabilities in various software (including the Linux kernel in the past), where a bounds check was bypassed because a negative offset was treated as a very large positive value during an unsigned comparison.

gemini-3-flash-preview

							input: 2306
							output: 33
							thoughts: 351
						

**Analyzing a C Comparison in Kernel Context**

Okay, so I'm looking at this C expression: `tmp_buf_end - tmp_buf < sizeof_cur_arg`. My immediate thought is, "Is this an unsigned comparison?" Given that `tmp_buf_end` and `tmp_buf` are pointers and `sizeof_cur_arg` is a `size_t`, which is unsigned, that's the core question.

In standard C, the difference of two pointers gives you a `ptrdiff_t`, which is signed. The problem comes from comparing that signed `ptrdiff_t` to the unsigned `size_t`. The usual arithmetic conversions kick in. If `size_t` and `ptrdiff_t` have the same rank (which they usually do, both matching the pointer size), then the `ptrdiff_t` will be converted to `size_t` for the comparison. Therefore, yes, in most standard implementations, it *should* be an unsigned comparison.

But, I know better than to just assume. This is kernel code, so I need to verify. I need to make sure the types are as I expect them to be, especially if this is related to a specific code snippet or potentially a security vulnerability. That's what makes this interesting and reminds me of the kind of work I usually do. The mention of "researching complex questions about kernel source code" makes me think this isn't just a generic C question. It sounds like this could relate to a specific bug, a subtle overflow, or some tricky memory management pattern in the kernel. Therefore, I need to search the kernel source code for this specific expression, see where it appears, and understand the context. That's the best next step.

log-in to see details

map[Name:tmp_buf_end - tmp_buf < sizeof_cur_arg]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 3085
							output: 23
							thoughts: 58
						

**Navigating the Codebase**

Okay, so I'm trying to locate a specific expression within this codebase, but it's not popping up directly with a simple `codesearch-find-references`. That's a classic sign that it's probably not a standalone, self-contained unit. It's likely a composite thing, built up from several pieces. I need to be more strategic.

Alright, instead of looking for the whole thing, I'll break it down. Let's start with a focused search. Given what I'm dealing with, let's try searching for the component parts, specifically `tmp_buf_end - tmp_buf`. That should be a good starting point. Hopefully, that will lead me to the larger construct I am after.

log-in to see details

map[Name:tmp_buf_end]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 3351
							output: 23
							thoughts: 44
						

Okay, here's my take on those thoughts:

**Navigating the Prompt & Tool Use**

Alright, the wording of this prompt is a bit ambiguous – are they really after something specific, or just a general C programming question? The variable names are throwing me off, they might not be exactly what's used. But, the explicit instruction to use "tools" suggests I should dive into some research. Rather than guess, let's start with a focused search. Let's see what comes up if I search for something as specific as `sizeof_cur_arg`. That should at least give me a solid base to understand the intent.

log-in to see details

map[Name:sizeof_cur_arg]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 3574
							output: 18
							thoughts: 151
						

**Navigating the Codebase**

Okay, so I'm trying to locate something in this codebase, likely related to buffer management or the filesystem. My initial instinct was to reach for `grep` or a similar command-line tool, but I recall I don't have that directly available. However, I *do* have `codesearch-dir-index` and `codesearch-file-index`, which are probably sufficient for this task.

Given that I'm looking for usages of `tmp_buf`, I'm going to try to discover references to that specific string. It sounds like something related to temporary buffers in either a filesystem or memory management.

That said, before I go down that path, it might be more fruitful to get a broader understanding of the context. I think I'll look for comparisons between `ptrdiff_t` and `size_t` because those are often clues.

Wait a moment, I can probably search more efficiently using `codesearch-find-references`. But it requires an entity name! That might be more difficult than just searching the whole code base.

Okay, let's start simple. Let's see if I can find any file that even *contains* the string `tmp_buf`. That should be quick and might give me a good jumping-off point.

map[Dir:]

map[Files:<nil> Subdirs:[Documentation LICENSES arch block certs crypto drivers fs include init io_uring ipc kernel lib mm net rust samples scripts security sound tools usr virt]]

gemini-3-flash-preview

							input: 4134
							output: 21
							thoughts: 92
						

Okay, here's my thought process as I approach this.

**Investigating `tmp_buf` in Kernel Code**

Alright, so the task at hand involves this `tmp_buf` variable. My initial instinct is to dig into the `fs/` and `kernel/` directories – those are the usual suspects when dealing with low-level kernel operations and data handling. It's a pretty common pattern to find temporary buffers hanging around in those areas.

But, before I go brute-forcing it with a file system search, let me think a bit smarter. Rather than just searching for the name itself, I'll leverage my knowledge of the codebase and utilize `codesearch-find-references`. I'll try searching for references to a related, more general name, something that's likely to appear in the same function where `tmp_buf` might be used. This could help narrow down the scope significantly and identify relevant contexts.

Wait a second… the prompt is pretty specific. It zeroes in on the *expression* itself. That suggests this isn't just a generic variable name issue. It might be tied to a specific vulnerability, perhaps a recent CVE or a known bug that mentions `tmp_buf` in its description. Hmm, that's a good angle to consider.

Right, so, given that the search is expression specific, let's start by trying a more direct search for `tmp_buf` specifically as a variable name. Let's see what that yields first. I can refine my approach after I get some preliminary results.

log-in to see details

map[Name:tmp_buf]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 4594
							output: 24
							thoughts: 109
						

**Debugging a Mysterious Variable**

Okay, that's not what I expected at all. I was certain `codesearch-find-references` would flag that use of `sizeof_cur_arg`, but it's returning empty. Hmm, could this be a local variable that isn't indexed globally? `codesearch-find-references` isn't perfect, especially with scoping.

Alright, let's double-check. I'll search for `sizeof_cur_arg` again, just to be sure I didn't introduce a typo when typing it. Nope, still nothing.

Alright, let's widen the search a little. What about `tmp_buf_end`? Ah, still no joy.

Time to think this through. "cur_arg"... that screams argument parsing. Now, where is argument parsing typically handled in this codebase? My instincts are telling me to look in `fs/exec.c`. That seems like the most likely place based on the variable names. Let's start there.

map[SourceFile:fs/exec.c]

map[Entities:[map[Kind:function Name:__do_sys_execve] map[Kind:function Name:__do_sys_execveat] map[Kind:function Name:__register_binfmt] map[Kind:function Name:__se_sys_execve] map[Kind:function Name:__se_sys_execveat] map[Kind:function Name:__set_task_comm] map[Kind:function Name:__x64_sys_execve] map[Kind:function Name:__x64_sys_execveat] map[Kind:function Name:acct_arg_size] map[Kind:function Name:alloc_bprm] map[Kind:function Name:begin_new_exec] map[Kind:function Name:bprm_change_interp] map[Kind:function Name:bprm_creds_from_file] map[Kind:function Name:bprm_execve] map[Kind:function Name:bprm_fill_uid] map[Kind:function Name:bprm_hit_stack_limit] map[Kind:function Name:bprm_mm_init] map[Kind:function Name:bprm_set_stack_limit] map[Kind:function Name:bprm_stack_limits] map[Kind:function Name:check_unsafe_exec] map[Kind:function Name:class_bprm_constructor] map[Kind:function Name:class_bprm_destructor] map[Kind:function Name:copy_string_kernel] map[Kind:function Name:copy_strings] map[Kind:function Name:copy_strings_kernel] map[Kind:function Name:count] map[Kind:function Name:count_strings_kernel] map[Kind:function Name:de_thread] map[Kind:function Name:do_close_execat] map[Kind:function Name:do_execveat_common] map[Kind:function Name:do_open_execat] map[Kind:function Name:exec_binprm] map[Kind:function Name:exec_mmap] map[Kind:function Name:finalize_exec] map[Kind:function Name:flush_arg_page] map[Kind:function Name:free_arg_pages] map[Kind:function Name:free_bprm] map[Kind:function Name:get_arg_page] map[Kind:function Name:get_user_arg_ptr] map[Kind:function Name:init_fs_exec_sysctls] map[Kind:function Name:kernel_execve] map[Kind:function Name:native_arg] map[Kind:function Name:open_exec] map[Kind:function Name:path_noexec] map[Kind:function Name:prepare_binprm] map[Kind:function Name:prepare_bprm_creds] map[Kind:function Name:proc_dointvec_minmax_coredump] map[Kind:function Name:put_arg_page] map[Kind:function Name:put_binfmt] map[Kind:function Name:remove_arg_zero] map[Kind:function Name:search_binary_handler] map[Kind:function Name:set_binfmt] map[Kind:function Name:set_dumpable] map[Kind:function Name:setup_arg_pages] map[Kind:function Name:setup_new_exec] map[Kind:function Name:unregister_binfmt] map[Kind:function Name:unshare_sighand] map[Kind:function Name:valid_arg_len] map[Kind:function Name:would_dump] map[Kind:struct Name:user_arg_ptr] map[Kind:global_variable Name:__UNIQUE_ID_addressable___register_binfmt_885] map[Kind:global_variable Name:__UNIQUE_ID_addressable_begin_new_exec_918] map[Kind:global_variable Name:__UNIQUE_ID_addressable_bprm_change_interp_922] map[Kind:global_variable Name:__UNIQUE_ID_addressable_copy_string_kernel_903] map[Kind:global_variable Name:__UNIQUE_ID_addressable_finalize_exec_921] map[Kind:global_variable Name:__UNIQUE_ID_addressable_init_fs_exec_sysctls_928] map[Kind:global_variable Name:__UNIQUE_ID_addressable_open_exec_908] map[Kind:global_variable Name:__UNIQUE_ID_addressable_remove_arg_zero_925] map[Kind:global_variable Name:__UNIQUE_ID_addressable_set_binfmt_926] map[Kind:global_variable Name:__UNIQUE_ID_addressable_setup_arg_pages_907] map[Kind:global_variable Name:__UNIQUE_ID_addressable_setup_new_exec_920] map[Kind:global_variable Name:__UNIQUE_ID_addressable_unregister_binfmt_886] map[Kind:global_variable Name:__UNIQUE_ID_addressable_would_dump_919] map[Kind:global_variable Name:binfmt_lock] map[Kind:global_variable Name:formats] map[Kind:global_variable Name:fs_exec_sysctls] map[Kind:global_variable Name:suid_dumpable] map[Kind:typedef Name:class_bprm_t] map[Kind:typedef Name:lock_bprm_t]]]

gemini-3-flash-preview

							input: 6440
							output: 27
							thoughts: 1160
						

**Analyzing the Arithmetic Conversion in a C Comparison**

Okay, so I'm presented with a comparison involving `tmp_buf_end - tmp_buf` and `sizeof_cur_arg`. I don't immediately see the variables in the immediate context, so I need to figure out the types and whether the comparison is unsigned. Let's start with where these might be located, maybe in a `drivers/` directory, I can search for `tmp_buf` within it. I could try `codesearch-find-references` to see if those variable are referenced anywhere. Even try `codesearch-find-references` on the name of the buffer. If that doesn't yield anything, I'll fall back to C rules.

First, let's determine the types involved. `tmp_buf_end - tmp_buf` is a `ptrdiff_t` (signed), and `sizeof_cur_arg` is a `size_t` (unsigned), by definition, which is critical. The question hinges on if that difference results in an unsigned comparison. So, based on C99/C11/C17, Section 6.3.1.8 ("Usual arithmetic conversions"), I know that if the operands have the same rank and one is signed and the other is unsigned, the signed operand is converted to the unsigned type.

`ptrdiff_t` and `size_t` typically have the same rank on modern systems (e.g., both 64-bit on 64-bit systems, or 32-bit on 32-bit systems). If `ptrdiff_t` is converted to `size_t`, it becomes an unsigned comparison, and any negative result from the subtraction would wrap around to a very large positive `size_t` value.

The question explicitly asks if it *is* an unsigned comparison. The answer is yes. It's an unsigned comparison due to the usual arithmetic conversions.

To make absolutely sure, I'd like to see an example to confirm the types. I'll need to double check the type of `ptrdiff_t` and `size_t`, or where they are used. Even try to search for the variables in `fs/`.

So, even though I don't have the context of the code, I know the answer: yes, this *is* an unsigned comparison due to the implicit type conversion in C.

map[SourceFile:fs/binfmt_elf.c]

map[Entities:[map[Kind:function Name:__fill_note] map[Kind:function Name:arch_check_elf] map[Kind:function Name:arch_elf_pt_proc] map[Kind:function Name:create_elf_tables] map[Kind:function Name:do_thread_regset_writeback] map[Kind:function Name:elf_core_dump] map[Kind:function Name:elf_coredump_get_mm_eflags] map[Kind:function Name:elf_coredump_set_mm_eflags] map[Kind:function Name:elf_load] map[Kind:function Name:elf_map] map[Kind:function Name:elf_read] map[Kind:function Name:exit_elf_binfmt] map[Kind:function Name:fill_auxv_note] map[Kind:function Name:fill_elf_header] map[Kind:function Name:fill_elf_note_phdr] map[Kind:function Name:fill_extnum_info] map[Kind:function Name:fill_files_note] map[Kind:function Name:fill_note_info] map[Kind:function Name:fill_prstatus] map[Kind:function Name:fill_psinfo] map[Kind:function Name:fill_siginfo_note] map[Kind:function Name:fill_thread_core_info] map[Kind:function Name:free_note_info] map[Kind:function Name:init_elf_binfmt] map[Kind:function Name:load_elf_binary] map[Kind:function Name:load_elf_interp] map[Kind:function Name:load_elf_phdrs] map[Kind:function Name:make_prot] map[Kind:function Name:maximum_alignment] map[Kind:function Name:notesize] map[Kind:function Name:padzero] map[Kind:function Name:parse_elf_properties] map[Kind:function Name:parse_elf_property] map[Kind:function Name:total_mapping_size] map[Kind:function Name:write_note_info] map[Kind:function Name:writenote] map[Kind:struct Name:arch_elf_state] map[Kind:struct Name:elf_note_info] map[Kind:struct Name:elf_thread_core_info] map[Kind:struct Name:memelfnote] map[Kind:global_variable Name:__UNIQUE_ID_addressable_init_elf_binfmt_537] map[Kind:global_variable Name:__exitcall_exit_elf_binfmt] map[Kind:global_variable Name:elf_format]]]

gemini-3-flash-preview

							input: 8881
							output: 26
							thoughts: 24
						

Okay, here's my summary, tailored as if I'm an expert in the field thinking through this:

**Where Am I?**

Hmm, I'm drawing a blank. Not immediately obvious where to start this particular investigation. My mind is casting about... Let's see... thinking about file systems... Okay, my gut says start with the proc filesystem. That's a reasonable place to look for system information and process data. Perhaps there are some low-level internals to glean. Let me probe around the `/proc/` mountpoint. Specifically, `fs/proc/` sounds familiar, a good starting point to explore. And... Yes, that rings a bell! It feels like `fs/proc/base.c` is the most obvious candidate for some core proc filesystem functionality. Let's see what that file might contain, and if that gives me a better idea of the state of things.

map[SourceFile:fs/proc/base.c]

map[Entities:[map[Kind:function Name:__mem_open] map[Kind:function Name:__set_oom_adj] map[Kind:function Name:auxv_open] map[Kind:function Name:auxv_read] map[Kind:function Name:comm_open] map[Kind:function Name:comm_show] map[Kind:function Name:comm_write] map[Kind:function Name:dname_to_vma_addr] map[Kind:function Name:do_io_accounting] map[Kind:function Name:do_proc_readlink] map[Kind:function Name:early_proc_mem_force_override] map[Kind:function Name:environ_open] map[Kind:function Name:environ_read] map[Kind:function Name:first_tid] map[Kind:function Name:get_mm_cmdline] map[Kind:function Name:get_mm_proctitle] map[Kind:function Name:get_task_cmdline] map[Kind:function Name:get_task_root] map[Kind:function Name:has_pid_permissions] map[Kind:function Name:lock_trace] map[Kind:function Name:map_files_d_revalidate] map[Kind:function Name:map_files_get_link] map[Kind:function Name:mem_lseek] map[Kind:function Name:mem_open] map[Kind:function Name:mem_read] map[Kind:function Name:mem_release] map[Kind:function Name:mem_rw] map[Kind:function Name:mem_write] map[Kind:function Name:next_tgid] map[Kind:function Name:next_tid] map[Kind:function Name:oom_adj_read] map[Kind:function Name:oom_adj_write] map[Kind:function Name:oom_score_adj_read] map[Kind:function Name:oom_score_adj_write] map[Kind:function Name:pid_delete_dentry] map[Kind:function Name:pid_entry_nlink] map[Kind:function Name:pid_getattr] map[Kind:function Name:pid_revalidate] map[Kind:function Name:pid_update_inode] map[Kind:function Name:proc_attr_dir_lookup] map[Kind:function Name:proc_attr_dir_readdir] map[Kind:function Name:proc_coredump_filter_read] map[Kind:function Name:proc_coredump_filter_write] map[Kind:function Name:proc_cwd_link] map[Kind:function Name:proc_dir_llseek] map[Kind:function Name:proc_exe_link] map[Kind:function Name:proc_fail_nth_read] map[Kind:function Name:proc_fail_nth_write] map[Kind:function Name:proc_fault_inject_read] map[Kind:function Name:proc_fault_inject_write] map[Kind:function Name:proc_fd_access_allowed] map[Kind:function Name:proc_fill_cache] map[Kind:function Name:proc_flush_pid] map[Kind:function Name:proc_gid_map_open] map[Kind:function Name:proc_id_map_open] map[Kind:function Name:proc_id_map_release] map[Kind:function Name:proc_inode_is_dead] map[Kind:function Name:proc_loginuid_read] map[Kind:function Name:proc_loginuid_write] map[Kind:function Name:proc_map_files_get_link] map[Kind:function Name:proc_map_files_instantiate] map[Kind:function Name:proc_map_files_lookup] map[Kind:function Name:proc_map_files_readdir] map[Kind:function Name:proc_mem_foll_force] map[Kind:function Name:proc_mem_open] map[Kind:function Name:proc_nochmod_setattr] map[Kind:function Name:proc_oom_score] map[Kind:function Name:proc_pid_attr_open] map[Kind:function Name:proc_pid_attr_read] map[Kind:function Name:proc_pid_attr_write] map[Kind:function Name:proc_pid_cmdline_read] map[Kind:function Name:proc_pid_evict_inode] map[Kind:function Name:proc_pid_get_link] map[Kind:function Name:proc_pid_instantiate] map[Kind:function Name:proc_pid_ksm_merging_pages] map[Kind:function Name:proc_pid_ksm_stat] map[Kind:function Name:proc_pid_limits] map[Kind:function Name:proc_pid_lookup] map[Kind:function Name:proc_pid_make_base_inode] map[Kind:function Name:proc_pid_make_inode] map[Kind:function Name:proc_pid_permission] map[Kind:function Name:proc_pid_personality] map[Kind:function Name:proc_pid_readdir] map[Kind:function Name:proc_pid_readlink] map[Kind:function Name:proc_pid_schedstat] map[Kind:function Name:proc_pid_stack] map[Kind:function Name:proc_pid_syscall] map[Kind:function Name:proc_pid_wchan] map[Kind:function Name:proc_pident_instantiate] map[Kind:function Name:proc_pident_lookup] map[Kind:function Name:proc_pident_readdir] map[Kind:function Name:proc_projid_map_open] map[Kind:function Name:proc_root_link] map[Kind:function Name:proc_sessionid_read] map[Kind:function Name:proc_setgroups_open] map[Kind:function Name:proc_setgroups_release] map[Kind:function Name:proc_single_open] map[Kind:function Name:proc_single_show] map[Kind:function Name:proc_smack_attr_dir_iterate] map[Kind:function Name:proc_smack_attr_dir_lookup] map[Kind:function Name:proc_task_getattr] map[Kind:function Name:proc_task_instantiate] map[Kind:function Name:proc_task_lookup] map[Kind:function Name:proc_task_readdir] map[Kind:function Name:proc_tgid_base_lookup] map[Kind:function Name:proc_tgid_base_readdir] map[Kind:function Name:proc_tgid_io_accounting] map[Kind:function Name:proc_tid_base_lookup] map[Kind:function Name:proc_tid_base_readdir] map[Kind:function Name:proc_tid_comm_permission] map[Kind:function Name:proc_tid_io_accounting] map[Kind:function Name:proc_timers_open] map[Kind:function Name:proc_uid_map_open] map[Kind:function Name:sched_autogroup_open] map[Kind:function Name:sched_autogroup_show] map[Kind:function Name:sched_autogroup_write] map[Kind:function Name:sched_open] map[Kind:function Name:sched_show] map[Kind:function Name:sched_write] map[Kind:function Name:set_proc_pid_nlink] map[Kind:function Name:show_timer] map[Kind:function Name:task_dump_owner] map[Kind:function Name:tgid_pidfd_to_pid] map[Kind:function Name:timens_offsets_open] map[Kind:function Name:timens_offsets_show] map[Kind:function Name:timens_offsets_write] map[Kind:function Name:timers_next] map[Kind:function Name:timers_start] map[Kind:function Name:timers_stop] map[Kind:function Name:timerslack_ns_open] map[Kind:function Name:timerslack_ns_show] map[Kind:function Name:timerslack_ns_write] map[Kind:function Name:unlock_trace] map[Kind:struct Name:limit_names] map[Kind:struct Name:map_files_info] map[Kind:struct Name:pid_entry] map[Kind:struct Name:tgid_iter] map[Kind:struct Name:timers_private] map[Kind:global_variable Name:__setup_early_proc_mem_force_override] map[Kind:global_variable Name:__setup_str_early_proc_mem_force_override] map[Kind:global_variable Name:attr_dir_stuff] map[Kind:global_variable Name:lnames] map[Kind:global_variable Name:pid_dentry_operations] map[Kind:global_variable Name:proc_attr_dir_inode_operations] map[Kind:global_variable Name:proc_attr_dir_operations] map[Kind:global_variable Name:proc_auxv_operations] map[Kind:global_variable Name:proc_coredump_filter_operations] map[Kind:global_variable Name:proc_def_inode_operations] map[Kind:global_variable Name:proc_environ_operations] map[Kind:global_variable Name:proc_fail_nth_operations] map[Kind:global_variable Name:proc_fault_inject_operations] map[Kind:global_variable Name:proc_gid_map_operations] map[Kind:global_variable Name:proc_loginuid_operations] map[Kind:global_variable Name:proc_map_files_inode_operations] map[Kind:global_variable Name:proc_map_files_link_inode_operations] map[Kind:global_variable Name:proc_map_files_operations] map[Kind:global_variable Name:proc_mem_force_override] map[Kind:global_variable Name:proc_mem_force_table] map[Kind:global_variable Name:proc_mem_operations] map[Kind:global_variable Name:proc_oom_adj_operations] map[Kind:global_variable Name:proc_oom_score_adj_operations] map[Kind:global_variable Name:proc_pid_attr_operations] map[Kind:global_variable Name:proc_pid_cmdline_ops] map[Kind:global_variable Name:proc_pid_link_inode_operations] map[Kind:global_variable Name:proc_pid_sched_autogroup_operations] map[Kind:global_variable Name:proc_pid_sched_operations] map[Kind:global_variable Name:proc_pid_set_comm_operations] map[Kind:global_variable Name:proc_pid_set_timerslack_ns_operations] map[Kind:global_variable Name:proc_projid_map_operations] map[Kind:global_variable Name:proc_sessionid_operations] map[Kind:global_variable Name:proc_setgroups_operations] map[Kind:global_variable Name:proc_single_file_operations] map[Kind:global_variable Name:proc_smack_attr_dir_inode_ops] map[Kind:global_variable Name:proc_smack_attr_dir_ops] map[Kind:global_variable Name:proc_task_inode_operations] map[Kind:global_variable Name:proc_task_operations] map[Kind:global_variable Name:proc_tgid_base_inode_operations] map[Kind:global_variable Name:proc_tgid_base_operations] map[Kind:global_variable Name:proc_tid_base_inode_operations] map[Kind:global_variable Name:proc_tid_base_operations] map[Kind:global_variable Name:proc_tid_comm_inode_operations] map[Kind:global_variable Name:proc_timens_offsets_operations] map[Kind:global_variable Name:proc_timers_operations] map[Kind:global_variable Name:proc_timers_seq_ops] map[Kind:global_variable Name:proc_uid_map_operations] map[Kind:global_variable Name:smack_attr_dir_stuff] map[Kind:global_variable Name:tgid_base_stuff] map[Kind:global_variable Name:tid_base_stuff] map[Kind:global_variable Name:tid_map_files_dentry_operations] map[Kind:enum Name:proc_mem_force]]]

gemini-3-flash-preview

							input: 12520
							output: 44
							thoughts: 24
						

Here's my take on those thoughts, tailored for an expert audience:

**Diving into the Process Command Line Read**

Okay, so I need to understand how the `/proc/[pid]/cmdline` file works. My instinct is to head straight for the kernel source. Specifically, the function responsible for handling the read operation: `proc_pid_cmdline_read`. I expect it'll be defined in `fs/proc/base.c`. That file's usually the go-to for process-related procfs entries, and the naming convention suggests the right place. I'm curious about the mechanics here – how does the kernel sanitize potentially sensitive or malicious data, how's the command line formatted, and what's the access control like? Time to dig in and see how it's handled at the lowest level. I'm expecting some interesting edge cases to explore, things like how the kernel deals with argument lists exceeding the maximum length allowed, potential race conditions and so on. Let's see if the code has anything interesting or unexpected to offer.

map[ContextFile:fs/proc/base.c IncludeLines:true Name:proc_pid_cmdline_read]

map[SourceCode: 393:	static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
 394:					     size_t count, loff_t *pos)
 395:	{
 396:		struct task_struct *tsk;
 397:		ssize_t ret;
 398:	
 399:		BUG_ON(*pos < 0);
 400:	
 401:		tsk = get_proc_task(file_inode(file));
 402:		if (!tsk)
 403:			return -ESRCH;
 404:		ret = get_task_cmdline(tsk, buf, count, pos);
 405:		put_task_struct(tsk);
 406:		if (ret > 0)
 407:			*pos += ret;
 408:		return ret;
 409:	}
 SourceFile:fs/proc/base.c]

gemini-3-flash-preview

							input: 13086
							output: 42
							thoughts: 16
						

Okay, here's my summarized thought process, presented as if I'm the one thinking it:

**Analyzing the Function Call**

Alright, the code's calling `get_task_cmdline`. That function name rings a bell... it's clearly crucial to understanding how a specific task's command-line is being handled. I need to dig into `get_task_cmdline` immediately. Let's start by examining the definition and where it's called from. I'm already anticipating some interesting edge cases, depending on how this is implemented.

map[ContextFile:fs/proc/base.c IncludeLines:true Name:get_task_cmdline]

map[SourceCode: 378:	static ssize_t get_task_cmdline(struct task_struct *tsk, char __user *buf,
 379:					size_t count, loff_t *pos)
 380:	{
 381:		struct mm_struct *mm;
 382:		ssize_t ret;
 383:	
 384:		mm = get_task_mm(tsk);
 385:		if (!mm)
 386:			return 0;
 387:	
 388:		ret = get_mm_cmdline(mm, buf, count, pos);
 389:		mmput(mm);
 390:		return ret;
 391:	}
 SourceFile:fs/proc/base.c]

gemini-3-flash-preview

							input: 13486
							output: 42
							thoughts: 10
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Analyzing the Function Call: `get_mm_cmdline`**

Right, so the system is calling `get_mm_cmdline`. That immediately signals a focus on memory management and the command-line arguments related to that. My initial thought process revolves around the specifics of this function: What's the context? What's the target platform? Knowing those details is crucial for assessing its purpose. Is it retrieving kernel command-line parameters for memory tuning, debugging, or system configuration? Or perhaps it's concerned with user-space memory management via specific application launch options? Depending on the architecture, the retrieval method could vary greatly. Are we dealing with something reading from `/proc/cmdline`, or a more specialized interface? Understanding the underlying implementation is key to interpreting the implications of this call. The possibilities range from something as basic as reading a static configuration file, to interfacing with complex firmware or hardware registers. My brain immediately starts formulating hypotheses.

map[ContextFile:fs/proc/base.c IncludeLines:true Name:get_mm_cmdline]

map[SourceCode: 291:	static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 292:				      size_t count, loff_t *ppos)
 293:	{
 294:		unsigned long arg_start, arg_end, env_start, env_end;
 295:		unsigned long pos, len;
 296:		char *page, c;
 297:	
 298:		/* Check if process spawned far enough to have cmdline. */
 299:		if (!mm->env_end)
 300:			return 0;
 301:	
 302:		spin_lock(&mm->arg_lock);
 303:		arg_start = mm->arg_start;
 304:		arg_end = mm->arg_end;
 305:		env_start = mm->env_start;
 306:		env_end = mm->env_end;
 307:		spin_unlock(&mm->arg_lock);
 308:	
 309:		if (arg_start >= arg_end)
 310:			return 0;
 311:	
 312:		/*
 313:		 * We allow setproctitle() to overwrite the argument
 314:		 * strings, and overflow past the original end. But
 315:		 * only when it overflows into the environment area.
 316:		 */
 317:		if (env_start != arg_end || env_end < env_start)
 318:			env_start = env_end = arg_end;
 319:		len = env_end - arg_start;
 320:	
 321:		/* We're not going to care if "*ppos" has high bits set */
 322:		pos = *ppos;
 323:		if (pos >= len)
 324:			return 0;
 325:		if (count > len - pos)
 326:			count = len - pos;
 327:		if (!count)
 328:			return 0;
 329:	
 330:		/*
 331:		 * Magical special case: if the argv[] end byte is not
 332:		 * zero, the user has overwritten it with setproctitle(3).
 333:		 *
 334:		 * Possible future enhancement: do this only once when
 335:		 * pos is 0, and set a flag in the 'struct file'.
 336:		 */
 337:		if (access_remote_vm(mm, arg_end-1, &c, 1, FOLL_ANON) == 1 && c)
 338:			return get_mm_proctitle(mm, buf, count, pos, arg_start);
 339:	
 340:		/*
 341:		 * For the non-setproctitle() case we limit things strictly
 342:		 * to the [arg_start, arg_end[ range.
 343:		 */
 344:		pos += arg_start;
 345:		if (pos < arg_start || pos >= arg_end)
 346:			return 0;
 347:		if (count > arg_end - pos)
 348:			count = arg_end - pos;
 349:	
 350:		page = (char *)__get_free_page(GFP_KERNEL);
 351:		if (!page)
 352:			return -ENOMEM;
 353:	
 354:		len = 0;
 355:		while (count) {
 356:			int got;
 357:			size_t size = min_t(size_t, PAGE_SIZE, count);
 358:	
 359:			got = access_remote_vm(mm, pos, page, size, FOLL_ANON);
 360:			if (got <= 0)
 361:				break;
 362:			got -= copy_to_user(buf, page, got);
 363:			if (unlikely(!got)) {
 364:				if (!len)
 365:					len = -EFAULT;
 366:				break;
 367:			}
 368:			pos += got;
 369:			buf += got;
 370:			len += got;
 371:			count -= got;
 372:		}
 373:	
 374:		free_page((unsigned long)page);
 375:		return len;
 376:	}
 SourceFile:fs/proc/base.c]

gemini-3-flash-preview

							input: 15031
							output: 20
							thoughts: 68
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, and delivered as a first-person summary:

**Digging Deeper for That Elusive Expression**

Right, this initial search didn't yield the specific expression I was expecting. Seems like a dead end for now. I need to broaden my scope. Given that this is kernel code, the term isn't a likely candidate to be declared or defined in user-space code.

My next step is to initiate a deeper dive. I'll rerun the search for `tmp_buf` in the kernel source, but this time I'll make it much more comprehensive. Instead of focusing on specific files at first, I'm going to leverage `codesearch-dir-index` and apply it to the `kernel/` and `lib/` directories, to perform a global sweep. I'm aiming to identify *any* file, no matter how obscure, that might contain a reference to that variable or struct. This more aggressive search strategy should flush out any hidden definitions or uses, even if they're indirect or in a more specialized subsystem. Hopefully, this broader search will yield some new leads.

map[Dir:kernel/]

map[Files:[acct.c async.c audit.c audit.h audit_fsnotify.c audit_tree.c audit_watch.c auditfilter.c auditsc.c backtracetest.c bounds.c capability.c cfi.c compat.c configs.c context_tracking.c cpu.c cpu_pm.c crash_core.c crash_core_test.c crash_dump_dm_crypt.c crash_reserve.c cred.c delayacct.c dma.c elfcorehdr.c exec_domain.c exit.c exit.h extable.c fail_function.c fork.c freezer.c groups.c hung_task.c iomem.c irq_work.c jump_label.c kallsyms.c kallsyms_internal.h kallsyms_selftest.c kallsyms_selftest.h kcmp.c kcov.c kexec.c kexec_core.c kexec_elf.c kexec_file.c kexec_internal.h kheaders.c kprobes.c kstack_erase.c ksyms_common.c ksysfs.c kthread.c latencytop.c module_signature.c notifier.c nscommon.c nsproxy.c nstree.c padata.c panic.c params.c pid.c pid_namespace.c pid_sysctl.h profile.c ptrace.c range.c reboot.c regset.c relay.c resource.c resource_kunit.c rseq.c scftorture.c scs.c seccomp.c signal.c smp.c smpboot.c smpboot.h softirq.c stacktrace.c static_call.c static_call_inline.c stop_machine.c sys.c sys_ni.c sysctl-test.c sysctl.c task_work.c taskstats.c torture.c tracepoint.c tsacct.c ucount.c uid16.c uid16.h umh.c up.c user-return-notifier.c user.c user_namespace.c utsname.c utsname_sysctl.c vhost_task.c vmcore_info.c watch_queue.c watchdog.c watchdog_buddy.c watchdog_perf.c workqueue.c workqueue_internal.h] Subdirs:[bpf cgroup configs debug dma entry events futex gcov irq kcsan livepatch liveupdate locking module power printk rcu sched time trace unwind]]

gemini-3-flash-preview

							input: 16363
							output: 24
							thoughts: 11
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Diving into Kernel Parameters**

Alright, time to roll up my sleeves. The issue at hand is likely manifesting in system behavior governed by kernel parameters. My first thought is to zero in on `kernel/params.c`. This is the logical starting point – the heart of where tunable kernel parameters are defined, initialized, and potentially modified at runtime. I need to understand how the system's runtime configurations interact with the broader system functionality, so this file is the key to understanding all of the options that could be contributing to the specific performance issue, and how they interact. Analyzing that code will give me a better understanding of the possible sources of a particular system behavior.

map[SourceFile:kernel/params.c]

map[Entities:[map[Kind:function Name:__modver_version_show] map[Kind:function Name:add_sysfs_param] map[Kind:function Name:check_kparam_locked] map[Kind:function Name:dash2underscore] map[Kind:function Name:free_module_param_attrs] map[Kind:function Name:kernel_add_sysfs_param] map[Kind:function Name:kernel_param_lock] map[Kind:function Name:kernel_param_unlock] map[Kind:function Name:kmalloc_parameter] map[Kind:function Name:lookup_or_create_module_kobject] map[Kind:function Name:maybe_kfree_parameter] map[Kind:function Name:module_attr_show] map[Kind:function Name:module_attr_store] map[Kind:function Name:module_destroy_params] map[Kind:function Name:module_kobj_release] map[Kind:function Name:module_param_sysfs_remove] map[Kind:function Name:module_param_sysfs_setup] map[Kind:function Name:param_array] map[Kind:function Name:param_array_free] map[Kind:function Name:param_array_get] map[Kind:function Name:param_array_set] map[Kind:function Name:param_attr_show] map[Kind:function Name:param_attr_store] map[Kind:function Name:param_check_unsafe] map[Kind:function Name:param_free_charp] map[Kind:function Name:param_get_bool] map[Kind:function Name:param_get_byte] map[Kind:function Name:param_get_charp] map[Kind:function Name:param_get_hexint] map[Kind:function Name:param_get_int] map[Kind:function Name:param_get_invbool] map[Kind:function Name:param_get_long] map[Kind:function Name:param_get_short] map[Kind:function Name:param_get_string] map[Kind:function Name:param_get_uint] map[Kind:function Name:param_get_ullong] map[Kind:function Name:param_get_ulong] map[Kind:function Name:param_get_ushort] map[Kind:function Name:param_set_bint] map[Kind:function Name:param_set_bool] map[Kind:function Name:param_set_bool_enable_only] map[Kind:function Name:param_set_byte] map[Kind:function Name:param_set_charp] map[Kind:function Name:param_set_copystring] map[Kind:function Name:param_set_hexint] map[Kind:function Name:param_set_int] map[Kind:function Name:param_set_invbool] map[Kind:function Name:param_set_long] map[Kind:function Name:param_set_short] map[Kind:function Name:param_set_uint] map[Kind:function Name:param_set_uint_minmax] map[Kind:function Name:param_set_ullong] map[Kind:function Name:param_set_ulong] map[Kind:function Name:param_set_ushort] map[Kind:function Name:param_sysfs_builtin] map[Kind:function Name:param_sysfs_builtin_init] map[Kind:function Name:param_sysfs_init] map[Kind:function Name:parameq] map[Kind:function Name:parameqn] map[Kind:function Name:parse_args] map[Kind:function Name:parse_one] map[Kind:function Name:uevent_filter] map[Kind:function Name:version_sysfs_builtin] map[Kind:struct Name:kmalloced_param] map[Kind:struct Name:module_param_attrs] map[Kind:struct Name:param_attribute] map[Kind:global_variable Name:__UNIQUE_ID_addressable_kernel_param_lock_527] map[Kind:global_variable Name:__UNIQUE_ID_addressable_kernel_param_unlock_528] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_array_ops_523] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_free_charp_511] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_bool_514] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_byte_482] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_charp_510] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_hexint_506] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_int_491] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_invbool_519] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_long_497] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_short_485] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_string_525] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_uint_494] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_ullong_503] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_ulong_500] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_get_ushort_488] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_bint_522] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_bool_515] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_bool_enable_only_517] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_byte_483] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_charp_512] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_hexint_507] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_int_492] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_invbool_520] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_long_498] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_short_486] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_string_526] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_uint_495] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_ullong_504] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_ulong_501] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_ops_ushort_489] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_bint_521] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_bool_513] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_bool_enable_only_516] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_byte_481] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_charp_509] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_copystring_524] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_hexint_505] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_int_490] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_invbool_518] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_long_496] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_short_484] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_uint_493] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_uint_minmax_508] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_ullong_502] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_ulong_499] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_set_ushort_487] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_sysfs_builtin_init_532] map[Kind:global_variable Name:__UNIQUE_ID_addressable_param_sysfs_init_530] map[Kind:global_variable Name:kmalloced_params] map[Kind:global_variable Name:kmalloced_params_lock] map[Kind:global_variable Name:module_ktype] map[Kind:global_variable Name:module_sysfs_ops] map[Kind:global_variable Name:module_uevent_ops] map[Kind:global_variable Name:param_array_ops] map[Kind:global_variable Name:param_lock] map[Kind:global_variable Name:param_ops_bint] map[Kind:global_variable Name:param_ops_bool] map[Kind:global_variable Name:param_ops_bool_enable_only] map[Kind:global_variable Name:param_ops_byte] map[Kind:global_variable Name:param_ops_charp] map[Kind:global_variable Name:param_ops_hexint] map[Kind:global_variable Name:param_ops_int] map[Kind:global_variable Name:param_ops_invbool] map[Kind:global_variable Name:param_ops_long] map[Kind:global_variable Name:param_ops_short] map[Kind:global_variable Name:param_ops_string] map[Kind:global_variable Name:param_ops_uint] map[Kind:global_variable Name:param_ops_ullong] map[Kind:global_variable Name:param_ops_ulong] map[Kind:global_variable Name:param_ops_ushort]]]

gemini-3-flash-preview

							input: 19596
							output: 37
							thoughts: 61
						

**Delving into a Potential Kernel Bug**

Okay, so this question has definitely sparked something. My initial hunch is that we're dealing with a bug related to file system execution, perhaps within `fs/exec.c` or something analogous. That's a reasonable starting point, and I've seen some head-scratchers there in the past.

Wait a second... a memory jogged! I *think* I recall something specifically about `copy_strings` inside `fs/exec.c`. Yes, that function, I have a vague recall of having issues with that in a previous project or review. Time to refresh that memory.

Alright, let's circle back to `fs/exec.c` and zero in on the `copy_strings` function. It's time to dig in and see if this rings any bells or provides a clue to the root cause.

map[ContextFile:fs/exec.c IncludeLines:true Name:copy_strings]

map[SourceCode: 443:	/*
 444:	 * 'copy_strings()' copies argument/environment strings from the old
 445:	 * processes's memory to the new process's stack.  The call to get_user_pages()
 446:	 * ensures the destination page is created and not swapped out.
 447:	 */
 448:	static int copy_strings(int argc, struct user_arg_ptr argv,
 449:				struct linux_binprm *bprm)
 450:	{
 451:		struct page *kmapped_page = NULL;
 452:		char *kaddr = NULL;
 453:		unsigned long kpos = 0;
 454:		int ret;
 455:	
 456:		while (argc-- > 0) {
 457:			const char __user *str;
 458:			int len;
 459:			unsigned long pos;
 460:	
 461:			ret = -EFAULT;
 462:			str = get_user_arg_ptr(argv, argc);
 463:			if (IS_ERR(str))
 464:				goto out;
 465:	
 466:			len = strnlen_user(str, MAX_ARG_STRLEN);
 467:			if (!len)
 468:				goto out;
 469:	
 470:			ret = -E2BIG;
 471:			if (!valid_arg_len(bprm, len))
 472:				goto out;
 473:	
 474:			/* We're going to work our way backwards. */
 475:			pos = bprm->p;
 476:			str += len;
 477:			bprm->p -= len;
 478:			if (bprm_hit_stack_limit(bprm))
 479:				goto out;
 480:	
 481:			while (len > 0) {
 482:				int offset, bytes_to_copy;
 483:	
 484:				if (fatal_signal_pending(current)) {
 485:					ret = -ERESTARTNOHAND;
 486:					goto out;
 487:				}
 488:				cond_resched();
 489:	
 490:				offset = pos % PAGE_SIZE;
 491:				if (offset == 0)
 492:					offset = PAGE_SIZE;
 493:	
 494:				bytes_to_copy = offset;
 495:				if (bytes_to_copy > len)
 496:					bytes_to_copy = len;
 497:	
 498:				offset -= bytes_to_copy;
 499:				pos -= bytes_to_copy;
 500:				str -= bytes_to_copy;
 501:				len -= bytes_to_copy;
 502:	
 503:				if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
 504:					struct page *page;
 505:	
 506:					page = get_arg_page(bprm, pos, 1);
 507:					if (!page) {
 508:						ret = -E2BIG;
 509:						goto out;
 510:					}
 511:	
 512:					if (kmapped_page) {
 513:						flush_dcache_page(kmapped_page);
 514:						kunmap_local(kaddr);
 515:						put_arg_page(kmapped_page);
 516:					}
 517:					kmapped_page = page;
 518:					kaddr = kmap_local_page(kmapped_page);
 519:					kpos = pos & PAGE_MASK;
 520:					flush_arg_page(bprm, kpos, kmapped_page);
 521:				}
 522:				if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
 523:					ret = -EFAULT;
 524:					goto out;
 525:				}
 526:			}
 527:		}
 528:		ret = 0;
 529:	out:
 530:		if (kmapped_page) {
 531:			flush_dcache_page(kmapped_page);
 532:			kunmap_local(kaddr);
 533:			put_arg_page(kmapped_page);
 534:		}
 535:		return ret;
 536:	}
 SourceFile:fs/exec.c]

gemini-3-flash-preview

							input: 21177
							output: 25
							thoughts: 197
						

**Navigating the Labyrinth of Variable Names**

Okay, still hitting a wall trying to pinpoint these elusive variable names. I'm going to revisit that `tmp_buf` concept. Instead of just searching for the variable itself, I'll use `codesearch-find-references` again, but this time I'll think about searching for it as a string, too. It's often the case.

Maybe I'll limit the search to the `drivers/staging/` directory. That seems like a logical place to start digging deeper. Hmm, on second thought, I was considering searching for the expression `tmp_buf_end - tmp_buf`, but I can't do that with the current tools. Time to rethink this approach.

Back to square one; let me revisit `sizeof_cur_arg`. Maybe it's a variation, like `sizeof_arg`?

Wait a second... hold on... I remember a similar pattern, wasn't there a known vulnerability, CVE-2023-31248 or something like that? No, that's not right. Let me pivot and see what I can find in `kernel/auditsc.c`. I have a feeling that file has some complex argument handling that might reveal the answer.

map[SourceFile:kernel/auditsc.c]

map[Entities:[map[Kind:function Name:__audit_bprm] map[Kind:function Name:__audit_fanotify] map[Kind:function Name:__audit_fd_pair] map[Kind:function Name:__audit_file] map[Kind:function Name:__audit_filter_op] map[Kind:function Name:__audit_free] map[Kind:function Name:__audit_getname] map[Kind:function Name:__audit_inode] map[Kind:function Name:__audit_inode_child] map[Kind:function Name:__audit_ipc_obj] map[Kind:function Name:__audit_ipc_set_perm] map[Kind:function Name:__audit_log_bprm_fcaps] map[Kind:function Name:__audit_log_capset] map[Kind:function Name:__audit_log_kern_module] map[Kind:function Name:__audit_log_nfcfg] map[Kind:function Name:__audit_mmap_fd] map[Kind:function Name:__audit_mq_getsetattr] map[Kind:function Name:__audit_mq_notify] map[Kind:function Name:__audit_mq_open] map[Kind:function Name:__audit_mq_sendrecv] map[Kind:function Name:__audit_ntp_log] map[Kind:function Name:__audit_openat2_how] map[Kind:function Name:__audit_ptrace] map[Kind:function Name:__audit_sockaddr] map[Kind:function Name:__audit_socketcall] map[Kind:function Name:__audit_syscall_entry] map[Kind:function Name:__audit_syscall_exit] map[Kind:function Name:__audit_tk_injoffset] map[Kind:function Name:__audit_uring_entry] map[Kind:function Name:__audit_uring_exit] map[Kind:function Name:audit_alloc] map[Kind:function Name:audit_alloc_context] map[Kind:function Name:audit_alloc_name] map[Kind:function Name:audit_compare_gid] map[Kind:function Name:audit_compare_uid] map[Kind:function Name:audit_copy_fcaps] map[Kind:function Name:audit_copy_inode] map[Kind:function Name:audit_core_dumps] map[Kind:function Name:audit_field_compare] map[Kind:function Name:audit_filter_inode_name] map[Kind:function Name:audit_filter_inodes] map[Kind:function Name:audit_filter_rules] map[Kind:function Name:audit_filter_syscall] map[Kind:function Name:audit_filter_task] map[Kind:function Name:audit_filter_uring] map[Kind:function Name:audit_free_aux] map[Kind:function Name:audit_free_context] map[Kind:function Name:audit_free_module] map[Kind:function Name:audit_free_names] map[Kind:function Name:audit_in_mask] map[Kind:function Name:audit_killed_trees] map[Kind:function Name:audit_log_cap] map[Kind:function Name:audit_log_execve_info] map[Kind:function Name:audit_log_exit] map[Kind:function Name:audit_log_fcaps] map[Kind:function Name:audit_log_name] map[Kind:function Name:audit_log_pid_context] map[Kind:function Name:audit_log_proctitle] map[Kind:function Name:audit_log_task] map[Kind:function Name:audit_log_time] map[Kind:function Name:audit_log_uring] map[Kind:function Name:audit_match_filetype] map[Kind:function Name:audit_match_perm] map[Kind:function Name:audit_proctitle_free] map[Kind:function Name:audit_proctitle_rtrim] map[Kind:function Name:audit_reset_context] map[Kind:function Name:audit_return_fixup] map[Kind:function Name:audit_seccomp] map[Kind:function Name:audit_seccomp_actions_logged] map[Kind:function Name:audit_set_auditable] map[Kind:function Name:audit_signal_info_syscall] map[Kind:function Name:auditsc_get_stamp] map[Kind:function Name:free_tree_refs] map[Kind:function Name:grow_tree_refs] map[Kind:function Name:handle_one] map[Kind:function Name:handle_path] map[Kind:function Name:match_tree_refs] map[Kind:function Name:put_tree_ref] map[Kind:function Name:show_special] map[Kind:function Name:unroll_tree_refs] map[Kind:struct Name:audit_aux_data] map[Kind:struct Name:audit_aux_data_bprm_fcaps] map[Kind:struct Name:audit_aux_data_pids] map[Kind:struct Name:audit_nfcfgop_tab] map[Kind:struct Name:audit_tree_refs] map[Kind:global_variable Name:__UNIQUE_ID_addressable___audit_inode_child_531] map[Kind:global_variable Name:__UNIQUE_ID_addressable___audit_log_nfcfg_537] map[Kind:global_variable Name:audit_nfcfgs]]]

gemini-3-flash-preview

							input: 23189
							output: 43
							thoughts: 23
						

Here's my thought process, summarized as you requested:

**Diving into `audit_log_execve_info`**

Okay, time to get to the core of this. My initial thought is to navigate to the `audit_log_execve_info` function within `kernel/auditsc.c`. That's where I would expect to find the meat of the execution event logging, specifically for `execve` calls. I need to understand exactly what information is being captured during those system calls, and how the audit subsystem handles this crucial data. From there, I can analyze the audit data structure and decide how to deal with this data.

map[ContextFile:kernel/auditsc.c IncludeLines:true Name:audit_log_execve_info]

map[SourceCode:1120:	static void audit_log_execve_info(struct audit_context *context,
1121:					  struct audit_buffer **ab)
1122:	{
1123:		long len_max;
1124:		long len_rem;
1125:		long len_full;
1126:		long len_buf;
1127:		long len_abuf = 0;
1128:		long len_tmp;
1129:		bool require_data;
1130:		bool encode;
1131:		unsigned int iter;
1132:		unsigned int arg;
1133:		char *buf_head;
1134:		char *buf;
1135:		const char __user *p = (const char __user *)current->mm->arg_start;
1136:	
1137:		/* NOTE: this buffer needs to be large enough to hold all the non-arg
1138:		 *       data we put in the audit record for this argument (see the
1139:		 *       code below) ... at this point in time 96 is plenty */
1140:		char abuf[96];
1141:	
1142:		/* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
1143:		 *       current value of 7500 is not as important as the fact that it
1144:		 *       is less than 8k, a setting of 7500 gives us plenty of wiggle
1145:		 *       room if we go over a little bit in the logging below */
1146:		WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
1147:		len_max = MAX_EXECVE_AUDIT_LEN;
1148:	
1149:		/* scratch buffer to hold the userspace args */
1150:		buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
1151:		if (!buf_head) {
1152:			audit_panic("out of memory for argv string");
1153:			return;
1154:		}
1155:		buf = buf_head;
1156:	
1157:		audit_log_format(*ab, "argc=%d", context->execve.argc);
1158:	
1159:		len_rem = len_max;
1160:		len_buf = 0;
1161:		len_full = 0;
1162:		require_data = true;
1163:		encode = false;
1164:		iter = 0;
1165:		arg = 0;
1166:		do {
1167:			/* NOTE: we don't ever want to trust this value for anything
1168:			 *       serious, but the audit record format insists we
1169:			 *       provide an argument length for really long arguments,
1170:			 *       e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
1171:			 *       to use strncpy_from_user() to obtain this value for
1172:			 *       recording in the log, although we don't use it
1173:			 *       anywhere here to avoid a double-fetch problem */
1174:			if (len_full == 0)
1175:				len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
1176:	
1177:			/* read more data from userspace */
1178:			if (require_data) {
1179:				/* can we make more room in the buffer? */
1180:				if (buf != buf_head) {
1181:					memmove(buf_head, buf, len_buf);
1182:					buf = buf_head;
1183:				}
1184:	
1185:				/* fetch as much as we can of the argument */
1186:				len_tmp = strncpy_from_user(&buf_head[len_buf], p,
1187:							    len_max - len_buf);
1188:				if (len_tmp == -EFAULT) {
1189:					/* unable to copy from userspace */
1190:					send_sig(SIGKILL, current, 0);
1191:					goto out;
1192:				} else if (len_tmp == (len_max - len_buf)) {
1193:					/* buffer is not large enough */
1194:					require_data = true;
1195:					/* NOTE: if we are going to span multiple
1196:					 *       buffers force the encoding so we stand
1197:					 *       a chance at a sane len_full value and
1198:					 *       consistent record encoding */
1199:					encode = true;
1200:					len_full = len_full * 2;
1201:					p += len_tmp;
1202:				} else {
1203:					require_data = false;
1204:					if (!encode)
1205:						encode = audit_string_contains_control(
1206:									buf, len_tmp);
1207:					/* try to use a trusted value for len_full */
1208:					if (len_full < len_max)
1209:						len_full = (encode ?
1210:							    len_tmp * 2 : len_tmp);
1211:					p += len_tmp + 1;
1212:				}
1213:				len_buf += len_tmp;
1214:				buf_head[len_buf] = '\0';
1215:	
1216:				/* length of the buffer in the audit record? */
1217:				len_abuf = (encode ? len_buf * 2 : len_buf + 2);
1218:			}
1219:	
1220:			/* write as much as we can to the audit log */
1221:			if (len_buf >= 0) {
1222:				/* NOTE: some magic numbers here - basically if we
1223:				 *       can't fit a reasonable amount of data into the
1224:				 *       existing audit buffer, flush it and start with
1225:				 *       a new buffer */
1226:				if ((sizeof(abuf) + 8) > len_rem) {
1227:					len_rem = len_max;
1228:					audit_log_end(*ab);
1229:					*ab = audit_log_start(context,
1230:							      GFP_KERNEL, AUDIT_EXECVE);
1231:					if (!*ab)
1232:						goto out;
1233:				}
1234:	
1235:				/* create the non-arg portion of the arg record */
1236:				len_tmp = 0;
1237:				if (require_data || (iter > 0) ||
1238:				    ((len_abuf + sizeof(abuf)) > len_rem)) {
1239:					if (iter == 0) {
1240:						len_tmp += snprintf(&abuf[len_tmp],
1241:								sizeof(abuf) - len_tmp,
1242:								" a%d_len=%lu",
1243:								arg, len_full);
1244:					}
1245:					len_tmp += snprintf(&abuf[len_tmp],
1246:							    sizeof(abuf) - len_tmp,
1247:							    " a%d[%d]=", arg, iter++);
1248:				} else
1249:					len_tmp += snprintf(&abuf[len_tmp],
1250:							    sizeof(abuf) - len_tmp,
1251:							    " a%d=", arg);
1252:				WARN_ON(len_tmp >= sizeof(abuf));
1253:				abuf[sizeof(abuf) - 1] = '\0';
1254:	
1255:				/* log the arg in the audit record */
1256:				audit_log_format(*ab, "%s", abuf);
1257:				len_rem -= len_tmp;
1258:				len_tmp = len_buf;
1259:				if (encode) {
1260:					if (len_abuf > len_rem)
1261:						len_tmp = len_rem / 2; /* encoding */
1262:					audit_log_n_hex(*ab, buf, len_tmp);
1263:					len_rem -= len_tmp * 2;
1264:					len_abuf -= len_tmp * 2;
1265:				} else {
1266:					if (len_abuf > len_rem)
1267:						len_tmp = len_rem - 2; /* quotes */
1268:					audit_log_n_string(*ab, buf, len_tmp);
1269:					len_rem -= len_tmp + 2;
1270:					/* don't subtract the "2" because we still need
1271:					 * to add quotes to the remaining string */
1272:					len_abuf -= len_tmp;
1273:				}
1274:				len_buf -= len_tmp;
1275:				buf += len_tmp;
1276:			}
1277:	
1278:			/* ready to move to the next argument? */
1279:			if ((len_buf == 0) && !require_data) {
1280:				arg++;
1281:				iter = 0;
1282:				len_full = 0;
1283:				require_data = true;
1284:				encode = false;
1285:			}
1286:		} while (arg < context->execve.argc);
1287:	
1288:		/* NOTE: the caller handles the final audit_log_end() call */
1289:	
1290:	out:
1291:		kfree(buf_head);
1292:	}
 SourceFile:kernel/auditsc.c]

gemini-3-flash-preview

							input: 26153
							output: 23
							thoughts: 160
						

**Analyzing the Code Snippet**

Okay, so this code snippet... it's not quite right. Back to the drawing board, let's re-examine the original question. I see a comparison: `tmp_buf_end - tmp_buf < sizeof_cur_arg`. Alright, `tmp_buf_end` and `tmp_buf` are pointers, and `sizeof_cur_arg` is a `size_t`. I'm going to base my answer on C's language rules, if all else fails. Although, I have this nagging suspicion this is related to a specific patch or a known bug. Hold on, let me search for `sizeof_cur_arg` throughout the entire code tree again. Perhaps I should use `codesearch-dir-index` on the include files. Actually, scrap that, I'm going to search for `tmp_buf_end` within the `fs/` directory first. I'll get to the bottom of this.

log-in to see details

map[Name:tmp_buf_end]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 26566
							output: 22
							thoughts: 129
						

**Analyzing C Code in a Linux Kernel Context**

Alright, let's break this down. It seems we're dealing with a general C question, likely focused on the Linux kernel's coding environment. My initial thought is to make sure we understand the types involved and potential pitfalls in their interactions.

Specifically, I'm thinking about `size_t` and `ptrdiff_t`. I know, in this environment, `size_t` is *unsigned*, and `ptrdiff_t` is *signed*. So, we're talking about differences between memory addresses – the classic pointer arithmetic scenario. That subtraction, `tmp_buf_end - tmp_buf`, is going to result in a `ptrdiff_t` value. Makes perfect sense.

Now comes the tricky part: the comparison. Since we're comparing `ptrdiff_t` (signed) to `size_t` (unsigned), we're going to trigger the standard arithmetic conversions. That's where things can get interesting, and potentially problematic, due to how the compiler handles signed/unsigned comparisons.

My next step would be to verify these type definitions within the kernel's header files. I'd typically look in a familiar place like `include/linux/types.h` or something similar. Confirming these definitions is critical. Once I have the definitions right in front of me, I can be certain in my assessments and I can start writing out the code that I need.

map[File:include/linux/types.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _LINUX_TYPES_H
#define _LINUX_TYPES_H

#include <uapi/linux/types.h>

#ifndef __ASSEMBLY__

#define DECLARE_BITMAP(name,bits) \
	unsigned long name[BITS_TO_LONGS(bits)]

#ifdef __SIZEOF_INT128__
typedef __s128 s128;
typedef __u128 u128;
#endif

typedef u32 __kernel_dev_t;

typedef __kernel_fd_set		fd_set;
typedef __kernel_dev_t		dev_t;
typedef __kernel_ulong_t	ino_t;
typedef __kernel_mode_t		mode_t;
typedef unsigned short		umode_t;
typedef u32			nlink_t;
typedef __kernel_off_t		off_t;
typedef __kernel_pid_t		pid_t;
typedef __kernel_daddr_t	daddr_t;
typedef __kernel_key_t		key_t;
typedef __kernel_suseconds_t	suseconds_t;
typedef __kernel_timer_t	timer_t;
typedef __kernel_clockid_t	clockid_t;
typedef __kernel_mqd_t		mqd_t;

typedef _Bool			bool;

typedef __kernel_uid32_t	uid_t;
typedef __kernel_gid32_t	gid_t;
typedef __kernel_uid16_t        uid16_t;
typedef __kernel_gid16_t        gid16_t;

typedef unsigned long		uintptr_t;
typedef long			intptr_t;

#ifdef CONFIG_HAVE_UID16
/* This is defined by arch/{arch}/include/asm/posix_types.h */
typedef __kernel_old_uid_t	old_uid_t;
typedef __kernel_old_gid_t	old_gid_t;
#endif /* CONFIG_UID16 */

#if defined(__GNUC__)
typedef __kernel_loff_t		loff_t;
typedef __kernel_uoff_t		uoff_t;
#endif

/*
 * The following typedefs are also protected by individual ifdefs for
 * historical reasons:
 */
#ifndef _SIZE_T
#define _SIZE_T
typedef __kernel_size_t		size_t;
#endif

#ifndef _SSIZE_T
#define _SSIZE_T
typedef __kernel_ssize_t	ssize_t;
#endif

#ifndef _PTRDIFF_T
#define _PTRDIFF_T
typedef __kernel_ptrdiff_t	ptrdiff_t;
#endif

#ifndef _CLOCK_T
#define _CLOCK_T
typedef __kernel_clock_t	clock_t;
#endif

#ifndef _CADDR_T
#define _CADDR_T
typedef __kernel_caddr_t	caddr_t;
#endif

/* bsd */
typedef unsigned char		u_char;
typedef unsigned short		u_short;
typedef unsigned int		u_int;
typedef unsigned long		u_long;

/* sysv */
typedef unsigned char		unchar;
typedef unsigned short		ushort;
typedef unsigned int		uint;
typedef unsigned long		ulong;
typedef unsigned long long	ullong;

#ifndef __BIT_TYPES_DEFINED__
#define __BIT_TYPES_DEFINED__

typedef u8			u_int8_t;
typedef s8			int8_t;
typedef u16			u_int16_t;
typedef s16			int16_t;
typedef u32			u_int32_t;
typedef s32			int32_t;

#endif /* !(__BIT_TYPES_DEFINED__) */

typedef u8			uint8_t;
typedef u16			uint16_t;
typedef u32			uint32_t;

#if defined(__GNUC__)
typedef u64			uint64_t;
typedef u64			u_int64_t;
typedef s64			int64_t;
#endif

/* These are the special 64-bit data types that are 8-byte aligned */
#define aligned_u64		__aligned_u64
#define aligned_s64		__aligned_s64
#define aligned_be64		__aligned_be64
#define aligned_le64		__aligned_le64

/* Nanosecond scalar representation for kernel time values */
typedef s64	ktime_t;

/**
 * The type used for indexing onto a disc or disc partition.
 *
 * Linux always considers sectors to be 512 bytes long independently
 * of the devices real block size.
 *
 * blkcnt_t is the type of the inode's block count.
 */
typedef u64 sector_t;
typedef u64 blkcnt_t;

/* generic data direction definitions */
#define READ			0
#define WRITE			1

/*
 * The type of an index into the pagecache.
 */
#define pgoff_t unsigned long

/*
 * A dma_addr_t can hold any valid DMA address, i.e., any address returned
 * by the DMA API.
 *
 * If the DMA API only uses 32-bit addresses, dma_addr_t need only be 32
 * bits wide.  Bus addresses, e.g., PCI BARs, may be wider than 32 bits,
 * but drivers do memory-mapped I/O to ioremapped kernel virtual addresses,
 * so they don't care about the size of the actual bus addresses.
 */
#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
typedef u64 dma_addr_t;
#else
typedef u32 dma_addr_t;
#endif

typedef unsigned int __bitwise gfp_t;
typedef unsigned int __bitwise slab_flags_t;
typedef unsigned int __bitwise fmode_t;

#ifdef CONFIG_PHYS_ADDR_T_64BIT
typedef u64 phys_addr_t;
#else
typedef u32 phys_addr_t;
#endif

struct phys_vec {
	phys_addr_t	paddr;
	size_t		len;
};

typedef phys_addr_t resource_size_t;

/*
 * This type is the placeholder for a hardware interrupt number. It has to be
 * big enough to enclose whatever representation is used by a given platform.
 */
typedef unsigned long irq_hw_number_t;

typedef struct {
	int __aligned(sizeof(int)) counter;
} atomic_t;

#define ATOMIC_INIT(i) { (i) }

#ifdef CONFIG_64BIT
typedef struct {
	s64 counter;
} atomic64_t;
#endif

typedef struct {
	atomic_t refcnt;
} rcuref_t;

#define RCUREF_INIT(i)	{ .refcnt = ATOMIC_INIT(i - 1) }

struct list_head {
	struct list_head *next, *prev;
};

struct hlist_head {
	struct hlist_node *first;
};

struct hlist_node {
	struct hlist_node *next, **pprev;
};

struct ustat {
	__kernel_daddr_t	f_tfree;
#ifdef CONFIG_ARCH_32BIT_USTAT_F_TINODE
	unsigned int		f_tinode;
#else
	unsigned long		f_tinode;
#endif
	char			f_fname[6];
	char			f_fpack[6];
};

/**
 * struct callback_head - callback structure for use with RCU and task_work
 * @next: next update requests in a list
 * @func: actual update function to call after the grace period.
 *
 * The struct is aligned to size of pointer. On most architectures it happens
 * naturally due ABI requirements, but some architectures (like CRIS) have
 * weird ABI and we need to ask it explicitly.
 *
 * The alignment is required to guarantee that bit 0 of @next will be
 * clear under normal conditions -- as long as we use call_rcu() or
 * call_srcu() to queue the callback.
 *
 * This guarantee is important for few reasons:
 *  - future call_rcu_lazy() will make use of lower bits in the pointer;
 *  - the structure shares storage space in struct page with @compound_info,
 *    which encode PageTail() in bit 0. The guarantee is needed to avoid
 *    false-positive PageTail().
 */
struct callback_head {
	struct callback_head *next;
	void (*func)(struct callback_head *head);
} __attribute__((aligned(sizeof(void *))));
#define rcu_head callback_head

typedef void (*rcu_callback_t)(struct rcu_head *head);
typedef void (*call_rcu_func_t)(struct rcu_head *head, rcu_callback_t func);

typedef void (*swap_r_func_t)(void *a, void *b, int size, const void *priv);
typedef void (*swap_func_t)(void *a, void *b, int size);

typedef int (*cmp_r_func_t)(const void *a, const void *b, const void *priv);
typedef int (*cmp_func_t)(const void *a, const void *b);

/*
 * rcuwait provides a way of blocking and waking up a single
 * task in an rcu-safe manner.
 *
 * The only time @task is non-nil is when a user is blocked (or
 * checking if it needs to) on a condition, and reset as soon as we
 * know that the condition has succeeded and are awoken.
 */
struct rcuwait {
	struct task_struct __rcu *task;
};

#endif /*  __ASSEMBLY__ */
#endif /* _LINUX_TYPES_H */
]

gemini-3-flash-preview

							input: 29409
							output: 37
							thoughts: 86
						

Here's my thought process, as it stands:

**Navigating Kernel Data Type Definitions**

Okay, so I'm looking at how `size_t` and `ptrdiff_t` are defined within the kernel. I remember seeing these as `__kernel_size_t` and `__kernel_ptrdiff_t`, respectively. Right, and those are going to be defined somewhere in the `uapi/linux/types.h` header, or perhaps an architecture-specific header. Let me confirm that by taking a look at a common example, say,  `arch/x86/include/uapi/asm/posix_types_64.h`. I'll want to check this file (or a similar one, for another architecture if I need to) to see precisely how these essential types are mapped to their underlying representations, especially for 64-bit x86 systems. It's important to understand the kernel's definitions to ensure portability and avoid any subtle type-related issues.

map[File:arch/x86/include/uapi/asm/posix_types_64.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _ASM_X86_POSIX_TYPES_64_H
#define _ASM_X86_POSIX_TYPES_64_H

/*
 * This file is generally used by user-level software, so you need to
 * be a little careful about namespace pollution etc.  Also, we cannot
 * assume GCC is being used.
 */

typedef unsigned short __kernel_old_uid_t;
typedef unsigned short __kernel_old_gid_t;
#define __kernel_old_uid_t __kernel_old_uid_t

typedef unsigned long	__kernel_old_dev_t;
#define __kernel_old_dev_t __kernel_old_dev_t

#include <asm-generic/posix_types.h>

#endif /* _ASM_X86_POSIX_TYPES_64_H */
]

gemini-3-flash-preview

							input: 29978
							output: 30
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience and presented in the first person:

**Navigating the Headers**

Alright, let's see. My mind immediately recognizes the inclusion of `asm-generic/posix_types.h`. That's interesting. It signals a dive into the fundamental type definitions, the bedrock upon which our system calls and data structures are built. This is where the core definitions for things like `__kernel_long_t`, `__kernel_ulong_t`, and other primitive types reside. It suggests that we're dealing with code that either needs to interact directly with the kernel's data representations or perhaps is defining interfaces that have to be carefully aligned with kernel expectations. The presence of this header automatically flags the possibility of architecture-specific adaptations. I'll need to keep an eye out for potential platform-dependent nuances in how these types are used and interpreted downstream. Also it is important to remember that since this is part of the `asm-generic` it means it is platform agnostic and will most likely need to use more specific types or calls further down. It is likely that this code might interact with a kernel module or some system level call.

map[File:include/uapi/asm-generic/posix_types.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef __ASM_GENERIC_POSIX_TYPES_H
#define __ASM_GENERIC_POSIX_TYPES_H

#include <asm/bitsperlong.h>
/*
 * This file is generally used by user-level software, so you need to
 * be a little careful about namespace pollution etc.
 *
 * First the types that are often defined in different ways across
 * architectures, so that you can override them.
 */

#ifndef __kernel_long_t
typedef long		__kernel_long_t;
typedef unsigned long	__kernel_ulong_t;
#endif

#ifndef __kernel_ino_t
typedef __kernel_ulong_t __kernel_ino_t;
#endif

#ifndef __kernel_mode_t
typedef unsigned int	__kernel_mode_t;
#endif

#ifndef __kernel_pid_t
typedef int		__kernel_pid_t;
#endif

#ifndef __kernel_ipc_pid_t
typedef int		__kernel_ipc_pid_t;
#endif

#ifndef __kernel_uid_t
typedef unsigned int	__kernel_uid_t;
typedef unsigned int	__kernel_gid_t;
#endif

#ifndef __kernel_suseconds_t
typedef __kernel_long_t		__kernel_suseconds_t;
#endif

#ifndef __kernel_daddr_t
typedef int		__kernel_daddr_t;
#endif

#ifndef __kernel_uid32_t
typedef unsigned int	__kernel_uid32_t;
typedef unsigned int	__kernel_gid32_t;
#endif

#ifndef __kernel_old_uid_t
typedef __kernel_uid_t	__kernel_old_uid_t;
typedef __kernel_gid_t	__kernel_old_gid_t;
#endif

#ifndef __kernel_old_dev_t
typedef unsigned int	__kernel_old_dev_t;
#endif

/*
 * Most 32 bit architectures use "unsigned int" size_t,
 * and all 64 bit architectures use "unsigned long" size_t.
 */
#ifndef __kernel_size_t
#if __BITS_PER_LONG != 64
typedef unsigned int	__kernel_size_t;
typedef int		__kernel_ssize_t;
typedef int		__kernel_ptrdiff_t;
#else
typedef __kernel_ulong_t __kernel_size_t;
typedef __kernel_long_t	__kernel_ssize_t;
typedef __kernel_long_t	__kernel_ptrdiff_t;
#endif
#endif

#ifndef __kernel_fsid_t
typedef struct {
	int	val[2];
} __kernel_fsid_t;
#endif

/*
 * anything below here should be completely generic
 */
typedef __kernel_long_t	__kernel_off_t;
typedef long long	__kernel_loff_t;
typedef unsigned long long	__kernel_uoff_t;
typedef __kernel_long_t	__kernel_old_time_t;
#ifndef __KERNEL__
typedef __kernel_long_t	__kernel_time_t;
#endif
typedef long long __kernel_time64_t;
typedef __kernel_long_t	__kernel_clock_t;
typedef int		__kernel_timer_t;
typedef int		__kernel_clockid_t;
typedef char *		__kernel_caddr_t;
typedef unsigned short	__kernel_uid16_t;
typedef unsigned short	__kernel_gid16_t;

#endif /* __ASM_GENERIC_POSIX_TYPES_H */
]

gemini-3-flash-preview

							input: 31154
							output: 33
							thoughts: 534
						

**Analyzing Potential Integer Overflow in Kernel Code**

Okay, let's break this down. My initial thought is about how `__kernel_size_t` and `__kernel_ptrdiff_t` behave across different architectures, specifically 32-bit versus 64-bit. On a 64-bit system, they're `unsigned long` and `long`, respectively, and on 32-bit, they're `unsigned int` and `int`.  Crucially, in both scenarios, the *rank* (conversion hierarchy) of these types is the same.

The real crux of the matter comes when comparing `ptrdiff_t` (which is what `__kernel_ptrdiff_t` resolves to) with `size_t`. Since `ptrdiff_t` is signed and `size_t` is unsigned, the `ptrdiff_t` will always be converted to unsigned for the comparison. Now, I need to consider a potential problem: could `tmp_buf_end - tmp_buf` ever be negative? If it is, that subtraction results in a huge unsigned value. If `sizeof_cur_arg` is relatively small, this means the comparison will be false.  Had it been signed, `negative_value < small_value` *would* have been true. That behavior difference is important. This is a classic integer overflow situation.

The user's query is pretty specific, mentioning `tmp_buf_end`, `tmp_buf`, and `sizeof_cur_arg`, which is very helpful. I need to find where this potential issue exists in the kernel.  I tried a previous tool but I did not find anything, so I'm going to try to search again. I can't search for substrings directly, so I need to refine my search.

I'm thinking where I might have seen similar code, and it's making me think of `fs/exec.c` and other files in the `fs/` directory, so I'm going to search for `tmp_buf` in those, looking particularly at any code related to execution or arguments (`*exec*`, `*arg*`).

Wait, I think I found it!  It looks like it might be in `fs/exec.c`, but maybe a slightly older version, or in a specific branch of the kernel.

Hmm, I've checked `fs/exec.c`, I don't see it, it's not here.

Let me try another possibility - I've worked on USB gadget drivers, and I recall similar buffer management in that area. I'll search for `tmp_buf` in `drivers/usb/gadget/function/f_fs.c`. Let's see if this yields any results!

map[SourceFile:drivers/usb/gadget/function/f_fs.c]

map[Entities:[map[Kind:function Name:__ffs_data_do_entity] map[Kind:function Name:__ffs_data_do_os_desc] map[Kind:function Name:__ffs_data_got_descs] map[Kind:function Name:__ffs_data_got_strings] map[Kind:function Name:__ffs_do_os_desc_header] map[Kind:function Name:__ffs_ep0_queue_wait] map[Kind:function Name:__ffs_ep0_read_events] map[Kind:function Name:__ffs_ep0_stall] map[Kind:function Name:__ffs_epfile_read_buffer_free] map[Kind:function Name:__ffs_epfile_read_buffered] map[Kind:function Name:__ffs_epfile_read_data] map[Kind:function Name:__ffs_event_add] map[Kind:function Name:__ffs_func_bind_do_descs] map[Kind:function Name:__ffs_func_bind_do_nums] map[Kind:function Name:__ffs_func_bind_do_os_desc] map[Kind:function Name:_ffs_alloc_dev] map[Kind:function Name:_ffs_do_find_dev] map[Kind:function Name:_ffs_find_dev] map[Kind:function Name:_ffs_free_dev] map[Kind:function Name:_ffs_func_bind] map[Kind:function Name:_ffs_get_single_dev] map[Kind:function Name:clear_one] map[Kind:function Name:f_fs_opts_ready_show] map[Kind:function Name:ffs_acquire_dev] map[Kind:function Name:ffs_aio_cancel] map[Kind:function Name:ffs_alloc] map[Kind:function Name:ffs_alloc_buffer] map[Kind:function Name:ffs_alloc_inst] map[Kind:function Name:ffs_attr_release] map[Kind:function Name:ffs_build_sg_list] map[Kind:function Name:ffs_closed] map[Kind:function Name:ffs_copy_to_iter] map[Kind:function Name:ffs_data_clear] map[Kind:function Name:ffs_data_closed] map[Kind:function Name:ffs_data_get] map[Kind:function Name:ffs_data_new] map[Kind:function Name:ffs_data_put] map[Kind:function Name:ffs_data_reset] map[Kind:function Name:ffs_dma_resv_lock] map[Kind:function Name:ffs_dmabuf_attach] map[Kind:function Name:ffs_dmabuf_cleanup] map[Kind:function Name:ffs_dmabuf_detach] map[Kind:function Name:ffs_dmabuf_fence_release] map[Kind:function Name:ffs_dmabuf_find_attachment] map[Kind:function Name:ffs_dmabuf_get] map[Kind:function Name:ffs_dmabuf_get_driver_name] map[Kind:function Name:ffs_dmabuf_get_timeline_name] map[Kind:function Name:ffs_dmabuf_put] map[Kind:function Name:ffs_dmabuf_release] map[Kind:function Name:ffs_dmabuf_signal_done] map[Kind:function Name:ffs_dmabuf_transfer] map[Kind:function Name:ffs_do_descs] map[Kind:function Name:ffs_do_functionfs_bind] map[Kind:function Name:ffs_do_os_descs] map[Kind:function Name:ffs_do_single_desc] map[Kind:function Name:ffs_do_single_os_desc] map[Kind:function Name:ffs_ep0_complete] map[Kind:function Name:ffs_ep0_ioctl] map[Kind:function Name:ffs_ep0_open] map[Kind:function Name:ffs_ep0_poll] map[Kind:function Name:ffs_ep0_read] map[Kind:function Name:ffs_ep0_release] map[Kind:function Name:ffs_ep0_write] map[Kind:function Name:ffs_ep_addr2idx] map[Kind:function Name:ffs_epfile_async_io_complete] map[Kind:function Name:ffs_epfile_dmabuf_io_complete] map[Kind:function Name:ffs_epfile_io] map[Kind:function Name:ffs_epfile_io_complete] map[Kind:function Name:ffs_epfile_ioctl] map[Kind:function Name:ffs_epfile_open] map[Kind:function Name:ffs_epfile_read_iter] map[Kind:function Name:ffs_epfile_release] map[Kind:function Name:ffs_epfile_wait_ep] map[Kind:function Name:ffs_epfile_write_iter] map[Kind:function Name:ffs_epfiles_create] map[Kind:function Name:ffs_epfiles_destroy] map[Kind:function Name:ffs_event_add] map[Kind:function Name:ffs_free] map[Kind:function Name:ffs_free_buffer] map[Kind:function Name:ffs_free_inst] map[Kind:function Name:ffs_fs_free_fc] map[Kind:function Name:ffs_fs_get_tree] map[Kind:function Name:ffs_fs_init_fs_context] map[Kind:function Name:ffs_fs_kill_sb] map[Kind:function Name:ffs_fs_parse_param] map[Kind:function Name:ffs_func_bind] map[Kind:function Name:ffs_func_disable] map[Kind:function Name:ffs_func_eps_disable] map[Kind:function Name:ffs_func_eps_enable] map[Kind:function Name:ffs_func_from_usb] map[Kind:function Name:ffs_func_get_alt] map[Kind:function Name:ffs_func_req_match] map[Kind:function Name:ffs_func_resume] map[Kind:function Name:ffs_func_revmap_ep] map[Kind:function Name:ffs_func_revmap_intf] map[Kind:function Name:ffs_func_set_alt] map[Kind:function Name:ffs_func_setup] map[Kind:function Name:ffs_func_suspend] map[Kind:function Name:ffs_func_unbind] map[Kind:function Name:ffs_mutex_lock] map[Kind:function Name:ffs_name_dev] map[Kind:function Name:ffs_prepare_buffer] map[Kind:function Name:ffs_ready] map[Kind:function Name:ffs_release_dev] map[Kind:function Name:ffs_reset_work] map[Kind:function Name:ffs_sb_create_file] map[Kind:function Name:ffs_sb_fill] map[Kind:function Name:ffs_sb_make_inode] map[Kind:function Name:ffs_set_inst_name] map[Kind:function Name:ffs_setup_state_clear_cancelled] map[Kind:function Name:ffs_single_dev] map[Kind:function Name:ffs_user_copy_worker] map[Kind:function Name:ffsmod_exit] map[Kind:function Name:ffsmod_init] map[Kind:function Name:functionfs_bind] map[Kind:function Name:functionfs_cleanup] map[Kind:function Name:functionfs_init] map[Kind:function Name:functionfs_unbind] map[Kind:function Name:to_ffs_opts] map[Kind:struct Name:ffs_buffer] map[Kind:struct Name:ffs_desc_helper] map[Kind:struct Name:ffs_dma_fence] map[Kind:struct Name:ffs_dmabuf_priv] map[Kind:struct Name:ffs_ep] map[Kind:struct Name:ffs_epfile] map[Kind:struct Name:ffs_function] map[Kind:struct Name:ffs_io_data] map[Kind:struct Name:ffs_sb_fill_data] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ffs_lock_529] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ffs_name_dev_566] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ffs_single_dev_567] map[Kind:global_variable Name:__UNIQUE_ID_addressable_ffsmod_init_570] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_528] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_542] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_568] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_571] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_572] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_573] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_574] map[Kind:global_variable Name:__exitcall_ffsmod_exit] map[Kind:global_variable Name:f_fs_opts_attr_ready] map[Kind:global_variable Name:ffs_attrs] map[Kind:global_variable Name:ffs_devices] map[Kind:global_variable Name:ffs_dmabuf_fence_ops] map[Kind:global_variable Name:ffs_ep0_operations] map[Kind:global_variable Name:ffs_epfile_operations] map[Kind:global_variable Name:ffs_fs_context_ops] map[Kind:global_variable Name:ffs_fs_fs_parameters] map[Kind:global_variable Name:ffs_fs_type] map[Kind:global_variable Name:ffs_func_type] map[Kind:global_variable Name:ffs_item_ops] map[Kind:global_variable Name:ffs_lock] map[Kind:global_variable Name:ffs_sb_operations] map[Kind:global_variable Name:ffsusb_func] map[Kind:enum Name:ffs_entity_type] map[Kind:enum Name:ffs_os_desc_type] map[Kind:typedef Name:ffs_entity_callback] map[Kind:typedef Name:ffs_os_desc_callback]]]

gemini-3-flash-preview

							input: 35355
							output: 52
							thoughts: 32
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating `f_fs.c` String Handling**

Alright, time to dive into this. The task at hand is to understand how strings are being handled within the `f_fs.c` file, specifically within the USB gadget function driver framework. I need to refresh my memory on the internal data structures used to store these strings. Let's start by scrutinizing the `__ffs_data_got_strings` variable within that file. I'm assuming it's a critical component, likely the key data structure or variable holding pointers to the string descriptors used by the function filesystem. I expect there will be a section that handles their allocation, initialization, and deallocation. I need to clarify if these strings are static or dynamically allocated and, if dynamic, the mechanisms of their memory management. I'm looking for potential vulnerabilities, like buffer overflows, or unexpected side effects caused by improper string handling. My goal is to grasp the overall string handling strategy employed within this specific function driver and make sure it's robust.

map[ContextFile:drivers/usb/gadget/function/f_fs.c IncludeLines:true Name:__ffs_data_got_strings]

map[SourceCode:3035:	static int __ffs_data_got_strings(struct ffs_data *ffs,
3036:					  char *const _data, size_t len)
3037:	{
3038:		u32 str_count, needed_count, lang_count;
3039:		struct usb_gadget_strings **stringtabs, *t;
3040:		const char *data = _data;
3041:		struct usb_string *s;
3042:	
3043:		if (len < 16 ||
3044:		    get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
3045:		    get_unaligned_le32(data + 4) != len)
3046:			goto error;
3047:		str_count  = get_unaligned_le32(data + 8);
3048:		lang_count = get_unaligned_le32(data + 12);
3049:	
3050:		/* if one is zero the other must be zero */
3051:		if (!str_count != !lang_count)
3052:			goto error;
3053:	
3054:		/* Do we have at least as many strings as descriptors need? */
3055:		needed_count = ffs->strings_count;
3056:		if (str_count < needed_count)
3057:			goto error;
3058:	
3059:		/*
3060:		 * If we don't need any strings just return and free all
3061:		 * memory.
3062:		 */
3063:		if (!needed_count) {
3064:			kfree(_data);
3065:			return 0;
3066:		}
3067:	
3068:		/* Allocate everything in one chunk so there's less maintenance. */
3069:		{
3070:			unsigned i = 0;
3071:			vla_group(d);
3072:			vla_item(d, struct usb_gadget_strings *, stringtabs,
3073:				size_add(lang_count, 1));
3074:			vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
3075:			vla_item(d, struct usb_string, strings,
3076:				size_mul(lang_count, (needed_count + 1)));
3077:	
3078:			char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
3079:	
3080:			if (!vlabuf) {
3081:				kfree(_data);
3082:				return -ENOMEM;
3083:			}
3084:	
3085:			/* Initialize the VLA pointers */
3086:			stringtabs = vla_ptr(vlabuf, d, stringtabs);
3087:			t = vla_ptr(vlabuf, d, stringtab);
3088:			i = lang_count;
3089:			do {
3090:				*stringtabs++ = t++;
3091:			} while (--i);
3092:			*stringtabs = NULL;
3093:	
3094:			/* stringtabs = vlabuf = d_stringtabs for later kfree */
3095:			stringtabs = vla_ptr(vlabuf, d, stringtabs);
3096:			t = vla_ptr(vlabuf, d, stringtab);
3097:			s = vla_ptr(vlabuf, d, strings);
3098:		}
3099:	
3100:		/* For each language */
3101:		data += 16;
3102:		len -= 16;
3103:	
3104:		do { /* lang_count > 0 so we can use do-while */
3105:			unsigned needed = needed_count;
3106:			u32 str_per_lang = str_count;
3107:	
3108:			if (len < 3)
3109:				goto error_free;
3110:			t->language = get_unaligned_le16(data);
3111:			t->strings  = s;
3112:			++t;
3113:	
3114:			data += 2;
3115:			len -= 2;
3116:	
3117:			/* For each string */
3118:			do { /* str_count > 0 so we can use do-while */
3119:				size_t length = strnlen(data, len);
3120:	
3121:				if (length == len)
3122:					goto error_free;
3123:	
3124:				/*
3125:				 * User may provide more strings then we need,
3126:				 * if that's the case we simply ignore the
3127:				 * rest
3128:				 */
3129:				if (needed) {
3130:					/*
3131:					 * s->id will be set while adding
3132:					 * function to configuration so for
3133:					 * now just leave garbage here.
3134:					 */
3135:					s->s = data;
3136:					--needed;
3137:					++s;
3138:				}
3139:	
3140:				data += length + 1;
3141:				len -= length + 1;
3142:			} while (--str_per_lang);
3143:	
3144:			s->id = 0;   /* terminator */
3145:			s->s = NULL;
3146:			++s;
3147:	
3148:		} while (--lang_count);
3149:	
3150:		/* Some garbage left? */
3151:		if (len)
3152:			goto error_free;
3153:	
3154:		/* Done! */
3155:		ffs->stringtabs = stringtabs;
3156:		ffs->raw_strings = _data;
3157:	
3158:		return 0;
3159:	
3160:	error_free:
3161:		kfree(stringtabs);
3162:	error:
3163:		kfree(_data);
3164:		return -EINVAL;
3165:	}
 SourceFile:drivers/usb/gadget/function/f_fs.c]

gemini-3-flash-preview

							input: 37504
							output: 26
							thoughts: 206
						

**Kernel Debugging Deep Dive**

Okay, still no luck. I'm going to revisit `tmp_buf` in `kernel/auditsc.c` but this time I'll dig into the history – see if I can catch something I missed. Or, better yet, I'll try a broader search using `codesearch-find-references`. I'll look for `tmp_buf_end - tmp_buf`, but with a different variable name in the search query.

Hold on, `codesearch-find-references` might be clever enough to return nothing if `tmp_buf` is a local variable. That's actually useful – if it *is* local, I'm going to have a hard time finding it without knowing the file. But a negative result would be telling.

Right, back to the size issue. Let me try that global search for `sizeof_cur_arg` again. Wait... did I misread that variable name? Could it be `sizeof_arg` instead? I'm missing something, clearly.

Alright, I'll switch gears and try another file: let me search for `tmp_buf` in `fs/proc/array.c`.

map[SourceFile:fs/proc/array.c]

map[Entities:[map[Kind:function Name:arch_proc_pid_thread_features] map[Kind:function Name:children_seq_next] map[Kind:function Name:children_seq_open] map[Kind:function Name:children_seq_show] map[Kind:function Name:children_seq_start] map[Kind:function Name:children_seq_stop] map[Kind:function Name:collect_sigign_sigcatch] map[Kind:function Name:do_task_stat] map[Kind:function Name:get_children_pid] map[Kind:function Name:get_task_state] map[Kind:function Name:proc_pid_statm] map[Kind:function Name:proc_pid_status] map[Kind:function Name:proc_task_name] map[Kind:function Name:proc_tgid_stat] map[Kind:function Name:proc_tid_stat] map[Kind:function Name:render_cap_t] map[Kind:function Name:render_sigset_t] map[Kind:function Name:task_cap] map[Kind:function Name:task_context_switch_counts] map[Kind:function Name:task_core_dumping] map[Kind:function Name:task_cpus_allowed] map[Kind:function Name:task_seccomp] map[Kind:function Name:task_sig] map[Kind:function Name:task_state] map[Kind:function Name:task_thp_status] map[Kind:function Name:task_untag_mask] map[Kind:global_variable Name:children_seq_ops] map[Kind:global_variable Name:proc_tid_children_operations] map[Kind:global_variable Name:task_state_array]]]

gemini-3-flash-preview

							input: 38486
							output: 25
							thoughts: 25
						

Okay, here's my thought process laid out, assuming I'm an expert debugging a system:

**Lost in the Code, Time to Search**

Okay, I'm drawing a blank here. I'm not immediately seeing the root of the problem. Time for a targeted approach. Let's see... what was that variable again? Ah, yes, `tmp_buf`. I vaguely recall something using it. Right, I need to understand where it's being used. Now, based on the context, and my familiarity with the usual suspects, `lib/vsprintf.c` is probably the right place to start looking. I'll search for all instances of `tmp_buf` within that file and see what comes up. That should give me the contextual clues I need.

map[SourceFile:lib/vsprintf.c]

map[Entities:[map[Kind:function Name:__ptr_to_hashval] map[Kind:function Name:address_val] map[Kind:function Name:bdev_name] map[Kind:function Name:bitmap_list_string] map[Kind:function Name:bitmap_string] map[Kind:function Name:bstr_printf] map[Kind:function Name:check_pointer] map[Kind:function Name:check_pointer_msg] map[Kind:function Name:clock] map[Kind:function Name:convert_num_spec] map[Kind:function Name:date_str] map[Kind:function Name:debug_boot_weak_hash_enable] map[Kind:function Name:default_pointer] map[Kind:function Name:dentry_name] map[Kind:function Name:device_node_string] map[Kind:function Name:err_ptr] map[Kind:function Name:error_string] map[Kind:function Name:escaped_string] map[Kind:function Name:file_dentry_name] map[Kind:function Name:fill_ptr_key] map[Kind:function Name:flags_string] map[Kind:function Name:format_decode] map[Kind:function Name:format_flags] map[Kind:function Name:format_page_flags] map[Kind:function Name:fourcc_string] map[Kind:function Name:fwnode_full_name_string] map[Kind:function Name:fwnode_string] map[Kind:function Name:hash_pointers_finalize] map[Kind:function Name:hash_pointers_mode_parse] map[Kind:function Name:hex_range] map[Kind:function Name:hex_string] map[Kind:function Name:ip4_addr_string] map[Kind:function Name:ip4_addr_string_sa] map[Kind:function Name:ip4_string] map[Kind:function Name:ip6_addr_string] map[Kind:function Name:ip6_addr_string_sa] map[Kind:function Name:ip6_compressed_string] map[Kind:function Name:ip6_string] map[Kind:function Name:ip_addr_string] map[Kind:function Name:mac_address_string] map[Kind:function Name:move_right] map[Kind:function Name:netdev_bits] map[Kind:function Name:no_hash_pointers_enable] map[Kind:function Name:num_to_str] map[Kind:function Name:number] map[Kind:function Name:pointer] map[Kind:function Name:pointer_string] map[Kind:function Name:ptr_to_hashval] map[Kind:function Name:ptr_to_id] map[Kind:function Name:put_dec] map[Kind:function Name:put_dec_full8] map[Kind:function Name:put_dec_trunc8] map[Kind:function Name:range_string] map[Kind:function Name:resource_or_range] map[Kind:function Name:resource_string] map[Kind:function Name:restricted_pointer] map[Kind:function Name:rtc_str] map[Kind:function Name:scnprintf] map[Kind:function Name:set_field_width] map[Kind:function Name:set_precision] map[Kind:function Name:simple_strntoll] map[Kind:function Name:simple_strntoul] map[Kind:function Name:simple_strntoull] map[Kind:function Name:simple_strtol] map[Kind:function Name:simple_strtoll] map[Kind:function Name:simple_strtoul] map[Kind:function Name:simple_strtoull] map[Kind:function Name:skip_atoi] map[Kind:function Name:snprintf] map[Kind:function Name:spec_flag] map[Kind:function Name:special_hex_number] map[Kind:function Name:sprintf] map[Kind:function Name:sscanf] map[Kind:function Name:string] map[Kind:function Name:string_nocheck] map[Kind:function Name:symbol_string] map[Kind:function Name:time64_str] map[Kind:function Name:time_and_date] map[Kind:function Name:time_str] map[Kind:function Name:timespec64_str] map[Kind:function Name:uuid_string] map[Kind:function Name:va_format] map[Kind:function Name:vbin_printf] map[Kind:function Name:vscnprintf] map[Kind:function Name:vsnprintf] map[Kind:function Name:vsprintf] map[Kind:function Name:vsprintf_init_hashval] map[Kind:function Name:vsscanf] map[Kind:function Name:widen_string] map[Kind:struct Name:fmt] map[Kind:struct Name:format_state] map[Kind:struct Name:page_flags_fields] map[Kind:struct Name:printf_spec] map[Kind:global_variable Name:__UNIQUE_ID_addressable_bstr_printf_858] map[Kind:global_variable Name:__UNIQUE_ID_addressable_no_hash_pointers_819] map[Kind:global_variable Name:__UNIQUE_ID_addressable_scnprintf_854] map[Kind:global_variable Name:__UNIQUE_ID_addressable_simple_strntoul_822] map[Kind:global_variable Name:__UNIQUE_ID_addressable_simple_strtol_823] map[Kind:global_variable Name:__UNIQUE_ID_addressable_simple_strtoll_824] map[Kind:global_variable Name:__UNIQUE_ID_addressable_simple_strtoul_821] map[Kind:global_variable Name:__UNIQUE_ID_addressable_simple_strtoull_820] map[Kind:global_variable Name:__UNIQUE_ID_addressable_snprintf_853] map[Kind:global_variable Name:__UNIQUE_ID_addressable_sprintf_856] map[Kind:global_variable Name:__UNIQUE_ID_addressable_sscanf_860] map[Kind:global_variable Name:__UNIQUE_ID_addressable_vbin_printf_857] map[Kind:global_variable Name:__UNIQUE_ID_addressable_vscnprintf_852] map[Kind:global_variable Name:__UNIQUE_ID_addressable_vsnprintf_851] map[Kind:global_variable Name:__UNIQUE_ID_addressable_vsprintf_855] map[Kind:global_variable Name:__UNIQUE_ID_addressable_vsprintf_init_hashval_827] map[Kind:global_variable Name:__UNIQUE_ID_addressable_vsscanf_859] map[Kind:global_variable Name:__setup_debug_boot_weak_hash_enable] map[Kind:global_variable Name:__setup_hash_pointers_mode_parse] map[Kind:global_variable Name:__setup_no_hash_pointers_enable] map[Kind:global_variable Name:__setup_str_debug_boot_weak_hash_enable] map[Kind:global_variable Name:__setup_str_hash_pointers_mode_parse] map[Kind:global_variable Name:__setup_str_no_hash_pointers_enable] map[Kind:global_variable Name:decpair] map[Kind:global_variable Name:default_dec02_spec] map[Kind:global_variable Name:default_dec04_spec] map[Kind:global_variable Name:default_dec_spec] map[Kind:global_variable Name:default_flag_spec] map[Kind:global_variable Name:default_str_spec] map[Kind:global_variable Name:pff] map[Kind:enum Name:format_state] map[Kind:enum Name:hash_pointers_policy]]]

gemini-3-flash-preview

							input: 40917
							output: 38
							thoughts: 18
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Diving into the `vsprintf` Implementation**

Right, so I need to understand how this is working under the hood, and my first instinct is to go straight to the heart of it. `vsnprintf`...that's the key variable argument formatting function. Let's see what's happening internally. I'm heading directly to `lib/vsprintf.c`. That's where I expect to find the core logic for the variable argument processing and formatting that `vsnprintf` relies on. I'll need to trace how it handles the format string, how it pulls the arguments off the stack (or registers, depending on the architecture), and how it ultimately constructs the output string. I expect to see the typical parse-and-format loop in there, dealing with things like field width, precision, flags, and the different conversion specifiers (`%d`, `%s`, `%x`, etc.). I will be particularly interested in memory management within this function to make sure that it deals with potential overflows and other security aspects properly. I'll need to confirm that this version of `vsprintf` is safe, and I will be looking closely at the implementation of the string formatting and overflow handling.

map[ContextFile:lib/vsprintf.c IncludeLines:true Name:vsnprintf]

map[SourceCode:2836:	/**
2837:	 * vsnprintf - Format a string and place it in a buffer
2838:	 * @buf: The buffer to place the result into
2839:	 * @size: The size of the buffer, including the trailing null space
2840:	 * @fmt_str: The format string to use
2841:	 * @args: Arguments for the format string
2842:	 *
2843:	 * This function generally follows C99 vsnprintf, but has some
2844:	 * extensions and a few limitations:
2845:	 *
2846:	 *  - ``%n`` is unsupported
2847:	 *  - ``%p*`` is handled by pointer()
2848:	 *
2849:	 * See pointer() or Documentation/core-api/printk-formats.rst for more
2850:	 * extensive description.
2851:	 *
2852:	 * **Please update the documentation in both places when making changes**
2853:	 *
2854:	 * The return value is the number of characters which would
2855:	 * be generated for the given input, excluding the trailing
2856:	 * '\0', as per ISO C99. If you want to have the exact
2857:	 * number of characters written into @buf as return value
2858:	 * (not including the trailing '\0'), use vscnprintf(). If the
2859:	 * return is greater than or equal to @size, the resulting
2860:	 * string is truncated.
2861:	 *
2862:	 * If you're not already dealing with a va_list consider using snprintf().
2863:	 */
2864:	int vsnprintf(char *buf, size_t size, const char *fmt_str, va_list args)
2865:	{
2866:		char *str, *end;
2867:		struct printf_spec spec = {0};
2868:		struct fmt fmt = {
2869:			.str = fmt_str,
2870:			.state = FORMAT_STATE_NONE,
2871:		};
2872:	
2873:		/* Reject out-of-range values early.  Large positive sizes are
2874:		   used for unknown buffer sizes. */
2875:		if (WARN_ON_ONCE(size > INT_MAX))
2876:			return 0;
2877:	
2878:		str = buf;
2879:		end = buf + size;
2880:	
2881:		/* Make sure end is always >= buf */
2882:		if (end < buf) {
2883:			end = ((void *)-1);
2884:			size = end - buf;
2885:		}
2886:	
2887:		while (*fmt.str) {
2888:			const char *old_fmt = fmt.str;
2889:	
2890:			fmt = format_decode(fmt, &spec);
2891:	
2892:			switch (fmt.state) {
2893:			case FORMAT_STATE_NONE: {
2894:				int read = fmt.str - old_fmt;
2895:				if (str < end) {
2896:					int copy = read;
2897:					if (copy > end - str)
2898:						copy = end - str;
2899:					memcpy(str, old_fmt, copy);
2900:				}
2901:				str += read;
2902:				continue;
2903:			}
2904:	
2905:			case FORMAT_STATE_NUM: {
2906:				unsigned long long num;
2907:	
2908:				if (fmt.size > sizeof(int))
2909:					num = va_arg(args, long long);
2910:				else
2911:					num = convert_num_spec(va_arg(args, int), fmt.size, spec);
2912:				str = number(str, end, num, spec);
2913:				continue;
2914:			}
2915:	
2916:			case FORMAT_STATE_WIDTH:
2917:				set_field_width(&spec, va_arg(args, int));
2918:				continue;
2919:	
2920:			case FORMAT_STATE_PRECISION:
2921:				set_precision(&spec, va_arg(args, int));
2922:				continue;
2923:	
2924:			case FORMAT_STATE_CHAR: {
2925:				char c;
2926:	
2927:				if (!(spec.flags & LEFT)) {
2928:					while (--spec.field_width > 0) {
2929:						if (str < end)
2930:							*str = ' ';
2931:						++str;
2932:	
2933:					}
2934:				}
2935:				c = (unsigned char) va_arg(args, int);
2936:				if (str < end)
2937:					*str = c;
2938:				++str;
2939:				while (--spec.field_width > 0) {
2940:					if (str < end)
2941:						*str = ' ';
2942:					++str;
2943:				}
2944:				continue;
2945:			}
2946:	
2947:			case FORMAT_STATE_STR:
2948:				str = string(str, end, va_arg(args, char *), spec);
2949:				continue;
2950:	
2951:			case FORMAT_STATE_PTR:
2952:				str = pointer(fmt.str, str, end, va_arg(args, void *),
2953:					      spec);
2954:				while (isalnum(*fmt.str))
2955:					fmt.str++;
2956:				continue;
2957:	
2958:			case FORMAT_STATE_PERCENT_CHAR:
2959:				if (str < end)
2960:					*str = '%';
2961:				++str;
2962:				continue;
2963:	
2964:			default:
2965:				/*
2966:				 * Presumably the arguments passed gcc's type
2967:				 * checking, but there is no safe or sane way
2968:				 * for us to continue parsing the format and
2969:				 * fetching from the va_list; the remaining
2970:				 * specifiers and arguments would be out of
2971:				 * sync.
2972:				 */
2973:				goto out;
2974:			}
2975:		}
2976:	
2977:	out:
2978:		if (size > 0) {
2979:			if (str < end)
2980:				*str = '\0';
2981:			else
2982:				end[-1] = '\0';
2983:		}
2984:	
2985:		/* the trailing null byte doesn't count towards the total */
2986:		return str-buf;
2987:	
2988:	}
 SourceFile:lib/vsprintf.c]

gemini-3-flash-preview

							input: 43280
							output: 29
							thoughts: 126
						

**Analyzing the Function's Return Value**

Okay, so I'm looking at this code and I've spotted `str-buf` at the tail end. Right, that's a `ptrdiff_t` that's been type-cast to an `int` for the return. But hang on, I'm not seeing *exactly* where that calculation is being done. It's a bit unclear without the direct expression.

Let me take another crack at this. I'll search for `tmp_buf` again in `drivers/usb/gadget/function/f_fs.c`. This time, though, I'll broaden the search to the entire file to make sure I don't miss anything. Might be I need to search the entire `drivers/usb/gadget/function/f_fs.c` file using the `read-file` command, just to be absolutely certain I'm not overlooking some subtle reference. I'm sure it's in there somewhere.

map[File:drivers/usb/gadget/function/f_fs.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0+
/*
 * f_fs.c -- user mode file system API for USB composite function controllers
 *
 * Copyright (C) 2010 Samsung Electronics
 * Author: Michal Nazarewicz <mina86@mina86.com>
 *
 * Based on inode.c (GadgetFS) which was:
 * Copyright (C) 2003-2004 David Brownell
 * Copyright (C) 2003 Agilent Technologies
 */


/* #define DEBUG */
/* #define VERBOSE_DEBUG */

#include <linux/blkdev.h>
#include <linux/dma-buf.h>
#include <linux/dma-fence.h>
#include <linux/dma-resv.h>
#include <linux/pagemap.h>
#include <linux/export.h>
#include <linux/fs_parser.h>
#include <linux/hid.h>
#include <linux/mm.h>
#include <linux/module.h>
#include <linux/scatterlist.h>
#include <linux/sched/signal.h>
#include <linux/uio.h>
#include <linux/vmalloc.h>
#include <linux/unaligned.h>

#include <linux/usb/ccid.h>
#include <linux/usb/composite.h>
#include <linux/usb/functionfs.h>
#include <linux/usb/func_utils.h>

#include <linux/aio.h>
#include <linux/kthread.h>
#include <linux/poll.h>
#include <linux/eventfd.h>

#include "u_fs.h"
#include "u_os_desc.h"
#include "configfs.h"

#define FUNCTIONFS_MAGIC	0xa647361 /* Chosen by a honest dice roll ;) */
#define MAX_ALT_SETTINGS	2		  /* Allow up to 2 alt settings to be set. */

#define DMABUF_ENQUEUE_TIMEOUT_MS 5000

MODULE_IMPORT_NS("DMA_BUF");

/* Reference counter handling */
static void ffs_data_get(struct ffs_data *ffs);
static void ffs_data_put(struct ffs_data *ffs);
/* Creates new ffs_data object. */
static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
	__attribute__((malloc));

/* Opened counter handling. */
static void ffs_data_closed(struct ffs_data *ffs);

/* Called with ffs->mutex held; take over ownership of data. */
static int __must_check
__ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
static int __must_check
__ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);


/* The function structure ***************************************************/

struct ffs_ep;

struct ffs_function {
	struct usb_configuration	*conf;
	struct usb_gadget		*gadget;
	struct ffs_data			*ffs;

	struct ffs_ep			*eps;
	u8				eps_revmap[16];
	short				*interfaces_nums;

	struct usb_function		function;
	int				cur_alt[MAX_CONFIG_INTERFACES];
};


static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
{
	return container_of(f, struct ffs_function, function);
}


static inline enum ffs_setup_state
ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
{
	return (enum ffs_setup_state)
		cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
}


static void ffs_func_eps_disable(struct ffs_function *func);
static int __must_check ffs_func_eps_enable(struct ffs_function *func);

static int ffs_func_bind(struct usb_configuration *,
			 struct usb_function *);
static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
static int ffs_func_get_alt(struct usb_function *f, unsigned int intf);
static void ffs_func_disable(struct usb_function *);
static int ffs_func_setup(struct usb_function *,
			  const struct usb_ctrlrequest *);
static bool ffs_func_req_match(struct usb_function *,
			       const struct usb_ctrlrequest *,
			       bool config0);
static void ffs_func_suspend(struct usb_function *);
static void ffs_func_resume(struct usb_function *);


static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);


/* The endpoints structures *************************************************/

struct ffs_ep {
	struct usb_ep			*ep;	/* P: ffs->eps_lock */
	struct usb_request		*req;	/* P: epfile->mutex */

	/* [0]: full speed, [1]: high speed, [2]: super speed */
	struct usb_endpoint_descriptor	*descs[3];

	u8				num;
};

struct ffs_dmabuf_priv {
	struct list_head entry;
	struct kref ref;
	struct ffs_data *ffs;
	struct dma_buf_attachment *attach;
	struct sg_table *sgt;
	enum dma_data_direction dir;
	spinlock_t lock;
	u64 context;
	struct usb_request *req;	/* P: ffs->eps_lock */
	struct usb_ep *ep;		/* P: ffs->eps_lock */
};

struct ffs_dma_fence {
	struct dma_fence base;
	struct ffs_dmabuf_priv *priv;
	struct work_struct work;
};

struct ffs_epfile {
	/* Protects ep->ep and ep->req. */
	struct mutex			mutex;

	struct ffs_data			*ffs;
	struct ffs_ep			*ep;	/* P: ffs->eps_lock */

	/*
	 * Buffer for holding data from partial reads which may happen since
	 * we’re rounding user read requests to a multiple of a max packet size.
	 *
	 * The pointer is initialised with NULL value and may be set by
	 * __ffs_epfile_read_data function to point to a temporary buffer.
	 *
	 * In normal operation, calls to __ffs_epfile_read_buffered will consume
	 * data from said buffer and eventually free it.  Importantly, while the
	 * function is using the buffer, it sets the pointer to NULL.  This is
	 * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered
	 * can never run concurrently (they are synchronised by epfile->mutex)
	 * so the latter will not assign a new value to the pointer.
	 *
	 * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is
	 * valid) and sets the pointer to READ_BUFFER_DROP value.  This special
	 * value is crux of the synchronisation between ffs_func_eps_disable and
	 * __ffs_epfile_read_data.
	 *
	 * Once __ffs_epfile_read_data is about to finish it will try to set the
	 * pointer back to its old value (as described above), but seeing as the
	 * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free
	 * the buffer.
	 *
	 * == State transitions ==
	 *
	 * • ptr == NULL:  (initial state)
	 *   ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP
	 *   ◦ __ffs_epfile_read_buffered:    nop
	 *   ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf
	 *   ◦ reading finishes:              n/a, not in ‘and reading’ state
	 * • ptr == DROP:
	 *   ◦ __ffs_epfile_read_buffer_free: nop
	 *   ◦ __ffs_epfile_read_buffered:    go to ptr == NULL
	 *   ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop
	 *   ◦ reading finishes:              n/a, not in ‘and reading’ state
	 * • ptr == buf:
	 *   ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP
	 *   ◦ __ffs_epfile_read_buffered:    go to ptr == NULL and reading
	 *   ◦ __ffs_epfile_read_data:        n/a, __ffs_epfile_read_buffered
	 *                                    is always called first
	 *   ◦ reading finishes:              n/a, not in ‘and reading’ state
	 * • ptr == NULL and reading:
	 *   ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading
	 *   ◦ __ffs_epfile_read_buffered:    n/a, mutex is held
	 *   ◦ __ffs_epfile_read_data:        n/a, mutex is held
	 *   ◦ reading finishes and …
	 *     … all data read:               free buf, go to ptr == NULL
	 *     … otherwise:                   go to ptr == buf and reading
	 * • ptr == DROP and reading:
	 *   ◦ __ffs_epfile_read_buffer_free: nop
	 *   ◦ __ffs_epfile_read_buffered:    n/a, mutex is held
	 *   ◦ __ffs_epfile_read_data:        n/a, mutex is held
	 *   ◦ reading finishes:              free buf, go to ptr == DROP
	 */
	struct ffs_buffer		*read_buffer;
#define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN))

	char				name[5];

	unsigned char			in;	/* P: ffs->eps_lock */
	unsigned char			isoc;	/* P: ffs->eps_lock */

	unsigned char			_pad;

	/* Protects dmabufs */
	struct mutex			dmabufs_mutex;
	struct list_head		dmabufs; /* P: dmabufs_mutex */
	atomic_t			seqno;
};

struct ffs_buffer {
	size_t length;
	char *data;
	char storage[] __counted_by(length);
};

/*  ffs_io_data structure ***************************************************/

struct ffs_io_data {
	bool aio;
	bool read;

	struct kiocb *kiocb;
	struct iov_iter data;
	const void *to_free;
	char *buf;

	struct mm_struct *mm;
	struct work_struct work;

	struct usb_ep *ep;
	struct usb_request *req;
	struct sg_table sgt;
	bool use_sg;

	struct ffs_data *ffs;

	int status;
	struct completion done;
};

struct ffs_desc_helper {
	struct ffs_data *ffs;
	unsigned interfaces_count;
	unsigned eps_count;
};

static int  __must_check ffs_epfiles_create(struct ffs_data *ffs);
static void ffs_epfiles_destroy(struct super_block *sb,
				struct ffs_epfile *epfiles, unsigned count);

static int ffs_sb_create_file(struct super_block *sb, const char *name,
			      void *data, const struct file_operations *fops);

/* Devices management *******************************************************/

DEFINE_MUTEX(ffs_lock);
EXPORT_SYMBOL_GPL(ffs_lock);

static struct ffs_dev *_ffs_find_dev(const char *name);
static struct ffs_dev *_ffs_alloc_dev(void);
static void _ffs_free_dev(struct ffs_dev *dev);
static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data);
static void ffs_release_dev(struct ffs_dev *ffs_dev);
static int ffs_ready(struct ffs_data *ffs);
static void ffs_closed(struct ffs_data *ffs);

/* Misc helper functions ****************************************************/

static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
	__attribute__((warn_unused_result, nonnull));
static char *ffs_prepare_buffer(const char __user *buf, size_t len)
	__attribute__((warn_unused_result, nonnull));


/* Control file aka ep0 *****************************************************/

static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
{
	struct ffs_data *ffs = req->context;

	complete(&ffs->ep0req_completion);
}

static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
	__releases(&ffs->ev.waitq.lock)
{
	struct usb_request *req = ffs->ep0req;
	int ret;

	if (!req) {
		spin_unlock_irq(&ffs->ev.waitq.lock);
		return -EINVAL;
	}

	req->zero     = len < le16_to_cpu(ffs->ev.setup.wLength);

	spin_unlock_irq(&ffs->ev.waitq.lock);

	req->buf      = data;
	req->length   = len;

	/*
	 * UDC layer requires to provide a buffer even for ZLP, but should
	 * not use it at all. Let's provide some poisoned pointer to catch
	 * possible bug in the driver.
	 */
	if (req->buf == NULL)
		req->buf = (void *)0xDEADBABE;

	reinit_completion(&ffs->ep0req_completion);

	ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
	if (ret < 0)
		return ret;

	ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
	if (ret) {
		usb_ep_dequeue(ffs->gadget->ep0, req);
		return -EINTR;
	}

	ffs->setup_state = FFS_NO_SETUP;
	return req->status ? req->status : req->actual;
}

static int __ffs_ep0_stall(struct ffs_data *ffs)
{
	if (ffs->ev.can_stall) {
		pr_vdebug("ep0 stall\n");
		usb_ep_set_halt(ffs->gadget->ep0);
		ffs->setup_state = FFS_NO_SETUP;
		return -EL2HLT;
	} else {
		pr_debug("bogus ep0 stall!\n");
		return -ESRCH;
	}
}

static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
			     size_t len, loff_t *ptr)
{
	struct ffs_data *ffs = file->private_data;
	ssize_t ret;
	char *data;

	/* Fast check if setup was canceled */
	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
		return -EIDRM;

	/* Acquire mutex */
	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
	if (ret < 0)
		return ret;

	/* Check state */
	switch (ffs->state) {
	case FFS_READ_DESCRIPTORS:
	case FFS_READ_STRINGS:
		/* Copy data */
		if (len < 16) {
			ret = -EINVAL;
			break;
		}

		data = ffs_prepare_buffer(buf, len);
		if (IS_ERR(data)) {
			ret = PTR_ERR(data);
			break;
		}

		/* Handle data */
		if (ffs->state == FFS_READ_DESCRIPTORS) {
			pr_info("read descriptors\n");
			ret = __ffs_data_got_descs(ffs, data, len);
			if (ret < 0)
				break;

			ffs->state = FFS_READ_STRINGS;
			ret = len;
		} else {
			pr_info("read strings\n");
			ret = __ffs_data_got_strings(ffs, data, len);
			if (ret < 0)
				break;

			ret = ffs_epfiles_create(ffs);
			if (ret) {
				ffs->state = FFS_CLOSING;
				break;
			}

			ffs->state = FFS_ACTIVE;
			mutex_unlock(&ffs->mutex);

			ret = ffs_ready(ffs);
			if (ret < 0) {
				ffs->state = FFS_CLOSING;
				return ret;
			}

			return len;
		}
		break;

	case FFS_ACTIVE:
		data = NULL;
		/*
		 * We're called from user space, we can use _irq
		 * rather then _irqsave
		 */
		spin_lock_irq(&ffs->ev.waitq.lock);
		switch (ffs_setup_state_clear_cancelled(ffs)) {
		case FFS_SETUP_CANCELLED:
			ret = -EIDRM;
			goto done_spin;

		case FFS_NO_SETUP:
			ret = -ESRCH;
			goto done_spin;

		case FFS_SETUP_PENDING:
			break;
		}

		/* FFS_SETUP_PENDING */
		if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
			spin_unlock_irq(&ffs->ev.waitq.lock);
			ret = __ffs_ep0_stall(ffs);
			break;
		}

		/* FFS_SETUP_PENDING and not stall */
		len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength));

		spin_unlock_irq(&ffs->ev.waitq.lock);

		data = ffs_prepare_buffer(buf, len);
		if (IS_ERR(data)) {
			ret = PTR_ERR(data);
			break;
		}

		spin_lock_irq(&ffs->ev.waitq.lock);

		/*
		 * We are guaranteed to be still in FFS_ACTIVE state
		 * but the state of setup could have changed from
		 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
		 * to check for that.  If that happened we copied data
		 * from user space in vain but it's unlikely.
		 *
		 * For sure we are not in FFS_NO_SETUP since this is
		 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
		 * transition can be performed and it's protected by
		 * mutex.
		 */
		if (ffs_setup_state_clear_cancelled(ffs) ==
		    FFS_SETUP_CANCELLED) {
			ret = -EIDRM;
done_spin:
			spin_unlock_irq(&ffs->ev.waitq.lock);
		} else {
			/* unlocks spinlock */
			ret = __ffs_ep0_queue_wait(ffs, data, len);
		}
		kfree(data);
		break;

	default:
		ret = -EBADFD;
		break;
	}

	mutex_unlock(&ffs->mutex);
	return ret;
}

/* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
				     size_t n)
	__releases(&ffs->ev.waitq.lock)
{
	/*
	 * n cannot be bigger than ffs->ev.count, which cannot be bigger than
	 * size of ffs->ev.types array (which is four) so that's how much space
	 * we reserve.
	 */
	struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
	const size_t size = n * sizeof *events;
	unsigned i = 0;

	memset(events, 0, size);

	do {
		events[i].type = ffs->ev.types[i];
		if (events[i].type == FUNCTIONFS_SETUP) {
			events[i].u.setup = ffs->ev.setup;
			ffs->setup_state = FFS_SETUP_PENDING;
		}
	} while (++i < n);

	ffs->ev.count -= n;
	if (ffs->ev.count)
		memmove(ffs->ev.types, ffs->ev.types + n,
			ffs->ev.count * sizeof *ffs->ev.types);

	spin_unlock_irq(&ffs->ev.waitq.lock);
	mutex_unlock(&ffs->mutex);

	return copy_to_user(buf, events, size) ? -EFAULT : size;
}

static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
			    size_t len, loff_t *ptr)
{
	struct ffs_data *ffs = file->private_data;
	char *data = NULL;
	size_t n;
	int ret;

	/* Fast check if setup was canceled */
	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
		return -EIDRM;

	/* Acquire mutex */
	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
	if (ret < 0)
		return ret;

	/* Check state */
	if (ffs->state != FFS_ACTIVE) {
		ret = -EBADFD;
		goto done_mutex;
	}

	/*
	 * We're called from user space, we can use _irq rather then
	 * _irqsave
	 */
	spin_lock_irq(&ffs->ev.waitq.lock);

	switch (ffs_setup_state_clear_cancelled(ffs)) {
	case FFS_SETUP_CANCELLED:
		ret = -EIDRM;
		break;

	case FFS_NO_SETUP:
		n = len / sizeof(struct usb_functionfs_event);
		if (!n) {
			ret = -EINVAL;
			break;
		}

		if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
			ret = -EAGAIN;
			break;
		}

		if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
							ffs->ev.count)) {
			ret = -EINTR;
			break;
		}

		/* unlocks spinlock */
		return __ffs_ep0_read_events(ffs, buf,
					     min_t(size_t, n, ffs->ev.count));

	case FFS_SETUP_PENDING:
		if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
			spin_unlock_irq(&ffs->ev.waitq.lock);
			ret = __ffs_ep0_stall(ffs);
			goto done_mutex;
		}

		len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength));

		spin_unlock_irq(&ffs->ev.waitq.lock);

		if (len) {
			data = kmalloc(len, GFP_KERNEL);
			if (!data) {
				ret = -ENOMEM;
				goto done_mutex;
			}
		}

		spin_lock_irq(&ffs->ev.waitq.lock);

		/* See ffs_ep0_write() */
		if (ffs_setup_state_clear_cancelled(ffs) ==
		    FFS_SETUP_CANCELLED) {
			ret = -EIDRM;
			break;
		}

		/* unlocks spinlock */
		ret = __ffs_ep0_queue_wait(ffs, data, len);
		if ((ret > 0) && (copy_to_user(buf, data, len)))
			ret = -EFAULT;
		goto done_mutex;

	default:
		ret = -EBADFD;
		break;
	}

	spin_unlock_irq(&ffs->ev.waitq.lock);
done_mutex:
	mutex_unlock(&ffs->mutex);
	kfree(data);
	return ret;
}


static void ffs_data_reset(struct ffs_data *ffs);

static int ffs_ep0_open(struct inode *inode, struct file *file)
{
	struct ffs_data *ffs = inode->i_sb->s_fs_info;

	spin_lock_irq(&ffs->eps_lock);
	if (ffs->state == FFS_CLOSING) {
		spin_unlock_irq(&ffs->eps_lock);
		return -EBUSY;
	}
	if (!ffs->opened++ && ffs->state == FFS_DEACTIVATED) {
		ffs->state = FFS_CLOSING;
		spin_unlock_irq(&ffs->eps_lock);
		ffs_data_reset(ffs);
	} else {
		spin_unlock_irq(&ffs->eps_lock);
	}
	file->private_data = ffs;

	return stream_open(inode, file);
}

static int ffs_ep0_release(struct inode *inode, struct file *file)
{
	struct ffs_data *ffs = file->private_data;

	ffs_data_closed(ffs);

	return 0;
}

static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
{
	struct ffs_data *ffs = file->private_data;
	struct usb_gadget *gadget = ffs->gadget;
	long ret;

	if (code == FUNCTIONFS_INTERFACE_REVMAP) {
		struct ffs_function *func = ffs->func;
		ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
	} else if (gadget && gadget->ops->ioctl) {
		ret = gadget->ops->ioctl(gadget, code, value);
	} else {
		ret = -ENOTTY;
	}

	return ret;
}

static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait)
{
	struct ffs_data *ffs = file->private_data;
	__poll_t mask = EPOLLWRNORM;
	int ret;

	poll_wait(file, &ffs->ev.waitq, wait);

	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
	if (ret < 0)
		return mask;

	switch (ffs->state) {
	case FFS_READ_DESCRIPTORS:
	case FFS_READ_STRINGS:
		mask |= EPOLLOUT;
		break;

	case FFS_ACTIVE:
		switch (ffs->setup_state) {
		case FFS_NO_SETUP:
			if (ffs->ev.count)
				mask |= EPOLLIN;
			break;

		case FFS_SETUP_PENDING:
		case FFS_SETUP_CANCELLED:
			mask |= (EPOLLIN | EPOLLOUT);
			break;
		}
		break;

	case FFS_CLOSING:
		break;
	case FFS_DEACTIVATED:
		break;
	}

	mutex_unlock(&ffs->mutex);

	return mask;
}

static const struct file_operations ffs_ep0_operations = {

	.open =		ffs_ep0_open,
	.write =	ffs_ep0_write,
	.read =		ffs_ep0_read,
	.release =	ffs_ep0_release,
	.unlocked_ioctl =	ffs_ep0_ioctl,
	.poll =		ffs_ep0_poll,
};


/* "Normal" endpoints operations ********************************************/

static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
{
	struct ffs_io_data *io_data = req->context;

	if (req->status)
		io_data->status = req->status;
	else
		io_data->status = req->actual;

	complete(&io_data->done);
}

static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
{
	ssize_t ret = copy_to_iter(data, data_len, iter);
	if (ret == data_len)
		return ret;

	if (iov_iter_count(iter))
		return -EFAULT;

	/*
	 * Dear user space developer!
	 *
	 * TL;DR: To stop getting below error message in your kernel log, change
	 * user space code using functionfs to align read buffers to a max
	 * packet size.
	 *
	 * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max
	 * packet size.  When unaligned buffer is passed to functionfs, it
	 * internally uses a larger, aligned buffer so that such UDCs are happy.
	 *
	 * Unfortunately, this means that host may send more data than was
	 * requested in read(2) system call.  f_fs doesn’t know what to do with
	 * that excess data so it simply drops it.
	 *
	 * Was the buffer aligned in the first place, no such problem would
	 * happen.
	 *
	 * Data may be dropped only in AIO reads.  Synchronous reads are handled
	 * by splitting a request into multiple parts.  This splitting may still
	 * be a problem though so it’s likely best to align the buffer
	 * regardless of it being AIO or not..
	 *
	 * This only affects OUT endpoints, i.e. reading data with a read(2),
	 * aio_read(2) etc. system calls.  Writing data to an IN endpoint is not
	 * affected.
	 */
	pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
	       "Align read buffer size to max packet size to avoid the problem.\n",
	       data_len, ret);

	return ret;
}

/*
 * allocate a virtually contiguous buffer and create a scatterlist describing it
 * @sg_table	- pointer to a place to be filled with sg_table contents
 * @size	- required buffer size
 */
static void *ffs_build_sg_list(struct sg_table *sgt, size_t sz)
{
	struct page **pages;
	void *vaddr, *ptr;
	unsigned int n_pages;
	int i;

	vaddr = vmalloc(sz);
	if (!vaddr)
		return NULL;

	n_pages = PAGE_ALIGN(sz) >> PAGE_SHIFT;
	pages = kvmalloc_objs(struct page *, n_pages);
	if (!pages) {
		vfree(vaddr);

		return NULL;
	}
	for (i = 0, ptr = vaddr; i < n_pages; ++i, ptr += PAGE_SIZE)
		pages[i] = vmalloc_to_page(ptr);

	if (sg_alloc_table_from_pages(sgt, pages, n_pages, 0, sz, GFP_KERNEL)) {
		kvfree(pages);
		vfree(vaddr);

		return NULL;
	}
	kvfree(pages);

	return vaddr;
}

static inline void *ffs_alloc_buffer(struct ffs_io_data *io_data,
	size_t data_len)
{
	if (io_data->use_sg)
		return ffs_build_sg_list(&io_data->sgt, data_len);

	return kmalloc(data_len, GFP_KERNEL);
}

static inline void ffs_free_buffer(struct ffs_io_data *io_data)
{
	if (!io_data->buf)
		return;

	if (io_data->use_sg) {
		sg_free_table(&io_data->sgt);
		vfree(io_data->buf);
	} else {
		kfree(io_data->buf);
	}
}

static void ffs_user_copy_worker(struct work_struct *work)
{
	struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
						   work);
	int ret = io_data->status;
	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;

	if (io_data->read && ret > 0) {
		kthread_use_mm(io_data->mm);
		ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
		kthread_unuse_mm(io_data->mm);
	}

	io_data->kiocb->ki_complete(io_data->kiocb, ret);

	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
		eventfd_signal(io_data->ffs->ffs_eventfd);

	usb_ep_free_request(io_data->ep, io_data->req);

	if (io_data->read)
		kfree(io_data->to_free);
	ffs_free_buffer(io_data);
	kfree(io_data);
}

static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
					 struct usb_request *req)
{
	struct ffs_io_data *io_data = req->context;
	struct ffs_data *ffs = io_data->ffs;

	io_data->status = req->status ? req->status : req->actual;

	INIT_WORK(&io_data->work, ffs_user_copy_worker);
	queue_work(ffs->io_completion_wq, &io_data->work);
}

static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
{
	/*
	 * See comment in struct ffs_epfile for full read_buffer pointer
	 * synchronisation story.
	 */
	struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP);
	if (buf && buf != READ_BUFFER_DROP)
		kfree(buf);
}

/* Assumes epfile->mutex is held. */
static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
					  struct iov_iter *iter)
{
	/*
	 * Null out epfile->read_buffer so ffs_func_eps_disable does not free
	 * the buffer while we are using it.  See comment in struct ffs_epfile
	 * for full read_buffer pointer synchronisation story.
	 */
	struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL);
	ssize_t ret;
	if (!buf || buf == READ_BUFFER_DROP)
		return 0;

	ret = copy_to_iter(buf->data, buf->length, iter);
	if (buf->length == ret) {
		kfree(buf);
		return ret;
	}

	if (iov_iter_count(iter)) {
		ret = -EFAULT;
	} else {
		buf->length -= ret;
		buf->data += ret;
	}

	if (cmpxchg(&epfile->read_buffer, NULL, buf))
		kfree(buf);

	return ret;
}

/* Assumes epfile->mutex is held. */
static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
				      void *data, int data_len,
				      struct iov_iter *iter)
{
	struct ffs_buffer *buf;

	ssize_t ret = copy_to_iter(data, data_len, iter);
	if (data_len == ret)
		return ret;

	if (iov_iter_count(iter))
		return -EFAULT;

	/* See ffs_copy_to_iter for more context. */
	pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
		data_len, ret);

	data_len -= ret;
	buf = kmalloc_flex(*buf, storage, data_len);
	if (!buf)
		return -ENOMEM;
	buf->length = data_len;
	buf->data = buf->storage;
	memcpy(buf->storage, data + ret, flex_array_size(buf, storage, data_len));

	/*
	 * At this point read_buffer is NULL or READ_BUFFER_DROP (if
	 * ffs_func_eps_disable has been called in the meanwhile).  See comment
	 * in struct ffs_epfile for full read_buffer pointer synchronisation
	 * story.
	 */
	if (cmpxchg(&epfile->read_buffer, NULL, buf))
		kfree(buf);

	return ret;
}

static struct ffs_ep *ffs_epfile_wait_ep(struct file *file)
{
	struct ffs_epfile *epfile = file->private_data;
	struct ffs_ep *ep;
	int ret;

	/* Wait for endpoint to be enabled */
	ep = epfile->ep;
	if (!ep) {
		if (file->f_flags & O_NONBLOCK)
			return ERR_PTR(-EAGAIN);

		ret = wait_event_interruptible(
				epfile->ffs->wait, (ep = epfile->ep));
		if (ret)
			return ERR_PTR(-EINTR);
	}

	return ep;
}

static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
{
	struct ffs_epfile *epfile = file->private_data;
	struct usb_request *req;
	struct ffs_ep *ep;
	char *data = NULL;
	ssize_t ret, data_len = -EINVAL;
	int halt;

	/* Are we still active? */
	if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
		return -ENODEV;

	ep = ffs_epfile_wait_ep(file);
	if (IS_ERR(ep))
		return PTR_ERR(ep);

	/* Do we halt? */
	halt = (!io_data->read == !epfile->in);
	if (halt && epfile->isoc)
		return -EINVAL;

	/* We will be using request and read_buffer */
	ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
	if (ret)
		goto error;

	/* Allocate & copy */
	if (!halt) {
		struct usb_gadget *gadget;

		/*
		 * Do we have buffered data from previous partial read?  Check
		 * that for synchronous case only because we do not have
		 * facility to ‘wake up’ a pending asynchronous read and push
		 * buffered data to it which we would need to make things behave
		 * consistently.
		 */
		if (!io_data->aio && io_data->read) {
			ret = __ffs_epfile_read_buffered(epfile, &io_data->data);
			if (ret)
				goto error_mutex;
		}

		/*
		 * if we _do_ wait above, the epfile->ffs->gadget might be NULL
		 * before the waiting completes, so do not assign to 'gadget'
		 * earlier
		 */
		gadget = epfile->ffs->gadget;

		spin_lock_irq(&epfile->ffs->eps_lock);
		/* In the meantime, endpoint got disabled or changed. */
		if (epfile->ep != ep) {
			ret = -ESHUTDOWN;
			goto error_lock;
		}
		data_len = iov_iter_count(&io_data->data);
		/*
		 * Controller may require buffer size to be aligned to
		 * maxpacketsize of an out endpoint.
		 */
		if (io_data->read)
			data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);

		io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE;
		spin_unlock_irq(&epfile->ffs->eps_lock);

		data = ffs_alloc_buffer(io_data, data_len);
		if (!data) {
			ret = -ENOMEM;
			goto error_mutex;
		}
		if (!io_data->read &&
		    !copy_from_iter_full(data, data_len, &io_data->data)) {
			ret = -EFAULT;
			goto error_mutex;
		}
	}

	spin_lock_irq(&epfile->ffs->eps_lock);

	if (epfile->ep != ep) {
		/* In the meantime, endpoint got disabled or changed. */
		ret = -ESHUTDOWN;
	} else if (halt) {
		ret = usb_ep_set_halt(ep->ep);
		if (!ret)
			ret = -EBADMSG;
	} else if (data_len == -EINVAL) {
		/*
		 * Sanity Check: even though data_len can't be used
		 * uninitialized at the time I write this comment, some
		 * compilers complain about this situation.
		 * In order to keep the code clean from warnings, data_len is
		 * being initialized to -EINVAL during its declaration, which
		 * means we can't rely on compiler anymore to warn no future
		 * changes won't result in data_len being used uninitialized.
		 * For such reason, we're adding this redundant sanity check
		 * here.
		 */
		WARN(1, "%s: data_len == -EINVAL\n", __func__);
		ret = -EINVAL;
	} else if (!io_data->aio) {
		bool interrupted = false;

		req = ep->req;
		if (io_data->use_sg) {
			req->buf = NULL;
			req->sg	= io_data->sgt.sgl;
			req->num_sgs = io_data->sgt.nents;
		} else {
			req->buf = data;
			req->num_sgs = 0;
		}
		req->length = data_len;

		io_data->buf = data;

		init_completion(&io_data->done);
		req->context  = io_data;
		req->complete = ffs_epfile_io_complete;

		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
		if (ret < 0)
			goto error_lock;

		spin_unlock_irq(&epfile->ffs->eps_lock);

		if (wait_for_completion_interruptible(&io_data->done)) {
			spin_lock_irq(&epfile->ffs->eps_lock);
			if (epfile->ep != ep) {
				ret = -ESHUTDOWN;
				goto error_lock;
			}
			/*
			 * To avoid race condition with ffs_epfile_io_complete,
			 * dequeue the request first then check
			 * status. usb_ep_dequeue API should guarantee no race
			 * condition with req->complete callback.
			 */
			usb_ep_dequeue(ep->ep, req);
			spin_unlock_irq(&epfile->ffs->eps_lock);
			wait_for_completion(&io_data->done);
			interrupted = io_data->status < 0;
		}

		if (interrupted)
			ret = -EINTR;
		else if (io_data->read && io_data->status > 0)
			ret = __ffs_epfile_read_data(epfile, data, io_data->status,
						     &io_data->data);
		else
			ret = io_data->status;
		goto error_mutex;
	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
		ret = -ENOMEM;
	} else {
		if (io_data->use_sg) {
			req->buf = NULL;
			req->sg	= io_data->sgt.sgl;
			req->num_sgs = io_data->sgt.nents;
		} else {
			req->buf = data;
			req->num_sgs = 0;
		}
		req->length = data_len;

		io_data->buf = data;
		io_data->ep = ep->ep;
		io_data->req = req;
		io_data->ffs = epfile->ffs;

		req->context  = io_data;
		req->complete = ffs_epfile_async_io_complete;

		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
		if (ret) {
			io_data->req = NULL;
			usb_ep_free_request(ep->ep, req);
			goto error_lock;
		}

		ret = -EIOCBQUEUED;
		/*
		 * Do not kfree the buffer in this function.  It will be freed
		 * by ffs_user_copy_worker.
		 */
		data = NULL;
	}

error_lock:
	spin_unlock_irq(&epfile->ffs->eps_lock);
error_mutex:
	mutex_unlock(&epfile->mutex);
error:
	if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */
		ffs_free_buffer(io_data);
	return ret;
}

static int
ffs_epfile_open(struct inode *inode, struct file *file)
{
	struct ffs_data *ffs = inode->i_sb->s_fs_info;
	struct ffs_epfile *epfile;

	spin_lock_irq(&ffs->eps_lock);
	if (!ffs->opened) {
		spin_unlock_irq(&ffs->eps_lock);
		return -ENODEV;
	}
	/*
	 * we want the state to be FFS_ACTIVE; FFS_ACTIVE alone is
	 * not enough, though - we might have been through FFS_CLOSING
	 * and back to FFS_ACTIVE, with our file already removed.
	 */
	epfile = smp_load_acquire(&inode->i_private);
	if (unlikely(ffs->state != FFS_ACTIVE || !epfile)) {
		spin_unlock_irq(&ffs->eps_lock);
		return -ENODEV;
	}
	ffs->opened++;
	spin_unlock_irq(&ffs->eps_lock);

	file->private_data = epfile;
	return stream_open(inode, file);
}

static int ffs_aio_cancel(struct kiocb *kiocb)
{
	struct ffs_io_data *io_data = kiocb->private;
	int value;

	if (io_data && io_data->ep && io_data->req)
		value = usb_ep_dequeue(io_data->ep, io_data->req);
	else
		value = -EINVAL;

	return value;
}

static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
{
	struct ffs_io_data io_data, *p = &io_data;
	ssize_t res;

	if (!is_sync_kiocb(kiocb)) {
		p = kzalloc_obj(io_data);
		if (!p)
			return -ENOMEM;
		p->aio = true;
	} else {
		memset(p, 0, sizeof(*p));
		p->aio = false;
	}

	p->read = false;
	p->kiocb = kiocb;
	p->data = *from;
	p->mm = current->mm;

	kiocb->private = p;

	if (p->aio)
		kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);

	res = ffs_epfile_io(kiocb->ki_filp, p);
	if (res == -EIOCBQUEUED)
		return res;
	if (p->aio)
		kfree(p);
	else
		*from = p->data;
	return res;
}

static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
{
	struct ffs_io_data io_data, *p = &io_data;
	ssize_t res;

	if (!is_sync_kiocb(kiocb)) {
		p = kzalloc_obj(io_data);
		if (!p)
			return -ENOMEM;
		p->aio = true;
	} else {
		memset(p, 0, sizeof(*p));
		p->aio = false;
	}

	p->read = true;
	p->kiocb = kiocb;
	if (p->aio) {
		p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
		if (!iter_is_ubuf(&p->data) && !p->to_free) {
			kfree(p);
			return -ENOMEM;
		}
	} else {
		p->data = *to;
		p->to_free = NULL;
	}
	p->mm = current->mm;

	kiocb->private = p;

	if (p->aio)
		kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);

	res = ffs_epfile_io(kiocb->ki_filp, p);
	if (res == -EIOCBQUEUED)
		return res;

	if (p->aio) {
		kfree(p->to_free);
		kfree(p);
	} else {
		*to = p->data;
	}
	return res;
}

static void ffs_dmabuf_release(struct kref *ref)
{
	struct ffs_dmabuf_priv *priv = container_of(ref, struct ffs_dmabuf_priv, ref);
	struct dma_buf_attachment *attach = priv->attach;
	struct dma_buf *dmabuf = attach->dmabuf;

	pr_vdebug("FFS DMABUF release\n");
	dma_buf_unmap_attachment_unlocked(attach, priv->sgt, priv->dir);

	dma_buf_detach(attach->dmabuf, attach);
	dma_buf_put(dmabuf);
	kfree(priv);
}

static void ffs_dmabuf_get(struct dma_buf_attachment *attach)
{
	struct ffs_dmabuf_priv *priv = attach->importer_priv;

	kref_get(&priv->ref);
}

static void ffs_dmabuf_put(struct dma_buf_attachment *attach)
{
	struct ffs_dmabuf_priv *priv = attach->importer_priv;

	kref_put(&priv->ref, ffs_dmabuf_release);
}

static int
ffs_epfile_release(struct inode *inode, struct file *file)
{
	struct ffs_epfile *epfile = file->private_data;
	struct ffs_dmabuf_priv *priv, *tmp;
	struct ffs_data *ffs = epfile->ffs;

	mutex_lock(&epfile->dmabufs_mutex);

	/* Close all attached DMABUFs */
	list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) {
		/* Cancel any pending transfer */
		spin_lock_irq(&ffs->eps_lock);
		if (priv->ep && priv->req)
			usb_ep_dequeue(priv->ep, priv->req);
		spin_unlock_irq(&ffs->eps_lock);

		list_del(&priv->entry);
		ffs_dmabuf_put(priv->attach);
	}

	mutex_unlock(&epfile->dmabufs_mutex);

	__ffs_epfile_read_buffer_free(epfile);
	ffs_data_closed(epfile->ffs);

	return 0;
}

static void ffs_dmabuf_cleanup(struct work_struct *work)
{
	struct ffs_dma_fence *dma_fence =
		container_of(work, struct ffs_dma_fence, work);
	struct ffs_dmabuf_priv *priv = dma_fence->priv;
	struct dma_buf_attachment *attach = priv->attach;
	struct dma_fence *fence = &dma_fence->base;

	ffs_dmabuf_put(attach);
	dma_fence_put(fence);
}

static void ffs_dmabuf_signal_done(struct ffs_dma_fence *dma_fence, int ret)
{
	struct ffs_dmabuf_priv *priv = dma_fence->priv;
	struct dma_fence *fence = &dma_fence->base;
	bool cookie = dma_fence_begin_signalling();

	dma_fence_get(fence);
	fence->error = ret;
	dma_fence_signal(fence);
	dma_fence_end_signalling(cookie);

	/*
	 * The fence will be unref'd in ffs_dmabuf_cleanup.
	 * It can't be done here, as the unref functions might try to lock
	 * the resv object, which would deadlock.
	 */
	INIT_WORK(&dma_fence->work, ffs_dmabuf_cleanup);
	queue_work(priv->ffs->io_completion_wq, &dma_fence->work);
}

static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep,
					  struct usb_request *req)
{
	pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status);
	ffs_dmabuf_signal_done(req->context, req->status);
	usb_ep_free_request(ep, req);
}

static const char *ffs_dmabuf_get_driver_name(struct dma_fence *fence)
{
	return "functionfs";
}

static const char *ffs_dmabuf_get_timeline_name(struct dma_fence *fence)
{
	return "";
}

static void ffs_dmabuf_fence_release(struct dma_fence *fence)
{
	struct ffs_dma_fence *dma_fence =
		container_of(fence, struct ffs_dma_fence, base);

	kfree(dma_fence);
}

static const struct dma_fence_ops ffs_dmabuf_fence_ops = {
	.get_driver_name	= ffs_dmabuf_get_driver_name,
	.get_timeline_name	= ffs_dmabuf_get_timeline_name,
	.release		= ffs_dmabuf_fence_release,
};

static int ffs_dma_resv_lock(struct dma_buf *dmabuf, bool nonblock)
{
	if (!nonblock)
		return dma_resv_lock_interruptible(dmabuf->resv, NULL);

	if (!dma_resv_trylock(dmabuf->resv))
		return -EBUSY;

	return 0;
}

static struct dma_buf_attachment *
ffs_dmabuf_find_attachment(struct ffs_epfile *epfile, struct dma_buf *dmabuf)
{
	struct device *dev = epfile->ffs->gadget->dev.parent;
	struct dma_buf_attachment *attach = NULL;
	struct ffs_dmabuf_priv *priv;

	mutex_lock(&epfile->dmabufs_mutex);

	list_for_each_entry(priv, &epfile->dmabufs, entry) {
		if (priv->attach->dev == dev
		    && priv->attach->dmabuf == dmabuf) {
			attach = priv->attach;
			break;
		}
	}

	if (attach)
		ffs_dmabuf_get(attach);

	mutex_unlock(&epfile->dmabufs_mutex);

	return attach ?: ERR_PTR(-EPERM);
}

static int ffs_dmabuf_attach(struct file *file, int fd)
{
	bool nonblock = file->f_flags & O_NONBLOCK;
	struct ffs_epfile *epfile = file->private_data;
	struct usb_gadget *gadget = epfile->ffs->gadget;
	struct dma_buf_attachment *attach;
	struct ffs_dmabuf_priv *priv;
	enum dma_data_direction dir;
	struct sg_table *sg_table;
	struct dma_buf *dmabuf;
	int err;

	if (!gadget || !gadget->sg_supported)
		return -EPERM;

	dmabuf = dma_buf_get(fd);
	if (IS_ERR(dmabuf))
		return PTR_ERR(dmabuf);

	attach = dma_buf_attach(dmabuf, gadget->dev.parent);
	if (IS_ERR(attach)) {
		err = PTR_ERR(attach);
		goto err_dmabuf_put;
	}

	priv = kzalloc_obj(*priv);
	if (!priv) {
		err = -ENOMEM;
		goto err_dmabuf_detach;
	}

	dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE;

	err = ffs_dma_resv_lock(dmabuf, nonblock);
	if (err)
		goto err_free_priv;

	sg_table = dma_buf_map_attachment(attach, dir);
	dma_resv_unlock(dmabuf->resv);

	if (IS_ERR(sg_table)) {
		err = PTR_ERR(sg_table);
		goto err_free_priv;
	}

	attach->importer_priv = priv;

	priv->sgt = sg_table;
	priv->dir = dir;
	priv->ffs = epfile->ffs;
	priv->attach = attach;
	spin_lock_init(&priv->lock);
	kref_init(&priv->ref);
	priv->context = dma_fence_context_alloc(1);

	mutex_lock(&epfile->dmabufs_mutex);
	list_add(&priv->entry, &epfile->dmabufs);
	mutex_unlock(&epfile->dmabufs_mutex);

	return 0;

err_free_priv:
	kfree(priv);
err_dmabuf_detach:
	dma_buf_detach(dmabuf, attach);
err_dmabuf_put:
	dma_buf_put(dmabuf);

	return err;
}

static int ffs_dmabuf_detach(struct file *file, int fd)
{
	struct ffs_epfile *epfile = file->private_data;
	struct ffs_data *ffs = epfile->ffs;
	struct device *dev = ffs->gadget->dev.parent;
	struct ffs_dmabuf_priv *priv, *tmp;
	struct dma_buf *dmabuf;
	int ret = -EPERM;

	dmabuf = dma_buf_get(fd);
	if (IS_ERR(dmabuf))
		return PTR_ERR(dmabuf);

	mutex_lock(&epfile->dmabufs_mutex);

	list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) {
		if (priv->attach->dev == dev
		    && priv->attach->dmabuf == dmabuf) {
			/* Cancel any pending transfer */
			spin_lock_irq(&ffs->eps_lock);
			if (priv->ep && priv->req)
				usb_ep_dequeue(priv->ep, priv->req);
			spin_unlock_irq(&ffs->eps_lock);

			list_del(&priv->entry);

			/* Unref the reference from ffs_dmabuf_attach() */
			ffs_dmabuf_put(priv->attach);
			ret = 0;
			break;
		}
	}

	mutex_unlock(&epfile->dmabufs_mutex);
	dma_buf_put(dmabuf);

	return ret;
}

static int ffs_dmabuf_transfer(struct file *file,
			       const struct usb_ffs_dmabuf_transfer_req *req)
{
	bool nonblock = file->f_flags & O_NONBLOCK;
	struct ffs_epfile *epfile = file->private_data;
	struct dma_buf_attachment *attach;
	struct ffs_dmabuf_priv *priv;
	struct ffs_dma_fence *fence;
	struct usb_request *usb_req;
	enum dma_resv_usage resv_dir;
	struct dma_buf *dmabuf;
	unsigned long timeout;
	struct ffs_ep *ep;
	bool cookie;
	u32 seqno;
	long retl;
	int ret;

	if (req->flags & ~USB_FFS_DMABUF_TRANSFER_MASK)
		return -EINVAL;

	dmabuf = dma_buf_get(req->fd);
	if (IS_ERR(dmabuf))
		return PTR_ERR(dmabuf);

	if (req->length > dmabuf->size || req->length == 0) {
		ret = -EINVAL;
		goto err_dmabuf_put;
	}

	attach = ffs_dmabuf_find_attachment(epfile, dmabuf);
	if (IS_ERR(attach)) {
		ret = PTR_ERR(attach);
		goto err_dmabuf_put;
	}

	priv = attach->importer_priv;

	ep = ffs_epfile_wait_ep(file);
	if (IS_ERR(ep)) {
		ret = PTR_ERR(ep);
		goto err_attachment_put;
	}

	ret = ffs_dma_resv_lock(dmabuf, nonblock);
	if (ret)
		goto err_attachment_put;

	/* Make sure we don't have writers */
	timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
	retl = dma_resv_wait_timeout(dmabuf->resv,
				     dma_resv_usage_rw(!epfile->in),
				     true, timeout);
	if (retl == 0)
		retl = -EBUSY;
	if (retl < 0) {
		ret = (int)retl;
		goto err_resv_unlock;
	}

	ret = dma_resv_reserve_fences(dmabuf->resv, 1);
	if (ret)
		goto err_resv_unlock;

	fence = kmalloc_obj(*fence);
	if (!fence) {
		ret = -ENOMEM;
		goto err_resv_unlock;
	}

	fence->priv = priv;

	spin_lock_irq(&epfile->ffs->eps_lock);

	/* In the meantime, endpoint got disabled or changed. */
	if (epfile->ep != ep) {
		ret = -ESHUTDOWN;
		goto err_fence_put;
	}

	usb_req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
	if (!usb_req) {
		ret = -ENOMEM;
		goto err_fence_put;
	}

	/*
	 * usb_ep_queue() guarantees that all transfers are processed in the
	 * order they are enqueued, so we can use a simple incrementing
	 * sequence number for the dma_fence.
	 */
	seqno = atomic_add_return(1, &epfile->seqno);

	dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
		       &priv->lock, priv->context, seqno);

	resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;

	dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir);
	dma_resv_unlock(dmabuf->resv);

	/* Now that the dma_fence is in place, queue the transfer. */

	usb_req->length = req->length;
	usb_req->buf = NULL;
	usb_req->sg = priv->sgt->sgl;
	usb_req->num_sgs = sg_nents_for_len(priv->sgt->sgl, req->length);
	usb_req->sg_was_mapped = true;
	usb_req->context  = fence;
	usb_req->complete = ffs_epfile_dmabuf_io_complete;

	cookie = dma_fence_begin_signalling();
	ret = usb_ep_queue(ep->ep, usb_req, GFP_ATOMIC);
	dma_fence_end_signalling(cookie);
	if (!ret) {
		priv->req = usb_req;
		priv->ep = ep->ep;
	} else {
		pr_warn("FFS: Failed to queue DMABUF: %d\n", ret);
		ffs_dmabuf_signal_done(fence, ret);
		usb_ep_free_request(ep->ep, usb_req);
	}

	spin_unlock_irq(&epfile->ffs->eps_lock);
	dma_buf_put(dmabuf);

	return ret;

err_fence_put:
	spin_unlock_irq(&epfile->ffs->eps_lock);
	dma_fence_put(&fence->base);
err_resv_unlock:
	dma_resv_unlock(dmabuf->resv);
err_attachment_put:
	ffs_dmabuf_put(attach);
err_dmabuf_put:
	dma_buf_put(dmabuf);

	return ret;
}

static long ffs_epfile_ioctl(struct file *file, unsigned code,
			     unsigned long value)
{
	struct ffs_epfile *epfile = file->private_data;
	struct ffs_ep *ep;
	int ret;

	if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
		return -ENODEV;

	switch (code) {
	case FUNCTIONFS_DMABUF_ATTACH:
	{
		int fd;

		if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
			return -EFAULT;

		return ffs_dmabuf_attach(file, fd);
	}
	case FUNCTIONFS_DMABUF_DETACH:
	{
		int fd;

		if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
			return -EFAULT;

		return ffs_dmabuf_detach(file, fd);
	}
	case FUNCTIONFS_DMABUF_TRANSFER:
	{
		struct usb_ffs_dmabuf_transfer_req req;

		if (copy_from_user(&req, (void __user *)value, sizeof(req)))
			return -EFAULT;

		return ffs_dmabuf_transfer(file, &req);
	}
	default:
		break;
	}

	/* Wait for endpoint to be enabled */
	ep = ffs_epfile_wait_ep(file);
	if (IS_ERR(ep))
		return PTR_ERR(ep);

	spin_lock_irq(&epfile->ffs->eps_lock);

	/* In the meantime, endpoint got disabled or changed. */
	if (epfile->ep != ep) {
		spin_unlock_irq(&epfile->ffs->eps_lock);
		return -ESHUTDOWN;
	}

	switch (code) {
	case FUNCTIONFS_FIFO_STATUS:
		ret = usb_ep_fifo_status(epfile->ep->ep);
		break;
	case FUNCTIONFS_FIFO_FLUSH:
		usb_ep_fifo_flush(epfile->ep->ep);
		ret = 0;
		break;
	case FUNCTIONFS_CLEAR_HALT:
		ret = usb_ep_clear_halt(epfile->ep->ep);
		break;
	case FUNCTIONFS_ENDPOINT_REVMAP:
		ret = epfile->ep->num;
		break;
	case FUNCTIONFS_ENDPOINT_DESC:
	{
		int desc_idx;
		struct usb_endpoint_descriptor desc1, *desc;

		switch (epfile->ffs->gadget->speed) {
		case USB_SPEED_SUPER:
		case USB_SPEED_SUPER_PLUS:
			desc_idx = 2;
			break;
		case USB_SPEED_HIGH:
			desc_idx = 1;
			break;
		default:
			desc_idx = 0;
		}

		desc = epfile->ep->descs[desc_idx];
		memcpy(&desc1, desc, desc->bLength);

		spin_unlock_irq(&epfile->ffs->eps_lock);
		ret = copy_to_user((void __user *)value, &desc1, desc1.bLength);
		if (ret)
			ret = -EFAULT;
		return ret;
	}
	default:
		ret = -ENOTTY;
	}
	spin_unlock_irq(&epfile->ffs->eps_lock);

	return ret;
}

static const struct file_operations ffs_epfile_operations = {

	.open =		ffs_epfile_open,
	.write_iter =	ffs_epfile_write_iter,
	.read_iter =	ffs_epfile_read_iter,
	.release =	ffs_epfile_release,
	.unlocked_ioctl =	ffs_epfile_ioctl,
	.compat_ioctl = compat_ptr_ioctl,
};


/* File system and super block operations ***********************************/

/*
 * Mounting the file system creates a controller file, used first for
 * function configuration then later for event monitoring.
 */

static struct inode *__must_check
ffs_sb_make_inode(struct super_block *sb, void *data,
		  const struct file_operations *fops,
		  const struct inode_operations *iops,
		  struct ffs_file_perms *perms)
{
	struct inode *inode;

	inode = new_inode(sb);

	if (inode) {
		struct timespec64 ts = inode_set_ctime_current(inode);

		inode->i_ino	 = get_next_ino();
		inode->i_mode    = perms->mode;
		inode->i_uid     = perms->uid;
		inode->i_gid     = perms->gid;
		inode_set_atime_to_ts(inode, ts);
		inode_set_mtime_to_ts(inode, ts);
		inode->i_private = data;
		if (fops)
			inode->i_fop = fops;
		if (iops)
			inode->i_op  = iops;
	}

	return inode;
}

/* Create "regular" file */
static int ffs_sb_create_file(struct super_block *sb, const char *name,
			      void *data, const struct file_operations *fops)
{
	struct ffs_data	*ffs = sb->s_fs_info;
	struct dentry	*dentry;
	struct inode	*inode;

	inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
	if (!inode)
		return -ENOMEM;
	dentry = simple_start_creating(sb->s_root, name);
	if (IS_ERR(dentry)) {
		iput(inode);
		return PTR_ERR(dentry);
	}

	d_make_persistent(dentry, inode);

	simple_done_creating(dentry);
	return 0;
}

/* Super block */
static const struct super_operations ffs_sb_operations = {
	.statfs =	simple_statfs,
	.drop_inode =	inode_just_drop,
};

struct ffs_sb_fill_data {
	struct ffs_file_perms perms;
	umode_t root_mode;
	const char *dev_name;
	bool no_disconnect;
	struct ffs_data *ffs_data;
};

static int ffs_sb_fill(struct super_block *sb, struct fs_context *fc)
{
	struct ffs_sb_fill_data *data = fc->fs_private;
	struct inode	*inode;
	struct ffs_data	*ffs = data->ffs_data;

	ffs->sb              = sb;
	data->ffs_data       = NULL;
	sb->s_fs_info        = ffs;
	sb->s_blocksize      = PAGE_SIZE;
	sb->s_blocksize_bits = PAGE_SHIFT;
	sb->s_magic          = FUNCTIONFS_MAGIC;
	sb->s_op             = &ffs_sb_operations;
	sb->s_time_gran      = 1;

	/* Root inode */
	data->perms.mode = data->root_mode;
	inode = ffs_sb_make_inode(sb, NULL,
				  &simple_dir_operations,
				  &simple_dir_inode_operations,
				  &data->perms);
	sb->s_root = d_make_root(inode);
	if (!sb->s_root)
		return -ENOMEM;

	/* EP0 file */
	return ffs_sb_create_file(sb, "ep0", ffs, &ffs_ep0_operations);
}

enum {
	Opt_no_disconnect,
	Opt_rmode,
	Opt_fmode,
	Opt_mode,
	Opt_uid,
	Opt_gid,
};

static const struct fs_parameter_spec ffs_fs_fs_parameters[] = {
	fsparam_bool	("no_disconnect",	Opt_no_disconnect),
	fsparam_u32	("rmode",		Opt_rmode),
	fsparam_u32	("fmode",		Opt_fmode),
	fsparam_u32	("mode",		Opt_mode),
	fsparam_u32	("uid",			Opt_uid),
	fsparam_u32	("gid",			Opt_gid),
	{}
};

static int ffs_fs_parse_param(struct fs_context *fc, struct fs_parameter *param)
{
	struct ffs_sb_fill_data *data = fc->fs_private;
	struct fs_parse_result result;
	int opt;

	opt = fs_parse(fc, ffs_fs_fs_parameters, param, &result);
	if (opt < 0)
		return opt;

	switch (opt) {
	case Opt_no_disconnect:
		data->no_disconnect = result.boolean;
		break;
	case Opt_rmode:
		data->root_mode  = (result.uint_32 & 0555) | S_IFDIR;
		break;
	case Opt_fmode:
		data->perms.mode = (result.uint_32 & 0666) | S_IFREG;
		break;
	case Opt_mode:
		data->root_mode  = (result.uint_32 & 0555) | S_IFDIR;
		data->perms.mode = (result.uint_32 & 0666) | S_IFREG;
		break;

	case Opt_uid:
		data->perms.uid = make_kuid(current_user_ns(), result.uint_32);
		if (!uid_valid(data->perms.uid))
			goto unmapped_value;
		break;
	case Opt_gid:
		data->perms.gid = make_kgid(current_user_ns(), result.uint_32);
		if (!gid_valid(data->perms.gid))
			goto unmapped_value;
		break;

	default:
		return -ENOPARAM;
	}

	return 0;

unmapped_value:
	return invalf(fc, "%s: unmapped value: %u", param->key, result.uint_32);
}

/*
 * Set up the superblock for a mount.
 */
static int ffs_fs_get_tree(struct fs_context *fc)
{
	struct ffs_sb_fill_data *ctx = fc->fs_private;
	struct ffs_data	*ffs;
	int ret;

	if (!fc->source)
		return invalf(fc, "No source specified");

	ffs = ffs_data_new(fc->source);
	if (!ffs)
		return -ENOMEM;
	ffs->file_perms = ctx->perms;
	ffs->no_disconnect = ctx->no_disconnect;

	ffs->dev_name = kstrdup(fc->source, GFP_KERNEL);
	if (!ffs->dev_name) {
		ffs_data_put(ffs);
		return -ENOMEM;
	}

	ret = ffs_acquire_dev(ffs->dev_name, ffs);
	if (ret) {
		ffs_data_put(ffs);
		return ret;
	}

	ctx->ffs_data = ffs;
	return get_tree_nodev(fc, ffs_sb_fill);
}

static void ffs_fs_free_fc(struct fs_context *fc)
{
	struct ffs_sb_fill_data *ctx = fc->fs_private;

	if (ctx) {
		if (ctx->ffs_data) {
			ffs_data_put(ctx->ffs_data);
		}

		kfree(ctx);
	}
}

static const struct fs_context_operations ffs_fs_context_ops = {
	.free		= ffs_fs_free_fc,
	.parse_param	= ffs_fs_parse_param,
	.get_tree	= ffs_fs_get_tree,
};

static int ffs_fs_init_fs_context(struct fs_context *fc)
{
	struct ffs_sb_fill_data *ctx;

	ctx = kzalloc_obj(struct ffs_sb_fill_data);
	if (!ctx)
		return -ENOMEM;

	ctx->perms.mode = S_IFREG | 0600;
	ctx->perms.uid = GLOBAL_ROOT_UID;
	ctx->perms.gid = GLOBAL_ROOT_GID;
	ctx->root_mode = S_IFDIR | 0500;
	ctx->no_disconnect = false;

	fc->fs_private = ctx;
	fc->ops = &ffs_fs_context_ops;
	return 0;
}

static void
ffs_fs_kill_sb(struct super_block *sb)
{
	kill_anon_super(sb);
	if (sb->s_fs_info) {
		struct ffs_data *ffs = sb->s_fs_info;
		ffs->state = FFS_CLOSING;
		ffs_data_reset(ffs);
		// no configfs accesses from that point on,
		// so no further schedule_work() is possible
		cancel_work_sync(&ffs->reset_work);
		ffs_data_put(ffs);
	}
}

static struct file_system_type ffs_fs_type = {
	.owner		= THIS_MODULE,
	.name		= "functionfs",
	.init_fs_context = ffs_fs_init_fs_context,
	.parameters	= ffs_fs_fs_parameters,
	.kill_sb	= ffs_fs_kill_sb,
};
MODULE_ALIAS_FS("functionfs");


/* Driver's main init/cleanup functions *************************************/

static int functionfs_init(void)
{
	int ret;

	ret = register_filesystem(&ffs_fs_type);
	if (!ret)
		pr_info("file system registered\n");
	else
		pr_err("failed registering file system (%d)\n", ret);

	return ret;
}

static void functionfs_cleanup(void)
{
	pr_info("unloading\n");
	unregister_filesystem(&ffs_fs_type);
}


/* ffs_data and ffs_function construction and destruction code **************/

static void ffs_data_clear(struct ffs_data *ffs);

static void ffs_data_get(struct ffs_data *ffs)
{
	refcount_inc(&ffs->ref);
}

static void ffs_data_put(struct ffs_data *ffs)
{
	if (refcount_dec_and_test(&ffs->ref)) {
		pr_info("%s(): freeing\n", __func__);
		ffs_data_clear(ffs);
		ffs_release_dev(ffs->private_data);
		BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
		       swait_active(&ffs->ep0req_completion.wait) ||
		       waitqueue_active(&ffs->wait));
		destroy_workqueue(ffs->io_completion_wq);
		kfree(ffs->dev_name);
		kfree(ffs);
	}
}

static void ffs_data_closed(struct ffs_data *ffs)
{
	spin_lock_irq(&ffs->eps_lock);
	if (--ffs->opened) {	// not the last opener?
		spin_unlock_irq(&ffs->eps_lock);
		return;
	}
	if (ffs->no_disconnect) {
		struct ffs_epfile *epfiles;

		ffs->state = FFS_DEACTIVATED;
		epfiles = ffs->epfiles;
		ffs->epfiles = NULL;
		spin_unlock_irq(&ffs->eps_lock);

		if (epfiles)
			ffs_epfiles_destroy(ffs->sb, epfiles,
					 ffs->eps_count);

		if (ffs->setup_state == FFS_SETUP_PENDING)
			__ffs_ep0_stall(ffs);
	} else {
		ffs->state = FFS_CLOSING;
		spin_unlock_irq(&ffs->eps_lock);
		ffs_data_reset(ffs);
	}
}

static struct ffs_data *ffs_data_new(const char *dev_name)
{
	struct ffs_data *ffs = kzalloc_obj(*ffs);
	if (!ffs)
		return NULL;

	ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
	if (!ffs->io_completion_wq) {
		kfree(ffs);
		return NULL;
	}

	refcount_set(&ffs->ref, 1);
	ffs->opened = 0;
	ffs->state = FFS_READ_DESCRIPTORS;
	mutex_init(&ffs->mutex);
	spin_lock_init(&ffs->eps_lock);
	init_waitqueue_head(&ffs->ev.waitq);
	init_waitqueue_head(&ffs->wait);
	init_completion(&ffs->ep0req_completion);

	/* XXX REVISIT need to update it in some places, or do we? */
	ffs->ev.can_stall = 1;

	return ffs;
}

static void ffs_data_clear(struct ffs_data *ffs)
{
	struct ffs_epfile *epfiles;
	unsigned long flags;

	ffs_closed(ffs);

	BUG_ON(ffs->gadget);

	spin_lock_irqsave(&ffs->eps_lock, flags);
	epfiles = ffs->epfiles;
	ffs->epfiles = NULL;
	spin_unlock_irqrestore(&ffs->eps_lock, flags);

	/*
	 * potential race possible between ffs_func_eps_disable
	 * & ffs_epfile_release therefore maintaining a local
	 * copy of epfile will save us from use-after-free.
	 */
	if (epfiles) {
		ffs_epfiles_destroy(ffs->sb, epfiles, ffs->eps_count);
		ffs->epfiles = NULL;
	}

	if (ffs->ffs_eventfd) {
		eventfd_ctx_put(ffs->ffs_eventfd);
		ffs->ffs_eventfd = NULL;
	}

	kfree(ffs->raw_descs_data);
	kfree(ffs->raw_strings);
	kfree(ffs->stringtabs);
}

static void ffs_data_reset(struct ffs_data *ffs)
{
	ffs_data_clear(ffs);

	spin_lock_irq(&ffs->eps_lock);
	ffs->raw_descs_data = NULL;
	ffs->raw_descs = NULL;
	ffs->raw_strings = NULL;
	ffs->stringtabs = NULL;

	ffs->raw_descs_length = 0;
	ffs->fs_descs_count = 0;
	ffs->hs_descs_count = 0;
	ffs->ss_descs_count = 0;

	ffs->strings_count = 0;
	ffs->interfaces_count = 0;
	ffs->eps_count = 0;

	ffs->ev.count = 0;

	ffs->state = FFS_READ_DESCRIPTORS;
	ffs->setup_state = FFS_NO_SETUP;
	ffs->flags = 0;

	ffs->ms_os_descs_ext_prop_count = 0;
	ffs->ms_os_descs_ext_prop_name_len = 0;
	ffs->ms_os_descs_ext_prop_data_len = 0;
	spin_unlock_irq(&ffs->eps_lock);
}


static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
{
	struct usb_gadget_strings **lang;
	int first_id;

	if ((ffs->state != FFS_ACTIVE
		 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
		return -EBADFD;

	first_id = usb_string_ids_n(cdev, ffs->strings_count);
	if (first_id < 0)
		return first_id;

	ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
	if (!ffs->ep0req)
		return -ENOMEM;
	ffs->ep0req->complete = ffs_ep0_complete;
	ffs->ep0req->context = ffs;

	lang = ffs->stringtabs;
	if (lang) {
		for (; *lang; ++lang) {
			struct usb_string *str = (*lang)->strings;
			int id = first_id;
			for (; str->s; ++id, ++str)
				str->id = id;
		}
	}

	ffs->gadget = cdev->gadget;
	ffs_data_get(ffs);
	return 0;
}

static void functionfs_unbind(struct ffs_data *ffs)
{
	if (!WARN_ON(!ffs->gadget)) {
		/* dequeue before freeing ep0req */
		usb_ep_dequeue(ffs->gadget->ep0, ffs->ep0req);
		mutex_lock(&ffs->mutex);
		usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
		ffs->ep0req = NULL;
		ffs->gadget = NULL;
		clear_bit(FFS_FL_BOUND, &ffs->flags);
		mutex_unlock(&ffs->mutex);
		ffs_data_put(ffs);
	}
}

static int ffs_epfiles_create(struct ffs_data *ffs)
{
	struct ffs_epfile *epfile, *epfiles;
	unsigned i, count;
	int err;

	count = ffs->eps_count;
	epfiles = kzalloc_objs(*epfiles, count);
	if (!epfiles)
		return -ENOMEM;

	epfile = epfiles;
	for (i = 1; i <= count; ++i, ++epfile) {
		epfile->ffs = ffs;
		mutex_init(&epfile->mutex);
		mutex_init(&epfile->dmabufs_mutex);
		INIT_LIST_HEAD(&epfile->dmabufs);
		if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
			sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
		else
			sprintf(epfile->name, "ep%u", i);
		err = ffs_sb_create_file(ffs->sb, epfile->name,
					 epfile, &ffs_epfile_operations);
		if (err) {
			ffs_epfiles_destroy(ffs->sb, epfiles, i - 1);
			return err;
		}
	}

	ffs->epfiles = epfiles;
	return 0;
}

static void clear_one(struct dentry *dentry)
{
	smp_store_release(&dentry->d_inode->i_private, NULL);
}

static void ffs_epfiles_destroy(struct super_block *sb,
				struct ffs_epfile *epfiles, unsigned count)
{
	struct ffs_epfile *epfile = epfiles;
	struct dentry *root = sb->s_root;

	for (; count; --count, ++epfile) {
		BUG_ON(mutex_is_locked(&epfile->mutex));
		simple_remove_by_name(root, epfile->name, clear_one);
	}

	kfree(epfiles);
}

static void ffs_func_eps_disable(struct ffs_function *func)
{
	struct ffs_ep *ep;
	struct ffs_epfile *epfile;
	unsigned short count;
	unsigned long flags;

	spin_lock_irqsave(&func->ffs->eps_lock, flags);
	count = func->ffs->eps_count;
	epfile = func->ffs->epfiles;
	ep = func->eps;
	while (count--) {
		/* pending requests get nuked */
		if (ep->ep)
			usb_ep_disable(ep->ep);
		++ep;

		if (epfile) {
			epfile->ep = NULL;
			__ffs_epfile_read_buffer_free(epfile);
			++epfile;
		}
	}
	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
}

static int ffs_func_eps_enable(struct ffs_function *func)
{
	struct ffs_data *ffs;
	struct ffs_ep *ep;
	struct ffs_epfile *epfile;
	unsigned short count;
	unsigned long flags;
	int ret = 0;

	spin_lock_irqsave(&func->ffs->eps_lock, flags);
	ffs = func->ffs;
	ep = func->eps;
	epfile = ffs->epfiles;
	count = ffs->eps_count;
	if (!epfile) {
		ret = -ENOMEM;
		goto done;
	}

	while (count--) {
		ep->ep->driver_data = ep;

		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
		if (ret) {
			pr_err("%s: config_ep_by_speed(%s) returned %d\n",
					__func__, ep->ep->name, ret);
			break;
		}

		ret = usb_ep_enable(ep->ep);
		if (!ret) {
			epfile->ep = ep;
			epfile->in = usb_endpoint_dir_in(ep->ep->desc);
			epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
		} else {
			break;
		}

		++ep;
		++epfile;
	}

	wake_up_interruptible(&ffs->wait);
done:
	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);

	return ret;
}


/* Parsing and building descriptors and strings *****************************/

/*
 * This validates if data pointed by data is a valid USB descriptor as
 * well as record how many interfaces, endpoints and strings are
 * required by given configuration.  Returns address after the
 * descriptor or NULL if data is invalid.
 */

enum ffs_entity_type {
	FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
};

enum ffs_os_desc_type {
	FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
};

typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
				   u8 *valuep,
				   struct usb_descriptor_header *desc,
				   void *priv);

typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
				    struct usb_os_desc_header *h, void *data,
				    unsigned len, void *priv);

static int __must_check ffs_do_single_desc(char *data, unsigned len,
					   ffs_entity_callback entity,
					   void *priv, int *current_class, int *current_subclass)
{
	struct usb_descriptor_header *_ds = (void *)data;
	u8 length;
	int ret;

	/* At least two bytes are required: length and type */
	if (len < 2) {
		pr_vdebug("descriptor too short\n");
		return -EINVAL;
	}

	/* If we have at least as many bytes as the descriptor takes? */
	length = _ds->bLength;
	if (len < length) {
		pr_vdebug("descriptor longer then available data\n");
		return -EINVAL;
	}

#define __entity_check_INTERFACE(val)  1
#define __entity_check_STRING(val)     (val)
#define __entity_check_ENDPOINT(val)   ((val) & USB_ENDPOINT_NUMBER_MASK)
#define __entity(type, val) do {					\
		pr_vdebug("entity " #type "(%02x)\n", (val));		\
		if (!__entity_check_ ##type(val)) {			\
			pr_vdebug("invalid entity's value\n");		\
			return -EINVAL;					\
		}							\
		ret = entity(FFS_ ##type, &val, _ds, priv);		\
		if (ret < 0) {						\
			pr_debug("entity " #type "(%02x); ret = %d\n",	\
				 (val), ret);				\
			return ret;					\
		}							\
	} while (0)

	/* Parse descriptor depending on type. */
	switch (_ds->bDescriptorType) {
	case USB_DT_DEVICE:
	case USB_DT_CONFIG:
	case USB_DT_STRING:
	case USB_DT_DEVICE_QUALIFIER:
		/* function can't have any of those */
		pr_vdebug("descriptor reserved for gadget: %d\n",
		      _ds->bDescriptorType);
		return -EINVAL;

	case USB_DT_INTERFACE: {
		struct usb_interface_descriptor *ds = (void *)_ds;
		pr_vdebug("interface descriptor\n");
		if (length != sizeof *ds)
			goto inv_length;

		__entity(INTERFACE, ds->bInterfaceNumber);
		if (ds->iInterface)
			__entity(STRING, ds->iInterface);
		*current_class = ds->bInterfaceClass;
		*current_subclass = ds->bInterfaceSubClass;
	}
		break;

	case USB_DT_ENDPOINT: {
		struct usb_endpoint_descriptor *ds = (void *)_ds;
		pr_vdebug("endpoint descriptor\n");
		if (length != USB_DT_ENDPOINT_SIZE &&
		    length != USB_DT_ENDPOINT_AUDIO_SIZE)
			goto inv_length;
		__entity(ENDPOINT, ds->bEndpointAddress);
	}
		break;

	case USB_TYPE_CLASS | 0x01:
		if (*current_class == USB_INTERFACE_CLASS_HID) {
			pr_vdebug("hid descriptor\n");
			if (length != sizeof(struct hid_descriptor))
				goto inv_length;
			break;
		} else if (*current_class == USB_INTERFACE_CLASS_CCID) {
			pr_vdebug("ccid descriptor\n");
			if (length != sizeof(struct ccid_descriptor))
				goto inv_length;
			break;
		} else if (*current_class == USB_CLASS_APP_SPEC &&
			   *current_subclass == USB_SUBCLASS_DFU) {
			pr_vdebug("dfu functional descriptor\n");
			if (length != sizeof(struct usb_dfu_functional_descriptor))
				goto inv_length;
			break;
		} else {
			pr_vdebug("unknown descriptor: %d for class %d\n",
			      _ds->bDescriptorType, *current_class);
			return -EINVAL;
		}

	case USB_DT_OTG:
		if (length != sizeof(struct usb_otg_descriptor))
			goto inv_length;
		break;

	case USB_DT_INTERFACE_ASSOCIATION: {
		struct usb_interface_assoc_descriptor *ds = (void *)_ds;
		pr_vdebug("interface association descriptor\n");
		if (length != sizeof *ds)
			goto inv_length;
		if (ds->iFunction)
			__entity(STRING, ds->iFunction);
	}
		break;

	case USB_DT_SS_ENDPOINT_COMP:
		pr_vdebug("EP SS companion descriptor\n");
		if (length != sizeof(struct usb_ss_ep_comp_descriptor))
			goto inv_length;
		break;

	case USB_DT_OTHER_SPEED_CONFIG:
	case USB_DT_INTERFACE_POWER:
	case USB_DT_DEBUG:
	case USB_DT_SECURITY:
	case USB_DT_CS_RADIO_CONTROL:
		/* TODO */
		pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
		return -EINVAL;

	default:
		/* We should never be here */
		pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
		return -EINVAL;

inv_length:
		pr_vdebug("invalid length: %d (descriptor %d)\n",
			  _ds->bLength, _ds->bDescriptorType);
		return -EINVAL;
	}

#undef __entity
#undef __entity_check_DESCRIPTOR
#undef __entity_check_INTERFACE
#undef __entity_check_STRING
#undef __entity_check_ENDPOINT

	return length;
}

static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
				     ffs_entity_callback entity, void *priv)
{
	const unsigned _len = len;
	unsigned long num = 0;
	int current_class = -1;
	int current_subclass = -1;

	for (;;) {
		int ret;

		if (num == count)
			data = NULL;

		/* Record "descriptor" entity */
		ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
		if (ret < 0) {
			pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
				 num, ret);
			return ret;
		}

		if (!data)
			return _len - len;

		ret = ffs_do_single_desc(data, len, entity, priv,
			&current_class, &current_subclass);
		if (ret < 0) {
			pr_debug("%s returns %d\n", __func__, ret);
			return ret;
		}

		len -= ret;
		data += ret;
		++num;
	}
}

static int __ffs_data_do_entity(enum ffs_entity_type type,
				u8 *valuep, struct usb_descriptor_header *desc,
				void *priv)
{
	struct ffs_desc_helper *helper = priv;
	struct usb_endpoint_descriptor *d;

	switch (type) {
	case FFS_DESCRIPTOR:
		break;

	case FFS_INTERFACE:
		/*
		 * Interfaces are indexed from zero so if we
		 * encountered interface "n" then there are at least
		 * "n+1" interfaces.
		 */
		if (*valuep >= helper->interfaces_count)
			helper->interfaces_count = *valuep + 1;
		break;

	case FFS_STRING:
		/*
		 * Strings are indexed from 1 (0 is reserved
		 * for languages list)
		 */
		if (*valuep > helper->ffs->strings_count)
			helper->ffs->strings_count = *valuep;
		break;

	case FFS_ENDPOINT:
		d = (void *)desc;
		helper->eps_count++;
		if (helper->eps_count >= FFS_MAX_EPS_COUNT)
			return -EINVAL;
		/* Check if descriptors for any speed were already parsed */
		if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
			helper->ffs->eps_addrmap[helper->eps_count] =
				d->bEndpointAddress;
		else if (helper->ffs->eps_addrmap[helper->eps_count] !=
				d->bEndpointAddress)
			return -EINVAL;
		break;
	}

	return 0;
}

static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
				   struct usb_os_desc_header *desc)
{
	u16 bcd_version = le16_to_cpu(desc->bcdVersion);
	u16 w_index = le16_to_cpu(desc->wIndex);

	if (bcd_version == 0x1) {
		pr_warn("bcdVersion must be 0x0100, stored in Little Endian order. "
			"Userspace driver should be fixed, accepting 0x0001 for compatibility.\n");
	} else if (bcd_version != 0x100) {
		pr_vdebug("unsupported os descriptors version: 0x%x\n",
			  bcd_version);
		return -EINVAL;
	}
	switch (w_index) {
	case 0x4:
		*next_type = FFS_OS_DESC_EXT_COMPAT;
		break;
	case 0x5:
		*next_type = FFS_OS_DESC_EXT_PROP;
		break;
	default:
		pr_vdebug("unsupported os descriptor type: %d", w_index);
		return -EINVAL;
	}

	return sizeof(*desc);
}

/*
 * Process all extended compatibility/extended property descriptors
 * of a feature descriptor
 */
static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
					      enum ffs_os_desc_type type,
					      u16 feature_count,
					      ffs_os_desc_callback entity,
					      void *priv,
					      struct usb_os_desc_header *h)
{
	int ret;
	const unsigned _len = len;

	/* loop over all ext compat/ext prop descriptors */
	while (feature_count--) {
		ret = entity(type, h, data, len, priv);
		if (ret < 0) {
			pr_debug("bad OS descriptor, type: %d\n", type);
			return ret;
		}
		data += ret;
		len -= ret;
	}
	return _len - len;
}

/* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
static int __must_check ffs_do_os_descs(unsigned count,
					char *data, unsigned len,
					ffs_os_desc_callback entity, void *priv)
{
	const unsigned _len = len;
	unsigned long num = 0;

	for (num = 0; num < count; ++num) {
		int ret;
		enum ffs_os_desc_type type;
		u16 feature_count;
		struct usb_os_desc_header *desc = (void *)data;

		if (len < sizeof(*desc))
			return -EINVAL;

		/*
		 * Record "descriptor" entity.
		 * Process dwLength, bcdVersion, wIndex, get b/wCount.
		 * Move the data pointer to the beginning of extended
		 * compatibilities proper or extended properties proper
		 * portions of the data
		 */
		if (le32_to_cpu(desc->dwLength) > len)
			return -EINVAL;

		ret = __ffs_do_os_desc_header(&type, desc);
		if (ret < 0) {
			pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
				 num, ret);
			return ret;
		}
		/*
		 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
		 */
		feature_count = le16_to_cpu(desc->wCount);
		if (type == FFS_OS_DESC_EXT_COMPAT &&
		    (feature_count > 255 || desc->Reserved))
				return -EINVAL;
		len -= ret;
		data += ret;

		/*
		 * Process all function/property descriptors
		 * of this Feature Descriptor
		 */
		ret = ffs_do_single_os_desc(data, len, type,
					    feature_count, entity, priv, desc);
		if (ret < 0) {
			pr_debug("%s returns %d\n", __func__, ret);
			return ret;
		}

		len -= ret;
		data += ret;
	}
	return _len - len;
}

/*
 * Validate contents of the buffer from userspace related to OS descriptors.
 */
static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
				 struct usb_os_desc_header *h, void *data,
				 unsigned len, void *priv)
{
	struct ffs_data *ffs = priv;
	u8 length;

	switch (type) {
	case FFS_OS_DESC_EXT_COMPAT: {
		struct usb_ext_compat_desc *d = data;
		int i;

		if (len < sizeof(*d) ||
		    d->bFirstInterfaceNumber >= ffs->interfaces_count)
			return -EINVAL;
		if (d->Reserved1 != 1) {
			/*
			 * According to the spec, Reserved1 must be set to 1
			 * but older kernels incorrectly rejected non-zero
			 * values.  We fix it here to avoid returning EINVAL
			 * in response to values we used to accept.
			 */
			pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
			d->Reserved1 = 1;
		}
		for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
			if (d->Reserved2[i])
				return -EINVAL;

		length = sizeof(struct usb_ext_compat_desc);
	}
		break;
	case FFS_OS_DESC_EXT_PROP: {
		struct usb_ext_prop_desc *d = data;
		u32 type, pdl;
		u16 pnl;

		if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
			return -EINVAL;
		length = le32_to_cpu(d->dwSize);
		if (len < length)
			return -EINVAL;
		type = le32_to_cpu(d->dwPropertyDataType);
		if (type < USB_EXT_PROP_UNICODE ||
		    type > USB_EXT_PROP_UNICODE_MULTI) {
			pr_vdebug("unsupported os descriptor property type: %d",
				  type);
			return -EINVAL;
		}
		pnl = le16_to_cpu(d->wPropertyNameLength);
		if (length < 14 + pnl) {
			pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
				  length, pnl, type);
			return -EINVAL;
		}
		pdl = le32_to_cpu(*(__le32 *)((u8 *)data + 10 + pnl));
		if (length != 14 + pnl + pdl) {
			pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
				  length, pnl, pdl, type);
			return -EINVAL;
		}
		++ffs->ms_os_descs_ext_prop_count;
		/* property name reported to the host as "WCHAR"s */
		ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
		ffs->ms_os_descs_ext_prop_data_len += pdl;
	}
		break;
	default:
		pr_vdebug("unknown descriptor: %d\n", type);
		return -EINVAL;
	}
	return length;
}

static int __ffs_data_got_descs(struct ffs_data *ffs,
				char *const _data, size_t len)
{
	char *data = _data, *raw_descs;
	unsigned os_descs_count = 0, counts[3], flags;
	int ret = -EINVAL, i;
	struct ffs_desc_helper helper;

	if (get_unaligned_le32(data + 4) != len)
		goto error;

	switch (get_unaligned_le32(data)) {
	case FUNCTIONFS_DESCRIPTORS_MAGIC:
		flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC;
		data += 8;
		len  -= 8;
		break;
	case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
		flags = get_unaligned_le32(data + 8);
		ffs->user_flags = flags;
		if (flags & ~(FUNCTIONFS_HAS_FS_DESC |
			      FUNCTIONFS_HAS_HS_DESC |
			      FUNCTIONFS_HAS_SS_DESC |
			      FUNCTIONFS_HAS_MS_OS_DESC |
			      FUNCTIONFS_VIRTUAL_ADDR |
			      FUNCTIONFS_EVENTFD |
			      FUNCTIONFS_ALL_CTRL_RECIP |
			      FUNCTIONFS_CONFIG0_SETUP)) {
			ret = -ENOSYS;
			goto error;
		}
		data += 12;
		len  -= 12;
		break;
	default:
		goto error;
	}

	if (flags & FUNCTIONFS_EVENTFD) {
		if (len < 4)
			goto error;
		ffs->ffs_eventfd =
			eventfd_ctx_fdget((int)get_unaligned_le32(data));
		if (IS_ERR(ffs->ffs_eventfd)) {
			ret = PTR_ERR(ffs->ffs_eventfd);
			ffs->ffs_eventfd = NULL;
			goto error;
		}
		data += 4;
		len  -= 4;
	}

	/* Read fs_count, hs_count and ss_count (if present) */
	for (i = 0; i < 3; ++i) {
		if (!(flags & (1 << i))) {
			counts[i] = 0;
		} else if (len < 4) {
			goto error;
		} else {
			counts[i] = get_unaligned_le32(data);
			data += 4;
			len  -= 4;
		}
	}
	if (flags & (1 << i)) {
		if (len < 4) {
			goto error;
		}
		os_descs_count = get_unaligned_le32(data);
		data += 4;
		len -= 4;
	}

	/* Read descriptors */
	raw_descs = data;
	helper.ffs = ffs;
	for (i = 0; i < 3; ++i) {
		if (!counts[i])
			continue;
		helper.interfaces_count = 0;
		helper.eps_count = 0;
		ret = ffs_do_descs(counts[i], data, len,
				   __ffs_data_do_entity, &helper);
		if (ret < 0)
			goto error;
		if (!ffs->eps_count && !ffs->interfaces_count) {
			ffs->eps_count = helper.eps_count;
			ffs->interfaces_count = helper.interfaces_count;
		} else {
			if (ffs->eps_count != helper.eps_count) {
				ret = -EINVAL;
				goto error;
			}
			if (ffs->interfaces_count != helper.interfaces_count) {
				ret = -EINVAL;
				goto error;
			}
		}
		data += ret;
		len  -= ret;
	}
	if (os_descs_count) {
		ret = ffs_do_os_descs(os_descs_count, data, len,
				      __ffs_data_do_os_desc, ffs);
		if (ret < 0)
			goto error;
		data += ret;
		len -= ret;
	}

	if (raw_descs == data || len) {
		ret = -EINVAL;
		goto error;
	}

	ffs->raw_descs_data	= _data;
	ffs->raw_descs		= raw_descs;
	ffs->raw_descs_length	= data - raw_descs;
	ffs->fs_descs_count	= counts[0];
	ffs->hs_descs_count	= counts[1];
	ffs->ss_descs_count	= counts[2];
	ffs->ms_os_descs_count	= os_descs_count;

	return 0;

error:
	kfree(_data);
	return ret;
}

static int __ffs_data_got_strings(struct ffs_data *ffs,
				  char *const _data, size_t len)
{
	u32 str_count, needed_count, lang_count;
	struct usb_gadget_strings **stringtabs, *t;
	const char *data = _data;
	struct usb_string *s;

	if (len < 16 ||
	    get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
	    get_unaligned_le32(data + 4) != len)
		goto error;
	str_count  = get_unaligned_le32(data + 8);
	lang_count = get_unaligned_le32(data + 12);

	/* if one is zero the other must be zero */
	if (!str_count != !lang_count)
		goto error;

	/* Do we have at least as many strings as descriptors need? */
	needed_count = ffs->strings_count;
	if (str_count < needed_count)
		goto error;

	/*
	 * If we don't need any strings just return and free all
	 * memory.
	 */
	if (!needed_count) {
		kfree(_data);
		return 0;
	}

	/* Allocate everything in one chunk so there's less maintenance. */
	{
		unsigned i = 0;
		vla_group(d);
		vla_item(d, struct usb_gadget_strings *, stringtabs,
			size_add(lang_count, 1));
		vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
		vla_item(d, struct usb_string, strings,
			size_mul(lang_count, (needed_count + 1)));

		char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);

		if (!vlabuf) {
			kfree(_data);
			return -ENOMEM;
		}

		/* Initialize the VLA pointers */
		stringtabs = vla_ptr(vlabuf, d, stringtabs);
		t = vla_ptr(vlabuf, d, stringtab);
		i = lang_count;
		do {
			*stringtabs++ = t++;
		} while (--i);
		*stringtabs = NULL;

		/* stringtabs = vlabuf = d_stringtabs for later kfree */
		stringtabs = vla_ptr(vlabuf, d, stringtabs);
		t = vla_ptr(vlabuf, d, stringtab);
		s = vla_ptr(vlabuf, d, strings);
	}

	/* For each language */
	data += 16;
	len -= 16;

	do { /* lang_count > 0 so we can use do-while */
		unsigned needed = needed_count;
		u32 str_per_lang = str_count;

		if (len < 3)
			goto error_free;
		t->language = get_unaligned_le16(data);
		t->strings  = s;
		++t;

		data += 2;
		len -= 2;

		/* For each string */
		do { /* str_count > 0 so we can use do-while */
			size_t length = strnlen(data, len);

			if (length == len)
				goto error_free;

			/*
			 * User may provide more strings then we need,
			 * if that's the case we simply ignore the
			 * rest
			 */
			if (needed) {
				/*
				 * s->id will be set while adding
				 * function to configuration so for
				 * now just leave garbage here.
				 */
				s->s = data;
				--needed;
				++s;
			}

			data += length + 1;
			len -= length + 1;
		} while (--str_per_lang);

		s->id = 0;   /* terminator */
		s->s = NULL;
		++s;

	} while (--lang_count);

	/* Some garbage left? */
	if (len)
		goto error_free;

	/* Done! */
	ffs->stringtabs = stringtabs;
	ffs->raw_strings = _data;

	return 0;

error_free:
	kfree(stringtabs);
error:
	kfree(_data);
	return -EINVAL;
}


/* Events handling and management *******************************************/

static void __ffs_event_add(struct ffs_data *ffs,
			    enum usb_functionfs_event_type type)
{
	enum usb_functionfs_event_type rem_type1, rem_type2 = type;
	int neg = 0;

	/*
	 * Abort any unhandled setup
	 *
	 * We do not need to worry about some cmpxchg() changing value
	 * of ffs->setup_state without holding the lock because when
	 * state is FFS_SETUP_PENDING cmpxchg() in several places in
	 * the source does nothing.
	 */
	if (ffs->setup_state == FFS_SETUP_PENDING)
		ffs->setup_state = FFS_SETUP_CANCELLED;

	/*
	 * Logic of this function guarantees that there are at most four pending
	 * evens on ffs->ev.types queue.  This is important because the queue
	 * has space for four elements only and __ffs_ep0_read_events function
	 * depends on that limit as well.  If more event types are added, those
	 * limits have to be revisited or guaranteed to still hold.
	 */
	switch (type) {
	case FUNCTIONFS_RESUME:
		rem_type2 = FUNCTIONFS_SUSPEND;
		fallthrough;
	case FUNCTIONFS_SUSPEND:
	case FUNCTIONFS_SETUP:
		rem_type1 = type;
		/* Discard all similar events */
		break;

	case FUNCTIONFS_BIND:
	case FUNCTIONFS_UNBIND:
	case FUNCTIONFS_DISABLE:
	case FUNCTIONFS_ENABLE:
		/* Discard everything other then power management. */
		rem_type1 = FUNCTIONFS_SUSPEND;
		rem_type2 = FUNCTIONFS_RESUME;
		neg = 1;
		break;

	default:
		WARN(1, "%d: unknown event, this should not happen\n", type);
		return;
	}

	{
		u8 *ev  = ffs->ev.types, *out = ev;
		unsigned n = ffs->ev.count;
		for (; n; --n, ++ev)
			if ((*ev == rem_type1 || *ev == rem_type2) == neg)
				*out++ = *ev;
			else
				pr_vdebug("purging event %d\n", *ev);
		ffs->ev.count = out - ffs->ev.types;
	}

	pr_vdebug("adding event %d\n", type);
	ffs->ev.types[ffs->ev.count++] = type;
	wake_up_locked(&ffs->ev.waitq);
	if (ffs->ffs_eventfd)
		eventfd_signal(ffs->ffs_eventfd);
}

static void ffs_event_add(struct ffs_data *ffs,
			  enum usb_functionfs_event_type type)
{
	unsigned long flags;
	spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
	__ffs_event_add(ffs, type);
	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
}

/* Bind/unbind USB function hooks *******************************************/

static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
{
	int i;

	for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
		if (ffs->eps_addrmap[i] == endpoint_address)
			return i;
	return -ENOENT;
}

static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
				    struct usb_descriptor_header *desc,
				    void *priv)
{
	struct usb_endpoint_descriptor *ds = (void *)desc;
	struct ffs_function *func = priv;
	struct ffs_ep *ffs_ep;
	unsigned ep_desc_id;
	int idx;
	static const char *speed_names[] = { "full", "high", "super" };

	if (type != FFS_DESCRIPTOR)
		return 0;

	/*
	 * If ss_descriptors is not NULL, we are reading super speed
	 * descriptors; if hs_descriptors is not NULL, we are reading high
	 * speed descriptors; otherwise, we are reading full speed
	 * descriptors.
	 */
	if (func->function.ss_descriptors) {
		ep_desc_id = 2;
		func->function.ss_descriptors[(long)valuep] = desc;
	} else if (func->function.hs_descriptors) {
		ep_desc_id = 1;
		func->function.hs_descriptors[(long)valuep] = desc;
	} else {
		ep_desc_id = 0;
		func->function.fs_descriptors[(long)valuep]    = desc;
	}

	if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
		return 0;

	idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1;
	if (idx < 0)
		return idx;

	ffs_ep = func->eps + idx;

	if (ffs_ep->descs[ep_desc_id]) {
		pr_err("two %sspeed descriptors for EP %d\n",
			  speed_names[ep_desc_id],
			  usb_endpoint_num(ds));
		return -EINVAL;
	}
	ffs_ep->descs[ep_desc_id] = ds;

	ffs_dump_mem(": Original  ep desc", ds, ds->bLength);
	if (ffs_ep->ep) {
		ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
		if (!ds->wMaxPacketSize)
			ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
	} else {
		struct usb_request *req;
		struct usb_ep *ep;
		u8 bEndpointAddress;
		u16 wMaxPacketSize;

		/*
		 * We back up bEndpointAddress because autoconfig overwrites
		 * it with physical endpoint address.
		 */
		bEndpointAddress = ds->bEndpointAddress;
		/*
		 * We back up wMaxPacketSize because autoconfig treats
		 * endpoint descriptors as if they were full speed.
		 */
		wMaxPacketSize = ds->wMaxPacketSize;
		pr_vdebug("autoconfig\n");
		ep = usb_ep_autoconfig(func->gadget, ds);
		if (!ep)
			return -ENOTSUPP;
		ep->driver_data = func->eps + idx;

		req = usb_ep_alloc_request(ep, GFP_KERNEL);
		if (!req)
			return -ENOMEM;

		ffs_ep->ep  = ep;
		ffs_ep->req = req;
		func->eps_revmap[ds->bEndpointAddress &
				 USB_ENDPOINT_NUMBER_MASK] = idx + 1;
		/*
		 * If we use virtual address mapping, we restore
		 * original bEndpointAddress value.
		 */
		if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
			ds->bEndpointAddress = bEndpointAddress;
		/*
		 * Restore wMaxPacketSize which was potentially
		 * overwritten by autoconfig.
		 */
		ds->wMaxPacketSize = wMaxPacketSize;
	}
	ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);

	return 0;
}

static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
				   struct usb_descriptor_header *desc,
				   void *priv)
{
	struct ffs_function *func = priv;
	unsigned idx;
	u8 newValue;

	switch (type) {
	default:
	case FFS_DESCRIPTOR:
		/* Handled in previous pass by __ffs_func_bind_do_descs() */
		return 0;

	case FFS_INTERFACE:
		idx = *valuep;
		if (func->interfaces_nums[idx] < 0) {
			int id = usb_interface_id(func->conf, &func->function);
			if (id < 0)
				return id;
			func->interfaces_nums[idx] = id;
		}
		newValue = func->interfaces_nums[idx];
		break;

	case FFS_STRING:
		/* String' IDs are allocated when fsf_data is bound to cdev */
		newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
		break;

	case FFS_ENDPOINT:
		/*
		 * USB_DT_ENDPOINT are handled in
		 * __ffs_func_bind_do_descs().
		 */
		if (desc->bDescriptorType == USB_DT_ENDPOINT)
			return 0;

		idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
		if (!func->eps[idx].ep)
			return -EINVAL;

		{
			struct usb_endpoint_descriptor **descs;
			descs = func->eps[idx].descs;
			newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
		}
		break;
	}

	pr_vdebug("%02x -> %02x\n", *valuep, newValue);
	*valuep = newValue;
	return 0;
}

static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
				      struct usb_os_desc_header *h, void *data,
				      unsigned len, void *priv)
{
	struct ffs_function *func = priv;
	u8 length = 0;

	switch (type) {
	case FFS_OS_DESC_EXT_COMPAT: {
		struct usb_ext_compat_desc *desc = data;
		struct usb_os_desc_table *t;

		t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
		t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
		memcpy(t->os_desc->ext_compat_id, &desc->IDs,
		       sizeof_field(struct usb_ext_compat_desc, IDs));
		length = sizeof(*desc);
	}
		break;
	case FFS_OS_DESC_EXT_PROP: {
		struct usb_ext_prop_desc *desc = data;
		struct usb_os_desc_table *t;
		struct usb_os_desc_ext_prop *ext_prop;
		char *ext_prop_name;
		char *ext_prop_data;

		t = &func->function.os_desc_table[h->interface];
		t->if_id = func->interfaces_nums[h->interface];

		ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
		func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);

		ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
		ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
		ext_prop->data_len = le32_to_cpu(*(__le32 *)
			usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
		length = ext_prop->name_len + ext_prop->data_len + 14;

		ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
		func->ffs->ms_os_descs_ext_prop_name_avail +=
			ext_prop->name_len;

		ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
		func->ffs->ms_os_descs_ext_prop_data_avail +=
			ext_prop->data_len;
		memcpy(ext_prop_data,
		       usb_ext_prop_data_ptr(data, ext_prop->name_len),
		       ext_prop->data_len);
		/* unicode data reported to the host as "WCHAR"s */
		switch (ext_prop->type) {
		case USB_EXT_PROP_UNICODE:
		case USB_EXT_PROP_UNICODE_ENV:
		case USB_EXT_PROP_UNICODE_LINK:
		case USB_EXT_PROP_UNICODE_MULTI:
			ext_prop->data_len *= 2;
			break;
		}
		ext_prop->data = ext_prop_data;

		memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
		       ext_prop->name_len);
		/* property name reported to the host as "WCHAR"s */
		ext_prop->name_len *= 2;
		ext_prop->name = ext_prop_name;

		t->os_desc->ext_prop_len +=
			ext_prop->name_len + ext_prop->data_len + 14;
		++t->os_desc->ext_prop_count;
		list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop);
	}
		break;
	default:
		pr_vdebug("unknown descriptor: %d\n", type);
	}

	return length;
}

static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
						struct usb_configuration *c)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	struct f_fs_opts *ffs_opts =
		container_of(f->fi, struct f_fs_opts, func_inst);
	struct ffs_data *ffs_data;
	int ret;

	/*
	 * Legacy gadget triggers binding in functionfs_ready_callback,
	 * which already uses locking; taking the same lock here would
	 * cause a deadlock.
	 *
	 * Configfs-enabled gadgets however do need ffs_dev_lock.
	 */
	if (!ffs_opts->no_configfs)
		ffs_dev_lock();
	ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
	ffs_data = ffs_opts->dev->ffs_data;
	if (!ffs_opts->no_configfs)
		ffs_dev_unlock();
	if (ret)
		return ERR_PTR(ret);

	func->ffs = ffs_data;
	func->conf = c;
	func->gadget = c->cdev->gadget;

	/*
	 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
	 * configurations are bound in sequence with list_for_each_entry,
	 * in each configuration its functions are bound in sequence
	 * with list_for_each_entry, so we assume no race condition
	 * with regard to ffs_opts->bound access
	 */
	if (!ffs_opts->refcnt) {
		ret = functionfs_bind(func->ffs, c->cdev);
		if (ret)
			return ERR_PTR(ret);
	}
	ffs_opts->refcnt++;
	func->function.strings = func->ffs->stringtabs;

	return ffs_opts;
}

static int _ffs_func_bind(struct usb_configuration *c,
			  struct usb_function *f)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	struct ffs_data *ffs = func->ffs;

	const int full = !!func->ffs->fs_descs_count;
	const int high = !!func->ffs->hs_descs_count;
	const int super = !!func->ffs->ss_descs_count;

	int fs_len, hs_len, ss_len, ret, i;
	struct ffs_ep *eps_ptr;

	/* Make it a single chunk, less management later on */
	vla_group(d);
	vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
	vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
		full ? ffs->fs_descs_count + 1 : 0);
	vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
		high ? ffs->hs_descs_count + 1 : 0);
	vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
		super ? ffs->ss_descs_count + 1 : 0);
	vla_item_with_sz(d, short, inums, ffs->interfaces_count);
	vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
			 c->cdev->use_os_string ? ffs->interfaces_count : 0);
	vla_item_with_sz(d, char[16], ext_compat,
			 c->cdev->use_os_string ? ffs->interfaces_count : 0);
	vla_item_with_sz(d, struct usb_os_desc, os_desc,
			 c->cdev->use_os_string ? ffs->interfaces_count : 0);
	vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
			 ffs->ms_os_descs_ext_prop_count);
	vla_item_with_sz(d, char, ext_prop_name,
			 ffs->ms_os_descs_ext_prop_name_len);
	vla_item_with_sz(d, char, ext_prop_data,
			 ffs->ms_os_descs_ext_prop_data_len);
	vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
	char *vlabuf;

	/* Has descriptors only for speeds gadget does not support */
	if (!(full | high | super))
		return -ENOTSUPP;

	/* Allocate a single chunk, less management later on */
	vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
	if (!vlabuf)
		return -ENOMEM;

	ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
	ffs->ms_os_descs_ext_prop_name_avail =
		vla_ptr(vlabuf, d, ext_prop_name);
	ffs->ms_os_descs_ext_prop_data_avail =
		vla_ptr(vlabuf, d, ext_prop_data);

	/* Copy descriptors  */
	memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
	       ffs->raw_descs_length);

	memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
	eps_ptr = vla_ptr(vlabuf, d, eps);
	for (i = 0; i < ffs->eps_count; i++)
		eps_ptr[i].num = -1;

	/* Save pointers
	 * d_eps == vlabuf, func->eps used to kfree vlabuf later
	*/
	func->eps             = vla_ptr(vlabuf, d, eps);
	func->interfaces_nums = vla_ptr(vlabuf, d, inums);

	/*
	 * Go through all the endpoint descriptors and allocate
	 * endpoints first, so that later we can rewrite the endpoint
	 * numbers without worrying that it may be described later on.
	 */
	if (full) {
		func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
		fs_len = ffs_do_descs(ffs->fs_descs_count,
				      vla_ptr(vlabuf, d, raw_descs),
				      d_raw_descs__sz,
				      __ffs_func_bind_do_descs, func);
		if (fs_len < 0) {
			ret = fs_len;
			goto error;
		}
	} else {
		fs_len = 0;
	}

	if (high) {
		func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
		hs_len = ffs_do_descs(ffs->hs_descs_count,
				      vla_ptr(vlabuf, d, raw_descs) + fs_len,
				      d_raw_descs__sz - fs_len,
				      __ffs_func_bind_do_descs, func);
		if (hs_len < 0) {
			ret = hs_len;
			goto error;
		}
	} else {
		hs_len = 0;
	}

	if (super) {
		func->function.ss_descriptors = func->function.ssp_descriptors =
			vla_ptr(vlabuf, d, ss_descs);
		ss_len = ffs_do_descs(ffs->ss_descs_count,
				vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
				d_raw_descs__sz - fs_len - hs_len,
				__ffs_func_bind_do_descs, func);
		if (ss_len < 0) {
			ret = ss_len;
			goto error;
		}
	} else {
		ss_len = 0;
	}

	/*
	 * Now handle interface numbers allocation and interface and
	 * endpoint numbers rewriting.  We can do that in one go
	 * now.
	 */
	ret = ffs_do_descs(ffs->fs_descs_count +
			   (high ? ffs->hs_descs_count : 0) +
			   (super ? ffs->ss_descs_count : 0),
			   vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
			   __ffs_func_bind_do_nums, func);
	if (ret < 0)
		goto error;

	func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
	if (c->cdev->use_os_string) {
		for (i = 0; i < ffs->interfaces_count; ++i) {
			struct usb_os_desc *desc;

			desc = func->function.os_desc_table[i].os_desc =
				vla_ptr(vlabuf, d, os_desc) +
				i * sizeof(struct usb_os_desc);
			desc->ext_compat_id =
				vla_ptr(vlabuf, d, ext_compat) + i * 16;
			INIT_LIST_HEAD(&desc->ext_prop);
		}
		ret = ffs_do_os_descs(ffs->ms_os_descs_count,
				      vla_ptr(vlabuf, d, raw_descs) +
				      fs_len + hs_len + ss_len,
				      d_raw_descs__sz - fs_len - hs_len -
				      ss_len,
				      __ffs_func_bind_do_os_desc, func);
		if (ret < 0)
			goto error;
	}
	func->function.os_desc_n =
		c->cdev->use_os_string ? ffs->interfaces_count : 0;

	/* And we're done */
	ffs_event_add(ffs, FUNCTIONFS_BIND);
	return 0;

error:
	/* XXX Do we need to release all claimed endpoints here? */
	return ret;
}

static int ffs_func_bind(struct usb_configuration *c,
			 struct usb_function *f)
{
	struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
	struct ffs_function *func = ffs_func_from_usb(f);
	int ret;

	if (IS_ERR(ffs_opts))
		return PTR_ERR(ffs_opts);

	ret = _ffs_func_bind(c, f);
	if (ret && !--ffs_opts->refcnt)
		functionfs_unbind(func->ffs);

	return ret;
}


/* Other USB function hooks *************************************************/

static void ffs_reset_work(struct work_struct *work)
{
	struct ffs_data *ffs = container_of(work,
		struct ffs_data, reset_work);
	ffs_data_reset(ffs);
}

static int ffs_func_get_alt(struct usb_function *f,
			    unsigned int interface)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	int intf = ffs_func_revmap_intf(func, interface);

	return (intf < 0) ? intf : func->cur_alt[interface];
}

static int ffs_func_set_alt(struct usb_function *f,
			    unsigned interface, unsigned alt)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	struct ffs_data *ffs = func->ffs;
	unsigned long flags;
	int ret = 0, intf;

	if (alt > MAX_ALT_SETTINGS)
		return -EINVAL;

	intf = ffs_func_revmap_intf(func, interface);
	if (intf < 0)
		return intf;

	if (ffs->func)
		ffs_func_eps_disable(ffs->func);

	spin_lock_irqsave(&ffs->eps_lock, flags);
	if (ffs->state == FFS_DEACTIVATED) {
		ffs->state = FFS_CLOSING;
		spin_unlock_irqrestore(&ffs->eps_lock, flags);
		INIT_WORK(&ffs->reset_work, ffs_reset_work);
		schedule_work(&ffs->reset_work);
		return -ENODEV;
	}
	spin_unlock_irqrestore(&ffs->eps_lock, flags);

	if (ffs->state != FFS_ACTIVE)
		return -ENODEV;

	ffs->func = func;
	ret = ffs_func_eps_enable(func);
	if (ret >= 0) {
		ffs_event_add(ffs, FUNCTIONFS_ENABLE);
		func->cur_alt[interface] = alt;
	}
	return ret;
}

static void ffs_func_disable(struct usb_function *f)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	struct ffs_data *ffs = func->ffs;
	unsigned long flags;

	if (ffs->func)
		ffs_func_eps_disable(ffs->func);

	spin_lock_irqsave(&ffs->eps_lock, flags);
	if (ffs->state == FFS_DEACTIVATED) {
		ffs->state = FFS_CLOSING;
		spin_unlock_irqrestore(&ffs->eps_lock, flags);
		INIT_WORK(&ffs->reset_work, ffs_reset_work);
		schedule_work(&ffs->reset_work);
		return;
	}
	spin_unlock_irqrestore(&ffs->eps_lock, flags);

	if (ffs->state == FFS_ACTIVE) {
		ffs->func = NULL;
		ffs_event_add(ffs, FUNCTIONFS_DISABLE);
	}
}

static int ffs_func_setup(struct usb_function *f,
			  const struct usb_ctrlrequest *creq)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	struct ffs_data *ffs = func->ffs;
	unsigned long flags;
	int ret;

	pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
	pr_vdebug("creq->bRequest     = %02x\n", creq->bRequest);
	pr_vdebug("creq->wValue       = %04x\n", le16_to_cpu(creq->wValue));
	pr_vdebug("creq->wIndex       = %04x\n", le16_to_cpu(creq->wIndex));
	pr_vdebug("creq->wLength      = %04x\n", le16_to_cpu(creq->wLength));

	/*
	 * Most requests directed to interface go through here
	 * (notable exceptions are set/get interface) so we need to
	 * handle them.  All other either handled by composite or
	 * passed to usb_configuration->setup() (if one is set).  No
	 * matter, we will handle requests directed to endpoint here
	 * as well (as it's straightforward).  Other request recipient
	 * types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP
	 * is being used.
	 */
	if (ffs->state != FFS_ACTIVE)
		return -ENODEV;

	switch (creq->bRequestType & USB_RECIP_MASK) {
	case USB_RECIP_INTERFACE:
		ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
		if (ret < 0)
			return ret;
		break;

	case USB_RECIP_ENDPOINT:
		ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
		if (ret < 0)
			return ret;
		if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
			ret = func->ffs->eps_addrmap[ret];
		break;

	default:
		if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP)
			ret = le16_to_cpu(creq->wIndex);
		else
			return -EOPNOTSUPP;
	}

	spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
	ffs->ev.setup = *creq;
	ffs->ev.setup.wIndex = cpu_to_le16(ret);
	__ffs_event_add(ffs, FUNCTIONFS_SETUP);
	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);

	return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
}

static bool ffs_func_req_match(struct usb_function *f,
			       const struct usb_ctrlrequest *creq,
			       bool config0)
{
	struct ffs_function *func = ffs_func_from_usb(f);

	if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP))
		return false;

	switch (creq->bRequestType & USB_RECIP_MASK) {
	case USB_RECIP_INTERFACE:
		return (ffs_func_revmap_intf(func,
					     le16_to_cpu(creq->wIndex)) >= 0);
	case USB_RECIP_ENDPOINT:
		return (ffs_func_revmap_ep(func,
					   le16_to_cpu(creq->wIndex)) >= 0);
	default:
		return (bool) (func->ffs->user_flags &
			       FUNCTIONFS_ALL_CTRL_RECIP);
	}
}

static void ffs_func_suspend(struct usb_function *f)
{
	ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
}

static void ffs_func_resume(struct usb_function *f)
{
	ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
}


/* Endpoint and interface numbers reverse mapping ***************************/

static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
{
	num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
	return num ? num : -EDOM;
}

static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
{
	short *nums = func->interfaces_nums;
	unsigned count = func->ffs->interfaces_count;

	for (; count; --count, ++nums) {
		if (*nums >= 0 && *nums == intf)
			return nums - func->interfaces_nums;
	}

	return -EDOM;
}


/* Devices management *******************************************************/

static LIST_HEAD(ffs_devices);

static struct ffs_dev *_ffs_do_find_dev(const char *name)
{
	struct ffs_dev *dev;

	if (!name)
		return NULL;

	list_for_each_entry(dev, &ffs_devices, entry) {
		if (strcmp(dev->name, name) == 0)
			return dev;
	}

	return NULL;
}

/*
 * ffs_lock must be taken by the caller of this function
 */
static struct ffs_dev *_ffs_get_single_dev(void)
{
	struct ffs_dev *dev;

	if (list_is_singular(&ffs_devices)) {
		dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
		if (dev->single)
			return dev;
	}

	return NULL;
}

/*
 * ffs_lock must be taken by the caller of this function
 */
static struct ffs_dev *_ffs_find_dev(const char *name)
{
	struct ffs_dev *dev;

	dev = _ffs_get_single_dev();
	if (dev)
		return dev;

	return _ffs_do_find_dev(name);
}

/* Configfs support *********************************************************/

static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
{
	return container_of(to_config_group(item), struct f_fs_opts,
			    func_inst.group);
}

static ssize_t f_fs_opts_ready_show(struct config_item *item, char *page)
{
	struct f_fs_opts *opts = to_ffs_opts(item);
	int ready;

	ffs_dev_lock();
	ready = opts->dev->desc_ready;
	ffs_dev_unlock();

	return sprintf(page, "%d\n", ready);
}

CONFIGFS_ATTR_RO(f_fs_opts_, ready);

static struct configfs_attribute *ffs_attrs[] = {
	&f_fs_opts_attr_ready,
	NULL,
};

static void ffs_attr_release(struct config_item *item)
{
	struct f_fs_opts *opts = to_ffs_opts(item);

	usb_put_function_instance(&opts->func_inst);
}

static const struct configfs_item_operations ffs_item_ops = {
	.release	= ffs_attr_release,
};

static const struct config_item_type ffs_func_type = {
	.ct_item_ops	= &ffs_item_ops,
	.ct_attrs	= ffs_attrs,
	.ct_owner	= THIS_MODULE,
};


/* Function registration interface ******************************************/

static void ffs_free_inst(struct usb_function_instance *f)
{
	struct f_fs_opts *opts;

	opts = to_f_fs_opts(f);
	ffs_release_dev(opts->dev);
	ffs_dev_lock();
	_ffs_free_dev(opts->dev);
	ffs_dev_unlock();
	kfree(opts);
}

static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
{
	if (strlen(name) >= sizeof_field(struct ffs_dev, name))
		return -ENAMETOOLONG;
	return ffs_name_dev(to_f_fs_opts(fi)->dev, name);
}

static struct usb_function_instance *ffs_alloc_inst(void)
{
	struct f_fs_opts *opts;
	struct ffs_dev *dev;

	opts = kzalloc_obj(*opts);
	if (!opts)
		return ERR_PTR(-ENOMEM);

	opts->func_inst.set_inst_name = ffs_set_inst_name;
	opts->func_inst.free_func_inst = ffs_free_inst;
	ffs_dev_lock();
	dev = _ffs_alloc_dev();
	ffs_dev_unlock();
	if (IS_ERR(dev)) {
		kfree(opts);
		return ERR_CAST(dev);
	}
	opts->dev = dev;
	dev->opts = opts;

	config_group_init_type_name(&opts->func_inst.group, "",
				    &ffs_func_type);
	return &opts->func_inst;
}

static void ffs_free(struct usb_function *f)
{
	kfree(ffs_func_from_usb(f));
}

static void ffs_func_unbind(struct usb_configuration *c,
			    struct usb_function *f)
{
	struct ffs_function *func = ffs_func_from_usb(f);
	struct ffs_data *ffs = func->ffs;
	struct f_fs_opts *opts =
		container_of(f->fi, struct f_fs_opts, func_inst);
	struct ffs_ep *ep = func->eps;
	unsigned count = ffs->eps_count;
	unsigned long flags;

	if (ffs->func == func) {
		ffs_func_eps_disable(func);
		ffs->func = NULL;
	}

	/* Drain any pending AIO completions */
	drain_workqueue(ffs->io_completion_wq);

	ffs_event_add(ffs, FUNCTIONFS_UNBIND);
	if (!--opts->refcnt)
		functionfs_unbind(ffs);

	/* cleanup after autoconfig */
	spin_lock_irqsave(&func->ffs->eps_lock, flags);
	while (count--) {
		if (ep->ep && ep->req)
			usb_ep_free_request(ep->ep, ep->req);
		ep->req = NULL;
		++ep;
	}
	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
	kfree(func->eps);
	func->eps = NULL;
	/*
	 * eps, descriptors and interfaces_nums are allocated in the
	 * same chunk so only one free is required.
	 */
	func->function.fs_descriptors = NULL;
	func->function.hs_descriptors = NULL;
	func->function.ss_descriptors = NULL;
	func->function.ssp_descriptors = NULL;
	func->interfaces_nums = NULL;

}

static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
{
	struct ffs_function *func;

	func = kzalloc_obj(*func);
	if (!func)
		return ERR_PTR(-ENOMEM);

	func->function.name    = "Function FS Gadget";

	func->function.bind    = ffs_func_bind;
	func->function.unbind  = ffs_func_unbind;
	func->function.set_alt = ffs_func_set_alt;
	func->function.get_alt = ffs_func_get_alt;
	func->function.disable = ffs_func_disable;
	func->function.setup   = ffs_func_setup;
	func->function.req_match = ffs_func_req_match;
	func->function.suspend = ffs_func_suspend;
	func->function.resume  = ffs_func_resume;
	func->function.free_func = ffs_free;

	return &func->function;
}

/*
 * ffs_lock must be taken by the caller of this function
 */
static struct ffs_dev *_ffs_alloc_dev(void)
{
	struct ffs_dev *dev;
	int ret;

	if (_ffs_get_single_dev())
			return ERR_PTR(-EBUSY);

	dev = kzalloc_obj(*dev);
	if (!dev)
		return ERR_PTR(-ENOMEM);

	if (list_empty(&ffs_devices)) {
		ret = functionfs_init();
		if (ret) {
			kfree(dev);
			return ERR_PTR(ret);
		}
	}

	list_add(&dev->entry, &ffs_devices);

	return dev;
}

int ffs_name_dev(struct ffs_dev *dev, const char *name)
{
	struct ffs_dev *existing;
	int ret = 0;

	ffs_dev_lock();

	existing = _ffs_do_find_dev(name);
	if (!existing)
		strscpy(dev->name, name, ARRAY_SIZE(dev->name));
	else if (existing != dev)
		ret = -EBUSY;

	ffs_dev_unlock();

	return ret;
}
EXPORT_SYMBOL_GPL(ffs_name_dev);

int ffs_single_dev(struct ffs_dev *dev)
{
	int ret;

	ret = 0;
	ffs_dev_lock();

	if (!list_is_singular(&ffs_devices))
		ret = -EBUSY;
	else
		dev->single = true;

	ffs_dev_unlock();
	return ret;
}
EXPORT_SYMBOL_GPL(ffs_single_dev);

/*
 * ffs_lock must be taken by the caller of this function
 */
static void _ffs_free_dev(struct ffs_dev *dev)
{
	list_del(&dev->entry);

	kfree(dev);
	if (list_empty(&ffs_devices))
		functionfs_cleanup();
}

static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data)
{
	int ret = 0;
	struct ffs_dev *ffs_dev;

	ffs_dev_lock();

	ffs_dev = _ffs_find_dev(dev_name);
	if (!ffs_dev) {
		ret = -ENOENT;
	} else if (ffs_dev->mounted) {
		ret = -EBUSY;
	} else if (ffs_dev->ffs_acquire_dev_callback &&
		   ffs_dev->ffs_acquire_dev_callback(ffs_dev)) {
		ret = -ENOENT;
	} else {
		ffs_dev->mounted = true;
		ffs_dev->ffs_data = ffs_data;
		ffs_data->private_data = ffs_dev;
	}

	ffs_dev_unlock();
	return ret;
}

static void ffs_release_dev(struct ffs_dev *ffs_dev)
{
	ffs_dev_lock();

	if (ffs_dev && ffs_dev->mounted) {
		ffs_dev->mounted = false;
		if (ffs_dev->ffs_data) {
			ffs_dev->ffs_data->private_data = NULL;
			ffs_dev->ffs_data = NULL;
		}

		if (ffs_dev->ffs_release_dev_callback)
			ffs_dev->ffs_release_dev_callback(ffs_dev);
	}

	ffs_dev_unlock();
}

static int ffs_ready(struct ffs_data *ffs)
{
	struct ffs_dev *ffs_obj;
	int ret = 0;

	ffs_dev_lock();

	ffs_obj = ffs->private_data;
	if (!ffs_obj) {
		ret = -EINVAL;
		goto done;
	}
	if (WARN_ON(ffs_obj->desc_ready)) {
		ret = -EBUSY;
		goto done;
	}

	ffs_obj->desc_ready = true;

	if (ffs_obj->ffs_ready_callback) {
		ret = ffs_obj->ffs_ready_callback(ffs);
		if (ret)
			goto done;
	}

	set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
done:
	ffs_dev_unlock();
	return ret;
}

static void ffs_closed(struct ffs_data *ffs)
{
	struct ffs_dev *ffs_obj;
	struct f_fs_opts *opts;
	struct config_item *ci;

	ffs_dev_lock();

	ffs_obj = ffs->private_data;
	if (!ffs_obj)
		goto done;

	ffs_obj->desc_ready = false;

	if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
	    ffs_obj->ffs_closed_callback)
		ffs_obj->ffs_closed_callback(ffs);

	if (ffs_obj->opts)
		opts = ffs_obj->opts;
	else
		goto done;

	if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
	    || !kref_read(&opts->func_inst.group.cg_item.ci_kref))
		goto done;

	ci = opts->func_inst.group.cg_item.ci_parent->ci_parent;
	ffs_dev_unlock();

	if (test_bit(FFS_FL_BOUND, &ffs->flags))
		unregister_gadget_item(ci);
	return;
done:
	ffs_dev_unlock();
}

/* Misc helper functions ****************************************************/

static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
{
	return nonblock
		? mutex_trylock(mutex) ? 0 : -EAGAIN
		: mutex_lock_interruptible(mutex);
}

static char *ffs_prepare_buffer(const char __user *buf, size_t len)
{
	char *data;

	if (!len)
		return NULL;

	data = memdup_user(buf, len);
	if (IS_ERR(data))
		return data;

	pr_vdebug("Buffer from user space:\n");
	ffs_dump_mem("", data, len);

	return data;
}

DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
MODULE_DESCRIPTION("user mode file system API for USB composite function controllers");
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Michal Nazarewicz");
]

gemini-3-flash-preview

							input: 85322
							output: 20
							thoughts: 1176
						

**Analyzing the Unsigned Comparison in C Pointer Arithmetic**

Okay, so the question is about whether the comparison `tmp_buf_end - tmp_buf < sizeof_cur_arg` is unsigned in C. First things first, I couldn't find this specific expression directly in `drivers/usb/gadget/function/f_fs.c`, but that's not the point. We need to dissect the C semantics.

`tmp_buf_end` and `tmp_buf` are pointers, so their difference results in a `ptrdiff_t` (signed), and `sizeof_cur_arg` is a `size_t` (unsigned). My immediate thought is, based on C rules, we're dealing with a comparison between a signed and an unsigned integer of the same rank. In the kernel, both `ptrdiff_t` and `size_t` have the same rank (either 32-bit or 64-bit). The C standard dictates that when comparing these types, the signed integer (`ptrdiff_t`) is *implicitly* converted to the unsigned type (`size_t`) for the comparison.

However, I need to be thorough. I need to make sure I am not missing some obscure edge case. So, I checked the standard again. And verified how `ptrdiff_t` and `size_t` are defined in the kernel's `include/uapi/asm-generic/posix_types.h`. Even in the 32-bit case (`__BITS_PER_LONG != 64`), `ptrdiff_t` and `size_t` are defined as `int` and `unsigned int`, so they are still of the same rank. The same applies for 64-bit systems.

The standard says that if the operand with the unsigned type has a greater rank, the signed type is converted. Otherwise, it is converted to the signed type. In this case, `ptrdiff_t` and `size_t` always have the same rank, and we're dealing with the `ptrdiff_t` being implicitly converted to `size_t`. So, there are no special cases in the kernel, at least related to the definitions.

The question explicitly states that the expressions use pointers and `size_t`, so I am certain the comparison *is* unsigned. The classic C pitfall! If `tmp_buf_end - tmp_buf` evaluates to a negative number, it will be converted to a very large unsigned value, causing unexpected behavior. For example, if the result is -1, the expression becomes `(size_t)-1 < 10` (if `sizeof_cur_arg` is 10), which is false in an unsigned comparison. In a signed comparison `-1 < 10` would be true.

I remembered a similar type of problem might be related to a buffer overflow issue from the past, so I went searching for it.

I searched `tmp_buf_end - tmp_buf` but didn't come up with anything related to this *specific* code. I did remember `audit_log_execve_info` from an earlier search. The comparison in that function `(len_abuf + sizeof(abuf)) > len_rem` *does* involve mixed signed/unsigned types (`long`, `size_t`) and it's also an unsigned comparison. Although that is not the same expression, it highlights a related pattern in the kernel. In the end, it is an **unsigned comparison**, due to C's implicit type conversion rules when comparing a signed integer (`ptrdiff_t`) to an unsigned integer (`size_t`) of the same rank.

map[Dir:security/]

map[Files:[commoncap.c commoncap_test.c device_cgroup.c inode.c lsm.h lsm_audit.c lsm_init.c lsm_notifier.c lsm_syscalls.c min_addr.c security.c] Subdirs:[apparmor bpf integrity ipe keys landlock loadpin lockdown safesetid selinux smack tomoyo yama]]

gemini-3-flash-preview

							input: 87479
							output: 27
							thoughts: 14
						

Okay, here's my summary, taking the role of the expert:

**Diving into `security/lsm_audit.c`**

Alright, time to dig in. Let's start with `security/lsm_audit.c`. I need to refresh my memory on the audit logging within the LSM framework. This file is probably the core of how the Linux Security Modules (LSM) handle audit events, specifically for the logging and reporting side of things. I'm expecting to find the key functions responsible for formatting audit records, potentially interfacing with the audit subsystem, and managing any related buffers or data structures. I'll be looking for where hooks are called, how events are classified, and how much context is included. Probably lots of interesting stuff regarding security event context as it pertains to the various LSM's and overall system audit policies. It's a foundational piece, so understanding this is vital for deep-level security analysis and auditing. Let's see what we've got!

map[SourceFile:security/lsm_audit.c]

map[Entities:[map[Kind:function Name:audit_log_lsm_data] map[Kind:function Name:common_lsm_audit] map[Kind:function Name:dump_common_audit_data] map[Kind:function Name:ipv4_skb_to_auditdata] map[Kind:function Name:ipv6_skb_to_auditdata] map[Kind:function Name:print_ipv4_addr] map[Kind:function Name:print_ipv6_addr]]]

gemini-3-flash-preview

							input: 87873
							output: 27
							thoughts: 17
						

Okay, here's my attempt at summarizing those thoughts from a first-person, expert perspective:

**Initial Assessment: A Disjointed Search**

Ugh, I'm drawing a blank. Not quite feeling it today. The problem I'm working on, the relevant code... it's just not coming to mind immediately. I'm feeling disconnected from the relevant parts of the codebase. My usual mental map isn't quite clicking.

Wait... a flicker... maybe? Now, where would that kind of functionality *typically* live in a Linux kernel? The kernel module for miscellaneous binary formats, that's it! Let's try `fs/binfmt_misc.c`. That's likely the right area for exploring this.

map[SourceFile:fs/binfmt_misc.c]

map[Entities:[map[Kind:function Name:add_entry] map[Kind:function Name:bm_entry_read] map[Kind:function Name:bm_entry_write] map[Kind:function Name:bm_evict_inode] map[Kind:function Name:bm_fill_super] map[Kind:function Name:bm_free] map[Kind:function Name:bm_get_inode] map[Kind:function Name:bm_get_tree] map[Kind:function Name:bm_init_fs_context] map[Kind:function Name:bm_put_super] map[Kind:function Name:bm_register_write] map[Kind:function Name:bm_status_read] map[Kind:function Name:bm_status_write] map[Kind:function Name:check_special_flags] map[Kind:function Name:create_entry] map[Kind:function Name:entry_status] map[Kind:function Name:exit_misc_binfmt] map[Kind:function Name:get_binfmt_handler] map[Kind:function Name:i_binfmt_misc] map[Kind:function Name:init_misc_binfmt] map[Kind:function Name:load_binfmt_misc] map[Kind:function Name:load_misc_binary] map[Kind:function Name:parse_command] map[Kind:function Name:put_binfmt_handler] map[Kind:function Name:remove_binfmt_handler] map[Kind:function Name:scanarg] map[Kind:function Name:search_binfmt_handler] map[Kind:global_variable Name:__UNIQUE_ID_addressable_init_misc_binfmt_568] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_566] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_569] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_570] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_571] map[Kind:global_variable Name:__exitcall_exit_misc_binfmt] map[Kind:global_variable Name:bm_context_ops] map[Kind:global_variable Name:bm_entry_operations] map[Kind:global_variable Name:bm_fs_type] map[Kind:global_variable Name:bm_register_operations] map[Kind:global_variable Name:bm_status_operations] map[Kind:global_variable Name:misc_format] map[Kind:global_variable Name:s_ops] map[Kind:typedef Name:Node]]]

gemini-3-flash-preview

							input: 88802
							output: 39
							thoughts: 19
						

Here's my take on those thoughts:

**Analyzing `scanarg` in `fs/binfmt_misc.c`**

Alright, let's dive into this. My first thought is to zero in on `scanarg` within `fs/binfmt_misc.c`. I need to understand exactly how this function is handling arguments. I suspect it's critical to the binary format registration process, likely involved in parsing and validating data provided during the registration of a new interpreter or binary format. My immediate goal is to figure out the exact mechanisms this function uses to accomplish that. I need to understand any vulnerabilities, potential gotchas, or unexpected behaviors in the argument parsing. It would be good to understand any edge cases the author accounted for and any they didn't. I'm especially interested in how it deals with malformed arguments, overflows, or injection possibilities. I'll need to look at its use within the broader context of the `binfmt_misc` module to fully grasp its impact and significance.

map[ContextFile:fs/binfmt_misc.c IncludeLines:true Name:scanarg]

map[SourceCode: 283:	/*
 284:	 * parses and copies one argument enclosed in del from *sp to *dp,
 285:	 * recognising the \x special.
 286:	 * returns pointer to the copied argument or NULL in case of an
 287:	 * error (and sets err) or null argument length.
 288:	 */
 289:	static char *scanarg(char *s, char del)
 290:	{
 291:		char c;
 292:	
 293:		while ((c = *s++) != del) {
 294:			if (c == '\\' && *s == 'x') {
 295:				s++;
 296:				if (!isxdigit(*s++))
 297:					return NULL;
 298:				if (!isxdigit(*s++))
 299:					return NULL;
 300:			}
 301:		}
 302:		s[-1] ='\0';
 303:		return s;
 304:	}
 SourceFile:fs/binfmt_misc.c]

gemini-3-flash-preview

							input: 89389
							output: 21
							thoughts: 523
						

**Debugging a Kernel Memory Issue**

Okay, so I'm on the trail of something... I was expecting to find `tmp_buf` in `fs/proc/base.c` and then maybe `tmp_buf_end`, but it seems like this isn't quite where the problem lies. I'll search for "tmp_buf" everywhere in the kernel source, but since I can't do that now, I'm going to have to make some educated guesses.

Aha! There it is, I think. `tmp_buf` *was* in `fs/proc/base.c` in some versions, so maybe it has a different name here. Actually, let's revisit `get_mm_cmdline`. Looking at this line:
```c
 347:		if (count > arg_end - pos)
 348:			count = arg_end - pos;
```
It looks like we've got an unsigned comparison. `count` is `size_t`, and `arg_end` and `pos` are `unsigned long`. But the expression I'm looking at has something like `tmp_buf_end - tmp_buf`, which looks suspiciously like a patch for a vulnerability.

I'll search for `tmp_buf_end` again, let's try `kernel/auditsc.c`. Wait, let's go back and carefully re-read the `audit_log_execve_info` function.

Hmm, I see `buf_head` and `buf` here:
```c
1150:		buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
...
1155:		buf = buf_head;
```
And then later, `buf += len_tmp;` but still no `tmp_buf_end`.

Okay, what about `fs/exec.c`? 
```c
 475:			pos = bprm->p;
 476:			str += len;
 477:			bprm->p -= len;
```
That's not it.

Let's try a broader search for `sizeof_cur_arg`, or perhaps just `sizeof_arg`. Actually, I'll broaden the search further and look for the string `cur_arg` itself.

log-in to see details

map[Name:cur_arg]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 90475
							output: 24
							thoughts: 788
						

**Analyzing the C Code Snippet for Potential Integer Overflow Vulnerability**

Alright, let's break down this C comparison, assuming it's related to some auditing or logging mechanism in the kernel, and the user likely needs it to be a correct analysis of potential vulnerabilities. The expression is `tmp_buf_end - tmp_buf < sizeof_cur_arg`. I immediately recognize that `tmp_buf_end` and `tmp_buf` are pointers, so their difference, `tmp_buf_end - tmp_buf`, is going to be a `ptrdiff_t`. Meanwhile, `sizeof_cur_arg` is of type `size_t`. This is where it gets interesting...

My understanding of C's type conversion rules kicks in. Whenever you compare a signed integer like `ptrdiff_t` to an unsigned integer like `size_t`, the compiler performs the usual arithmetic conversions.  Crucially, when both types have the same rank – which is the case for `ptrdiff_t` and `size_t` on Linux (both are "pointer-sized" integers, 32-bit or 64-bit depending on architecture) – the signed type (`ptrdiff_t`) is *converted* to the unsigned type (`size_t`).

So the comparison boils down to an *unsigned* comparison.  The underlying question that comes to mind is: Are there any architectures where `ptrdiff_t` and `size_t` *don't* have the same rank?  Though the C standard makes this very unlikely, since they are closely tied to pointer sizes, it's worth a second. Even if they had different ranks, the conversion rules would still be, in essence, to either promote the signed type to the unsigned, or to convert both to the corresponding unsigned type.

Let's look at the practice in Linux. On x86_64, `size_t` is `unsigned long` (64-bit) and `ptrdiff_t` is `long` (64-bit). They're of the same rank, and so `long` gets implicitly converted to `unsigned long` before the comparison.  Similarly, on x86 (32-bit), `size_t` is `unsigned int` (32-bit) and `ptrdiff_t` is `int` (32-bit).  Again, they have the same rank, and `int` becomes `unsigned int`. The outcome in both cases is an unsigned comparison.

Okay, let's step back and consider potential edge cases. What happens if `tmp_buf_end` is actually *less than* `tmp_buf`? That would mean `tmp_buf_end - tmp_buf` would be a negative value.  When this negative `ptrdiff_t` is converted to `size_t` (an unsigned type), it becomes a *very* large positive number, a wrapping around of the value. If `sizeof_cur_arg` is a regular, smaller value, then the comparison effectively becomes `large_positive_value < smaller_value`, which would be false (when it *should* be true if the calculation were interpreted signed).  So, this would be an integer overflow!

So, the critical insight is: the comparison *is* an unsigned comparison due to the type conversions.  I'll need to remember that when checking for potential vulnerabilities like integer overflows.

Just confirming that `sizeof_cur_arg` *is* actually `size_t`, as the user mentioned and the types suggest. Excellent.

Now, my mind goes back to the audit logging context and the type of bug. Is there a similar issue in the auditing code? Let me see. I'll search for `tmp_buf` again in `kernel/audit.c`. I might need to look at `fs/proc/base.c` as well, or `kernel/auditsc.c`.

map[SourceFile:kernel/audit.c]

map[Entities:[map[Kind:function Name:__audit_log_end] map[Kind:function Name:audit_backlog_limit_set] map[Kind:function Name:audit_buffer_alloc] map[Kind:function Name:audit_buffer_aux_end] map[Kind:function Name:audit_buffer_aux_new] map[Kind:function Name:audit_buffer_free] map[Kind:function Name:audit_cfg_lsm] map[Kind:function Name:audit_ctl_lock] map[Kind:function Name:audit_ctl_owner_current] map[Kind:function Name:audit_ctl_unlock] map[Kind:function Name:audit_do_config_change] map[Kind:function Name:audit_enable] map[Kind:function Name:audit_expand] map[Kind:function Name:audit_free_reply] map[Kind:function Name:audit_get_feature] map[Kind:function Name:audit_get_sk] map[Kind:function Name:audit_get_stamp] map[Kind:function Name:audit_get_tty] map[Kind:function Name:audit_init] map[Kind:function Name:audit_log] map[Kind:function Name:audit_log_common_recv_msg] map[Kind:function Name:audit_log_config_change] map[Kind:function Name:audit_log_d_path] map[Kind:function Name:audit_log_d_path_exe] map[Kind:function Name:audit_log_end] map[Kind:function Name:audit_log_feature_change] map[Kind:function Name:audit_log_format] map[Kind:function Name:audit_log_key] map[Kind:function Name:audit_log_lost] map[Kind:function Name:audit_log_multicast] map[Kind:function Name:audit_log_n_hex] map[Kind:function Name:audit_log_n_string] map[Kind:function Name:audit_log_n_untrustedstring] map[Kind:function Name:audit_log_nf_skb] map[Kind:function Name:audit_log_obj_ctx] map[Kind:function Name:audit_log_path_denied] map[Kind:function Name:audit_log_session_info] map[Kind:function Name:audit_log_set_loginuid] map[Kind:function Name:audit_log_start] map[Kind:function Name:audit_log_subj_ctx] map[Kind:function Name:audit_log_task_context] map[Kind:function Name:audit_log_task_info] map[Kind:function Name:audit_log_untrustedstring] map[Kind:function Name:audit_log_user_recv_msg] map[Kind:function Name:audit_log_vformat] map[Kind:function Name:audit_make_reply] map[Kind:function Name:audit_multicast_bind] map[Kind:function Name:audit_multicast_unbind] map[Kind:function Name:audit_net_exit] map[Kind:function Name:audit_net_init] map[Kind:function Name:audit_netlink_ok] map[Kind:function Name:audit_panic] map[Kind:function Name:audit_put_tty] map[Kind:function Name:audit_rate_check] map[Kind:function Name:audit_receive] map[Kind:function Name:audit_receive_msg] map[Kind:function Name:audit_replace] map[Kind:function Name:audit_send_list_thread] map[Kind:function Name:audit_send_reply] map[Kind:function Name:audit_send_reply_thread] map[Kind:function Name:audit_serial] map[Kind:function Name:audit_set_backlog_limit] map[Kind:function Name:audit_set_backlog_wait_time] map[Kind:function Name:audit_set_enabled] map[Kind:function Name:audit_set_failure] map[Kind:function Name:audit_set_feature] map[Kind:function Name:audit_set_loginuid] map[Kind:function Name:audit_set_loginuid_perm] map[Kind:function Name:audit_set_rate_limit] map[Kind:function Name:audit_signal_info] map[Kind:function Name:audit_string_contains_control] map[Kind:function Name:auditd_conn_free] map[Kind:function Name:auditd_pid_vnr] map[Kind:function Name:auditd_reset] map[Kind:function Name:auditd_send_unicast_skb] map[Kind:function Name:auditd_set] map[Kind:function Name:auditd_test_task] map[Kind:function Name:is_audit_feature_set] map[Kind:function Name:kauditd_hold_skb] map[Kind:function Name:kauditd_printk_skb] map[Kind:function Name:kauditd_rehold_skb] map[Kind:function Name:kauditd_retry_skb] map[Kind:function Name:kauditd_send_multicast_skb] map[Kind:function Name:kauditd_send_queue] map[Kind:function Name:kauditd_thread] map[Kind:struct Name:audit_buffer] map[Kind:struct Name:audit_ctl_mutex] map[Kind:struct Name:audit_net] map[Kind:struct Name:audit_reply] map[Kind:struct Name:auditd_connection] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_enabled_820] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_init_844] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_857] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_end_855] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_format_856] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_nf_skb_851] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_start_854] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_subj_ctx_847] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_task_context_848] map[Kind:global_variable Name:__UNIQUE_ID_addressable_audit_log_task_info_850] map[Kind:global_variable Name:__setup_audit_backlog_limit_set] map[Kind:global_variable Name:__setup_audit_enable] map[Kind:global_variable Name:__setup_str_audit_backlog_limit_set] map[Kind:global_variable Name:__setup_str_audit_enable] map[Kind:global_variable Name:af] map[Kind:global_variable Name:audit_backlog_limit] map[Kind:global_variable Name:audit_backlog_wait] map[Kind:global_variable Name:audit_backlog_wait_time] map[Kind:global_variable Name:audit_backlog_wait_time_actual] map[Kind:global_variable Name:audit_default] map[Kind:global_variable Name:audit_enabled] map[Kind:global_variable Name:audit_ever_enabled] map[Kind:global_variable Name:audit_failure] map[Kind:global_variable Name:audit_feature_names] map[Kind:global_variable Name:audit_initialized] map[Kind:global_variable Name:audit_lost] map[Kind:global_variable Name:audit_net_ops] map[Kind:global_variable Name:audit_sig_pid] map[Kind:global_variable Name:audit_sig_uid] map[Kind:global_variable Name:auditd_conn_lock] map[Kind:global_variable Name:kauditd_wait] map[Kind:global_variable Name:session_id]]]

gemini-3-flash-preview

							input: 94391
							output: 41
							thoughts: 21
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue:

**Diving into the Audit Log Implementation**

Right, so I need to understand how `audit_log_n_string` functions, and my best bet is to dig directly into the source. That means I'm going to navigate over to `kernel/audit.c`. That's where I expect to find the core implementation and any related data structures or helper functions that it depends on. I anticipate that this function is critical for logging string data within the audit subsystem and probably used extensively throughout the kernel. I'll be looking for things like buffer management, any potential limitations on string length, and how it interacts with the audit event structures. From experience, I anticipate this will involve a call to `audit_log_format` or something similar, and I'll need to understand how the arguments are passed to it. Let's get to it.

map[ContextFile:kernel/audit.c IncludeLines:true Name:audit_log_n_string]

map[SourceCode:2109:	/*
2110:	 * Format a string of no more than slen characters into the audit buffer,
2111:	 * enclosed in quote marks.
2112:	 */
2113:	void audit_log_n_string(struct audit_buffer *ab, const char *string,
2114:				size_t slen)
2115:	{
2116:		int avail, new_len;
2117:		unsigned char *ptr;
2118:		struct sk_buff *skb;
2119:	
2120:		if (!ab)
2121:			return;
2122:	
2123:		BUG_ON(!ab->skb);
2124:		skb = ab->skb;
2125:		avail = skb_tailroom(skb);
2126:		new_len = slen + 3;	/* enclosing quotes + null terminator */
2127:		if (new_len > avail) {
2128:			avail = audit_expand(ab, new_len);
2129:			if (!avail)
2130:				return;
2131:		}
2132:		ptr = skb_tail_pointer(skb);
2133:		*ptr++ = '"';
2134:		memcpy(ptr, string, slen);
2135:		ptr += slen;
2136:		*ptr++ = '"';
2137:		*ptr = 0;
2138:		skb_put(skb, slen + 2);	/* don't include null terminator */
2139:	}
 SourceFile:kernel/audit.c]

gemini-3-flash-preview

							input: 95126
							output: 43
							thoughts: 123
						

**Navigating the Labyrinth of Kernel Code**

Okay, I'm stuck. Not making any headway on this. Hmm, let me circle back and search for `tmp_buf` again, this time in `fs/exec.c`, but this time I'll broaden my search within that file for any occurrence of it.

Actually, scratch that. I'm going to take a more aggressive approach. Instead of a targeted search, I'll search the *entire* kernel source for the string "tmp_buf". That should turn up everything, right? I'll probably be able to pin down its usage that way.

Damn, I can't do that. I'm forgetting my current environment constraints... Okay, back to a more targeted approach then. Let's revisit `fs/proc/base.c` and search for `tmp_buf` there again.

Wait, before I do that, let me just check `get_mm_proctitle`. It might be relevant.

map[ContextFile:fs/proc/base.c IncludeLines:true Name:get_mm_proctitle]

map[SourceCode: 250:	/*
 251:	 * If the user used setproctitle(), we just get the string from
 252:	 * user space at arg_start, and limit it to a maximum of one page.
 253:	 */
 254:	static ssize_t get_mm_proctitle(struct mm_struct *mm, char __user *buf,
 255:					size_t count, unsigned long pos,
 256:					unsigned long arg_start)
 257:	{
 258:		char *page;
 259:		int ret, got;
 260:	
 261:		if (pos >= PAGE_SIZE)
 262:			return 0;
 263:	
 264:		page = (char *)__get_free_page(GFP_KERNEL);
 265:		if (!page)
 266:			return -ENOMEM;
 267:	
 268:		ret = 0;
 269:		got = access_remote_vm(mm, arg_start, page, PAGE_SIZE, FOLL_ANON);
 270:		if (got > 0) {
 271:			int len = strnlen(page, got);
 272:	
 273:			/* Include the NUL character if it was found */
 274:			if (len < got)
 275:				len++;
 276:	
 277:			if (len > pos) {
 278:				len -= pos;
 279:				if (len > count)
 280:					len = count;
 281:				len -= copy_to_user(buf, page+pos, len);
 282:				if (!len)
 283:					len = -EFAULT;
 284:				ret = len;
 285:			}
 286:		}
 287:		free_page((unsigned long)page);
 288:		return ret;
 289:	}
 SourceFile:fs/proc/base.c]

gemini-3-flash-preview

							input: 96073
							output: 35
							thoughts: 892
						

**Analyzing C Type Comparisons**

Okay, the question is straightforward – it's about C types and how they interact in a comparison. I'm looking at the expression `tmp_buf_end - tmp_buf < sizeof_cur_arg`.

Let's break down the types involved: `tmp_buf_end` and `tmp_buf` are pointers, so their difference, `tmp_buf_end - tmp_buf`, is a `ptrdiff_t` (signed), while `sizeof_cur_arg` is a `size_t` (unsigned).

Now, the C rules kick in (Usual Arithmetic Conversions).  When comparing a signed integer (`ptrdiff_t`) and an unsigned integer (`size_t`), the standard dictates that there's a conversion. Specifically, since `size_t` and `ptrdiff_t` have the same rank in the Linux kernel (both are the same width as a pointer), `ptrdiff_t` gets converted to `size_t`. This makes the comparison *unsigned*.

I need to make sure my understanding is correct and that this isn't platform dependent. The implication is significant.  If `tmp_buf_end - tmp_buf` is, say, -1 (meaning `tmp_buf_end` is one byte before `tmp_buf`), and `sizeof_cur_arg` is 10, then -1, when interpreted as a `size_t`, becomes a massive positive number (e.g., `0xFFFFFFFF` on a 32-bit system or `0xFFFFFFFFFFFFFFFF` on 64-bit). The comparison will yield *false*, even though -1 is mathematically less than 10. That’s counterintuitive if you're expecting a signed comparison!

Wait, let me double-check. The crux of the issue relies on the relative ranks of `size_t` and `ptrdiff_t`. I'm pretty certain, but I'll confirm in the C11 standard. Ah yes, 6.3.1.8 confirms it: the signed type is converted to the unsigned type if the unsigned type's rank is greater than or equal to the signed type's rank.  And the standard also states that the rank of the signed and unsigned of same bit-width are the same.  So, the rule applies.

So yes, the subtraction of two pointers gives you `ptrdiff_t`, and `sizeof` always gives you `size_t`. So the comparison is `ptrdiff_t < size_t`, which is *indeed* an unsigned comparison.

Okay, let's think. Does it matter if `sizeof_cur_arg` is a constant? No, `sizeof(something)` is always of type `size_t`, so `tmp_buf_end - tmp_buf < sizeof(something)` is also an unsigned comparison. I am confident in my analysis.

Just to be absolutely sure, I'll search the kernel code base again to see the actual usage.  I'll see if I can find code that makes this comparison using a different approach. I'll search for `tmp_buf_end`, but this time focus my search on `drivers/usb/gadget/function/f_mass_storage.c`, maybe I missed something. I'll see what I can find. Wait, I already checked that and I remember it's not there. Looks like I've got a definitive answer.

map[SourceFile:drivers/usb/gadget/function/f_mass_storage.c]

map[Entities:[map[Kind:function Name:__fsg_is_set] map[Kind:function Name:__raise_exception] map[Kind:function Name:_fsg_common_free_buffers] map[Kind:function Name:_fsg_common_get_max_lun] map[Kind:function Name:_fsg_common_remove_luns] map[Kind:function Name:alloc_request] map[Kind:function Name:bulk_in_complete] map[Kind:function Name:bulk_out_complete] map[Kind:function Name:check_command] map[Kind:function Name:check_command_size_in_blocks] map[Kind:function Name:do_inquiry] map[Kind:function Name:do_mode_select] map[Kind:function Name:do_mode_sense] map[Kind:function Name:do_prevent_allow] map[Kind:function Name:do_read] map[Kind:function Name:do_read_capacity] map[Kind:function Name:do_read_capacity_16] map[Kind:function Name:do_read_format_capacities] map[Kind:function Name:do_read_header] map[Kind:function Name:do_read_toc] map[Kind:function Name:do_request_sense] map[Kind:function Name:do_scsi_command] map[Kind:function Name:do_set_interface] map[Kind:function Name:do_start_stop] map[Kind:function Name:do_synchronize_cache] map[Kind:function Name:do_verify] map[Kind:function Name:do_write] map[Kind:function Name:ep0_queue] map[Kind:function Name:exception_in_progress] map[Kind:function Name:file_show] map[Kind:function Name:file_store] map[Kind:function Name:finish_reply] map[Kind:function Name:forced_eject_store] map[Kind:function Name:fsg_alloc] map[Kind:function Name:fsg_alloc_inst] map[Kind:function Name:fsg_attr_release] map[Kind:function Name:fsg_bind] map[Kind:function Name:fsg_common_create_lun] map[Kind:function Name:fsg_common_create_luns] map[Kind:function Name:fsg_common_free_buffers] map[Kind:function Name:fsg_common_release] map[Kind:function Name:fsg_common_remove_lun] map[Kind:function Name:fsg_common_remove_luns] map[Kind:function Name:fsg_common_set_cdev] map[Kind:function Name:fsg_common_set_inquiry_string] map[Kind:function Name:fsg_common_set_num_buffers] map[Kind:function Name:fsg_common_set_sysfs] map[Kind:function Name:fsg_common_setup] map[Kind:function Name:fsg_config_from_params] map[Kind:function Name:fsg_disable] map[Kind:function Name:fsg_free] map[Kind:function Name:fsg_free_inst] map[Kind:function Name:fsg_from_func] map[Kind:function Name:fsg_lun_attr_release] map[Kind:function Name:fsg_lun_dev_is_visible] map[Kind:function Name:fsg_lun_drop] map[Kind:function Name:fsg_lun_make] map[Kind:function Name:fsg_lun_opts_cdrom_show] map[Kind:function Name:fsg_lun_opts_cdrom_store] map[Kind:function Name:fsg_lun_opts_file_show] map[Kind:function Name:fsg_lun_opts_file_store] map[Kind:function Name:fsg_lun_opts_forced_eject_store] map[Kind:function Name:fsg_lun_opts_inquiry_string_show] map[Kind:function Name:fsg_lun_opts_inquiry_string_store] map[Kind:function Name:fsg_lun_opts_nofua_show] map[Kind:function Name:fsg_lun_opts_nofua_store] map[Kind:function Name:fsg_lun_opts_removable_show] map[Kind:function Name:fsg_lun_opts_removable_store] map[Kind:function Name:fsg_lun_opts_ro_show] map[Kind:function Name:fsg_lun_opts_ro_store] map[Kind:function Name:fsg_lun_release] map[Kind:function Name:fsg_main_thread] map[Kind:function Name:fsg_opts_num_buffers_show] map[Kind:function Name:fsg_opts_num_buffers_store] map[Kind:function Name:fsg_opts_stall_show] map[Kind:function Name:fsg_opts_stall_store] map[Kind:function Name:fsg_set_alt] map[Kind:function Name:fsg_set_halt] map[Kind:function Name:fsg_setup] map[Kind:function Name:fsg_unbind] map[Kind:function Name:get_next_command] map[Kind:function Name:halt_bulk_in_endpoint] map[Kind:function Name:handle_exception] map[Kind:function Name:invalidate_sub] map[Kind:function Name:mass_storagemod_exit] map[Kind:function Name:mass_storagemod_init] map[Kind:function Name:nofua_show] map[Kind:function Name:nofua_store] map[Kind:function Name:raise_exception] map[Kind:function Name:received_cbw] map[Kind:function Name:ro_show] map[Kind:function Name:ro_store] map[Kind:function Name:send_status] map[Kind:function Name:set_bulk_out_req_length] map[Kind:function Name:sleep_thread] map[Kind:function Name:start_in_transfer] map[Kind:function Name:start_out_transfer] map[Kind:function Name:start_transfer] map[Kind:function Name:throw_away_data] map[Kind:function Name:to_fsg_lun_opts] map[Kind:function Name:to_fsg_opts] map[Kind:function Name:wedge_bulk_in_endpoint] map[Kind:struct Name:fsg_common] map[Kind:struct Name:fsg_dev] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_create_lun_530] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_create_luns_531] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_free_buffers_528] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_remove_lun_526] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_remove_luns_527] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_set_cdev_529] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_set_inquiry_string_532] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_set_num_buffers_525] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_common_set_sysfs_524] map[Kind:global_variable Name:__UNIQUE_ID_addressable_fsg_config_from_params_551] map[Kind:global_variable Name:__UNIQUE_ID_addressable_mass_storagemod_init_543] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_541] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_544] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_545] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_546] map[Kind:global_variable Name:__UNIQUE_ID_modinfo_547] map[Kind:global_variable Name:__exitcall_mass_storagemod_exit] map[Kind:global_variable Name:dev_attr_file] map[Kind:global_variable Name:dev_attr_forced_eject] map[Kind:global_variable Name:dev_attr_nofua] map[Kind:global_variable Name:dev_attr_ro] map[Kind:global_variable Name:fsg_attrs] map[Kind:global_variable Name:fsg_func_type] map[Kind:global_variable Name:fsg_group_ops] map[Kind:global_variable Name:fsg_item_ops] map[Kind:global_variable Name:fsg_lun_attrs] map[Kind:global_variable Name:fsg_lun_dev_attrs] map[Kind:global_variable Name:fsg_lun_dev_group] map[Kind:global_variable Name:fsg_lun_dev_groups] map[Kind:global_variable Name:fsg_lun_item_ops] map[Kind:global_variable Name:fsg_lun_opts_attr_cdrom] map[Kind:global_variable Name:fsg_lun_opts_attr_file] map[Kind:global_variable Name:fsg_lun_opts_attr_forced_eject] map[Kind:global_variable Name:fsg_lun_opts_attr_inquiry_string] map[Kind:global_variable Name:fsg_lun_opts_attr_nofua] map[Kind:global_variable Name:fsg_lun_opts_attr_removable] map[Kind:global_variable Name:fsg_lun_opts_attr_ro] map[Kind:global_variable Name:fsg_lun_type] map[Kind:global_variable Name:fsg_opts_attr_num_buffers] map[Kind:global_variable Name:fsg_opts_attr_stall] map[Kind:global_variable Name:fsg_string_interface] map[Kind:global_variable Name:fsg_strings] map[Kind:global_variable Name:fsg_strings_array] map[Kind:global_variable Name:fsg_stringtab] map[Kind:global_variable Name:mass_storageusb_func]]]

gemini-3-flash-preview

							input: 100674
							output: 595
							thoughts: 186
						

**Unsigned Comparison in C**

Okay, I'm not entirely focused right now, but I can definitely address this C rule. I'm feeling good about my grasp of the core concepts here.

Let's break down this comparison: `tmp_buf_end - tmp_buf < sizeof_cur_arg`. It seems straightforward, but we need to be precise about how C handles these different integer types. First, `tmp_buf_end - tmp_buf` evaluates to a `ptrdiff_t`. I know that `ptrdiff_t` is a *signed* integer type.  On the other hand, `sizeof_cur_arg` is a `size_t`, which is, without question, an *unsigned* integer.

Now, here's the crucial C rule: when we compare a signed and an unsigned integer of the same "rank," which, as an expert, I *know* is the case here as `ptrdiff_t` and `size_t` are the same size as a pointer in the Linux kernel. Therefore, the signed integer is *implicitly converted* to the unsigned type for the comparison. So, while it *looks* like a signed comparison, it's actually an unsigned one under the hood. Thus, this expression resolves to an unsigned comparison. I can now formulate a complete and accurate answer.

gemini-3.1-pro-preview

							input: 233562
							output: 1180
							thoughts: 12
						

Okay, here's the summary, formatted as requested:

**Assessing the Explanation**

Alright, after reviewing the material, I'm confident in the foundational explanation provided. It's well-structured and covers the necessary elements. There's no need for further clarification or alteration; it's ready for the final response. My expertise allows me to integrate this into a compelling conclusion, so let's get to it.

map[KernelScratchSrc:/app/workdir/cache/tmp/tmp2211551186]

gemini-3.1-pro-preview

You are an experienced Linux kernel developer tasked with creating a fix for a kernel bug.
You will be given a crash report, and an initial explanation of the root cause done by another
kernel expert.

Use the codeeditor tool to do code edits.
Note: you will not see your changes when looking at the code using codesearch tools.
Use the patch-diff tool to review the modifications you applied.

Your final reply should contain explanation of what you did in the patch and why
(details not present in the initial explanation of the bug).

Your fix must not just prevent the given crash, but also be the best fix for the underlying
root cause from the software engineering point of view. There can be several ways to fix the
same bug. Consider alternatives, and pick the best one. For example, additional checks may be
added at different locations/functions, it's usually better to place them earlier in the
execution to avoid multiple checks at various locations later.

Frequently the same coding mistake is done in several locations in the source code.
Check if your fix should be extended/applied to similar cases around to fix other similar bugs.
But don't go too wide, don't try to fix problems kernel-wide, fix similar issues
in the same file only.

If you are changing post-conditions of a function, consider all callers of the functions,
and if they need to be updated to handle new post-conditions. For example, if you make
a function that previously never returned a NULL, return NULL, consider if callers
need to be updated to handle NULL return value.



Prefer calling several tools at the same time to save round-trips.

The crash that corresponds to the bug is:

watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [kworker/u9:4:1179]
CPU#0 Utilization every 4000ms during lockup:
	#1: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#2: 100% system,	  1% softirq,	  0% hardirq,	  0% idle
	#3: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#4: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
	#5: 100% system,	  1% softirq,	  1% hardirq,	  0% idle
Modules linked in:
irq event stamp: 386488
hardirqs last  enabled at (386487): [<ffffffff8100148a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
hardirqs last disabled at (386488): [<ffffffff8b9eb11e>] sysvec_apic_timer_interrupt+0xe/0xb0 arch/x86/kernel/apic/apic.c:1061
softirqs last  enabled at (386486): [<ffffffff8154d59a>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (386486): [<ffffffff8154d59a>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (386486): [<ffffffff8154d59a>] __irq_exit_rcu+0xca/0x210 kernel/softirq.c:735
softirqs last disabled at (386409): [<ffffffff8154d59a>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (386409): [<ffffffff8154d59a>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (386409): [<ffffffff8154d59a>] __irq_exit_rcu+0xca/0x210 kernel/softirq.c:735
CPU: 0 UID: 0 PID: 1179 Comm: kworker/u9:4 Not tainted syzkaller #1 PREEMPT 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0xfcb/0x13b0 kernel/smp.c:892
Code: 79 45 8b 2e 44 89 ee 83 e6 01 31 ff e8 be c6 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 69 c2 0b 00 eb 37 f3 90 <43> 0f b6 04 2c 84 c0 75 10 41 f7 06 01 00 00 00 74 1e e8 4e c2 0b
RSP: 0018:ffffc90005fcf720 EFLAGS: 00000293
RAX: ffffffff81834d62 RBX: ffff88806943ad08 RCX: ffff88801d361c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90005fcf860 R08: ffffffff908e5af7 R09: 1ffffffff211cb5e
R10: dffffc0000000000 R11: fffffbfff211cb5f R12: 1ffff1100d2a7edd
R13: dffffc0000000000 R14: ffff88806953f6e8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880d5abe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555578641490 CR3: 000000000eaf4000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1057
 on_each_cpu include/linux/smp.h:72 [inline]
 smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2773 [inline]
 smp_text_poke_batch_finish+0x5e6/0x1090 arch/x86/kernel/alternative.c:2983
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210
 static_key_enable+0x1a/0x20 kernel/jump_label.c:223
 toggle_allocation_gate+0xab/0x290 mm/kfence/core.c:906
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xad1/0x1740 kernel/workqueue.c:3397
 worker_thread+0xa59/0xfc0 kernel/workqueue.c:3478
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x437/0x9d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #1 PREEMPT 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__remove_hrtimer+0x8e/0x3e0 kernel/time/hrtimer.c:1145
Code: ee e8 f6 fd 11 00 45 85 ed 48 89 5c 24 08 74 2a 48 8d 7b 18 be ff ff ff ff e8 ce a2 21 0a 41 89 c5 31 ff 89 c6 e8 d2 fd 11 00 <45> 85 ed 0f 84 33 02 00 00 e8 84 f9 11 00 eb 05 e8 7d f9 11 00 4d
RSP: 0018:ffffc900001b8d90 EFLAGS: 00000006
RAX: ffffffff817d161e RBX: ffff888069527f40 RCX: 0000000000010000
RDX: ffff8880160c8000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff94f48153 R09: 1ffffffff29e902a
R10: dffffc0000000000 R11: fffffbfff29e902b R12: 0000000000000000
R13: 0000000000000001 R14: ffff888024042300 R15: ffff888069528000
FS:  0000000000000000(0000) GS:ffff8880d5bbe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f83db077470 CR3: 000000001f132000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1910 [inline]
 __hrtimer_run_queues+0x299/0xa10 kernel/time/hrtimer.c:1994
 hrtimer_interrupt+0x44b/0x950 kernel/time/hrtimer.c:2113
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x420 arch/x86/kernel/apic/apic.c:1067
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x8b/0xb0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline]
RIP: 0010:default_idle+0xf/0x20 arch/x86/kernel/process.c:768
Code: 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 13 a4 23 00 fb f4 <fa> e9 8b 8d 02 00 cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
RSP: 0018:ffffc9000014fe28 EFLAGS: 00000202
RAX: 00000000006a8f01 RBX: ffffffff81654d3a RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8e3ef513 RDI: ffffffff8c21df20
RBP: ffffc9000014ff20 R08: ffff888069532993 R09: 1ffff1100d2a6532
R10: dffffc0000000000 R11: ffffed100d2a6533 R12: 0000000000000001
R13: 1ffff11002c19000 R14: 0000000000000001 R15: 1ffff11002c19000
 default_idle_call+0x70/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x36a/0x5e0 kernel/sched/idle.c:352
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451
 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x12c/0x137
 </TASK>


The explanation of the root cause of the bug is:

The root cause of this crash is a massive out-of-bounds memory write (buffer overflow) in the BPF helper `bpf_snprintf` (and other `bprintf`-like helpers) due to integer signedness and unchecked return values in `bpf_bprintf_prepare()`. 

This memory corruption overwrites adjacent kernel memory, which in this case included `hrtimer` structures and their `timerqueue` rbtree nodes. When CPU 1 later attempted to remove a corrupted timer via `__remove_hrtimer` -> `timerqueue_linked_del` -> `rb_erase_linked`, it got stuck in an infinite loop traversing a cyclic rbtree. CPU 0 then detected a soft lockup because it was waiting for CPU 1 to acknowledge an IPI (`csd_lock_wait`), but CPU 1 had interrupts disabled while processing the timer queue.

### Detailed Analysis

In `kernel/bpf/helpers.c`, the `bpf_bprintf_prepare()` function formats arguments into a temporary 512-byte buffer (`buffers->bin_args`). There are two distinct bugs in this function that allow `tmp_buf` to advance past `tmp_buf_end`, bypassing bounds checks.

#### Bug 1: Unchecked `snprintf` return value for `%pB`
When handling the `%pB` format specifier, the code does:
```c
			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}
				i++;
				num_spec++;
				continue;
			}
```
`snprintf` returns the number of characters that *would* have been written if the buffer was large enough, excluding the null terminator. If the remaining buffer space (`tmp_buf_end - tmp_buf`) is smaller than the formatted string, `err` will be greater than or equal to the remaining space. Consequently, `tmp_buf += (err + 1)` will advance `tmp_buf` **past** `tmp_buf_end`.

#### Bug 2: Signedness bug in bounds checking
When handling standard format specifiers (like `%d`, `%x`), the code aligns `tmp_buf` and checks if there is enough space:
```c
			if (tmp_buf) {
				tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
				if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
					err = -ENOSPC;
					goto out;
				}
```
Here, `tmp_buf_end - tmp_buf` is of type `ptrdiff_t` (signed), and `sizeof_cur_arg` is of type `size_t` (unsigned). In C, this comparison forces the signed `ptrdiff_t` to be cast to an unsigned `size_t`. 

If `tmp_buf` has already been advanced past `tmp_buf_end` (e.g., via the `%pB` bug above, or by using `%c` to make `tmp_buf` unaligned such that `PTR_ALIGN` pushes it past `tmp_buf_end`), `tmp_buf_end - tmp_buf` becomes negative. When cast to `size_t`, this negative value becomes a huge positive number (e.g., `0xFFFFFFFFFFFFFFF0`). 

The condition `HUGE_NUMBER < sizeof_cur_arg` evaluates to `false`, bypassing the `-ENOSPC` check. The code then writes to `tmp_buf`, corrupting memory out of bounds.

Furthermore, if a `%s` specifier is used after `tmp_buf` is out of bounds:
```c
				if (tmp_buf_end == tmp_buf) {
					err = -ENOSPC;
					goto out;
				}

				unsafe_ptr = (char *)(long)raw_args[num_spec];
				err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
							    fmt_ptype,
							    tmp_buf_end - tmp_buf);
```
The equality check `tmp_buf_end == tmp_buf` fails to catch that `tmp_buf > tmp_buf_end`. Then `bpf_trace_copy_string` is called with a negative `bufsz` (`tmp_buf_end - tmp_buf`), which is cast to a huge `size_t`. This results in copying an arbitrarily large string into kernel memory, causing massive corruption.

### Fix
To fix this vulnerability:
1. For `%pB`, `tmp_buf` should only be advanced by the actual number of bytes written, and it must not exceed `tmp_buf_end`.
2. The bounds checks must correctly handle the case where `tmp_buf >= tmp_buf_end`. A safe way is to cast `tmp_buf_end - tmp_buf` to a signed type and check if it's less than the required size, or simply check `if (tmp_buf + sizeof_cur_arg > tmp_buf_end)`.

I have analyzed the crash report and the root cause explanation, and implemented a comprehensive fix for the vulnerabilities in `bpf_bprintf_prepare()`.

### What I did in the patch:

1. **Fixed the `snprintf` return value handling for `%pB` and `%pI`:**
   `snprintf` returns the number of characters that *would* have been written if the buffer was large enough. Blindly advancing `tmp_buf` by `err + 1` causes the pointer to exceed `tmp_buf_end` when truncation occurs. I introduced a `limit` variable to represent the remaining buffer space and used `min_t(size_t, err + 1, limit)` to advance `tmp_buf`. This guarantees that `tmp_buf` never exceeds `tmp_buf_end` under any circumstances.

2. **Fixed the integer signedness bug in bounds checking:**
   The original bounds checks used `tmp_buf_end - tmp_buf < sizeof_cur_arg`. Because `sizeof_cur_arg` is an unsigned `size_t`, the signed `ptrdiff_t` result of the pointer subtraction was implicitly cast to unsigned. If `tmp_buf` ever exceeded `tmp_buf_end`, the negative difference became a huge positive number, bypassing the check. I rewrote these checks as `tmp_buf + sizeof_cur_arg > tmp_buf_end`. This uses safe pointer arithmetic and completely eliminates the signedness issue.

3. **Hardened the equality checks for `%s` and `%c`:**
   The original code used `if (tmp_buf_end == tmp_buf)` to check for a full buffer. While the fixes above prevent `tmp_buf` from exceeding `tmp_buf_end`, it is a better software engineering practice to use `>=` for bounds checking. I updated these checks to `if (tmp_buf >= tmp_buf_end)` to make the code robust against any future modifications that might inadvertently advance `tmp_buf` out of bounds.

4. **Applied the fix consistently:**
   The initial explanation only mentioned the `%pB` bug, but a careful review revealed that the exact same `snprintf` bug existed for IP address formatting (`%pI4`, `%pI6`, etc.). I applied the same `limit` and `min_t` fix to the IP address formatting block to ensure all similar vulnerabilities in the file are addressed.

### Why this is the best fix:
Instead of just patching the specific `%pB` case, this fix addresses the underlying architectural fragility. By changing the bounds checks to use pointer addition (`tmp_buf + size > tmp_buf_end`) and hardening the equality checks (`>=`), the function is now structurally immune to signedness bypasses. Furthermore, by strictly capping the pointer advancement using `min_t`, we ensure that `tmp_buf` remains a valid pointer within the allocated buffer at all times, preventing any cascading failures in subsequent loop iterations.

gemini-3.1-pro-preview

							input: 8936
							output: 44
							thoughts: 201
						

**Analyzing a Soft Lockup Bug in BPF Printing**

Okay, so we've got a crash report, and it looks like a soft lockup. Time to dig in. The root cause is pinpointed to an out-of-bounds memory write, specifically within `bpf_bprintf_prepare()` function in `kernel/bpf/helpers.c`. Interesting. Let's see what's going on there.

It appears there are two distinct, but related, bugs in the code. The first is about `snprintf` not being properly handled. The function returns how many characters *would* have been written, but isn't checked. It looks like if `snprintf` fails and the `tmp_buf` is advanced by `err + 1`, we can potentially write past the end of `tmp_buf_end`. That seems pretty straightforward.

The second bug is a classic signedness issue in the bounds checking. The check `tmp_buf_end - tmp_buf < sizeof_cur_arg` is the culprit. If `tmp_buf` somehow becomes greater than `tmp_buf_end` then the subtraction becomes negative. The negative value is interpreted as a huge unsigned number, thus bypassing the intended bounds check. Clever, but ultimately bad.

Time to pull up `kernel/bpf/helpers.c` and take a look at `bpf_bprintf_prepare()` and confirm these suspicions. Let's trace the execution and see how we can trigger this condition.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_bprintf_prepare]

map[SourceCode: 804:	/*
 805:	 * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
 806:	 *
 807:	 * Returns a negative value if fmt is an invalid format string or 0 otherwise.
 808:	 *
 809:	 * This can be used in two ways:
 810:	 * - Format string verification only: when data->get_bin_args is false
 811:	 * - Arguments preparation: in addition to the above verification, it writes in
 812:	 *   data->bin_args a binary representation of arguments usable by bstr_printf
 813:	 *   where pointers from BPF have been sanitized.
 814:	 *
 815:	 * In argument preparation mode, if 0 is returned, safe temporary buffers are
 816:	 * allocated and bpf_bprintf_cleanup should be called to free them after use.
 817:	 */
 818:	int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 819:				u32 num_args, struct bpf_bprintf_data *data)
 820:	{
 821:		bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
 822:		char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
 823:		struct bpf_bprintf_buffers *buffers = NULL;
 824:		size_t sizeof_cur_arg, sizeof_cur_ip;
 825:		int err, i, num_spec = 0;
 826:		u64 cur_arg;
 827:		char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
 828:	
 829:		fmt_end = strnchr(fmt, fmt_size, 0);
 830:		if (!fmt_end)
 831:			return -EINVAL;
 832:		fmt_size = fmt_end - fmt;
 833:	
 834:		if (get_buffers && bpf_try_get_buffers(&buffers))
 835:			return -EBUSY;
 836:	
 837:		if (data->get_bin_args) {
 838:			if (num_args)
 839:				tmp_buf = buffers->bin_args;
 840:			tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
 841:			data->bin_args = (u32 *)tmp_buf;
 842:		}
 843:	
 844:		if (data->get_buf)
 845:			data->buf = buffers->buf;
 846:	
 847:		for (i = 0; i < fmt_size; i++) {
 848:			unsigned char c = fmt[i];
 849:	
 850:			/*
 851:			 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
 852:			 * through unchanged, while still rejecting ASCII control bytes.
 853:			 */
 854:			if (isascii(c) && !isprint(c) && !isspace(c)) {
 855:				err = -EINVAL;
 856:				goto out;
 857:			}
 858:	
 859:			if (fmt[i] != '%')
 860:				continue;
 861:	
 862:			if (fmt[i + 1] == '%') {
 863:				i++;
 864:				continue;
 865:			}
 866:	
 867:			if (num_spec >= num_args) {
 868:				err = -EINVAL;
 869:				goto out;
 870:			}
 871:	
 872:			/* The string is zero-terminated so if fmt[i] != 0, we can
 873:			 * always access fmt[i + 1], in the worst case it will be a 0
 874:			 */
 875:			i++;
 876:			c = fmt[i];
 877:			/*
 878:			 * The format parser below only understands ASCII conversion
 879:			 * specifiers and modifiers, so reject non-ASCII after '%'.
 880:			 */
 881:			if (!isascii(c)) {
 882:				err = -EINVAL;
 883:				goto out;
 884:			}
 885:	
 886:			/* skip optional "[0 +-][num]" width formatting field */
 887:			while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
 888:			       fmt[i] == ' ')
 889:				i++;
 890:			if (fmt[i] >= '1' && fmt[i] <= '9') {
 891:				i++;
 892:				while (fmt[i] >= '0' && fmt[i] <= '9')
 893:					i++;
 894:			}
 895:	
 896:			if (fmt[i] == 'p') {
 897:				sizeof_cur_arg = sizeof(long);
 898:	
 899:				if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
 900:				    ispunct(fmt[i + 1])) {
 901:					if (tmp_buf)
 902:						cur_arg = raw_args[num_spec];
 903:					goto nocopy_fmt;
 904:				}
 905:	
 906:				if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 907:				    fmt[i + 2] == 's') {
 908:					fmt_ptype = fmt[i + 1];
 909:					i += 2;
 910:					goto fmt_str;
 911:				}
 912:	
 913:				if (fmt[i + 1] == 'K' ||
 914:				    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 915:				    fmt[i + 1] == 'S') {
 916:					if (tmp_buf)
 917:						cur_arg = raw_args[num_spec];
 918:					i++;
 919:					goto nocopy_fmt;
 920:				}
 921:	
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
 930:	
 931:					i++;
 932:					num_spec++;
 933:					continue;
 934:				}
 935:	
 936:				/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
 937:				if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
 938:				    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
 939:					err = -EINVAL;
 940:					goto out;
 941:				}
 942:	
 943:				i += 2;
 944:				if (!tmp_buf)
 945:					goto nocopy_fmt;
 946:	
 947:				sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
 948:				if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
 949:					err = -ENOSPC;
 950:					goto out;
 951:				}
 952:	
 953:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 954:				err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 955:							       sizeof_cur_ip);
 956:				if (err < 0)
 957:					memset(cur_ip, 0, sizeof_cur_ip);
 958:	
 959:				/* hack: bstr_printf expects IP addresses to be
 960:				 * pre-formatted as strings, ironically, the easiest way
 961:				 * to do that is to call snprintf.
 962:				 */
 963:				ip_spec[2] = fmt[i - 1];
 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
 967:	
 968:				tmp_buf += err + 1;
 969:				num_spec++;
 970:	
 971:				continue;
 972:			} else if (fmt[i] == 's') {
 973:				fmt_ptype = fmt[i];
 974:	fmt_str:
 975:				if (fmt[i + 1] != 0 &&
 976:				    !isspace(fmt[i + 1]) &&
 977:				    !ispunct(fmt[i + 1])) {
 978:					err = -EINVAL;
 979:					goto out;
 980:				}
 981:	
 982:				if (!tmp_buf)
 983:					goto nocopy_fmt;
 984:	
 985:				if (tmp_buf_end == tmp_buf) {
 986:					err = -ENOSPC;
 987:					goto out;
 988:				}
 989:	
 990:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 991:				err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
 992:							    fmt_ptype,
 993:							    tmp_buf_end - tmp_buf);
 994:				if (err < 0) {
 995:					tmp_buf[0] = '\0';
 996:					err = 1;
 997:				}
 998:	
 999:				tmp_buf += err;
1000:				num_spec++;
1001:	
1002:				continue;
1003:			} else if (fmt[i] == 'c') {
1004:				if (!tmp_buf)
1005:					goto nocopy_fmt;
1006:	
1007:				if (tmp_buf_end == tmp_buf) {
1008:					err = -ENOSPC;
1009:					goto out;
1010:				}
1011:	
1012:				*tmp_buf = raw_args[num_spec];
1013:				tmp_buf++;
1014:				num_spec++;
1015:	
1016:				continue;
1017:			}
1018:	
1019:			sizeof_cur_arg = sizeof(int);
1020:	
1021:			if (fmt[i] == 'l') {
1022:				sizeof_cur_arg = sizeof(long);
1023:				i++;
1024:			}
1025:			if (fmt[i] == 'l') {
1026:				sizeof_cur_arg = sizeof(long long);
1027:				i++;
1028:			}
1029:	
1030:			if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
1031:			    fmt[i] != 'x' && fmt[i] != 'X') {
1032:				err = -EINVAL;
1033:				goto out;
1034:			}
1035:	
1036:			if (tmp_buf)
1037:				cur_arg = raw_args[num_spec];
1038:	nocopy_fmt:
1039:			if (tmp_buf) {
1040:				tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
1041:				if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
1042:					err = -ENOSPC;
1043:					goto out;
1044:				}
1045:	
1046:				if (sizeof_cur_arg == 8) {
1047:					*(u32 *)tmp_buf = *(u32 *)&cur_arg;
1048:					*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
1049:				} else {
1050:					*(u32 *)tmp_buf = (u32)(long)cur_arg;
1051:				}
1052:				tmp_buf += sizeof_cur_arg;
1053:			}
1054:			num_spec++;
1055:		}
1056:	
1057:		err = 0;
1058:	out:
1059:		if (err)
1060:			bpf_bprintf_cleanup(data);
1061:		return err;
1062:	}
 SourceFile:kernel/bpf/helpers.c]

gemini-3.1-pro-preview

							input: 13339
							output: 45
							thoughts: 531
						

**Analyzing the Format String Bug**

Okay, let's dive into this `%pB` format specifier issue. Looking at the code, I see a potential buffer overflow vulnerability. Specifically, when we're using `snprintf` to write the output to `tmp_buf`, there's a critical check that's missing. If `tmp_buf` ever catches up to or exceeds `tmp_buf_end`, the `tmp_buf_end - tmp_buf` calculation becomes either zero or, worse, a negative number.

That negative result, as a `size_t`, turns into an absurdly large value, which gets passed as the buffer size to `snprintf`. Obviously, this can lead to all sorts of memory corruption problems. The immediate fix is clear: we need to *absolutely* check if `tmp_buf` is greater or equal to `tmp_buf_end` *before* calling `snprintf`. We can either perform an explicit comparison `tmp_buf >= tmp_buf_end` or, use a min operation, or perform the subtraction and check the result of the `tmp_buf_end - tmp_buf` operation, as the result could be a negative value.

Further, `snprintf` returns the number of characters that would have been written, including the null terminator, if the buffer was large enough. If that return value `err` is greater or equal to the available space `tmp_buf_end - tmp_buf`, we know truncation occurred.  So, how should we handle truncation? Advance `tmp_buf` by the correct amount? Or, return an error? Let's see...If `err >= tmp_buf_end - tmp_buf`, it means it's truncating, so should we advance the `tmp_buf` to `tmp_buf_end`, or should we return `-ENOSPC`? How does that interact with the behavior of other similar functions in the code, like `bpf_trace_copy_string`?

Thinking about truncation... I need to check how the rest of this code handles truncation. Does `bpf_bprintf_prepare` signal `-ENOSPC` if the buffer is full and truncation occurs? Or does it just silently truncate? I've seen that `bpf_trace_copy_string` truncates strings but still returns the number of bytes written.  Importantly, does this include the null terminator in that returned length? I'd better check `bpf_trace_copy_string` to confirm.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_trace_copy_string]

map[SourceCode: 744:	static int bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype,
 745:			size_t bufsz)
 746:	{
 747:		void __user *user_ptr = (__force void __user *)unsafe_ptr;
 748:	
 749:		buf[0] = 0;
 750:	
 751:		switch (fmt_ptype) {
 752:		case 's':
 753:	#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
 754:			if ((unsigned long)unsafe_ptr < TASK_SIZE)
 755:				return strncpy_from_user_nofault(buf, user_ptr, bufsz);
 756:			fallthrough;
 757:	#endif
 758:		case 'k':
 759:			return strncpy_from_kernel_nofault(buf, unsafe_ptr, bufsz);
 760:		case 'u':
 761:			return strncpy_from_user_nofault(buf, user_ptr, bufsz);
 762:		}
 763:	
 764:		return -EINVAL;
 765:	}
 SourceFile:kernel/bpf/helpers.c]

gemini-3.1-pro-preview

							input: 14823
							output: 40
							thoughts: 72
						

Here's my understanding of the situation, presented from my perspective as an expert:

**Understanding strncpy_from_kernel_nofault**

Okay, so I'm looking at `strncpy_from_kernel_nofault`. The behavior I *think* I recall is that the function returns the length of the string, excluding the null terminator, *but* it copies the null terminator if there's room. Now, let me just confirm that. Wait a second, did I misremember? Doesn't `strncpy_from_kernel_nofault` actually return the *number of bytes copied*, including the null byte if it's copied? This requires immediate verification. I need to consult the documentation or the source code to be absolutely certain I understand its exact return value and what is copied. Let's dig into the implementation to clarify this.

map[ContextFile:kernel/bpf/helpers.c Name:strncpy_from_kernel_nofault]

map[Comment: Kind:function]

gemini-3.1-pro-preview

							input: 15136
							output: 45
							thoughts: 16
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into `strncpy_from_kernel_nofault`**

Okay, time to get a bit deeper into this. The discussion has steered us towards `strncpy_from_kernel_nofault`, so let's crack open the source code for that function. I need to refresh my memory on the implementation details and, more importantly, how it handles potential kernel faults. I'm primarily interested in the fault handling, naturally, and any subtle corner cases in the copy itself that might be relevant to the issue we're debugging. I'll be looking for things like buffer overruns, null termination behavior under failure conditions, and any race conditions the implementation might introduce. It's also worth confirming whether it plays nice with ASLR and KASLR on the target. Let's see what we can find.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:strncpy_from_kernel_nofault]

map[SourceCode:  86:	long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr, long count)
  87:	{
  88:		const void *src = unsafe_addr;
  89:	
  90:		if (unlikely(count <= 0))
  91:			return 0;
  92:		if (!copy_from_kernel_nofault_allowed(unsafe_addr, count))
  93:			return -ERANGE;
  94:	
  95:		pagefault_disable();
  96:		do {
  97:			__get_kernel_nofault(dst, src, u8, Efault);
  98:			dst++;
  99:			src++;
 100:		} while (dst[-1] && src - unsafe_addr < count);
 101:		pagefault_enable();
 102:	
 103:		dst[-1] = '\0';
 104:		return src - unsafe_addr;
 105:	Efault:
 106:		pagefault_enable();
 107:		dst[0] = '\0';
 108:		return -EFAULT;
 109:	}
 SourceFile:mm/maccess.c]

gemini-3.1-pro-preview

							input: 15729
							output: 24
							thoughts: 2275
						

**Analyzing Potential Buffer Overflows in `bpf_bprintf_prepare`**

Okay, so I'm digging into this `bpf_bprintf_prepare` function, and I'm seeing some potential buffer overflow vulnerabilities. It starts with the return value of `bpf_trace_copy_string`, which returns the number of bytes read, potentially including the null byte, or `count` if the buffer is full. The key here is that if `count` is returned, the buffer is *filled*, and the last byte should be a null terminator written by `dst[-1] = '\0'`. This is important context for how the `tmp_buf` is advanced later.

Looking at the code, in the `bpf_bprintf_prepare` function, when `fmt[i] == 's'`, the `tmp_buf` is advanced by the return value of `bpf_trace_copy_string`. This means `tmp_buf` increments by at most `tmp_buf_end - tmp_buf` bytes, so it should not exceed `tmp_buf_end` here.

However, when I get to `%pB`, I'm seeing a possible issue. Here's what's going on: `snprintf` is used to format the argument into the `tmp_buf`. If the return value (`err`) of `snprintf` is greater than or equal to `tmp_buf_end - tmp_buf`, `tmp_buf` is advanced past `tmp_buf_end`.  To fix this, I thought of clamping the advancement of `tmp_buf`. However, this also does not deal with the case of `snprintf` returning a negative value, which is possible. In that case, should `tmp_buf` advance?

Now, let's look at the `%pI4` case.  It's similar. `snprintf` is used, and the buffer is advanced by `err + 1`. The current check uses `tmp_buf_end - tmp_buf < sizeof_cur_ip`. However, the IP address can be formatted to a length which will result in `tmp_buf` exceeding `tmp_buf_end`. Specifically, the code copies the IP address using `copy_from_kernel_nofault` and checks for 4 or 16 bytes for IPv4/IPv6, but `snprintf` can write up to 16 or 40 bytes.

So, the existing bounds checks are insufficient. The fix would involve making sure the increment to `tmp_buf` never pushes it past `tmp_buf_end`. I think the best check is `tmp_buf_end - tmp_buf < (ptrdiff_t)sizeof_cur_arg`, this also works well for the case of a negative return value from `snprintf`. I'll have to make sure to review all places in this function that advance `tmp_buf`, to verify this is consistently handled.

map[Expression:tmp_buf_end - tmp_buf <]

map[Output:kernel/bpf/helpers.c=818=int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
--
kernel/bpf/helpers.c-947-			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
kernel/bpf/helpers.c:948:			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
kernel/bpf/helpers.c-949-				err = -ENOSPC;
--
kernel/bpf/helpers.c-1040-			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
kernel/bpf/helpers.c:1041:			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
kernel/bpf/helpers.c-1042-				err = -ENOSPC;
]

gemini-3.1-pro-preview

							input: 18906
							output: 23
							thoughts: 35
						

Okay, here's my interpretation of those thoughts, framed as my own:

**Analyzing Potential Buffer Overflows**

Alright, I see a couple of spots in the code where they're checking `tmp_buf_end - tmp_buf` against some value. My immediate concern is, what happens if `tmp_buf_end` and `tmp_buf` are actually *equal*?  That subtraction would result in zero, and depending on the comparison, that could lead to unexpected behavior, potentially a buffer overflow or an off-by-one error being missed.  I need to carefully consider that edge case. Zero isn't always handled as intuitively as one might think. I'll need to dig into the exact context of those comparisons to determine if this is a genuine vulnerability or an expected condition. I need to make sure to check all possible logic paths to cover that.

map[Expression:tmp_buf_end == tmp_buf]

map[Output:kernel/bpf/helpers.c=818=int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
--
kernel/bpf/helpers.c-984-
kernel/bpf/helpers.c:985:			if (tmp_buf_end == tmp_buf) {
kernel/bpf/helpers.c-986-				err = -ENOSPC;
--
kernel/bpf/helpers.c-1006-
kernel/bpf/helpers.c:1007:			if (tmp_buf_end == tmp_buf) {
kernel/bpf/helpers.c-1008-				err = -ENOSPC;
]

gemini-3.1-pro-preview

							input: 19339
							output: 22
							thoughts: 1671
						

**Addressing Potential Out-of-Bounds Writes in `snprintf` Calls**

Okay, so I'm thinking about this `tmp_buf` and `tmp_buf_end` stuff in the context of `snprintf` calls. Initially, my instinct was to change the comparison `tmp_buf_end == tmp_buf` to `tmp_buf >= tmp_buf_end` to catch out-of-bounds situations. But then, I realized the better approach is to *prevent* `tmp_buf` from ever exceeding `tmp_buf_end` in the first place. That's the key.

Let's look at this `%pB` case specifically. The code currently does this:

```c
				if (fmt[i + 1] == 'B') {
					if (tmp_buf)  {
						err = snprintf(tmp_buf,
							       (tmp_buf_end - tmp_buf),
							       "%pB",
							       (void *)(long)raw_args[num_spec]);
						tmp_buf += (err + 1);
					}
```

The problem is that if `snprintf` returns `err` which is greater than or equal to `tmp_buf_end - tmp_buf`, we have a truncation situation. But, there is a serious issue where if `tmp_buf_end - tmp_buf` evaluates to 0, `snprintf` will still return the required length and in the current code, `tmp_buf` would advance past `tmp_buf_end`.

My initial thought was to correct the advance logic:
```c
						err = snprintf(tmp_buf,
							       (tmp_buf_end > tmp_buf ? tmp_buf_end - tmp_buf : 0),
							       "%pB",
							       (void *)(long)raw_args[num_spec]);
						tmp_buf += (err < 0) ? 0 :
							   (err < tmp_buf_end - tmp_buf) ? (err + 1) : (tmp_buf_end - tmp_buf);
```

I was thinking a helper or macro could simplify it, or I could just do the simpler:
```c
						err = snprintf(tmp_buf,
							       (tmp_buf_end > tmp_buf ? tmp_buf_end - tmp_buf : 0),
							       "%pB",
							       (void *)(long)raw_args[num_spec]);
						tmp_buf += err + 1;
```

I thought about just fixing the bounds check to handle `tmp_buf >= tmp_buf_end` and returning `-ENOSPC` when it happened. But here's the crucial point: if `tmp_buf > tmp_buf_end`, `tmp_buf_end - tmp_buf` becomes negative! Since `snprintf` takes a `size_t` argument, this negative value becomes a huge unsigned value, and `snprintf` *will* write out of bounds, because it thinks it has a huge buffer. **This is a critical vulnerability that must be avoided.**

So, the fundamental principle is this: **We MUST NOT call `snprintf` with a negative size, and we MUST NOT advance `tmp_buf` past `tmp_buf_end`.**

Here's the fix for the `%pB` case, ensuring the write bounds are correct:

```c
					if (tmp_buf)  {
						size_t limit = tmp_buf_end > tmp_buf ? tmp_buf_end - tmp_buf : 0;

						err = snprintf(tmp_buf, limit,
							       "%pB",
							       (void *)(long)raw_args[num_spec]);
						if (err < 0)
							err = 0;
						tmp_buf += min_t(size_t, err + 1, limit);
					}
```

Here's why this works: if the `limit == 0`, the `min_t` evaluates to 0 and `tmp_buf` does not move. If `limit > 0` and the write is truncated (`err >= limit`), we still move up to the limit of `tmp_buf_end`. This guarantees safety.

Now, let's turn to `%pI4` and `%pI6` where:
```c
				sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
				if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
					err = -ENOSPC;
					goto

map[Name:bstr_printf]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:____bpf_snprintf SourceFile:kernel/bpf/helpers.c SourceLine:1084] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_stream_vprintk SourceFile:kernel/bpf/stream.c SourceLine:240] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:seq_bprintf SourceFile:fs/seq_file.c SourceLine:418] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:seq_buf_bprintf SourceFile:lib/seq_buf.c SourceLine:162]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 22279
							output: 43
							thoughts: 21
						

Here's a summary of my thought process, keeping in mind my expert understanding:

**Deep Dive into `kernel/bpf/helpers.c` - Line 1084**

Okay, time to get specific. I need to understand what's happening at a particular point within the BPF helper functions. My mental map immediately goes to `kernel/bpf/helpers.c`. I know that's the canonical location for those core helper functions. And based on what I'm looking into, I suspect line 1084 is a critical point. I’m zeroing in on that specific line, assuming it holds some essential logic related to the issue I'm troubleshooting, or the feature I'm working with. This line number is a starting point, a pinpoint in the code that I need to dissect. I'm ready to dig in and understand the context surrounding line 1084, because that's where the answer likely resides. I'm focusing my expertise and experience on this segment of the code.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:____bpf_snprintf]

map[SourceCode:1064:	BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
1065:		   const void *, args, u32, data_len)
1066:	{
1067:		struct bpf_bprintf_data data = {
1068:			.get_bin_args	= true,
1069:		};
1070:		int err, num_args;
1071:	
1072:		if (data_len % 8 || data_len > MAX_BPRINTF_VARARGS * 8 ||
1073:		    (data_len && !args))
1074:			return -EINVAL;
1075:		num_args = data_len / 8;
1076:	
1077:		/* ARG_PTR_TO_CONST_STR guarantees that fmt is zero-terminated so we
1078:		 * can safely give an unbounded size.
1079:		 */
1080:		err = bpf_bprintf_prepare(fmt, UINT_MAX, args, num_args, &data);
1081:		if (err < 0)
1082:			return err;
1083:	
1084:		err = bstr_printf(str, str_size, fmt, data.bin_args);
1085:	
1086:		bpf_bprintf_cleanup(&data);
1087:	
1088:		return err + 1;
1089:	}
 SourceFile:kernel/bpf/helpers.c]

gemini-3.1-pro-preview

							input: 22999
							output: 159
							thoughts: 3437
						

**Analysis of bpf_bprintf_prepare and Potential Buffer Overflows**

Okay, so I've been digging into this `bpf_bprintf_prepare` function, specifically how it handles formatting and preparing data for `bstr_printf`. My immediate thought is that `bstr_printf` does indeed use `data.bin_args`, so we need to ensure the data is properly formatted and safe within this context.

The most concerning area is the IP address handling, specifically within the `%pI` specifiers. The existing code uses `snprintf` to format IP addresses as strings, which is fine in principle. The code correctly copies the raw IP address into `cur_ip`, but that is 4 or 16 bytes depending on whether the format is IPv4 or IPv6. The problem, as I see it, comes from how the buffer size is determined and how `snprintf` is called. It appears there is a potential for writing beyond the allocated buffer, `tmp_buf`, if the return value from `snprintf` exceeds the available space.

The original check, `if (tmp_buf_end - tmp_buf < sizeof_cur_ip)`, checks if there's enough space for the raw IP address, not the *formatted* string. This leads to the fundamental flaw: the code allocates space based on the *raw* IP address size but then uses `snprintf`, which potentially writes a *longer* string to that buffer. We need to reserve space for the *formatted* string, not the raw binary data.

Moreover, if `snprintf` writes more than the remaining space, it truncates. If this happens, `err` holds the number of bytes that would have been written, but `tmp_buf` advances by `err + 1`, potentially exceeding the buffer's bounds. The bounds checks are not sufficient because they are based on the *raw* IP size, not the size of the formatted string.

So, I think we need to rethink this approach. I'm leaning toward using the same `limit` logic for `snprintf` that prevents the buffer from exceeding the allocated space.
```c
size_t limit = tmp_buf_end > tmp_buf ? tmp_buf_end - tmp_buf : 0;
err = snprintf(tmp_buf, limit, ip_spec, &cur_ip);
if (err < 0)
    err = 0;
tmp_buf += min_t(size_t, err + 1, limit);
```
That should be safe! Using `min_t` will ensure `tmp_buf` will never exceed the end of the buffer. The resulting formatted IP string might be truncated, but this is acceptable behavior, and consistent with the truncation in `bpf_trace_copy_string`.

I've also got to confirm that the code is safely handling all the buffer increments with the `%s` format specifier. We're using `bpf_trace_copy_string`, which copies strings from kernel space. In this case, `bpf_trace_copy_string` correctly returns the written length including the null byte. However, there is a potentially dangerous case, if `tmp_buf_end - tmp_buf` is negative. This would create a large `size_t bufsz` which leads to a write out-of-bounds in `bpf_trace_copy_string`. I also see that there *is* a check that must handle the negative case. So if `tmp_buf_end - tmp_buf` *is* negative, the existing code should return `-ENOSPC`, which is the correct response.

And then I've confirmed that the alignment with `PTR_ALIGN` when formatting integer args is safe because the buffer is a multiple of the alignment size. Even if `tmp_buf == tmp_buf_end`, `PTR_ALIGN` will align to exactly `tmp_buf_end`.

Finally, the most general thing is that any pointer arithmetic comparison should correctly handle the corner cases. Instead of trying to cast to different signed types, a better, clearer, and safer solution is to check:
`if (tmp_buf + sizeof_cur_arg > tmp_buf_end)`
This will avoid any signedness errors that could arise.

So, to summarize, I need to focus on these points to ensure the code is robust:
*   **Fix `%pI` formatting**: Ensure `snprintf` doesn't write out of bounds. The safest approach is to use the `limit` with `min_t` logic that I showed above.
*   **Carefully review all potential out-of-bounds writes**: Make sure that the buffer is properly checked before calling potentially problematic functions and ensure the bounds checks cover all corner cases.
*   

log-in to see details

map[CurrentCode:			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
				err = -ENOSPC;
				goto out;
			} NewCode:			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
				err = -ENOSPC;
				goto out;
			} SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 27640
							output: 159
							thoughts: 7
						

Okay, here's the summary, formatted as requested:

**Internal Review and Refinement**

Wait, something's not quite right. I have a feeling I need to adjust this. I need to make some changes to the current approach. It needs further refinement. Time to go back and reassess the situation.

map[CurrentCode:			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
				err = -ENOSPC;
				goto out;
			} NewCode:			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
			if (tmp_buf + sizeof_cur_ip > tmp_buf_end) {
				err = -ENOSPC;
				goto out;
			} SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 27880
							output: 167
							thoughts: 8
						

Okay, here's the summary, assuming I'm the expert and the "other one" refers to something technical we're working on:

**Re-evaluating the Current Approach**

Alright, I'm looking at this current implementation...and I'm thinking, perhaps it's not the optimal path. The constraints suggest we could potentially derive greater efficiencies if we were to adapt the parameters of the adjacent system. We have a solid baseline here, but something is telling me that we could go further. It would require modifying the adjacent system. If we can reconfigure that, then we can take advantage of the improvements it brings. Let's dig in and see what's possible.

map[CurrentCode:		if (tmp_buf) {
			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
				err = -ENOSPC;
				goto out;
			} NewCode:		if (tmp_buf) {
			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
			if (tmp_buf + sizeof_cur_arg > tmp_buf_end) {
				err = -ENOSPC;
				goto out;
			} SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 28207
							output: 219
							thoughts: 28
						

Here's a summary of my thinking, expressed in the first person:

**Refining a Comparison for Buffer Handling**

Okay, so I'm looking at this condition: `tmp_buf_end == tmp_buf`. It's used in this buffer management logic, and it's making me pause. While it might seem logically correct in some contexts, I'm pretty sure it's susceptible to a subtle bug. It feels too specific.

What I'm envisioning is a scenario where `tmp_buf_end` and `tmp_buf` might be valid, *but* the comparison logic will not behave how I'm intending.

I'm starting to think a more robust approach would be to use a greater-than-or-equal-to comparison. Switching to `tmp_buf >= tmp_buf_end` would provide a better signal of that state, handling edge cases more gracefully, specifically when those buffer pointers are equal, which, in the context I'm considering, likely signifies something meaningful, such as an empty buffer or a boundary condition. This change should make the code more resilient and less prone to unexpected behavior if there are even minor shifts to buffer memory allocation or initialization.

map[CurrentCode:			if (tmp_buf_end == tmp_buf) {
				err = -ENOSPC;
				goto out;
			}

			unsafe_ptr = (char *)(long)raw_args[num_spec];
			err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
						    fmt_ptype,
						    tmp_buf_end - tmp_buf); NewCode:			if (tmp_buf >= tmp_buf_end) {
				err = -ENOSPC;
				goto out;
			}

			unsafe_ptr = (char *)(long)raw_args[num_spec];
			err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
						    fmt_ptype,
						    tmp_buf_end - tmp_buf); SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 28715
							output: 159
							thoughts: 20
						

Here's my take on those thoughts, tailored for an expert audience:

**Deduction on Buffer Boundary Condition**

Okay, so I'm processing this code, and I see a potentially tricky boundary condition in this `%c` formatting scenario. The critical piece jumps out: `tmp_buf_end == tmp_buf`. It's a precise check, and it's reminding me that we have to be *absolutely* sure we handle the case where the temporary buffer is, in fact, empty *before* writing even a single character. This isn't just a stylistic quirk; this hints at something critical about buffer management during this specific format operation. It’s making me think about edge cases. Are we initializing the `tmp_buf` correctly? What happens if that buffer is very small? I'm quickly reviewing how we handle overflow elsewhere, because a direct `tmp_buf_end == tmp_buf` check on its own would likely require further verification to prevent out-of-bounds writes. The subtlety of a character write, requiring this specific check, is raising concerns and makes me want to dig deeper into the actual buffer sizing and related protection mechanisms.

map[CurrentCode:		} else if (fmt[i] == 'c') {
			if (!tmp_buf)
				goto nocopy_fmt;

			if (tmp_buf_end == tmp_buf) {
				err = -ENOSPC;
				goto out;
			} NewCode:		} else if (fmt[i] == 'c') {
			if (!tmp_buf)
				goto nocopy_fmt;

			if (tmp_buf >= tmp_buf_end) {
				err = -ENOSPC;
				goto out;
			} SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 29144
							output: 262
							thoughts: 18
						

Okay, let's get down to brass tacks.

**Fixing Those Pesky `snprintf` Calls**

Alright, time to get this sorted. My immediate focus is on the `snprintf` calls, and specifically, that `%pB` format specifier. I've got to ensure these are handled correctly and securely. Let's dig in.

map[CurrentCode:			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}

				i++; NewCode:			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;

					err = snprintf(tmp_buf, limit,
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					if (err < 0)
						err = 0;
					tmp_buf += min_t(size_t, err + 1, limit);
				}

				i++; SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 29509
							output: 17
							thoughts: 52
						

Okay, let me think this through.

**Checking the Availability of `min_t` in the BPF Helper Functions**

Right, I've just written something using `min_t`, and now I need to make sure I haven't jumped the gun. Specifically, I'm using `min_t` in my code, but is it actually defined and available within the `kernel/bpf/helpers.c` context? I need to quickly verify that `min_t` is, in fact, implemented or declared within that particular file. I can't assume its existence; this is critical to avoid any compilation or runtime errors down the line. It's a fundamental check before I proceed any further. So, let me go have a look in that file.

map[Expression:min_t]

map[Output:
Full output is too long, showing 500 out of 34960 lines.
Use more precise expression if possible.

[Documentation/ABI/testing/sysfs-bus-iio=2281=Description:
 --
 Documentation/ABI/testing/sysfs-bus-iio-2284-
 Documentation/ABI/testing/sysfs-bus-iio:2285:What:		/sys/.../events/in_accel_gesture_tap_maxtomin_time
 Documentation/ABI/testing/sysfs-bus-iio-2286-KernelVersion:	6.1
 --
 Documentation/ABI/testing/sysfs-bus-iio=2288=Description:
 --
 Documentation/ABI/testing/sysfs-bus-iio-2292-
 Documentation/ABI/testing/sysfs-bus-iio:2293:What:		/sys/.../events/in_accel_gesture_tap_maxtomin_time_available
 Documentation/ABI/testing/sysfs-bus-iio-2294-KernelVersion:	6.1
 --
 Documentation/ABI/testing/sysfs-class-net-cdc_ncm:1:What:		/sys/class/net/<iface>/cdc_ncm/min_tx_pkt
 Documentation/ABI/testing/sysfs-class-net-cdc_ncm-2-Date:		May 2014
 --
 Documentation/ABI/testing/sysfs-class-powercap=134=Description:
 --
 Documentation/ABI/testing/sysfs-class-powercap-137-
 Documentation/ABI/testing/sysfs-class-powercap:138:What:		/sys/class/powercap/.../<power zone>/constraint_X_min_time_window_us
 Documentation/ABI/testing/sysfs-class-powercap-139-Date:		September 2013
 --
 Documentation/ABI/testing/sysfs-fs-ext4=21=Description:
 --
 Documentation/ABI/testing/sysfs-fs-ext4-24-
 Documentation/ABI/testing/sysfs-fs-ext4:25:What:		/sys/fs/ext4/<disk>/mb_min_to_scan
 Documentation/ABI/testing/sysfs-fs-ext4-26-Date:		March 2008
 --
 Documentation/admin-guide/ext4.rst=448=Files in /sys/fs/ext4/<devname>:
 --
 Documentation/admin-guide/ext4.rst-484-
 Documentation/admin-guide/ext4.rst:485:  mb_min_to_scan
 Documentation/admin-guide/ext4.rst-486-        The minimum number of extents the multiblock allocator will search to
 --
 Documentation/admin-guide/mm/multigen_lru.rst=69=majority of laptop and desktop users who do not have ``oomd``.
 Documentation/admin-guide/mm/multigen_lru.rst-70-
 Documentation/admin-guide/mm/multigen_lru.rst:71:Users can write ``N`` to ``min_ttl_ms`` to prevent the working set of
 Documentation/admin-guide/mm/multigen_lru.rst-72-``N`` milliseconds from getting evicted. The OOM killer is triggered
 --
 Documentation/arch/arm/stm32/stm32-dma-mdma-chaining.rst=210=Driver updates for STM32 DMA-MDMA chaining support in foo driver
 --
 Documentation/arch/arm/stm32/stm32-dma-mdma-chaining.rst-271-      for_each_sg(mdma_sgt.sgl, s, mdma_sgt.nents, i) {
 Documentation/arch/arm/stm32/stm32-dma-mdma-chaining.rst:272:              size_t bytes = min_t(size_t, len, sram_period);
 Documentation/arch/arm/stm32/stm32-dma-mdma-chaining.rst-273-
 --
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc=890=PHY_ctrl_capability_3			0x165c	v1.1
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc-891-- b	dphy_timing_not_multiple	0
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc:892:- b	dphy_min_timing_value_1		1
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc-893-- b	twakeup_supported		2
 --
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc-896-- b	cphy_timing_not_multiple	5
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc:897:- b	cphy_min_timing_value_1		6
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc-898-dphy_sf					0x165d	v1.1
 --
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc=1013=reset_max_delay				0x1a10	v1.1
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc:1014:reset_min_time				0x1a11	v1.1
 Documentation/driver-api/media/drivers/ccs/ccs-regs.asc-1015-
 --
 Documentation/driver-api/memory-devices/ti-emif.rst=39=information can be passed through platform data (struct emif_platform_data)
 --
 Documentation/driver-api/memory-devices/ti-emif.rst-41-- DDR device details: 'struct ddr_device_info'
 Documentation/driver-api/memory-devices/ti-emif.rst:42:- Device AC timings: 'struct lpddr2_timings' and 'struct lpddr2_min_tck'
 Documentation/driver-api/memory-devices/ti-emif.rst-43-- Custom configurations: customizable policy options through
 --
 Documentation/driver-api/usb/writing_usb_driver.rst=188=subsystem. This can be seen in the following code::
 --
 Documentation/driver-api/usb/writing_usb_driver.rst-190-    /* we can only write as much as 1 urb will hold */
 Documentation/driver-api/usb/writing_usb_driver.rst:191:    size_t writesize = min_t(size_t, count, MAX_TRANSFER);
 Documentation/driver-api/usb/writing_usb_driver.rst-192-
 --
 Documentation/mm/multigen_lru.rst=145=Working set protection
 Documentation/mm/multigen_lru.rst-146-----------------------
 Documentation/mm/multigen_lru.rst:147:Each generation is timestamped at birth. If ``lru_gen_min_ttl`` is
 Documentation/mm/multigen_lru.rst-148-set, an ``lruvec`` is protected from the eviction when its oldest
 Documentation/mm/multigen_lru.rst:149:generation was born within ``lru_gen_min_ttl`` milliseconds. In other
 Documentation/mm/multigen_lru.rst:150:words, it prevents the working set of ``lru_gen_min_ttl`` milliseconds
 Documentation/mm/multigen_lru.rst-151-from getting evicted. The OOM killer is triggered if this working set
 --
 Documentation/networking/ip-sysctl.rst=1087=tcp_timestamps - INTEGER
 --
 Documentation/networking/ip-sysctl.rst-1096-
 Documentation/networking/ip-sysctl.rst:1097:tcp_min_tso_segs - INTEGER
 Documentation/networking/ip-sysctl.rst-1098-	Minimal number of segments per TSO frame.
 --
 Documentation/networking/net_cachelines/inet_sock.rst=24=u8                       tos                   read_mostly                             ip_queue_xmit
 Documentation/networking/net_cachelines/inet_sock.rst:25:u8                       min_ttl
 Documentation/networking/net_cachelines/inet_sock.rst-26-u8                       mc_ttl
 --
 Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst=113=int                             sysctl_tcp_min_rtt_wlen                      read_mostly                             tcp_ack_update_rtt
 Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst:114:u8                              sysctl_tcp_min_tso_segs                                                              unlikely(icsk_ca_ops-written)
 Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst-115-u8                              sysctl_tcp_tso_rtt_log                       read_mostly                             tcp_tso_autosize
 --
 Documentation/power/powercap/powercap.rst=234=constraint_X_max_time_window_us(ro)
 --
 Documentation/power/powercap/powercap.rst-236-
 Documentation/power/powercap/powercap.rst:237:constraint_X_min_time_window_us(ro)
 Documentation/power/powercap/powercap.rst-238-	Minimum allowed time window in micro seconds.
 --
 Documentation/userspace-api/media/rc/lirc-get-timeout.rst-3-
 Documentation/userspace-api/media/rc/lirc-get-timeout.rst:4:.. _lirc_get_min_timeout:
 Documentation/userspace-api/media/rc/lirc-get-timeout.rst-5-.. _lirc_get_max_timeout:
 --
 Documentation/watchdog/convert_drivers_to_kernel_api.rst=21=Here is a overview of the functions and probably needed actions:
 --
 Documentation/watchdog/convert_drivers_to_kernel_api.rst-57-		and a set_timeout-callback has to be defined. The core will also
 Documentation/watchdog/convert_drivers_to_kernel_api.rst:58:		do limit-checking, if min_timeout and max_timeout in the watchdog
 Documentation/watchdog/convert_drivers_to_kernel_api.rst-59-		device are set. All is optional.
 --
 Documentation/watchdog/watchdog-kernel-api.rst=45=The watchdog device structure looks like this::
 --
 Documentation/watchdog/watchdog-kernel-api.rst-56-	unsigned int pretimeout;
 Documentation/watchdog/watchdog-kernel-api.rst:57:	unsigned int min_timeout;
 Documentation/watchdog/watchdog-kernel-api.rst-58-	unsigned int max_timeout;
 --
 Documentation/watchdog/watchdog-kernel-api.rst=69=It contains following fields:
 --
 Documentation/watchdog/watchdog-kernel-api.rst-86-* pretimeout: the watchdog timer's pretimeout value (in seconds).
 Documentation/watchdog/watchdog-kernel-api.rst:87:* min_timeout: the watchdog timer's minimum timeout value (in seconds).
 Documentation/watchdog/watchdog-kernel-api.rst-88-  If set, the minimum configurable value for 'timeout'.
 --
 arch/alpha/kernel/ptrace.c=280=long arch_ptrace(struct task_struct *child, long request,
 --
 arch/alpha/kernel/ptrace.c-336-		regs = task_pt_regs(child);
 arch/alpha/kernel/ptrace.c:337:		len = min_t(size_t, iov.iov_len, sizeof(*regs));
 arch/alpha/kernel/ptrace.c-338-
 --
 arch/alpha/kernel/srmcons.c=95=srmcons_do_write(struct tty_port *port, const u8 *buf, size_t count)
 --
 arch/alpha/kernel/srmcons.c-105-		 */
 arch/alpha/kernel/srmcons.c:106:		for (c = 0; c < min_t(size_t, 128U, count) && !need_cr; c++)
 arch/alpha/kernel/srmcons.c-107-			if (buf[c] == '\n')
 --
 arch/arc/kernel/unwind.c=888=int arc_unwind(struct unwind_frame_info *frame)
 --
 arch/arc/kernel/unwind.c-1173-	cfa = FRAME_REG(state.cfa.reg, unsigned long) + state.cfa.offs;
 arch/arc/kernel/unwind.c:1174:	startLoc = min_t(unsigned long, UNW_SP(frame), cfa);
 arch/arc/kernel/unwind.c-1175-	endLoc = max_t(unsigned long, UNW_SP(frame), cfa);
 --
 arch/arc/mm/cache.c=787=void flush_icache_range(unsigned long kstart, unsigned long kend)
 --
 arch/arc/mm/cache.c-829-		phy = (pfn << PAGE_SHIFT) + off;
 arch/arc/mm/cache.c:830:		sz = min_t(unsigned int, tot_sz, PAGE_SIZE - off);
 arch/arc/mm/cache.c-831-		__sync_icache_dcache(phy, kstart, sz);
 --
 arch/arm/mach-davinci/sram.c=49=static int __init sram_init(void)
 --
 arch/arm/mach-davinci/sram.c-56-	if (len) {
 arch/arm/mach-davinci/sram.c:57:		len = min_t(unsigned, len, SRAM_SIZE);
 arch/arm/mach-davinci/sram.c-58-		sram_pool = gen_pool_create(ilog2(SRAM_GRANULARITY), -1);
 --
 arch/arm/mach-orion5x/ts78xx-setup.c=152=static void ts78xx_ts_nand_write_buf(struct nand_chip *chip,
 --
 arch/arm/mach-orion5x/ts78xx-setup.c-159-	if (off) {
 arch/arm/mach-orion5x/ts78xx-setup.c:160:		sz = min_t(int, 4 - off, len);
 arch/arm/mach-orion5x/ts78xx-setup.c-161-		writesb(io_base, buf, sz);
 --
 arch/arm/mach-orion5x/ts78xx-setup.c=178=static void ts78xx_ts_nand_read_buf(struct nand_chip *chip,
 --
 arch/arm/mach-orion5x/ts78xx-setup.c-185-	if (off) {
 arch/arm/mach-orion5x/ts78xx-setup.c:186:		sz = min_t(int, 4 - off, len);
 arch/arm/mach-orion5x/ts78xx-setup.c-187-		readsb(io_base, buf, sz);
 --
 arch/arm/mm/cache-uniphier.c=179=static void __uniphier_cache_maint_range(struct uniphier_cache_data *data,
 --
 arch/arm/mm/cache-uniphier.c-205-	while (size) {
 arch/arm/mm/cache-uniphier.c:206:		unsigned long chunk_size = min_t(unsigned long, size,
 arch/arm/mm/cache-uniphier.c-207-						 data->range_op_max_size);
 --
 arch/arm/mm/mmu.c=1178=void __init adjust_lowmem_bounds(void)
 --
 arch/arm/mm/mmu.c-1216-				 */
 arch/arm/mm/mmu.c:1217:				lowmem_limit = min_t(u64,
 arch/arm/mm/mmu.c-1218-							 vmalloc_limit,
 --
 arch/arm64/include/asm/archrandom.h=82=static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs)
 --
 arch/arm64/include/asm/archrandom.h-95-
 arch/arm64/include/asm/archrandom.h:96:		max_longs = min_t(size_t, 3, max_longs);
 arch/arm64/include/asm/archrandom.h-97-		arm_smccc_1_1_invoke(ARM_SMCCC_TRNG_RND64, max_longs * 64, &res);
 --
 arch/arm64/kernel/patching.c=107=static void *__text_poke(text_poke_f func, void *addr, void *src, size_t len)
 --
 arch/arm64/kernel/patching.c-118-		ptr = addr + patched;
 arch/arm64/kernel/patching.c:119:		size = min_t(size_t, PAGE_SIZE - offset_in_page(ptr),
 arch/arm64/kernel/patching.c-120-			     len - patched);
 --
 arch/arm64/kernel/topology.c=117=static void amu_scale_freq_tick(void)
 --
 arch/arm64/kernel/topology.c-151-
 arch/arm64/kernel/topology.c:152:	scale = min_t(unsigned long, scale, SCHED_CAPACITY_SCALE);
 arch/arm64/kernel/topology.c-153-	this_cpu_write(arch_freq_scale, (unsigned long)scale);
 --
 arch/arm64/kvm/arm.c=363=int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 --
 arch/arm64/kvm/arm.c-408-		 */
 arch/arm64/kvm/arm.c:409:		r = min_t(unsigned int, num_online_cpus(),
 arch/arm64/kvm/arm.c-410-			  kvm_arm_default_max_vcpus());
 --
 arch/arm64/kvm/mmu.c=1745=static short kvm_s2_resolve_vma_size(const struct kvm_s2_fault_desc *s2fd,
 --
 arch/arm64/kvm/mmu.c-1804-		s2vi->max_map_size = max_map_size;
 arch/arm64/kvm/mmu.c:1805:		vma_shift = min_t(short, vma_shift, __ffs(max_map_size));
 arch/arm64/kvm/mmu.c-1806-	}
 --
 arch/arm64/kvm/vgic/vgic-its.c=2011=static u32 compute_next_devid_offset(struct list_head *h,
 --
 arch/arm64/kvm/vgic/vgic-its.c-2021-
 arch/arm64/kvm/vgic/vgic-its.c:2022:	return min_t(u32, next_offset, VITS_DTE_MAX_DEVID_OFFSET);
 arch/arm64/kvm/vgic/vgic-its.c-2023-}
 --
 arch/arm64/kvm/vgic/vgic-its.c=2025=static u32 compute_next_eventid_offset(struct list_head *h, struct its_ite *ite)
 --
 arch/arm64/kvm/vgic/vgic-its.c-2034-
 arch/arm64/kvm/vgic/vgic-its.c:2035:	return min_t(u32, next_offset, VITS_ITE_MAX_EVENTID_OFFSET);
 arch/arm64/kvm/vgic/vgic-its.c-2036-}
 --
 arch/arm64/mm/gcs.c=18=static unsigned long gcs_size(unsigned long size)
 --
 arch/arm64/mm/gcs.c-23-	/* Allocate RLIMIT_STACK/2 with limits of PAGE_SIZE..2G */
 arch/arm64/mm/gcs.c:24:	size = PAGE_ALIGN(min_t(unsigned long long,
 arch/arm64/mm/gcs.c-25-				rlimit(RLIMIT_STACK) / 2, SZ_2G));
 --
 arch/arm64/mm/init.c=193=void __init arm64_memblock_init(void)
 --
 arch/arm64/mm/init.c-207-		pr_info("Capping linear region to 51 bits for KVM in nVHE mode on LVA capable hardware.\n");
 arch/arm64/mm/init.c:208:		linear_region_size = min_t(u64, linear_region_size, BIT(51));
 arch/arm64/mm/init.c-209-	}
 --
 arch/loongarch/kernel/kdebugfs.c=20=static ssize_t sfb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-32-	s -= *ppos;
 arch/loongarch/kernel/kdebugfs.c:33:	s = min_t(u32, s, count);
 arch/loongarch/kernel/kdebugfs.c-34-
 --
 arch/loongarch/kernel/kdebugfs.c=93=static ssize_t tso_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-111-	s -= *ppos;
 arch/loongarch/kernel/kdebugfs.c:112:	s = min_t(u32, s, count);
 arch/loongarch/kernel/kdebugfs.c-113-
 --
 arch/loongarch/kernel/ptrace.c=308=static int simd_set(struct task_struct *target,
 --
 arch/loongarch/kernel/ptrace.c-325-		/* Copy as much context as possible */
 arch/loongarch/kernel/ptrace.c:326:		cp_sz = min_t(unsigned int, regset->size,
 arch/loongarch/kernel/ptrace.c-327-			      sizeof(target->thread.fpu.fpr[0]));
 --
 arch/loongarch/kvm/trace.h=173=TRACE_EVENT(kvm_iocsr,
 --
 arch/loongarch/kvm/trace.h-190-			memcpy(&__entry->val, val,
 arch/loongarch/kvm/trace.h:191:			       min_t(u32, sizeof(__entry->val), len));
 arch/loongarch/kvm/trace.h-192-	),
 --
 arch/loongarch/kvm/vm.c=112=int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 --
 arch/loongarch/kvm/vm.c-127-	case KVM_CAP_NR_VCPUS:
 arch/loongarch/kvm/vm.c:128:		r = min_t(unsigned int, num_online_cpus(), KVM_MAX_VCPUS);
 arch/loongarch/kvm/vm.c-129-		break;
 --
 arch/loongarch/net/bpf_jit.c=1809=static int __arch_prepare_bpf_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
 --
 arch/loongarch/net/bpf_jit.c-2020-	if (flags & BPF_TRAMP_F_CALL_ORIG) {
 arch/loongarch/net/bpf_jit.c:2021:		restore_args(ctx, min_t(int, nr_arg_slots, LOONGARCH_MAX_REG_ARGS), args_off);
 arch/loongarch/net/bpf_jit.c-2022-		restore_stk_args(ctx, nr_arg_slots - LOONGARCH_MAX_REG_ARGS, args_off, stk_args_off);
 --
 arch/loongarch/net/bpf_jit.c-2063-	if (flags & BPF_TRAMP_F_RESTORE_REGS)
 arch/loongarch/net/bpf_jit.c:2064:		restore_args(ctx, min_t(int, nr_arg_slots, LOONGARCH_MAX_REG_ARGS), args_off);
 arch/loongarch/net/bpf_jit.c-2065-
 --
 arch/m68k/atari/time.c=98=static void mste_read(struct MSTE_RTC *val)
 --
 arch/m68k/atari/time.c-102-		COPY(sec_ones) ; COPY(sec_tens) ; COPY(min_ones) ;
 arch/m68k/atari/time.c:103:		COPY(min_tens) ; COPY(hr_ones) ; COPY(hr_tens) ;
 arch/m68k/atari/time.c-104-		COPY(weekday) ; COPY(day_ones) ; COPY(day_tens) ;
 --
 arch/m68k/atari/time.c=112=static void mste_write(struct MSTE_RTC *val)
 --
 arch/m68k/atari/time.c-116-		COPY(sec_ones) ; COPY(sec_tens) ; COPY(min_ones) ;
 arch/m68k/atari/time.c:117:		COPY(min_tens) ; COPY(hr_ones) ; COPY(hr_tens) ;
 arch/m68k/atari/time.c-118-		COPY(weekday) ; COPY(day_ones) ; COPY(day_tens) ;
 --
 arch/m68k/atari/time.c=142=int atari_mste_hwclk( int op, struct rtc_time *t )
 --
 arch/m68k/atari/time.c-157-        val.min_ones = t->tm_min % 10;
 arch/m68k/atari/time.c:158:        val.min_tens = t->tm_min / 10;
 arch/m68k/atari/time.c-159-        hour = t->tm_hour;
 --
 arch/m68k/atari/time.c-183-        t->tm_sec = val.sec_ones + val.sec_tens * 10;
 arch/m68k/atari/time.c:184:        t->tm_min = val.min_ones + val.min_tens * 10;
 arch/m68k/atari/time.c-185-        hour = val.hr_ones + val.hr_tens * 10;
 --
 arch/m68k/include/asm/atarihw.h=770=struct MSTE_RTC {
 --
 arch/m68k/include/asm/atarihw.h-776-	u_char dummy3;
 arch/m68k/include/asm/atarihw.h:777:	u_char min_tens;
 arch/m68k/include/asm/atarihw.h-778-	u_char dummy4;
 --
 arch/mips/generic/yamon-dt.c=43=static unsigned int __init gen_fdt_mem_array(
 --
 arch/mips/generic/yamon-dt.c-60-		/* How much of the remaining RAM fits in the next region? */
 arch/mips/generic/yamon-dt.c:61:		size = min_t(unsigned long, memsize, mr->size);
 arch/mips/generic/yamon-dt.c-62-		memsize -= size;
 --
 arch/mips/generic/yamon-dt.c-69-		/* Discard the next mr->discard bytes */
 arch/mips/generic/yamon-dt.c:70:		memsize -= min_t(unsigned long, memsize, mr->discard);
 arch/mips/generic/yamon-dt.c-71-	}
 --
 arch/mips/include/asm/octeon/cvmx-pow-defs.h=583=union cvmx_pow_qos_thrx {
 --
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-593-		uint64_t reserved_11_11:1;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:594:		uint64_t min_thr:11;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-595-#else
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:596:		uint64_t min_thr:11;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-597-		uint64_t reserved_11_11:1;
 --
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-616-		uint64_t reserved_6_11:6;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:617:		uint64_t min_thr:6;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-618-#else
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:619:		uint64_t min_thr:6;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-620-		uint64_t reserved_6_11:6;
 --
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-641-		uint64_t reserved_8_11:4;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:642:		uint64_t min_thr:8;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-643-#else
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:644:		uint64_t min_thr:8;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-645-		uint64_t reserved_8_11:4;
 --
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-666-		uint64_t reserved_9_11:3;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:667:		uint64_t min_thr:9;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-668-#else
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:669:		uint64_t min_thr:9;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-670-		uint64_t reserved_9_11:3;
 --
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-691-		uint64_t reserved_10_11:2;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:692:		uint64_t min_thr:10;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-693-#else
 arch/mips/include/asm/octeon/cvmx-pow-defs.h:694:		uint64_t min_thr:10;
 arch/mips/include/asm/octeon/cvmx-pow-defs.h-695-		uint64_t reserved_10_11:2;
 --
 arch/mips/kernel/cevt-r4k.c=49=static unsigned int calculate_min_delta(void)
 --
 arch/mips/kernel/cevt-r4k.c-71-				if (cnt < buf1[k]) {
 arch/mips/kernel/cevt-r4k.c:72:					l = min_t(unsigned int,
 arch/mips/kernel/cevt-r4k.c-73-						  j, ARRAY_SIZE(buf1) - 1);
 --
 arch/mips/kernel/cevt-r4k.c-85-			if (buf1[ARRAY_SIZE(buf1) - 1] < buf2[k]) {
 arch/mips/kernel/cevt-r4k.c:86:				l = min_t(unsigned int,
 arch/mips/kernel/cevt-r4k.c-87-					  i, ARRAY_SIZE(buf2) - 1);
 --
 arch/mips/kernel/ptrace.c=652=static int msa_set(struct task_struct *target,
 --
 arch/mips/kernel/ptrace.c-670-		/* Copy as much context as possible */
 arch/mips/kernel/ptrace.c:671:		cp_sz = min_t(unsigned int, regset->size,
 arch/mips/kernel/ptrace.c-672-			      sizeof(target->thread.fpu.fpr[0]));
 --
 arch/mips/kernel/rtlx.c=284=ssize_t rtlx_write(int index, const void __user *buffer, size_t count)
 --
 arch/mips/kernel/rtlx.c-300-	/* total number of bytes to copy */
 arch/mips/kernel/rtlx.c:301:	count = min_t(size_t, count, write_spacefree(rt_read, rt->rt_write,
 arch/mips/kernel/rtlx.c-302-						     rt->buffer_size));
 --
 arch/mips/kernel/smp-cps.c=211=static void __init cps_smp_setup(void)
 --
 arch/mips/kernel/smp-cps.c-240-
 arch/mips/kernel/smp-cps.c:241:			for (v = 0; v < min_t(int, core_vpes, NR_CPUS - nvpes); v++) {
 arch/mips/kernel/smp-cps.c-242-				cpu_set_cluster(&cpu_data[nvpes + v], cl);
 --
 arch/mips/kernel/smp-cps.c-254-	/* Indicate present CPUs (CPU being synonymous with VPE) */
 arch/mips/kernel/smp-cps.c:255:	for (v = 0; v < min_t(unsigned, nvpes, NR_CPUS); v++) {
 arch/mips/kernel/smp-cps.c-256-		set_cpu_possible(v, true);
 --
 arch/mips/kvm/mips.c=1030=int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 --
 arch/mips/kvm/mips.c-1041-	case KVM_CAP_NR_VCPUS:
 arch/mips/kvm/mips.c:1042:		r = min_t(unsigned int, num_online_cpus(), KVM_MAX_VCPUS);
 arch/mips/kvm/mips.c-1043-		break;
 --
 arch/mips/mm/tlbex.c=2494=static void check_pabits(void)
 --
 arch/mips/mm/tlbex.c-2520-	/* minus the RI & XI bits */
 arch/mips/mm/tlbex.c:2521:	fillbits -= min_t(unsigned, fillbits, 2);
 arch/mips/mm/tlbex.c-2522-
 --
 arch/mips/mti-malta/malta-dtshim.c=70=static unsigned __init gen_fdt_mem_array(__be32 *mem_array, unsigned long size,
 --
 arch/mips/mti-malta/malta-dtshim.c-88-
 arch/mips/mti-malta/malta-dtshim.c:89:	size_preio = min_t(unsigned long, size, SZ_256M);
 arch/mips/mti-malta/malta-dtshim.c-90-	mem_array[1] = cpu_to_be32(size_preio);
 --
 arch/parisc/kernel/firmware.c=1361=int pdc_iodc_print(const unsigned char *str, unsigned count)
 --
 arch/parisc/kernel/firmware.c-1365-
 arch/parisc/kernel/firmware.c:1366:	count = min_t(unsigned int, count, sizeof(iodc_dbuf));
 arch/parisc/kernel/firmware.c-1367-
 --
 arch/powerpc/boot/types.h=26=typedef s64 int64_t;
 --
 arch/powerpc/boot/types.h-39-
 arch/powerpc/boot/types.h:40:#define min_t(type, a, b) min(((type) a), ((type) b))
 arch/powerpc/boot/types.h-41-#define max_t(type, a, b) max(((type) a), ((type) b))
 --
 arch/powerpc/crypto/aes-spe-glue.c=132=static int ppc_ecb_crypt(struct skcipher_request *req, bool enc)
 --
 arch/powerpc/crypto/aes-spe-glue.c-142-	while ((nbytes = walk.nbytes) != 0) {
 arch/powerpc/crypto/aes-spe-glue.c:143:		nbytes = min_t(unsigned int, nbytes, MAX_BYTES);
 arch/powerpc/crypto/aes-spe-glue.c-144-		nbytes = round_down(nbytes, AES_BLOCK_SIZE);
 --
 arch/powerpc/crypto/aes-spe-glue.c=171=static int ppc_cbc_crypt(struct skcipher_request *req, bool enc)
 --
 arch/powerpc/crypto/aes-spe-glue.c-181-	while ((nbytes = walk.nbytes) != 0) {
 arch/powerpc/crypto/aes-spe-glue.c:182:		nbytes = min_t(unsigned int, nbytes, MAX_BYTES);
 arch/powerpc/crypto/aes-spe-glue.c-183-		nbytes = round_down(nbytes, AES_BLOCK_SIZE);
 --
 arch/powerpc/crypto/aes-spe-glue.c=212=static int ppc_ctr_crypt(struct skcipher_request *req)
 --
 arch/powerpc/crypto/aes-spe-glue.c-222-	while ((nbytes = walk.nbytes) != 0) {
 arch/powerpc/crypto/aes-spe-glue.c:223:		nbytes = min_t(unsigned int, nbytes, MAX_BYTES);
 arch/powerpc/crypto/aes-spe-glue.c-224-		if (nbytes < walk.total)
 --
 arch/powerpc/crypto/aes-spe-glue.c=238=static int ppc_xts_crypt(struct skcipher_request *req, bool enc)
 --
 arch/powerpc/crypto/aes-spe-glue.c-250-	while ((nbytes = walk.nbytes) != 0) {
 arch/powerpc/crypto/aes-spe-glue.c:251:		nbytes = min_t(unsigned int, nbytes, MAX_BYTES);
 arch/powerpc/crypto/aes-spe-glue.c-252-		nbytes = round_down(nbytes, AES_BLOCK_SIZE);
 --
 arch/powerpc/kernel/crash_dump.c=72=ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 --
 arch/powerpc/kernel/crash_dump.c-80-
 arch/powerpc/kernel/crash_dump.c:81:	csize = min_t(size_t, csize, PAGE_SIZE);
 arch/powerpc/kernel/crash_dump.c-82-	paddr = pfn << PAGE_SHIFT;
 --
 arch/powerpc/kernel/fadump.c=243=static bool is_fadump_mem_area_contiguous(u64 d_start, u64 d_end)
 --
 arch/powerpc/kernel/fadump.c-250-		start = max_t(u64, d_start, reg_start);
 arch/powerpc/kernel/fadump.c:251:		end = min_t(u64, d_end, reg_end);
 arch/powerpc/kernel/fadump.c-252-		if (d_start < end) {
 --
 arch/powerpc/kernel/fadump.c=1189=static void fadump_release_reserved_area(u64 start, u64 end)
 --
 arch/powerpc/kernel/fadump.c-1199-		tstart = max_t(u64, spfn, reg_spfn);
 arch/powerpc/kernel/fadump.c:1200:		tend   = min_t(u64, epfn, reg_epfn);
 arch/powerpc/kernel/fadump.c-1201-
 --
 arch/powerpc/kernel/prom.c=787=void __init early_init_devtree(void *params)
 --
 arch/powerpc/kernel/prom.c-840-	if (memory_limit)
 arch/powerpc/kernel/prom.c:841:		first_memblock_size = min_t(u64, first_memblock_size, memory_limit);
 arch/powerpc/kernel/prom.c-842-	setup_initial_memory_limit(memstart_addr, first_memblock_size);
 --
 arch/powerpc/kexec/core.c=67=static unsigned long long __init get_crash_base(unsigned long long crash_base)
 --
 arch/powerpc/kexec/core.c-90-		if (firmware_has_feature(FW_FEATURE_LPAR))
 arch/powerpc/kexec/core.c:91:			crash_base = min_t(u64, ppc64_rma_size / 2, SZ_512M);
 arch/powerpc/kexec/core.c-92-		else
 arch/powerpc/kexec/core.c:93:			crash_base = min_t(u64, ppc64_rma_size / 2, SZ_128M);
 arch/powerpc/kexec/core.c-94-#else
 --
 arch/powerpc/kvm/book3s_hv_ras.c=37=static void reload_slb(struct kvm_vcpu *vcpu)
 --
 arch/powerpc/kvm/book3s_hv_ras.c-50-	/* Sanity check */
 arch/powerpc/kvm/book3s_hv_ras.c:51:	n = min_t(u32, be32_to_cpu(slb->persistent), SLB_MIN_SIZE);
 arch/powerpc/kvm/book3s_hv_ras.c-52-	if ((void *) &slb->save_area[n] > vcpu->arch.slb_shadow.pinned_end)
 --
 arch/powerpc/kvm/booke.c=578=static unsigned long watchdog_next_timeout(struct kvm_vcpu *vcpu)
 --
 arch/powerpc/kvm/booke.c-600-
 arch/powerpc/kvm/booke.c:601:	return min_t(unsigned long long, nr_jiffies, TIMER_NEXT_MAX_DELTA);
 arch/powerpc/kvm/booke.c-602-}
 --
 arch/powerpc/kvm/powerpc.c=502=int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 --
 arch/powerpc/kvm/powerpc.c-637-		if (hv_enabled)
 arch/powerpc/kvm/powerpc.c:638:			r = min_t(unsigned int, num_present_cpus(), KVM_MAX_VCPUS);
 arch/powerpc/kvm/powerpc.c-639-		else
 arch/powerpc/kvm/powerpc.c:640:			r = min_t(unsigned int, num_online_cpus(), KVM_MAX_VCPUS);
 arch/powerpc/kvm/powerpc.c-641-		break;
 --
 arch/powerpc/lib/code-patching.c=550=int patch_instructions(u32 *addr, u32 *code, size_t len, bool repeat_instr)
 --
 arch/powerpc/lib/code-patching.c-556-
 arch/powerpc/lib/code-patching.c:557:		plen = min_t(size_t, PAGE_SIZE - offset_in_page(addr), len);
 arch/powerpc/lib/code-patching.c-558-
 --
 arch/powerpc/lib/sstep.c=665=static nokprobe_inline int do_vec_load(int rn, unsigned long ea,
 --
 arch/powerpc/lib/sstep.c-685-	if (unlikely(cross_endian))
 arch/powerpc/lib/sstep.c:686:		do_byte_reverse(&u.b[ea & 0xf], min_t(size_t, size, sizeof(u)));
 arch/powerpc/lib/sstep.c-687-	preempt_disable();
 --
 arch/powerpc/lib/sstep.c=696=static nokprobe_inline int do_vec_store(int rn, unsigned long ea,
 --
 arch/powerpc/lib/sstep.c-719-	if (unlikely(cross_endian))
 arch/powerpc/lib/sstep.c:720:		do_byte_reverse(&u.b[ea & 0xf], min_t(size_t, size, sizeof(u)));
 arch/powerpc/lib/sstep.c-721-	return copy_mem_out(&u.b[ea & 0xf], ea, size, regs);
 --
 arch/powerpc/mm/book3s32/mmu.c=424=void setup_initial_memory_limit(phys_addr_t first_memblock_base,
 --
 arch/powerpc/mm/book3s32/mmu.c-431-
 arch/powerpc/mm/book3s32/mmu.c:432:	memblock_set_current_limit(min_t(u64, first_memblock_size, SZ_256M));
 arch/powerpc/mm/book3s32/mmu.c-433-}
 --
 arch/powerpc/mm/book3s64/hash_utils.c=2390=void hash__setup_initial_memory_limit(phys_addr_t first_memblock_base,
]
]

gemini-3.1-pro-preview

							input: 41876
							output: 334
							thoughts: 289
						

**Reviewing the Buffer Allocation Logic**

Okay, `min_t` is definitely available, so that's good. Now, let's go over these code changes. It looks like they've refactored the buffer overflow checks. I see:

1.  `tmp_buf_end - tmp_buf < sizeof_cur_ip` is now `tmp_buf + sizeof_cur_ip > tmp_buf_end`. Right, that's just a simple arithmetic transformation to avoid subtraction, which can be prone to integer overflow issues, and it's cleaner to read this way.
2.  Same thing with `tmp_buf_end - tmp_buf < sizeof_cur_arg` becoming `tmp_buf + sizeof_cur_arg > tmp_buf_end`. Makes sense. Keeps the logic consistent.
3.  The check `tmp_buf_end == tmp_buf` has been changed to `tmp_buf >= tmp_buf_end`. Ah, it's safer to avoid equality tests on pointer arithmetic. This avoids integer overflow if `tmp_buf` has wrapped around, although I think it is an edge case.
4.  Now, looking at the `%pB` `snprintf` advance logic... I see they're using `snprintf` to format a pointer. They are carefully checking for buffer overflow issues. Okay, `limit` calculates the available space, and then the `snprintf` call happens. They're using `min_t` to determine the actual number of bytes written, which seems redundant since the return value from `snprintf` will always be less than or equal to `limit`. Okay, they're ensuring that the buffer pointer is never incremented beyond the end of the allocation, and there is a +1 for a null terminator. That's a reasonable safeguard.

Wait, what about `%pI`? I need to check how that's handled. Is it using the same buffer protection logic? Let's check the code and be absolutely certain.

map[CurrentCode:			/* hack: bstr_printf expects IP addresses to be
			 * pre-formatted as strings, ironically, the easiest way
			 * to do that is to call snprintf.
			 */
			ip_spec[2] = fmt[i - 1];
			ip_spec[3] = fmt[i];
			err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
				       ip_spec, &cur_ip);

			tmp_buf += err + 1;
			num_spec++; NewCode:			/* hack: bstr_printf expects IP addresses to be
			 * pre-formatted as strings, ironically, the easiest way
			 * to do that is to call snprintf.
			 */
			ip_spec[2] = fmt[i - 1];
			ip_spec[3] = fmt[i];
			if (tmp_buf) {
				size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;

				err = snprintf(tmp_buf, limit, ip_spec, &cur_ip);
				if (err < 0)
					err = 0;
				tmp_buf += min_t(size_t, err + 1, limit);
			}
			num_spec++; SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 42937
							output: 44
							thoughts: 32
						

Okay, here's my interpretation of that thought process, from an expert's perspective:

**Debugging a Format String Vulnerability**

Alright, hang on a second. I see `%pI` being processed *within* the `if (fmt[i] == 'p')` block. That's immediately interesting, and potentially problematic. The `'p'` format specifier typically signifies a pointer, which often leads to an address being printed. But, the actual vulnerability depends on the *context*. I need to drill down and understand the code surrounding `%pI` in this `if` statement. Where is `fmt` defined? How is it populated? What other processing happens inside that conditional? Is there any bounds checking? The devil's definitely in the details here, and my gut is telling me this could be a potential format string vulnerability, but I can't say for sure without more information. Let's get the wider picture.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_bprintf_prepare]

map[SourceCode: 804:	/*
 805:	 * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
 806:	 *
 807:	 * Returns a negative value if fmt is an invalid format string or 0 otherwise.
 808:	 *
 809:	 * This can be used in two ways:
 810:	 * - Format string verification only: when data->get_bin_args is false
 811:	 * - Arguments preparation: in addition to the above verification, it writes in
 812:	 *   data->bin_args a binary representation of arguments usable by bstr_printf
 813:	 *   where pointers from BPF have been sanitized.
 814:	 *
 815:	 * In argument preparation mode, if 0 is returned, safe temporary buffers are
 816:	 * allocated and bpf_bprintf_cleanup should be called to free them after use.
 817:	 */
 818:	int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 819:				u32 num_args, struct bpf_bprintf_data *data)
 820:	{
 821:		bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
 822:		char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
 823:		struct bpf_bprintf_buffers *buffers = NULL;
 824:		size_t sizeof_cur_arg, sizeof_cur_ip;
 825:		int err, i, num_spec = 0;
 826:		u64 cur_arg;
 827:		char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
 828:	
 829:		fmt_end = strnchr(fmt, fmt_size, 0);
 830:		if (!fmt_end)
 831:			return -EINVAL;
 832:		fmt_size = fmt_end - fmt;
 833:	
 834:		if (get_buffers && bpf_try_get_buffers(&buffers))
 835:			return -EBUSY;
 836:	
 837:		if (data->get_bin_args) {
 838:			if (num_args)
 839:				tmp_buf = buffers->bin_args;
 840:			tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
 841:			data->bin_args = (u32 *)tmp_buf;
 842:		}
 843:	
 844:		if (data->get_buf)
 845:			data->buf = buffers->buf;
 846:	
 847:		for (i = 0; i < fmt_size; i++) {
 848:			unsigned char c = fmt[i];
 849:	
 850:			/*
 851:			 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
 852:			 * through unchanged, while still rejecting ASCII control bytes.
 853:			 */
 854:			if (isascii(c) && !isprint(c) && !isspace(c)) {
 855:				err = -EINVAL;
 856:				goto out;
 857:			}
 858:	
 859:			if (fmt[i] != '%')
 860:				continue;
 861:	
 862:			if (fmt[i + 1] == '%') {
 863:				i++;
 864:				continue;
 865:			}
 866:	
 867:			if (num_spec >= num_args) {
 868:				err = -EINVAL;
 869:				goto out;
 870:			}
 871:	
 872:			/* The string is zero-terminated so if fmt[i] != 0, we can
 873:			 * always access fmt[i + 1], in the worst case it will be a 0
 874:			 */
 875:			i++;
 876:			c = fmt[i];
 877:			/*
 878:			 * The format parser below only understands ASCII conversion
 879:			 * specifiers and modifiers, so reject non-ASCII after '%'.
 880:			 */
 881:			if (!isascii(c)) {
 882:				err = -EINVAL;
 883:				goto out;
 884:			}
 885:	
 886:			/* skip optional "[0 +-][num]" width formatting field */
 887:			while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
 888:			       fmt[i] == ' ')
 889:				i++;
 890:			if (fmt[i] >= '1' && fmt[i] <= '9') {
 891:				i++;
 892:				while (fmt[i] >= '0' && fmt[i] <= '9')
 893:					i++;
 894:			}
 895:	
 896:			if (fmt[i] == 'p') {
 897:				sizeof_cur_arg = sizeof(long);
 898:	
 899:				if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
 900:				    ispunct(fmt[i + 1])) {
 901:					if (tmp_buf)
 902:						cur_arg = raw_args[num_spec];
 903:					goto nocopy_fmt;
 904:				}
 905:	
 906:				if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 907:				    fmt[i + 2] == 's') {
 908:					fmt_ptype = fmt[i + 1];
 909:					i += 2;
 910:					goto fmt_str;
 911:				}
 912:	
 913:				if (fmt[i + 1] == 'K' ||
 914:				    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 915:				    fmt[i + 1] == 'S') {
 916:					if (tmp_buf)
 917:						cur_arg = raw_args[num_spec];
 918:					i++;
 919:					goto nocopy_fmt;
 920:				}
 921:	
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
 930:	
 931:					i++;
 932:					num_spec++;
 933:					continue;
 934:				}
 935:	
 936:				/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
 937:				if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
 938:				    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
 939:					err = -EINVAL;
 940:					goto out;
 941:				}
 942:	
 943:				i += 2;
 944:				if (!tmp_buf)
 945:					goto nocopy_fmt;
 946:	
 947:				sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
 948:				if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
 949:					err = -ENOSPC;
 950:					goto out;
 951:				}
 952:	
 953:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 954:				err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 955:							       sizeof_cur_ip);
 956:				if (err < 0)
 957:					memset(cur_ip, 0, sizeof_cur_ip);
 958:	
 959:				/* hack: bstr_printf expects IP addresses to be
 960:				 * pre-formatted as strings, ironically, the easiest way
 961:				 * to do that is to call snprintf.
 962:				 */
 963:				ip_spec[2] = fmt[i - 1];
 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
 967:	
 968:				tmp_buf += err + 1;
 969:				num_spec++;
 970:	
 971:				continue;
 972:			} else if (fmt[i] == 's') {
 973:				fmt_ptype = fmt[i];
 974:	fmt_str:
 975:				if (fmt[i + 1] != 0 &&
 976:				    !isspace(fmt[i + 1]) &&
 977:				    !ispunct(fmt[i + 1])) {
 978:					err = -EINVAL;
 979:					goto out;
 980:				}
 981:	
 982:				if (!tmp_buf)
 983:					goto nocopy_fmt;
 984:	
 985:				if (tmp_buf_end == tmp_buf) {
 986:					err = -ENOSPC;
 987:					goto out;
 988:				}
 989:	
 990:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 991:				err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
 992:							    fmt_ptype,
 993:							    tmp_buf_end - tmp_buf);
 994:				if (err < 0) {
 995:					tmp_buf[0] = '\0';
 996:					err = 1;
 997:				}
 998:	
 999:				tmp_buf += err;
1000:				num_spec++;
1001:	
1002:				continue;
1003:			} else if (fmt[i] == 'c') {
1004:				if (!tmp_buf)
1005:					goto nocopy_fmt;
1006:	
1007:				if (tmp_buf_end == tmp_buf) {
1008:					err = -ENOSPC;
1009:					goto out;
1010:				}
1011:	
1012:				*tmp_buf = raw_args[num_spec];
1013:				tmp_buf++;
1014:				num_spec++;
1015:	
1016:				continue;
1017:			}
1018:	
1019:			sizeof_cur_arg = sizeof(int);
1020:	
1021:			if (fmt[i] == 'l') {
1022:				sizeof_cur_arg = sizeof(long);
1023:				i++;
1024:			}
1025:			if (fmt[i] == 'l') {
1026:				sizeof_cur_arg = sizeof(long long);
1027:				i++;
1028:			}
1029:	
1030:			if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
1031:			    fmt[i] != 'x' && fmt[i] != 'X') {
1032:				err = -EINVAL;
1033:				goto out;
1034:			}
1035:	
1036:			if (tmp_buf)
1037:				cur_arg = raw_args[num_spec];
1038:	nocopy_fmt:
1039:			if (tmp_buf) {
1040:				tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
1041:				if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
1042:					err = -ENOSPC;
1043:					goto out;
1044:				}
1045:	
1046:				if (sizeof_cur_arg == 8) {
1047:					*(u32 *)tmp_buf = *(u32 *)&cur_arg;
1048:					*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
1049:				} else {
1050:					*(u32 *)tmp_buf = (u32)(long)cur_arg;
1051:				}
1052:				tmp_buf += sizeof_cur_arg;
1053:			}
1054:			num_spec++;
1055:		}
1056:	
1057:		err = 0;
1058:	out:
1059:		if (err)
1060:			bpf_bprintf_cleanup(data);
1061:		return err;
1062:	}
 SourceFile:kernel/bpf/helpers.c]

gemini-3.1-pro-preview

							input: 47050
							output: 23
							thoughts: 24
						

Here's my thought process, as if I were the one thinking it:

**Checking My Work on Patch Application**

Okay, hold on a second... didn't I just tweak `%pB` and `%pI`? I could have sworn I did. Best practice is to double-check these things, especially after making even minor edits. Let me just run a quick check on the `patch-diff` utility to be sure. It's too easy to lose track of what I've done, and a quick verification now will save me potential headaches down the line. A clean `patch-diff` output confirms my changes, which is what I expect. Excellent.

map[File:kernel/bpf/helpers.c]

map[Output:diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 2bb60200c..18e382a24 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -804,259 +804,266 @@ void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
 /*
  * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
  *
  * Returns a negative value if fmt is an invalid format string or 0 otherwise.
  *
  * This can be used in two ways:
  * - Format string verification only: when data->get_bin_args is false
  * - Arguments preparation: in addition to the above verification, it writes in
  *   data->bin_args a binary representation of arguments usable by bstr_printf
  *   where pointers from BPF have been sanitized.
  *
  * In argument preparation mode, if 0 is returned, safe temporary buffers are
  * allocated and bpf_bprintf_cleanup should be called to free them after use.
  */
 int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 			u32 num_args, struct bpf_bprintf_data *data)
 {
 	bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
 	char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
 	struct bpf_bprintf_buffers *buffers = NULL;
 	size_t sizeof_cur_arg, sizeof_cur_ip;
 	int err, i, num_spec = 0;
 	u64 cur_arg;
 	char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
 
 	fmt_end = strnchr(fmt, fmt_size, 0);
 	if (!fmt_end)
 		return -EINVAL;
 	fmt_size = fmt_end - fmt;
 
 	if (get_buffers && bpf_try_get_buffers(&buffers))
 		return -EBUSY;
 
 	if (data->get_bin_args) {
 		if (num_args)
 			tmp_buf = buffers->bin_args;
 		tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
 		data->bin_args = (u32 *)tmp_buf;
 	}
 
 	if (data->get_buf)
 		data->buf = buffers->buf;
 
 	for (i = 0; i < fmt_size; i++) {
 		unsigned char c = fmt[i];
 
 		/*
 		 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
 		 * through unchanged, while still rejecting ASCII control bytes.
 		 */
 		if (isascii(c) && !isprint(c) && !isspace(c)) {
 			err = -EINVAL;
 			goto out;
 		}
 
 		if (fmt[i] != '%')
 			continue;
 
 		if (fmt[i + 1] == '%') {
 			i++;
 			continue;
 		}
 
 		if (num_spec >= num_args) {
 			err = -EINVAL;
 			goto out;
 		}
 
 		/* The string is zero-terminated so if fmt[i] != 0, we can
 		 * always access fmt[i + 1], in the worst case it will be a 0
 		 */
 		i++;
 		c = fmt[i];
 		/*
 		 * The format parser below only understands ASCII conversion
 		 * specifiers and modifiers, so reject non-ASCII after '%'.
 		 */
 		if (!isascii(c)) {
 			err = -EINVAL;
 			goto out;
 		}
 
 		/* skip optional "[0 +-][num]" width formatting field */
 		while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
 		       fmt[i] == ' ')
 			i++;
 		if (fmt[i] >= '1' && fmt[i] <= '9') {
 			i++;
 			while (fmt[i] >= '0' && fmt[i] <= '9')
 				i++;
 		}
 
 		if (fmt[i] == 'p') {
 			sizeof_cur_arg = sizeof(long);
 
 			if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
 			    ispunct(fmt[i + 1])) {
 				if (tmp_buf)
 					cur_arg = raw_args[num_spec];
 				goto nocopy_fmt;
 			}
 
 			if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 			    fmt[i + 2] == 's') {
 				fmt_ptype = fmt[i + 1];
 				i += 2;
 				goto fmt_str;
 			}
 
 			if (fmt[i + 1] == 'K' ||
 			    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 			    fmt[i + 1] == 'S') {
 				if (tmp_buf)
 					cur_arg = raw_args[num_spec];
 				i++;
 				goto nocopy_fmt;
 			}
 
 			if (fmt[i + 1] == 'B') {
 				if (tmp_buf)  {
-					err = snprintf(tmp_buf,
-						       (tmp_buf_end - tmp_buf),
+					size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;
+
+					err = snprintf(tmp_buf, limit,
 						       "%pB",
 						       (void *)(long)raw_args[num_spec]);
-					tmp_buf += (err + 1);
+					if (err < 0)
+						err = 0;
+					tmp_buf += min_t(size_t, err + 1, limit);
 				}
 
 				i++;
 				num_spec++;
 				continue;
 			}
 
 			/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
 			if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
 			    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
 				err = -EINVAL;
 				goto out;
 			}
 
 			i += 2;
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
 			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
-			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
+			if (tmp_buf + sizeof_cur_ip > tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			unsafe_ptr = (char *)(long)raw_args[num_spec];
 			err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 						       sizeof_cur_ip);
 			if (err < 0)
 				memset(cur_ip, 0, sizeof_cur_ip);
 
 			/* hack: bstr_printf expects IP addresses to be
 			 * pre-formatted as strings, ironically, the easiest way
 			 * to do that is to call snprintf.
 			 */
 			ip_spec[2] = fmt[i - 1];
 			ip_spec[3] = fmt[i];
-			err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
-				       ip_spec, &cur_ip);
+			if (tmp_buf) {
+				size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;
 
-			tmp_buf += err + 1;
+				err = snprintf(tmp_buf, limit, ip_spec, &cur_ip);
+				if (err < 0)
+					err = 0;
+				tmp_buf += min_t(size_t, err + 1, limit);
+			}
 			num_spec++;
 
 			continue;
 		} else if (fmt[i] == 's') {
 			fmt_ptype = fmt[i];
 fmt_str:
 			if (fmt[i + 1] != 0 &&
 			    !isspace(fmt[i + 1]) &&
 			    !ispunct(fmt[i + 1])) {
 				err = -EINVAL;
 				goto out;
 			}
 
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			if (tmp_buf_end == tmp_buf) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			unsafe_ptr = (char *)(long)raw_args[num_spec];
 			err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
 						    fmt_ptype,
 						    tmp_buf_end - tmp_buf);
 			if (err < 0) {
 				tmp_buf[0] = '\0';
 				err = 1;
 			}
 
 			tmp_buf += err;
 			num_spec++;
 
 			continue;
 		} else if (fmt[i] == 'c') {
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			if (tmp_buf_end == tmp_buf) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			*tmp_buf = raw_args[num_spec];
 			tmp_buf++;
 			num_spec++;
 
 			continue;
 		}
 
 		sizeof_cur_arg = sizeof(int);
 
 		if (fmt[i] == 'l') {
 			sizeof_cur_arg = sizeof(long);
 			i++;
 		}
 		if (fmt[i] == 'l') {
 			sizeof_cur_arg = sizeof(long long);
 			i++;
 		}
 
 		if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
 		    fmt[i] != 'x' && fmt[i] != 'X') {
 			err = -EINVAL;
 			goto out;
 		}
 
 		if (tmp_buf)
 			cur_arg = raw_args[num_spec];
 nocopy_fmt:
 		if (tmp_buf) {
 			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
-			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
+			if (tmp_buf + sizeof_cur_arg > tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			if (sizeof_cur_arg == 8) {
 				*(u32 *)tmp_buf = *(u32 *)&cur_arg;
 				*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
 			} else {
 				*(u32 *)tmp_buf = (u32)(long)cur_arg;
 			}
 			tmp_buf += sizeof_cur_arg;
 		}
 		num_spec++;
 	}
 
 	err = 0;
 out:
 	if (err)
 		bpf_bprintf_cleanup(data);
 	return err;
 }
]

gemini-3.1-pro-preview

							input: 50346
							output: 385
							thoughts: 264
						

**My Analysis of the Code Changes**

Okay, the diff seems solid at first glance. It looks like we've made some nice improvements to the buffer boundary checks. Replacing those subtractions with additions is a good move; it's generally clearer and less prone to overflow issues, especially when dealing with potential size calculations. Specifically, the replacements of `tmp_buf_end - tmp_buf < sizeof_cur_ip` and `tmp_buf_end - tmp_buf < sizeof_cur_arg` with `tmp_buf + sizeof_cur_ip > tmp_buf_end` and `tmp_buf + sizeof_cur_arg > tmp_buf_end` respectively look perfect. And that substitution of `tmp_buf_end == tmp_buf` with `tmp_buf >= tmp_buf_end` for the empty buffer condition is spot-on. Finally, the adjustments to how we handle the `snprintf` calls within the `%pB` and `%pI` specifiers, using `limit` and the `min_t` function to control buffer advancement, look sound.

Wait a second, though... when I look at the `%pI` code again, I see that I added an `if (tmp_buf)` check within that block. But earlier within that exact block, there is this:

```c
			if (!tmp_buf)
				goto nocopy_fmt;
```

That means that `tmp_buf` can *never* be NULL at that point in the code, because if it was, we would have jumped to `nocopy_fmt`. So, that redundant `if (tmp_buf)` check is actually unnecessary. It's a bit of clutter that doesn't add anything. I should remove it to keep the code as clean and concise as possible. It's a minor thing, but good practice to be efficient.

map[CurrentCode:			/* hack: bstr_printf expects IP addresses to be
			 * pre-formatted as strings, ironically, the easiest way
			 * to do that is to call snprintf.
			 */
			ip_spec[2] = fmt[i - 1];
			ip_spec[3] = fmt[i];
			if (tmp_buf) {
				size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;

				err = snprintf(tmp_buf, limit, ip_spec, &cur_ip);
				if (err < 0)
					err = 0;
				tmp_buf += min_t(size_t, err + 1, limit);
			}
			num_spec++; NewCode:			/* hack: bstr_printf expects IP addresses to be
			 * pre-formatted as strings, ironically, the easiest way
			 * to do that is to call snprintf.
			 */
			ip_spec[2] = fmt[i - 1];
			ip_spec[3] = fmt[i];
			{
				size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;

				err = snprintf(tmp_buf, limit, ip_spec, &cur_ip);
				if (err < 0)
					err = 0;
				tmp_buf += min_t(size_t, err + 1, limit);
			}
			num_spec++; SourceFile:kernel/bpf/helpers.c]

map[]

gemini-3.1-pro-preview

							input: 51400
							output: 16
							thoughts: 55
						

Okay, here's my summary, considering my expertise:

**Refactoring `bpf_bprintf_prepare` - A Quick Optimization**

Right, so I was looking at that `bpf_bprintf_prepare` function, and I was initially thinking about where to define the `limit` variable, to keep it as neat as possible. Then it hit me: I can just declare `limit` right at the top of the function, or I could stick it inside a block scope. Simple as that. A block scope is more than sufficient. Now, before I jump to a solution, let's take a quick look and make sure that there isn't another place in `bpf_bprintf_prepare` where `snprintf` is used. Always good to double check, I'm sure I've missed one once or twice.

map[Expression:snprintf]

map[Output:
Full output is too long, showing 500 out of 43682 lines.
Use more precise expression if possible.

[Documentation/admin-guide/media/visl.rst=146=integer that denotes the buffer sequence, i.e.:
 --
 Documentation/admin-guide/media/visl.rst-149-
 Documentation/admin-guide/media/visl.rst:150:	snprintf(name, 32, "bitstream%d", run->src->sequence);
 Documentation/admin-guide/media/visl.rst-151-
 --
 Documentation/core-api/printk-formats.rst=53=unsupported specifier or length qualifier results in a WARN and early
 Documentation/core-api/printk-formats.rst:54:return from vsnprintf().
 Documentation/core-api/printk-formats.rst-55-
 --
 Documentation/core-api/printk-formats.rst=150=either kernel memory (k) or user memory (u). The subsequent ``s`` specifier
 Documentation/core-api/printk-formats.rst:151:results in printing a string. For direct use in regular vsnprintf() the (k)
 Documentation/core-api/printk-formats.rst-152-and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(),
 --
 Documentation/core-api/printk-formats.rst=467=and va_list as follows::
 --
 Documentation/core-api/printk-formats.rst-473-
 Documentation/core-api/printk-formats.rst:474:Implements a "recursive vsnprintf".
 Documentation/core-api/printk-formats.rst-475-
 --
 Documentation/driver-api/gpio/board.rst=57=with the string passed in con_id to get the resulting string
 Documentation/driver-api/gpio/board.rst:58:(``snprintf(... "%s-%s", con_id, gpio_suffixes[]``).
 Documentation/driver-api/gpio/board.rst-59-
 --
 Documentation/driver-api/nvdimm/nvdimm.rst=529=internally with a static identifier::
 --
 Documentation/driver-api/nvdimm/nvdimm.rst-536-
 Documentation/driver-api/nvdimm/nvdimm.rst:537:          snprintf(devname, sizeof(devname), "namespace%d.%d",
 Documentation/driver-api/nvdimm/nvdimm.rst-538-                          ndctl_region_get_id(region), parameters->id);
 --
 Documentation/filesystems/sysfs.rst=261=A very simple (and naive) implementation of a device attribute is::
 --
 Documentation/filesystems/sysfs.rst-271-    {
 Documentation/filesystems/sysfs.rst:272:	    snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/filesystems/sysfs.rst-273-		    (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/i2c/dev-interface.rst=35=Next thing, open the device file, as follows::
 --
 Documentation/i2c/dev-interface.rst-40-
 Documentation/i2c/dev-interface.rst:41:  snprintf(filename, 19, "/dev/i2c-%d", adapter_nr);
 Documentation/i2c/dev-interface.rst-42-  file = open(filename, O_RDWR);
 --
 Documentation/input/uinput.rst=185=but interact with uinput via ioctl calls, or use libevdev.
 --
 Documentation/input/uinput.rst-213-      memset(&uud, 0, sizeof(uud));
 Documentation/input/uinput.rst:214:      snprintf(uud.name, UINPUT_MAX_NAME_SIZE, "uinput old interface");
 Documentation/input/uinput.rst-215-      write(fd, &uud, sizeof(uud));
 --
 Documentation/livepatch/module-elf-format.rst=146=module that patches vmlinux and modules 9p, btrfs, ext4:**
 --
 Documentation/livepatch/module-elf-format.rst-178-  0000000000000036  0000003b00000002 R_X86_64_PC32          0000000000000000 .klp.sym.btrfs.can_modify_feature.isra.3,0 - 4
 Documentation/livepatch/module-elf-format.rst:179:  000000000000004c  0000004900000002 R_X86_64_PC32          0000000000000000 .klp.sym.vmlinux.snprintf,0 - 4
 Documentation/livepatch/module-elf-format.rst-180-  [ snip ]                                                                   ^
 --
 Documentation/livepatch/module-elf-format.rst=267=Examples:
 --
 Documentation/livepatch/module-elf-format.rst-273-
 Documentation/livepatch/module-elf-format.rst:274:	.klp.sym.vmlinux.snprintf,0
 Documentation/livepatch/module-elf-format.rst-275-	.klp.sym.vmlinux.printk,0
 --
 Documentation/livepatch/module-elf-format.rst-284-     [ snip ]
 Documentation/livepatch/module-elf-format.rst:285:      73: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT OS [0xff20] .klp.sym.vmlinux.snprintf,0
 Documentation/livepatch/module-elf-format.rst-286-      74: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT OS [0xff20] .klp.sym.vmlinux.capable,0
 --
 Documentation/scsi/ChangeLog.lpfc=1399=Changes from 20040409 to 20040416
 --
 Documentation/scsi/ChangeLog.lpfc-1430-	* Fix RHEL 3 build by #defining EXPORT_SYMTAB.
 Documentation/scsi/ChangeLog.lpfc:1431:	* Replace sprintf with snprintf in lpfc_proc_info.
 Documentation/scsi/ChangeLog.lpfc-1432-	* Fix build warnings on 2.6 kernels - remove no longer used calls
 --
 Documentation/trace/ftrace.rst=90=of ftrace. Here is a list of some of the key files:
 --
 Documentation/trace/ftrace.rst-633-			va_start(ap, fmt);
 Documentation/trace/ftrace.rst:634:			n = vsnprintf(buf, 256, fmt, ap);
 Documentation/trace/ftrace.rst-635-			va_end(ap);
 --
 Documentation/trace/ftrace.rst=2515=something like this simple program.
 --
 Documentation/trace/ftrace.rst-2567-	       static char trace_file[MAX_PATH+1];
 Documentation/trace/ftrace.rst:2568:	       snprintf(trace_file, MAX_PATH, "%s/%s", find_tracefs(), file_name);
 Documentation/trace/ftrace.rst-2569-	       return trace_file;
 --
 Documentation/trace/timerlat-tracer.rst=226=Here is an basic example of user-space code for timerlat::
 --
 Documentation/trace/timerlat-tracer.rst-241-
 Documentation/trace/timerlat-tracer.rst:242:	snprintf(buffer, sizeof(buffer),
 Documentation/trace/timerlat-tracer.rst-243-		"/sys/kernel/tracing/osnoise/per_cpu/cpu%ld/timerlat_fd",
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-63-内核的printf不支持%n。显而易见，浮点格式(%e, %f, %g, %a)也不被识别。使用任何不
 Documentation/translations/zh_CN/core-api/printk-formats.rst:64:支持的占位符或长度限定符都会导致一个WARN并且终止vsnprintf()执行。
 Documentation/translations/zh_CN/core-api/printk-formats.rst-65-
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst=96=seq_printf()，而不是printk()）由用户空间进程读取，使用下面描述的%pK修饰符，不
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-147-``k`` 和 ``u`` 指定符用于打印来自内核内存(k)或用户内存(u)的先前探测的内存。后面的 ``s`` 指
 Documentation/translations/zh_CN/core-api/printk-formats.rst:148:定符的结果是打印一个字符串。对于直接在常规的vsnprintf()中使用时，(k)和(u)注释被忽略，但是，当
 Documentation/translations/zh_CN/core-api/printk-formats.rst-149-在BPF的bpf_trace_printk()之外使用时，它会读取它所指向的内存，不会出现错误。
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst=407=va_format结构体
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-423-
 Documentation/translations/zh_CN/core-api/printk-formats.rst:424:实现 "递归vsnprintf"。
 Documentation/translations/zh_CN/core-api/printk-formats.rst-425-
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt=190=Sysfs 将会为每次读写操作调用一次这个方法。这使得这些方法在执行时
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt-217-
 Documentation/translations/zh_CN/filesystems/sysfs.txt:218:- show() 方法在将格式化返回值返回用户空间的时候，禁止使用snprintf()。
 Documentation/translations/zh_CN/filesystems/sysfs.txt-219-  如果可以保证不会发生缓冲区溢出，可以使用sprintf()，否则必须使用
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt=240=static ssize_t store_name(struct device *dev, struct device_attribute *attr,
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt-242-{
 Documentation/translations/zh_CN/filesystems/sysfs.txt:243:        snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/translations/zh_CN/filesystems/sysfs.txt-244-                 (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt=193=Sysfs 將會爲每次讀寫操作調用一次這個方法。這使得這些方法在執行時
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt-220-
 Documentation/translations/zh_TW/filesystems/sysfs.txt:221:- show() 方法在將格式化返回值返回用戶空間的時候，禁止使用snprintf()。
 Documentation/translations/zh_TW/filesystems/sysfs.txt-222-  如果可以保證不會發生緩衝區溢出，可以使用sprintf()，否則必須使用
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt=243=static ssize_t store_name(struct device *dev, struct device_attribute *attr,
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt-245-{
 Documentation/translations/zh_TW/filesystems/sysfs.txt:246:        snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/translations/zh_TW/filesystems/sysfs.txt-247-                 (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/userspace-api/media/v4l/dev-osd.rst=57=Example: Finding a framebuffer device for OSD
 --
 Documentation/userspace-api/media/v4l/dev-osd.rst-76-
 Documentation/userspace-api/media/v4l/dev-osd.rst:77:	snprintf(dev_name, sizeof(dev_name), "/dev/fb%u", i);
 Documentation/userspace-api/media/v4l/dev-osd.rst-78-
 --
 arch/arm/kernel/process.c=112=void __show_regs(struct pt_regs *regs)
 --
 arch/arm/kernel/process.c-188-			    : "=r" (transbase));
 arch/arm/kernel/process.c:189:			snprintf(buf, sizeof(buf), "  Table: %08x  DAC: %08x",
 arch/arm/kernel/process.c-190-				transbase, domain);
 --
 arch/arm/kernel/setup.c=358=void __init early_print(const char *str, ...)
 --
 arch/arm/kernel/setup.c-364-	va_start(ap, str);
 arch/arm/kernel/setup.c:365:	vsnprintf(buf, sizeof(buf), str, ap);
 arch/arm/kernel/setup.c-366-	va_end(ap);
 --
 arch/arm/kernel/setup.c=700=static void __init setup_processor(void)
 --
 arch/arm/kernel/setup.c-722-
 arch/arm/kernel/setup.c:723:	snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
 arch/arm/kernel/setup.c-724-		 list->arch_name, ENDIANNESS);
 arch/arm/kernel/setup.c:725:	snprintf(elf_platform, ELF_PLATFORM_SIZE, "%s%c",
 arch/arm/kernel/setup.c-726-		 list->elf_name, ENDIANNESS);
 --
 arch/arm/mach-dove/pcie.c=35=static int __init dove_pcie_setup(int nr, struct pci_sys_data *sys)
 --
 arch/arm/mach-dove/pcie.c-61-	 */
 arch/arm/mach-dove/pcie.c:62:	snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
 arch/arm/mach-dove/pcie.c-63-		 "PCIe %d MEM", pp->index);
 --
 arch/arm/mach-mv78xx0/pcie.c=54=static void __init mv78xx0_pcie_preinit(void)
 --
 arch/arm/mach-mv78xx0/pcie.c-76-
 arch/arm/mach-mv78xx0/pcie.c:77:		snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
 arch/arm/mach-mv78xx0/pcie.c-78-			"PCIe %d.%d MEM", pp->maj, pp->min);
 --
 arch/arm/mm/cache-l2x0-pmu.c=340=static ssize_t l2x0_pmu_event_show(struct device *dev,
 --
 arch/arm/mm/cache-l2x0-pmu.c-345-	lattr = container_of(attr, typeof(*lattr), attr);
 arch/arm/mm/cache-l2x0-pmu.c:346:	return snprintf(buf, PAGE_SIZE, "config=0x%x\n", lattr->config);
 arch/arm/mm/cache-l2x0-pmu.c-347-}
 --
 arch/arm/plat-orion/gpio.c=520=void __init orion_gpio_init(int gpio_base, int ngpio,
 --
 arch/arm/plat-orion/gpio.c-533-
 arch/arm/plat-orion/gpio.c:534:	snprintf(gc_label, sizeof(gc_label), "orion_gpio%d",
 arch/arm/plat-orion/gpio.c-535-		orion_gpio_chip_count);
 --
 arch/arm64/kvm/ptdump.c=93=static int kvm_ptdump_build_levels(struct ptdump_pg_level *level, u32 start_lvl)
 --
 arch/arm64/kvm/ptdump.c-105-	for (i = start_lvl; i < KVM_PGTABLE_MAX_LEVELS; i++) {
 arch/arm64/kvm/ptdump.c:106:		snprintf(level[i].name, sizeof(level[i].name), "%u", i);
 arch/arm64/kvm/ptdump.c-107-
 --
 arch/arm64/kvm/ptdump.c=276=void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu)
 --
 arch/arm64/kvm/ptdump.c-280-
 arch/arm64/kvm/ptdump.c:281:	snprintf(file_name, sizeof(file_name), "0x%016llx-0x%016llx-s2-%sabled",
 arch/arm64/kvm/ptdump.c-282-		 mmu->tlb_vttbr,
 --
 arch/loongarch/kernel/kdebugfs.c=20=static ssize_t sfb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-26-
 arch/loongarch/kernel/kdebugfs.c:27:	s = snprintf(str, sizeof(str), "Boot State: %x\nCurrent State: %x\n", sfb_state, state);
 arch/loongarch/kernel/kdebugfs.c-28-
 --
 arch/loongarch/kernel/kdebugfs.c=93=static ssize_t tso_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-99-
 arch/loongarch/kernel/kdebugfs.c:100:	s = snprintf(str, sizeof(str), "Boot State: %d (%s)\n"
 arch/loongarch/kernel/kdebugfs.c-101-			               "Current State: %d (%s)\n\n"
 --
 arch/m68k/emu/natfeat.c=55=void nfprint(const char *fmt, ...)
 --
 arch/m68k/emu/natfeat.c-60-	va_start(ap, fmt);
 arch/m68k/emu/natfeat.c:61:	vsnprintf(buf, 256, fmt, ap);
 arch/m68k/emu/natfeat.c-62-	nf_call(nf_get_id("NF_STDERR"), virt_to_phys(buf));
 --
 arch/m68k/emu/nfblock.c=97=static int __init nfhd_init_one(int id, u32 blocks, u32 bsize)
 --
 arch/m68k/emu/nfblock.c-134-	dev->disk->private_data = dev;
 arch/m68k/emu/nfblock.c:135:	snprintf(dev->disk->disk_name, sizeof(dev->disk->disk_name), "nfhd%u",
 arch/m68k/emu/nfblock.c-136-		 dev_id);
 --
 arch/m68k/sun3/prom/printf.c=24=prom_printf(char *fmt, ...)
 --
 arch/m68k/sun3/prom/printf.c-32-	ppbuf[0] = 'O';
 arch/m68k/sun3/prom/printf.c:33:	vsnprintf(ppbuf + 1, sizeof(ppbuf) - 1, fmt, args);
 arch/m68k/sun3/prom/printf.c-34-#else
 arch/m68k/sun3/prom/printf.c:35:	vsnprintf(ppbuf, sizeof(ppbuf), fmt, args);
 arch/m68k/sun3/prom/printf.c-36-#endif
 --
 arch/m68k/virt/config.c=80=void __init config_virt(void)
 --
 arch/m68k/virt/config.c-83-
 arch/m68k/virt/config.c:84:	snprintf(earlycon, sizeof(earlycon), "early_gf_tty,0x%08x",
 arch/m68k/virt/config.c-85-		 virt_bi_data.tty.mmio);
 --
 arch/mips/bcm47xx/prom.c=48=__init void bcm47xx_set_system_type(u16 chip_id)
 arch/mips/bcm47xx/prom.c-49-{
 arch/mips/bcm47xx/prom.c:50:	snprintf(bcm47xx_system_type, sizeof(bcm47xx_system_type),
 arch/mips/bcm47xx/prom.c-51-		 (chip_id > 0x9999) ? "Broadcom BCM%d" :
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c=728=void __init board_prom_init(void)
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-752-			if(cfe[5] == 'd')
 arch/mips/bcm63xx/boards/board_bcm963xx.c:753:				snprintf(cfe_version, 11, "%s",
 arch/mips/bcm63xx/boards/board_bcm963xx.c-754-					 (char *) &cfe[5]);
 arch/mips/bcm63xx/boards/board_bcm963xx.c-755-			else if (cfe[10] > 0)
 arch/mips/bcm63xx/boards/board_bcm963xx.c:756:				snprintf(cfe_version, sizeof(cfe_version),
 arch/mips/bcm63xx/boards/board_bcm963xx.c-757-					 "%u.%u.%u-%u.%u-%u", cfe[5], cfe[6],
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-759-			else
 arch/mips/bcm63xx/boards/board_bcm963xx.c:760:				snprintf(cfe_version, sizeof(cfe_version),
 arch/mips/bcm63xx/boards/board_bcm963xx.c-761-					 "%u.%u.%u-%u.%u", cfe[5], cfe[6],
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-763-		} else {
 arch/mips/bcm63xx/boards/board_bcm963xx.c:764:			snprintf(cfe_version, 12, "%s", (char *) &cfe[4]);
 arch/mips/bcm63xx/boards/board_bcm963xx.c-765-		}
 --
 arch/mips/bcm63xx/setup.c=141=const char *get_system_type(void)
 --
 arch/mips/bcm63xx/setup.c-143-	static char buf[128];
 arch/mips/bcm63xx/setup.c:144:	snprintf(buf, sizeof(buf), "bcm63xx/%s (0x%04x/0x%02X)",
 arch/mips/bcm63xx/setup.c-145-		 board_get_name(),
 --
 arch/mips/cavium-octeon/octeon-platform.c=483=static void __init octeon_fdt_set_phy(int eth, int phy_addr)
 --
 arch/mips/cavium-octeon/octeon-platform.c-555-
 arch/mips/cavium-octeon/octeon-platform.c:556:	snprintf(new_name, sizeof(new_name), "ethernet-phy@%x", phy_addr);
 arch/mips/cavium-octeon/octeon-platform.c-557-
 --
 arch/mips/cavium-octeon/octeon-platform.c=649=static void __init octeon_fdt_pip_port(int iface, int i, int p, int max)
 --
 arch/mips/cavium-octeon/octeon-platform.c-656-
 arch/mips/cavium-octeon/octeon-platform.c:657:	snprintf(name_buffer, sizeof(name_buffer), "ethernet@%x", p);
 arch/mips/cavium-octeon/octeon-platform.c-658-	eth = fdt_subnode_offset(initial_boot_params, iface, name_buffer);
 --
 arch/mips/cavium-octeon/octeon-platform.c=682=static void __init octeon_fdt_pip_iface(int pip, int idx)
 --
 arch/mips/cavium-octeon/octeon-platform.c-688-
 arch/mips/cavium-octeon/octeon-platform.c:689:	snprintf(name_buffer, sizeof(name_buffer), "interface@%d", idx);
 arch/mips/cavium-octeon/octeon-platform.c-690-	iface = fdt_subnode_offset(initial_boot_params, pip, name_buffer);
 --
 arch/mips/cavium-octeon/octeon-platform.c=701=void __init octeon_fill_mac_addresses(void)
 --
 arch/mips/cavium-octeon/octeon-platform.c-724-
 arch/mips/cavium-octeon/octeon-platform.c:725:		snprintf(name_buffer, sizeof(name_buffer), "mix%d", i);
 arch/mips/cavium-octeon/octeon-platform.c-726-		alias_prop = fdt_getprop(initial_boot_params, aliases,
 --
 arch/mips/cavium-octeon/octeon-platform.c-747-
 arch/mips/cavium-octeon/octeon-platform.c:748:		snprintf(name_buffer, sizeof(name_buffer), "interface@%d", i);
 arch/mips/cavium-octeon/octeon-platform.c-749-		iface = fdt_subnode_offset(initial_boot_params, pip,
 --
 arch/mips/cavium-octeon/octeon-platform.c-755-
 arch/mips/cavium-octeon/octeon-platform.c:756:			snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-757-				 "ethernet@%x", p);
 --
 arch/mips/cavium-octeon/octeon-platform.c=767=int __init octeon_prune_device_tree(void)
 --
 arch/mips/cavium-octeon/octeon-platform.c-800-
 arch/mips/cavium-octeon/octeon-platform.c:801:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-802-			 "mix%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-842-
 arch/mips/cavium-octeon/octeon-platform.c:843:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-844-			 "twsi%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-873-
 arch/mips/cavium-octeon/octeon-platform.c:874:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-875-			 "smi%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-900-
 arch/mips/cavium-octeon/octeon-platform.c:901:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-902-			 "uart%d", i);
 --
 arch/mips/cavium-octeon/setup.c=493=static void __init init_octeon_system_type(void)
 --
 arch/mips/cavium-octeon/setup.c-508-
 arch/mips/cavium-octeon/setup.c:509:	snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
 arch/mips/cavium-octeon/setup.c-510-		 board_type, octeon_model_get_string(read_c0_prid()));
 --
 arch/mips/dec/prom/identify.c=44=const char *get_system_type(void)
 --
 arch/mips/dec/prom/identify.c-51-		called = 1;
 arch/mips/dec/prom/identify.c:52:		snprintf(system, STR_BUF_LEN, "Digital %s",
 arch/mips/dec/prom/identify.c-53-			 dec_system_strings[mips_machtype]);
 --
 arch/mips/generic/yamon-dt.c=75=__init int yamon_dt_append_memory(void *fdt,
 --
 arch/mips/generic/yamon-dt.c-109-	for (i = 0; i < ARRAY_SIZE(var_names); i++) {
 arch/mips/generic/yamon-dt.c:110:		snprintf(param_name, sizeof(param_name), "%s=", var_names[i]);
 arch/mips/generic/yamon-dt.c-111-		var = strstr(arcs_cmdline, param_name);
 --
 arch/mips/generic/yamon-dt.c=157=__init int yamon_dt_serial_config(void *fdt)
 --
 arch/mips/generic/yamon-dt.c-179-
 arch/mips/generic/yamon-dt.c:180:	snprintf(mode_var_name, sizeof(mode_var_name), "modetty%u", uart);
 arch/mips/generic/yamon-dt.c-181-	mode_var = fw_getenv(mode_var_name);
 --
 arch/mips/generic/yamon-dt.c-210-
 arch/mips/generic/yamon-dt.c:211:	WARN_ON(snprintf(path, sizeof(path), "serial%u:%u%c%u%s",
 arch/mips/generic/yamon-dt.c-212-			 uart, baud, parity, stop_bits,
 --
 arch/mips/kernel/mips-cm.c=393=void mips_cm_error_report(void)
 --
 arch/mips/kernel/mips-cm.c-421-
 arch/mips/kernel/mips-cm.c:422:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-423-				 "CCA=%lu TR=%s MCmd=%s STag=%lu "
 --
 arch/mips/kernel/mips-cm.c-435-
 arch/mips/kernel/mips-cm.c:436:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-437-				 "C3=%s C2=%s C1=%s C0=%s SC=%s "
 --
 arch/mips/kernel/mips-cm.c-451-
 arch/mips/kernel/mips-cm.c:452:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-453-				 "Type=%s%s Instr=%s DW=%lu Way=%lu "
 --
 arch/mips/kernel/mips-cm.c-490-			unsigned long bank_bit = (cm_error >> 28) & 0x1;
 arch/mips/kernel/mips-cm.c:491:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-492-				 "%s ECC Error: Way=%lu (DWORD=%lu, Sets=%lu)"
 --
 arch/mips/kernel/mips-cm.c-510-
 arch/mips/kernel/mips-cm.c:511:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-512-				 "Decode Request Error: Type=%lu, Command=%lu"
 --
 arch/mips/kernel/traps.c=1991=void __noreturn nmi_exception_handler(struct pt_regs *regs)
 --
 arch/mips/kernel/traps.c-1997-	bust_spinlocks(1);
 arch/mips/kernel/traps.c:1998:	snprintf(str, 100, "CPU%d NMI taken, CP0_EPC=%lx\n",
 arch/mips/kernel/traps.c-1999-		 smp_processor_id(), regs->cp0_epc);
 --
 arch/mips/lantiq/prom.c=100=void __init prom_init(void)
 --
 arch/mips/lantiq/prom.c-103-	ltq_soc_detect(&soc_info);
 arch/mips/lantiq/prom.c:104:	snprintf(soc_info.sys_type, LTQ_SYS_TYPE_LEN - 1, "%s rev %s",
 arch/mips/lantiq/prom.c-105-		soc_info.name, soc_info.rev_type);
 --
 arch/mips/mti-malta/malta-dtshim.c=131=static void __init append_memory(void *fdt, int root_off)
 --
 arch/mips/mti-malta/malta-dtshim.c-179-	for (i = 0; i < ARRAY_SIZE(var_names); i++) {
 arch/mips/mti-malta/malta-dtshim.c:180:		snprintf(param_name, sizeof(param_name), "%s=", var_names[i]);
 arch/mips/mti-malta/malta-dtshim.c-181-		var = strstr(arcs_cmdline, param_name);
 --
 arch/mips/pci/pci-xtalk-bridge.c=568=static int bridge_get_partnum(u64 baddr, char *partnum)
 --
 arch/mips/pci/pci-xtalk-bridge.c-575-
 arch/mips/pci/pci-xtalk-bridge.c:576:	snprintf(prefix, sizeof(prefix), "bridge-%012llx-0b-", baddr);
 arch/mips/pci/pci-xtalk-bridge.c-577-
 --
 arch/mips/ralink/mt7620.c=220=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/mt7620.c-226-
 arch/mips/ralink/mt7620.c:227:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/mt7620.c-228-		"MediaTek %s ver:%u eco:%u",
 --
 arch/mips/ralink/mt7621.c=167=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/mt7621.c-198-
 arch/mips/ralink/mt7621.c:199:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/mt7621.c-200-		"MediaTek %s ver:%u eco:%u",
 --
 arch/mips/ralink/rt288x.c=90=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt288x.c-97-
 arch/mips/ralink/rt288x.c:98:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt288x.c-99-		"Ralink %s id:%u rev:%u",
 --
 arch/mips/ralink/rt305x.c=193=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt305x.c-196-
 arch/mips/ralink/rt305x.c:197:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt305x.c-198-		"Ralink %s id:%u rev:%u",
 --
 arch/mips/ralink/rt3883.c=90=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt3883.c-97-
 arch/mips/ralink/rt3883.c:98:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt3883.c-99-		"Ralink %s ver:%u eco:%u",
 --
 arch/mips/sgi-ip27/ip27-xtalk.c=26=static void bridge_platform_create(nasid_t nasid, int widget, int masterwid)
 --
 arch/mips/sgi-ip27/ip27-xtalk.c-42-
 arch/mips/sgi-ip27/ip27-xtalk.c:43:	snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx",
 arch/mips/sgi-ip27/ip27-xtalk.c-44-		 offset + (widget << SWIN_SIZE_BITS));
 --
 arch/mips/sgi-ip30/ip30-xtalk.c=39=static void bridge_platform_create(int widget, int masterwid)
 --
 arch/mips/sgi-ip30/ip30-xtalk.c-52-
 arch/mips/sgi-ip30/ip30-xtalk.c:53:	snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx",
 arch/mips/sgi-ip30/ip30-xtalk.c-54-		 IP30_SWIN_BASE(widget));
 --
 arch/mips/txx9/generic/setup.c=635=void __init txx9_iocled_init(unsigned long baseaddr,
 --
 arch/mips/txx9/generic/setup.c-675-		struct gpio_led *led = &iocled->leds[i];
 arch/mips/txx9/generic/setup.c:676:		snprintf(iocled->names[i], sizeof(iocled->names[i]),
 arch/mips/txx9/generic/setup.c-677-			 "iocled:%s:%u", color, i);
 --
 arch/parisc/kernel/cache.c=135=show_cache_info(struct seq_file *m)
 --
 arch/parisc/kernel/cache.c-141-	if (cache_info.dc_loop != 1)
 arch/parisc/kernel/cache.c:142:		snprintf(buf, 32, "%lu-way associative", cache_info.dc_loop);
 arch/parisc/kernel/cache.c-143-	seq_printf(m, "D-cache\t\t: %ld KB (%s%s, %s, alias=%d)\n",
 --
 arch/parisc/kernel/drivers.c=493=alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
 --
 arch/parisc/kernel/drivers.c-536-	name = parisc_hardware_description(&dev->id) ? : "unknown";
 arch/parisc/kernel/drivers.c:537:	snprintf(dev->name, sizeof(dev->name), "%s [%s]",
 arch/parisc/kernel/drivers.c-538-		name, parisc_pathname(dev));
 --
 arch/powerpc/kernel/fadump.c=149=void __init fadump_append_bootargs(void)
 --
 arch/powerpc/kernel/fadump.c-175-	pr_debug("Cmdline: %s\n", boot_command_line);
 arch/powerpc/kernel/fadump.c:176:	snprintf(boot_command_line + len, COMMAND_LINE_SIZE - len, " %s", append_args);
 arch/powerpc/kernel/fadump.c-177-	pr_info("Updated cmdline: %s\n", boot_command_line);
 --
 arch/powerpc/kernel/rtas.c=1644=void rtas_os_term(char *str)
 --
 arch/powerpc/kernel/rtas.c-1659-
 arch/powerpc/kernel/rtas.c:1660:	snprintf(rtas_os_term_buf, 2048, "OS panic: %s", str);
 arch/powerpc/kernel/rtas.c-1661-
 --
 arch/powerpc/kernel/rtas_flash.c=449=static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf, 
 --
 arch/powerpc/kernel/rtas_flash.c-457-		    (args_buf->update_results == VALIDATE_TMP_UPDATE))
 arch/powerpc/kernel/rtas_flash.c:458:			n += snprintf(msg + n, msglen - n, "%s\n",
 arch/powerpc/kernel/rtas_flash.c-459-					args_buf->buf);
 --
 arch/powerpc/kernel/udbg.c=114=void udbg_printf(const char *fmt, ...)
 --
 arch/powerpc/kernel/udbg.c-120-		va_start(args, fmt);
 arch/powerpc/kernel/udbg.c:121:		vsnprintf(buf, UDBG_BUFSIZE, fmt, args);
 arch/powerpc/kernel/udbg.c-122-		udbg_puts(buf);
 --
 arch/powerpc/kexec/file_load_64.c=194=static int add_usable_mem_property(void *fdt, struct device_node *dn,
 --
 arch/powerpc/kexec/file_load_64.c-203-
 arch/powerpc/kexec/file_load_64.c:204:	if (snprintf(path, NODE_PATH_LEN, "%pOF", dn) > (NODE_PATH_LEN - 1)) {
 arch/powerpc/kexec/file_load_64.c-205-		pr_err("Buffer (%d) too small for memory node: %pOF\n",
 --
 arch/powerpc/kvm/book3s_hv.c=2864=static ssize_t debugfs_timings_read(struct file *file, char __user *buf,
 --
 arch/powerpc/kvm/book3s_hv.c-2899-			if (!ok)
 arch/powerpc/kvm/book3s_hv.c:2900:				snprintf(s, buf_end - s, "%s: stuck\n",
 arch/powerpc/kvm/book3s_hv.c-2901-					timings[i].name);
 arch/powerpc/kvm/book3s_hv.c-2902-			else
 arch/powerpc/kvm/book3s_hv.c:2903:				snprintf(s, buf_end - s,
 arch/powerpc/kvm/book3s_hv.c-2904-					"%s: %llu %llu %llu %llu\n",
 --
 arch/powerpc/perf/hv-24x7.c=388=static char *event_fmt(struct hv_24x7_event_data *event, unsigned int domain)
 --
 arch/powerpc/perf/hv-24x7.c-396-	case HV_PERF_DOMAIN_PHYS_CHIP:
 arch/powerpc/perf/hv-24x7.c:397:		snprintf(buf, sizeof(buf), "%d", domain);
 arch/powerpc/perf/hv-24x7.c-398-		domain_str = buf;
 --
 arch/powerpc/platforms/512x/clock-commonclk.c=704=static void __init mpc512x_clk_setup_clock_tree(struct device_node *np, int busfreq)
 --
 arch/powerpc/platforms/512x/clock-commonclk.c-822-		char name[12];
 arch/powerpc/platforms/512x/clock-commonclk.c:823:		snprintf(name, sizeof(name), "psc%d", mclk_idx);
 arch/powerpc/platforms/512x/clock-commonclk.c-824-		clks[MPC512x_CLK_PSC0 + mclk_idx] = mpc512x_clk_gated(
 --
 arch/powerpc/platforms/512x/clock-commonclk.c=951=static void __init mpc5121_clk_provide_migration_support(void)
 --
 arch/powerpc/platforms/512x/clock-commonclk.c-988-	of_address_to_resource(np, 0, &res); \
 arch/powerpc/platforms/512x/clock-commonclk.c:989:	snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
 arch/powerpc/platforms/512x/clock-commonclk.c-990-} while (0)
 --
 arch/powerpc/platforms/82xx/ep8248e.c=109=static int ep8248e_mdio_probe(struct platform_device *ofdev)
 --
 arch/powerpc/platforms/82xx/ep8248e.c-130-	bus->parent = &ofdev->dev;
]
]

gemini-3.1-pro-preview

							input: 63942
							output: 16
							thoughts: 51
						

Okay, here's my understanding, considering I'm thoroughly familiar with these kernel contexts:

**Checking `snprintf` Usage in `kernel/bpf/helpers.c`**

Alright, I've just had a scan through `kernel/bpf/helpers.c`, and I *believe* I can confidently say that I've accounted for all the instances of `snprintf` in that file. I don't see any other calls that require my immediate attention. However, given the criticality of this, let me just double-check that location one more time, just to be absolutely sure that I haven't missed anything. A quick, thorough re-examination of `kernel/bpf/helpers.c` is warranted. Better safe than sorry when dealing with potentially vulnerable string formatting functions.

map[Expression:snprintf]

map[Output:
Full output is too long, showing 500 out of 43682 lines.
Use more precise expression if possible.

[Documentation/admin-guide/media/visl.rst=146=integer that denotes the buffer sequence, i.e.:
 --
 Documentation/admin-guide/media/visl.rst-149-
 Documentation/admin-guide/media/visl.rst:150:	snprintf(name, 32, "bitstream%d", run->src->sequence);
 Documentation/admin-guide/media/visl.rst-151-
 --
 Documentation/core-api/printk-formats.rst=53=unsupported specifier or length qualifier results in a WARN and early
 Documentation/core-api/printk-formats.rst:54:return from vsnprintf().
 Documentation/core-api/printk-formats.rst-55-
 --
 Documentation/core-api/printk-formats.rst=150=either kernel memory (k) or user memory (u). The subsequent ``s`` specifier
 Documentation/core-api/printk-formats.rst:151:results in printing a string. For direct use in regular vsnprintf() the (k)
 Documentation/core-api/printk-formats.rst-152-and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(),
 --
 Documentation/core-api/printk-formats.rst=467=and va_list as follows::
 --
 Documentation/core-api/printk-formats.rst-473-
 Documentation/core-api/printk-formats.rst:474:Implements a "recursive vsnprintf".
 Documentation/core-api/printk-formats.rst-475-
 --
 Documentation/driver-api/gpio/board.rst=57=with the string passed in con_id to get the resulting string
 Documentation/driver-api/gpio/board.rst:58:(``snprintf(... "%s-%s", con_id, gpio_suffixes[]``).
 Documentation/driver-api/gpio/board.rst-59-
 --
 Documentation/driver-api/nvdimm/nvdimm.rst=529=internally with a static identifier::
 --
 Documentation/driver-api/nvdimm/nvdimm.rst-536-
 Documentation/driver-api/nvdimm/nvdimm.rst:537:          snprintf(devname, sizeof(devname), "namespace%d.%d",
 Documentation/driver-api/nvdimm/nvdimm.rst-538-                          ndctl_region_get_id(region), parameters->id);
 --
 Documentation/filesystems/sysfs.rst=261=A very simple (and naive) implementation of a device attribute is::
 --
 Documentation/filesystems/sysfs.rst-271-    {
 Documentation/filesystems/sysfs.rst:272:	    snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/filesystems/sysfs.rst-273-		    (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/i2c/dev-interface.rst=35=Next thing, open the device file, as follows::
 --
 Documentation/i2c/dev-interface.rst-40-
 Documentation/i2c/dev-interface.rst:41:  snprintf(filename, 19, "/dev/i2c-%d", adapter_nr);
 Documentation/i2c/dev-interface.rst-42-  file = open(filename, O_RDWR);
 --
 Documentation/input/uinput.rst=185=but interact with uinput via ioctl calls, or use libevdev.
 --
 Documentation/input/uinput.rst-213-      memset(&uud, 0, sizeof(uud));
 Documentation/input/uinput.rst:214:      snprintf(uud.name, UINPUT_MAX_NAME_SIZE, "uinput old interface");
 Documentation/input/uinput.rst-215-      write(fd, &uud, sizeof(uud));
 --
 Documentation/livepatch/module-elf-format.rst=146=module that patches vmlinux and modules 9p, btrfs, ext4:**
 --
 Documentation/livepatch/module-elf-format.rst-178-  0000000000000036  0000003b00000002 R_X86_64_PC32          0000000000000000 .klp.sym.btrfs.can_modify_feature.isra.3,0 - 4
 Documentation/livepatch/module-elf-format.rst:179:  000000000000004c  0000004900000002 R_X86_64_PC32          0000000000000000 .klp.sym.vmlinux.snprintf,0 - 4
 Documentation/livepatch/module-elf-format.rst-180-  [ snip ]                                                                   ^
 --
 Documentation/livepatch/module-elf-format.rst=267=Examples:
 --
 Documentation/livepatch/module-elf-format.rst-273-
 Documentation/livepatch/module-elf-format.rst:274:	.klp.sym.vmlinux.snprintf,0
 Documentation/livepatch/module-elf-format.rst-275-	.klp.sym.vmlinux.printk,0
 --
 Documentation/livepatch/module-elf-format.rst-284-     [ snip ]
 Documentation/livepatch/module-elf-format.rst:285:      73: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT OS [0xff20] .klp.sym.vmlinux.snprintf,0
 Documentation/livepatch/module-elf-format.rst-286-      74: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT OS [0xff20] .klp.sym.vmlinux.capable,0
 --
 Documentation/scsi/ChangeLog.lpfc=1399=Changes from 20040409 to 20040416
 --
 Documentation/scsi/ChangeLog.lpfc-1430-	* Fix RHEL 3 build by #defining EXPORT_SYMTAB.
 Documentation/scsi/ChangeLog.lpfc:1431:	* Replace sprintf with snprintf in lpfc_proc_info.
 Documentation/scsi/ChangeLog.lpfc-1432-	* Fix build warnings on 2.6 kernels - remove no longer used calls
 --
 Documentation/trace/ftrace.rst=90=of ftrace. Here is a list of some of the key files:
 --
 Documentation/trace/ftrace.rst-633-			va_start(ap, fmt);
 Documentation/trace/ftrace.rst:634:			n = vsnprintf(buf, 256, fmt, ap);
 Documentation/trace/ftrace.rst-635-			va_end(ap);
 --
 Documentation/trace/ftrace.rst=2515=something like this simple program.
 --
 Documentation/trace/ftrace.rst-2567-	       static char trace_file[MAX_PATH+1];
 Documentation/trace/ftrace.rst:2568:	       snprintf(trace_file, MAX_PATH, "%s/%s", find_tracefs(), file_name);
 Documentation/trace/ftrace.rst-2569-	       return trace_file;
 --
 Documentation/trace/timerlat-tracer.rst=226=Here is an basic example of user-space code for timerlat::
 --
 Documentation/trace/timerlat-tracer.rst-241-
 Documentation/trace/timerlat-tracer.rst:242:	snprintf(buffer, sizeof(buffer),
 Documentation/trace/timerlat-tracer.rst-243-		"/sys/kernel/tracing/osnoise/per_cpu/cpu%ld/timerlat_fd",
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-63-内核的printf不支持%n。显而易见，浮点格式(%e, %f, %g, %a)也不被识别。使用任何不
 Documentation/translations/zh_CN/core-api/printk-formats.rst:64:支持的占位符或长度限定符都会导致一个WARN并且终止vsnprintf()执行。
 Documentation/translations/zh_CN/core-api/printk-formats.rst-65-
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst=96=seq_printf()，而不是printk()）由用户空间进程读取，使用下面描述的%pK修饰符，不
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-147-``k`` 和 ``u`` 指定符用于打印来自内核内存(k)或用户内存(u)的先前探测的内存。后面的 ``s`` 指
 Documentation/translations/zh_CN/core-api/printk-formats.rst:148:定符的结果是打印一个字符串。对于直接在常规的vsnprintf()中使用时，(k)和(u)注释被忽略，但是，当
 Documentation/translations/zh_CN/core-api/printk-formats.rst-149-在BPF的bpf_trace_printk()之外使用时，它会读取它所指向的内存，不会出现错误。
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst=407=va_format结构体
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-423-
 Documentation/translations/zh_CN/core-api/printk-formats.rst:424:实现 "递归vsnprintf"。
 Documentation/translations/zh_CN/core-api/printk-formats.rst-425-
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt=190=Sysfs 将会为每次读写操作调用一次这个方法。这使得这些方法在执行时
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt-217-
 Documentation/translations/zh_CN/filesystems/sysfs.txt:218:- show() 方法在将格式化返回值返回用户空间的时候，禁止使用snprintf()。
 Documentation/translations/zh_CN/filesystems/sysfs.txt-219-  如果可以保证不会发生缓冲区溢出，可以使用sprintf()，否则必须使用
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt=240=static ssize_t store_name(struct device *dev, struct device_attribute *attr,
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt-242-{
 Documentation/translations/zh_CN/filesystems/sysfs.txt:243:        snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/translations/zh_CN/filesystems/sysfs.txt-244-                 (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt=193=Sysfs 將會爲每次讀寫操作調用一次這個方法。這使得這些方法在執行時
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt-220-
 Documentation/translations/zh_TW/filesystems/sysfs.txt:221:- show() 方法在將格式化返回值返回用戶空間的時候，禁止使用snprintf()。
 Documentation/translations/zh_TW/filesystems/sysfs.txt-222-  如果可以保證不會發生緩衝區溢出，可以使用sprintf()，否則必須使用
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt=243=static ssize_t store_name(struct device *dev, struct device_attribute *attr,
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt-245-{
 Documentation/translations/zh_TW/filesystems/sysfs.txt:246:        snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/translations/zh_TW/filesystems/sysfs.txt-247-                 (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/userspace-api/media/v4l/dev-osd.rst=57=Example: Finding a framebuffer device for OSD
 --
 Documentation/userspace-api/media/v4l/dev-osd.rst-76-
 Documentation/userspace-api/media/v4l/dev-osd.rst:77:	snprintf(dev_name, sizeof(dev_name), "/dev/fb%u", i);
 Documentation/userspace-api/media/v4l/dev-osd.rst-78-
 --
 arch/arm/kernel/process.c=112=void __show_regs(struct pt_regs *regs)
 --
 arch/arm/kernel/process.c-188-			    : "=r" (transbase));
 arch/arm/kernel/process.c:189:			snprintf(buf, sizeof(buf), "  Table: %08x  DAC: %08x",
 arch/arm/kernel/process.c-190-				transbase, domain);
 --
 arch/arm/kernel/setup.c=358=void __init early_print(const char *str, ...)
 --
 arch/arm/kernel/setup.c-364-	va_start(ap, str);
 arch/arm/kernel/setup.c:365:	vsnprintf(buf, sizeof(buf), str, ap);
 arch/arm/kernel/setup.c-366-	va_end(ap);
 --
 arch/arm/kernel/setup.c=700=static void __init setup_processor(void)
 --
 arch/arm/kernel/setup.c-722-
 arch/arm/kernel/setup.c:723:	snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
 arch/arm/kernel/setup.c-724-		 list->arch_name, ENDIANNESS);
 arch/arm/kernel/setup.c:725:	snprintf(elf_platform, ELF_PLATFORM_SIZE, "%s%c",
 arch/arm/kernel/setup.c-726-		 list->elf_name, ENDIANNESS);
 --
 arch/arm/mach-dove/pcie.c=35=static int __init dove_pcie_setup(int nr, struct pci_sys_data *sys)
 --
 arch/arm/mach-dove/pcie.c-61-	 */
 arch/arm/mach-dove/pcie.c:62:	snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
 arch/arm/mach-dove/pcie.c-63-		 "PCIe %d MEM", pp->index);
 --
 arch/arm/mach-mv78xx0/pcie.c=54=static void __init mv78xx0_pcie_preinit(void)
 --
 arch/arm/mach-mv78xx0/pcie.c-76-
 arch/arm/mach-mv78xx0/pcie.c:77:		snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
 arch/arm/mach-mv78xx0/pcie.c-78-			"PCIe %d.%d MEM", pp->maj, pp->min);
 --
 arch/arm/mm/cache-l2x0-pmu.c=340=static ssize_t l2x0_pmu_event_show(struct device *dev,
 --
 arch/arm/mm/cache-l2x0-pmu.c-345-	lattr = container_of(attr, typeof(*lattr), attr);
 arch/arm/mm/cache-l2x0-pmu.c:346:	return snprintf(buf, PAGE_SIZE, "config=0x%x\n", lattr->config);
 arch/arm/mm/cache-l2x0-pmu.c-347-}
 --
 arch/arm/plat-orion/gpio.c=520=void __init orion_gpio_init(int gpio_base, int ngpio,
 --
 arch/arm/plat-orion/gpio.c-533-
 arch/arm/plat-orion/gpio.c:534:	snprintf(gc_label, sizeof(gc_label), "orion_gpio%d",
 arch/arm/plat-orion/gpio.c-535-		orion_gpio_chip_count);
 --
 arch/arm64/kvm/ptdump.c=93=static int kvm_ptdump_build_levels(struct ptdump_pg_level *level, u32 start_lvl)
 --
 arch/arm64/kvm/ptdump.c-105-	for (i = start_lvl; i < KVM_PGTABLE_MAX_LEVELS; i++) {
 arch/arm64/kvm/ptdump.c:106:		snprintf(level[i].name, sizeof(level[i].name), "%u", i);
 arch/arm64/kvm/ptdump.c-107-
 --
 arch/arm64/kvm/ptdump.c=276=void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu)
 --
 arch/arm64/kvm/ptdump.c-280-
 arch/arm64/kvm/ptdump.c:281:	snprintf(file_name, sizeof(file_name), "0x%016llx-0x%016llx-s2-%sabled",
 arch/arm64/kvm/ptdump.c-282-		 mmu->tlb_vttbr,
 --
 arch/loongarch/kernel/kdebugfs.c=20=static ssize_t sfb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-26-
 arch/loongarch/kernel/kdebugfs.c:27:	s = snprintf(str, sizeof(str), "Boot State: %x\nCurrent State: %x\n", sfb_state, state);
 arch/loongarch/kernel/kdebugfs.c-28-
 --
 arch/loongarch/kernel/kdebugfs.c=93=static ssize_t tso_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-99-
 arch/loongarch/kernel/kdebugfs.c:100:	s = snprintf(str, sizeof(str), "Boot State: %d (%s)\n"
 arch/loongarch/kernel/kdebugfs.c-101-			               "Current State: %d (%s)\n\n"
 --
 arch/m68k/emu/natfeat.c=55=void nfprint(const char *fmt, ...)
 --
 arch/m68k/emu/natfeat.c-60-	va_start(ap, fmt);
 arch/m68k/emu/natfeat.c:61:	vsnprintf(buf, 256, fmt, ap);
 arch/m68k/emu/natfeat.c-62-	nf_call(nf_get_id("NF_STDERR"), virt_to_phys(buf));
 --
 arch/m68k/emu/nfblock.c=97=static int __init nfhd_init_one(int id, u32 blocks, u32 bsize)
 --
 arch/m68k/emu/nfblock.c-134-	dev->disk->private_data = dev;
 arch/m68k/emu/nfblock.c:135:	snprintf(dev->disk->disk_name, sizeof(dev->disk->disk_name), "nfhd%u",
 arch/m68k/emu/nfblock.c-136-		 dev_id);
 --
 arch/m68k/sun3/prom/printf.c=24=prom_printf(char *fmt, ...)
 --
 arch/m68k/sun3/prom/printf.c-32-	ppbuf[0] = 'O';
 arch/m68k/sun3/prom/printf.c:33:	vsnprintf(ppbuf + 1, sizeof(ppbuf) - 1, fmt, args);
 arch/m68k/sun3/prom/printf.c-34-#else
 arch/m68k/sun3/prom/printf.c:35:	vsnprintf(ppbuf, sizeof(ppbuf), fmt, args);
 arch/m68k/sun3/prom/printf.c-36-#endif
 --
 arch/m68k/virt/config.c=80=void __init config_virt(void)
 --
 arch/m68k/virt/config.c-83-
 arch/m68k/virt/config.c:84:	snprintf(earlycon, sizeof(earlycon), "early_gf_tty,0x%08x",
 arch/m68k/virt/config.c-85-		 virt_bi_data.tty.mmio);
 --
 arch/mips/bcm47xx/prom.c=48=__init void bcm47xx_set_system_type(u16 chip_id)
 arch/mips/bcm47xx/prom.c-49-{
 arch/mips/bcm47xx/prom.c:50:	snprintf(bcm47xx_system_type, sizeof(bcm47xx_system_type),
 arch/mips/bcm47xx/prom.c-51-		 (chip_id > 0x9999) ? "Broadcom BCM%d" :
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c=728=void __init board_prom_init(void)
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-752-			if(cfe[5] == 'd')
 arch/mips/bcm63xx/boards/board_bcm963xx.c:753:				snprintf(cfe_version, 11, "%s",
 arch/mips/bcm63xx/boards/board_bcm963xx.c-754-					 (char *) &cfe[5]);
 arch/mips/bcm63xx/boards/board_bcm963xx.c-755-			else if (cfe[10] > 0)
 arch/mips/bcm63xx/boards/board_bcm963xx.c:756:				snprintf(cfe_version, sizeof(cfe_version),
 arch/mips/bcm63xx/boards/board_bcm963xx.c-757-					 "%u.%u.%u-%u.%u-%u", cfe[5], cfe[6],
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-759-			else
 arch/mips/bcm63xx/boards/board_bcm963xx.c:760:				snprintf(cfe_version, sizeof(cfe_version),
 arch/mips/bcm63xx/boards/board_bcm963xx.c-761-					 "%u.%u.%u-%u.%u", cfe[5], cfe[6],
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-763-		} else {
 arch/mips/bcm63xx/boards/board_bcm963xx.c:764:			snprintf(cfe_version, 12, "%s", (char *) &cfe[4]);
 arch/mips/bcm63xx/boards/board_bcm963xx.c-765-		}
 --
 arch/mips/bcm63xx/setup.c=141=const char *get_system_type(void)
 --
 arch/mips/bcm63xx/setup.c-143-	static char buf[128];
 arch/mips/bcm63xx/setup.c:144:	snprintf(buf, sizeof(buf), "bcm63xx/%s (0x%04x/0x%02X)",
 arch/mips/bcm63xx/setup.c-145-		 board_get_name(),
 --
 arch/mips/cavium-octeon/octeon-platform.c=483=static void __init octeon_fdt_set_phy(int eth, int phy_addr)
 --
 arch/mips/cavium-octeon/octeon-platform.c-555-
 arch/mips/cavium-octeon/octeon-platform.c:556:	snprintf(new_name, sizeof(new_name), "ethernet-phy@%x", phy_addr);
 arch/mips/cavium-octeon/octeon-platform.c-557-
 --
 arch/mips/cavium-octeon/octeon-platform.c=649=static void __init octeon_fdt_pip_port(int iface, int i, int p, int max)
 --
 arch/mips/cavium-octeon/octeon-platform.c-656-
 arch/mips/cavium-octeon/octeon-platform.c:657:	snprintf(name_buffer, sizeof(name_buffer), "ethernet@%x", p);
 arch/mips/cavium-octeon/octeon-platform.c-658-	eth = fdt_subnode_offset(initial_boot_params, iface, name_buffer);
 --
 arch/mips/cavium-octeon/octeon-platform.c=682=static void __init octeon_fdt_pip_iface(int pip, int idx)
 --
 arch/mips/cavium-octeon/octeon-platform.c-688-
 arch/mips/cavium-octeon/octeon-platform.c:689:	snprintf(name_buffer, sizeof(name_buffer), "interface@%d", idx);
 arch/mips/cavium-octeon/octeon-platform.c-690-	iface = fdt_subnode_offset(initial_boot_params, pip, name_buffer);
 --
 arch/mips/cavium-octeon/octeon-platform.c=701=void __init octeon_fill_mac_addresses(void)
 --
 arch/mips/cavium-octeon/octeon-platform.c-724-
 arch/mips/cavium-octeon/octeon-platform.c:725:		snprintf(name_buffer, sizeof(name_buffer), "mix%d", i);
 arch/mips/cavium-octeon/octeon-platform.c-726-		alias_prop = fdt_getprop(initial_boot_params, aliases,
 --
 arch/mips/cavium-octeon/octeon-platform.c-747-
 arch/mips/cavium-octeon/octeon-platform.c:748:		snprintf(name_buffer, sizeof(name_buffer), "interface@%d", i);
 arch/mips/cavium-octeon/octeon-platform.c-749-		iface = fdt_subnode_offset(initial_boot_params, pip,
 --
 arch/mips/cavium-octeon/octeon-platform.c-755-
 arch/mips/cavium-octeon/octeon-platform.c:756:			snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-757-				 "ethernet@%x", p);
 --
 arch/mips/cavium-octeon/octeon-platform.c=767=int __init octeon_prune_device_tree(void)
 --
 arch/mips/cavium-octeon/octeon-platform.c-800-
 arch/mips/cavium-octeon/octeon-platform.c:801:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-802-			 "mix%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-842-
 arch/mips/cavium-octeon/octeon-platform.c:843:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-844-			 "twsi%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-873-
 arch/mips/cavium-octeon/octeon-platform.c:874:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-875-			 "smi%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-900-
 arch/mips/cavium-octeon/octeon-platform.c:901:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-902-			 "uart%d", i);
 --
 arch/mips/cavium-octeon/setup.c=493=static void __init init_octeon_system_type(void)
 --
 arch/mips/cavium-octeon/setup.c-508-
 arch/mips/cavium-octeon/setup.c:509:	snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
 arch/mips/cavium-octeon/setup.c-510-		 board_type, octeon_model_get_string(read_c0_prid()));
 --
 arch/mips/dec/prom/identify.c=44=const char *get_system_type(void)
 --
 arch/mips/dec/prom/identify.c-51-		called = 1;
 arch/mips/dec/prom/identify.c:52:		snprintf(system, STR_BUF_LEN, "Digital %s",
 arch/mips/dec/prom/identify.c-53-			 dec_system_strings[mips_machtype]);
 --
 arch/mips/generic/yamon-dt.c=75=__init int yamon_dt_append_memory(void *fdt,
 --
 arch/mips/generic/yamon-dt.c-109-	for (i = 0; i < ARRAY_SIZE(var_names); i++) {
 arch/mips/generic/yamon-dt.c:110:		snprintf(param_name, sizeof(param_name), "%s=", var_names[i]);
 arch/mips/generic/yamon-dt.c-111-		var = strstr(arcs_cmdline, param_name);
 --
 arch/mips/generic/yamon-dt.c=157=__init int yamon_dt_serial_config(void *fdt)
 --
 arch/mips/generic/yamon-dt.c-179-
 arch/mips/generic/yamon-dt.c:180:	snprintf(mode_var_name, sizeof(mode_var_name), "modetty%u", uart);
 arch/mips/generic/yamon-dt.c-181-	mode_var = fw_getenv(mode_var_name);
 --
 arch/mips/generic/yamon-dt.c-210-
 arch/mips/generic/yamon-dt.c:211:	WARN_ON(snprintf(path, sizeof(path), "serial%u:%u%c%u%s",
 arch/mips/generic/yamon-dt.c-212-			 uart, baud, parity, stop_bits,
 --
 arch/mips/kernel/mips-cm.c=393=void mips_cm_error_report(void)
 --
 arch/mips/kernel/mips-cm.c-421-
 arch/mips/kernel/mips-cm.c:422:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-423-				 "CCA=%lu TR=%s MCmd=%s STag=%lu "
 --
 arch/mips/kernel/mips-cm.c-435-
 arch/mips/kernel/mips-cm.c:436:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-437-				 "C3=%s C2=%s C1=%s C0=%s SC=%s "
 --
 arch/mips/kernel/mips-cm.c-451-
 arch/mips/kernel/mips-cm.c:452:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-453-				 "Type=%s%s Instr=%s DW=%lu Way=%lu "
 --
 arch/mips/kernel/mips-cm.c-490-			unsigned long bank_bit = (cm_error >> 28) & 0x1;
 arch/mips/kernel/mips-cm.c:491:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-492-				 "%s ECC Error: Way=%lu (DWORD=%lu, Sets=%lu)"
 --
 arch/mips/kernel/mips-cm.c-510-
 arch/mips/kernel/mips-cm.c:511:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-512-				 "Decode Request Error: Type=%lu, Command=%lu"
 --
 arch/mips/kernel/traps.c=1991=void __noreturn nmi_exception_handler(struct pt_regs *regs)
 --
 arch/mips/kernel/traps.c-1997-	bust_spinlocks(1);
 arch/mips/kernel/traps.c:1998:	snprintf(str, 100, "CPU%d NMI taken, CP0_EPC=%lx\n",
 arch/mips/kernel/traps.c-1999-		 smp_processor_id(), regs->cp0_epc);
 --
 arch/mips/lantiq/prom.c=100=void __init prom_init(void)
 --
 arch/mips/lantiq/prom.c-103-	ltq_soc_detect(&soc_info);
 arch/mips/lantiq/prom.c:104:	snprintf(soc_info.sys_type, LTQ_SYS_TYPE_LEN - 1, "%s rev %s",
 arch/mips/lantiq/prom.c-105-		soc_info.name, soc_info.rev_type);
 --
 arch/mips/mti-malta/malta-dtshim.c=131=static void __init append_memory(void *fdt, int root_off)
 --
 arch/mips/mti-malta/malta-dtshim.c-179-	for (i = 0; i < ARRAY_SIZE(var_names); i++) {
 arch/mips/mti-malta/malta-dtshim.c:180:		snprintf(param_name, sizeof(param_name), "%s=", var_names[i]);
 arch/mips/mti-malta/malta-dtshim.c-181-		var = strstr(arcs_cmdline, param_name);
 --
 arch/mips/pci/pci-xtalk-bridge.c=568=static int bridge_get_partnum(u64 baddr, char *partnum)
 --
 arch/mips/pci/pci-xtalk-bridge.c-575-
 arch/mips/pci/pci-xtalk-bridge.c:576:	snprintf(prefix, sizeof(prefix), "bridge-%012llx-0b-", baddr);
 arch/mips/pci/pci-xtalk-bridge.c-577-
 --
 arch/mips/ralink/mt7620.c=220=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/mt7620.c-226-
 arch/mips/ralink/mt7620.c:227:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/mt7620.c-228-		"MediaTek %s ver:%u eco:%u",
 --
 arch/mips/ralink/mt7621.c=167=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/mt7621.c-198-
 arch/mips/ralink/mt7621.c:199:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/mt7621.c-200-		"MediaTek %s ver:%u eco:%u",
 --
 arch/mips/ralink/rt288x.c=90=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt288x.c-97-
 arch/mips/ralink/rt288x.c:98:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt288x.c-99-		"Ralink %s id:%u rev:%u",
 --
 arch/mips/ralink/rt305x.c=193=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt305x.c-196-
 arch/mips/ralink/rt305x.c:197:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt305x.c-198-		"Ralink %s id:%u rev:%u",
 --
 arch/mips/ralink/rt3883.c=90=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt3883.c-97-
 arch/mips/ralink/rt3883.c:98:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt3883.c-99-		"Ralink %s ver:%u eco:%u",
 --
 arch/mips/sgi-ip27/ip27-xtalk.c=26=static void bridge_platform_create(nasid_t nasid, int widget, int masterwid)
 --
 arch/mips/sgi-ip27/ip27-xtalk.c-42-
 arch/mips/sgi-ip27/ip27-xtalk.c:43:	snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx",
 arch/mips/sgi-ip27/ip27-xtalk.c-44-		 offset + (widget << SWIN_SIZE_BITS));
 --
 arch/mips/sgi-ip30/ip30-xtalk.c=39=static void bridge_platform_create(int widget, int masterwid)
 --
 arch/mips/sgi-ip30/ip30-xtalk.c-52-
 arch/mips/sgi-ip30/ip30-xtalk.c:53:	snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx",
 arch/mips/sgi-ip30/ip30-xtalk.c-54-		 IP30_SWIN_BASE(widget));
 --
 arch/mips/txx9/generic/setup.c=635=void __init txx9_iocled_init(unsigned long baseaddr,
 --
 arch/mips/txx9/generic/setup.c-675-		struct gpio_led *led = &iocled->leds[i];
 arch/mips/txx9/generic/setup.c:676:		snprintf(iocled->names[i], sizeof(iocled->names[i]),
 arch/mips/txx9/generic/setup.c-677-			 "iocled:%s:%u", color, i);
 --
 arch/parisc/kernel/cache.c=135=show_cache_info(struct seq_file *m)
 --
 arch/parisc/kernel/cache.c-141-	if (cache_info.dc_loop != 1)
 arch/parisc/kernel/cache.c:142:		snprintf(buf, 32, "%lu-way associative", cache_info.dc_loop);
 arch/parisc/kernel/cache.c-143-	seq_printf(m, "D-cache\t\t: %ld KB (%s%s, %s, alias=%d)\n",
 --
 arch/parisc/kernel/drivers.c=493=alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
 --
 arch/parisc/kernel/drivers.c-536-	name = parisc_hardware_description(&dev->id) ? : "unknown";
 arch/parisc/kernel/drivers.c:537:	snprintf(dev->name, sizeof(dev->name), "%s [%s]",
 arch/parisc/kernel/drivers.c-538-		name, parisc_pathname(dev));
 --
 arch/powerpc/kernel/fadump.c=149=void __init fadump_append_bootargs(void)
 --
 arch/powerpc/kernel/fadump.c-175-	pr_debug("Cmdline: %s\n", boot_command_line);
 arch/powerpc/kernel/fadump.c:176:	snprintf(boot_command_line + len, COMMAND_LINE_SIZE - len, " %s", append_args);
 arch/powerpc/kernel/fadump.c-177-	pr_info("Updated cmdline: %s\n", boot_command_line);
 --
 arch/powerpc/kernel/rtas.c=1644=void rtas_os_term(char *str)
 --
 arch/powerpc/kernel/rtas.c-1659-
 arch/powerpc/kernel/rtas.c:1660:	snprintf(rtas_os_term_buf, 2048, "OS panic: %s", str);
 arch/powerpc/kernel/rtas.c-1661-
 --
 arch/powerpc/kernel/rtas_flash.c=449=static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf, 
 --
 arch/powerpc/kernel/rtas_flash.c-457-		    (args_buf->update_results == VALIDATE_TMP_UPDATE))
 arch/powerpc/kernel/rtas_flash.c:458:			n += snprintf(msg + n, msglen - n, "%s\n",
 arch/powerpc/kernel/rtas_flash.c-459-					args_buf->buf);
 --
 arch/powerpc/kernel/udbg.c=114=void udbg_printf(const char *fmt, ...)
 --
 arch/powerpc/kernel/udbg.c-120-		va_start(args, fmt);
 arch/powerpc/kernel/udbg.c:121:		vsnprintf(buf, UDBG_BUFSIZE, fmt, args);
 arch/powerpc/kernel/udbg.c-122-		udbg_puts(buf);
 --
 arch/powerpc/kexec/file_load_64.c=194=static int add_usable_mem_property(void *fdt, struct device_node *dn,
 --
 arch/powerpc/kexec/file_load_64.c-203-
 arch/powerpc/kexec/file_load_64.c:204:	if (snprintf(path, NODE_PATH_LEN, "%pOF", dn) > (NODE_PATH_LEN - 1)) {
 arch/powerpc/kexec/file_load_64.c-205-		pr_err("Buffer (%d) too small for memory node: %pOF\n",
 --
 arch/powerpc/kvm/book3s_hv.c=2864=static ssize_t debugfs_timings_read(struct file *file, char __user *buf,
 --
 arch/powerpc/kvm/book3s_hv.c-2899-			if (!ok)
 arch/powerpc/kvm/book3s_hv.c:2900:				snprintf(s, buf_end - s, "%s: stuck\n",
 arch/powerpc/kvm/book3s_hv.c-2901-					timings[i].name);
 arch/powerpc/kvm/book3s_hv.c-2902-			else
 arch/powerpc/kvm/book3s_hv.c:2903:				snprintf(s, buf_end - s,
 arch/powerpc/kvm/book3s_hv.c-2904-					"%s: %llu %llu %llu %llu\n",
 --
 arch/powerpc/perf/hv-24x7.c=388=static char *event_fmt(struct hv_24x7_event_data *event, unsigned int domain)
 --
 arch/powerpc/perf/hv-24x7.c-396-	case HV_PERF_DOMAIN_PHYS_CHIP:
 arch/powerpc/perf/hv-24x7.c:397:		snprintf(buf, sizeof(buf), "%d", domain);
 arch/powerpc/perf/hv-24x7.c-398-		domain_str = buf;
 --
 arch/powerpc/platforms/512x/clock-commonclk.c=704=static void __init mpc512x_clk_setup_clock_tree(struct device_node *np, int busfreq)
 --
 arch/powerpc/platforms/512x/clock-commonclk.c-822-		char name[12];
 arch/powerpc/platforms/512x/clock-commonclk.c:823:		snprintf(name, sizeof(name), "psc%d", mclk_idx);
 arch/powerpc/platforms/512x/clock-commonclk.c-824-		clks[MPC512x_CLK_PSC0 + mclk_idx] = mpc512x_clk_gated(
 --
 arch/powerpc/platforms/512x/clock-commonclk.c=951=static void __init mpc5121_clk_provide_migration_support(void)
 --
 arch/powerpc/platforms/512x/clock-commonclk.c-988-	of_address_to_resource(np, 0, &res); \
 arch/powerpc/platforms/512x/clock-commonclk.c:989:	snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
 arch/powerpc/platforms/512x/clock-commonclk.c-990-} while (0)
 --
 arch/powerpc/platforms/82xx/ep8248e.c=109=static int ep8248e_mdio_probe(struct platform_device *ofdev)
 --
 arch/powerpc/platforms/82xx/ep8248e.c-130-	bus->parent = &ofdev->dev;
]
]

gemini-3.1-pro-preview

							input: 76470
							output: 16
							thoughts: 12
						

Okay, here's my interpretation of those thoughts, crafted with the understanding that I'm speaking to a fellow expert:

**Navigating the BPF Landscape**

Alright, so the discussion has moved on, and my mind is immediately drawn to the heart of the matter when we talk about BPF helpers. Specifically, I'm thinking about the implementation details. When someone mentions "helpers," the first file that pops into my head is `kernel/bpf/helpers.c`. That's where all the magic happens, right? It's the central repository for those crucial functions that BPF programs leverage to interact with the kernel. I'm imagining us having this conversation and going directly to that file to dive into the specifics!

map[Expression:snprintf]

map[Output:
Full output is too long, showing 500 out of 43682 lines.
Use more precise expression if possible.

[Documentation/admin-guide/media/visl.rst=146=integer that denotes the buffer sequence, i.e.:
 --
 Documentation/admin-guide/media/visl.rst-149-
 Documentation/admin-guide/media/visl.rst:150:	snprintf(name, 32, "bitstream%d", run->src->sequence);
 Documentation/admin-guide/media/visl.rst-151-
 --
 Documentation/core-api/printk-formats.rst=53=unsupported specifier or length qualifier results in a WARN and early
 Documentation/core-api/printk-formats.rst:54:return from vsnprintf().
 Documentation/core-api/printk-formats.rst-55-
 --
 Documentation/core-api/printk-formats.rst=150=either kernel memory (k) or user memory (u). The subsequent ``s`` specifier
 Documentation/core-api/printk-formats.rst:151:results in printing a string. For direct use in regular vsnprintf() the (k)
 Documentation/core-api/printk-formats.rst-152-and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(),
 --
 Documentation/core-api/printk-formats.rst=467=and va_list as follows::
 --
 Documentation/core-api/printk-formats.rst-473-
 Documentation/core-api/printk-formats.rst:474:Implements a "recursive vsnprintf".
 Documentation/core-api/printk-formats.rst-475-
 --
 Documentation/driver-api/gpio/board.rst=57=with the string passed in con_id to get the resulting string
 Documentation/driver-api/gpio/board.rst:58:(``snprintf(... "%s-%s", con_id, gpio_suffixes[]``).
 Documentation/driver-api/gpio/board.rst-59-
 --
 Documentation/driver-api/nvdimm/nvdimm.rst=529=internally with a static identifier::
 --
 Documentation/driver-api/nvdimm/nvdimm.rst-536-
 Documentation/driver-api/nvdimm/nvdimm.rst:537:          snprintf(devname, sizeof(devname), "namespace%d.%d",
 Documentation/driver-api/nvdimm/nvdimm.rst-538-                          ndctl_region_get_id(region), parameters->id);
 --
 Documentation/filesystems/sysfs.rst=261=A very simple (and naive) implementation of a device attribute is::
 --
 Documentation/filesystems/sysfs.rst-271-    {
 Documentation/filesystems/sysfs.rst:272:	    snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/filesystems/sysfs.rst-273-		    (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/i2c/dev-interface.rst=35=Next thing, open the device file, as follows::
 --
 Documentation/i2c/dev-interface.rst-40-
 Documentation/i2c/dev-interface.rst:41:  snprintf(filename, 19, "/dev/i2c-%d", adapter_nr);
 Documentation/i2c/dev-interface.rst-42-  file = open(filename, O_RDWR);
 --
 Documentation/input/uinput.rst=185=but interact with uinput via ioctl calls, or use libevdev.
 --
 Documentation/input/uinput.rst-213-      memset(&uud, 0, sizeof(uud));
 Documentation/input/uinput.rst:214:      snprintf(uud.name, UINPUT_MAX_NAME_SIZE, "uinput old interface");
 Documentation/input/uinput.rst-215-      write(fd, &uud, sizeof(uud));
 --
 Documentation/livepatch/module-elf-format.rst=146=module that patches vmlinux and modules 9p, btrfs, ext4:**
 --
 Documentation/livepatch/module-elf-format.rst-178-  0000000000000036  0000003b00000002 R_X86_64_PC32          0000000000000000 .klp.sym.btrfs.can_modify_feature.isra.3,0 - 4
 Documentation/livepatch/module-elf-format.rst:179:  000000000000004c  0000004900000002 R_X86_64_PC32          0000000000000000 .klp.sym.vmlinux.snprintf,0 - 4
 Documentation/livepatch/module-elf-format.rst-180-  [ snip ]                                                                   ^
 --
 Documentation/livepatch/module-elf-format.rst=267=Examples:
 --
 Documentation/livepatch/module-elf-format.rst-273-
 Documentation/livepatch/module-elf-format.rst:274:	.klp.sym.vmlinux.snprintf,0
 Documentation/livepatch/module-elf-format.rst-275-	.klp.sym.vmlinux.printk,0
 --
 Documentation/livepatch/module-elf-format.rst-284-     [ snip ]
 Documentation/livepatch/module-elf-format.rst:285:      73: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT OS [0xff20] .klp.sym.vmlinux.snprintf,0
 Documentation/livepatch/module-elf-format.rst-286-      74: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT OS [0xff20] .klp.sym.vmlinux.capable,0
 --
 Documentation/scsi/ChangeLog.lpfc=1399=Changes from 20040409 to 20040416
 --
 Documentation/scsi/ChangeLog.lpfc-1430-	* Fix RHEL 3 build by #defining EXPORT_SYMTAB.
 Documentation/scsi/ChangeLog.lpfc:1431:	* Replace sprintf with snprintf in lpfc_proc_info.
 Documentation/scsi/ChangeLog.lpfc-1432-	* Fix build warnings on 2.6 kernels - remove no longer used calls
 --
 Documentation/trace/ftrace.rst=90=of ftrace. Here is a list of some of the key files:
 --
 Documentation/trace/ftrace.rst-633-			va_start(ap, fmt);
 Documentation/trace/ftrace.rst:634:			n = vsnprintf(buf, 256, fmt, ap);
 Documentation/trace/ftrace.rst-635-			va_end(ap);
 --
 Documentation/trace/ftrace.rst=2515=something like this simple program.
 --
 Documentation/trace/ftrace.rst-2567-	       static char trace_file[MAX_PATH+1];
 Documentation/trace/ftrace.rst:2568:	       snprintf(trace_file, MAX_PATH, "%s/%s", find_tracefs(), file_name);
 Documentation/trace/ftrace.rst-2569-	       return trace_file;
 --
 Documentation/trace/timerlat-tracer.rst=226=Here is an basic example of user-space code for timerlat::
 --
 Documentation/trace/timerlat-tracer.rst-241-
 Documentation/trace/timerlat-tracer.rst:242:	snprintf(buffer, sizeof(buffer),
 Documentation/trace/timerlat-tracer.rst-243-		"/sys/kernel/tracing/osnoise/per_cpu/cpu%ld/timerlat_fd",
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-63-内核的printf不支持%n。显而易见，浮点格式(%e, %f, %g, %a)也不被识别。使用任何不
 Documentation/translations/zh_CN/core-api/printk-formats.rst:64:支持的占位符或长度限定符都会导致一个WARN并且终止vsnprintf()执行。
 Documentation/translations/zh_CN/core-api/printk-formats.rst-65-
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst=96=seq_printf()，而不是printk()）由用户空间进程读取，使用下面描述的%pK修饰符，不
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-147-``k`` 和 ``u`` 指定符用于打印来自内核内存(k)或用户内存(u)的先前探测的内存。后面的 ``s`` 指
 Documentation/translations/zh_CN/core-api/printk-formats.rst:148:定符的结果是打印一个字符串。对于直接在常规的vsnprintf()中使用时，(k)和(u)注释被忽略，但是，当
 Documentation/translations/zh_CN/core-api/printk-formats.rst-149-在BPF的bpf_trace_printk()之外使用时，它会读取它所指向的内存，不会出现错误。
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst=407=va_format结构体
 --
 Documentation/translations/zh_CN/core-api/printk-formats.rst-423-
 Documentation/translations/zh_CN/core-api/printk-formats.rst:424:实现 "递归vsnprintf"。
 Documentation/translations/zh_CN/core-api/printk-formats.rst-425-
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt=190=Sysfs 将会为每次读写操作调用一次这个方法。这使得这些方法在执行时
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt-217-
 Documentation/translations/zh_CN/filesystems/sysfs.txt:218:- show() 方法在将格式化返回值返回用户空间的时候，禁止使用snprintf()。
 Documentation/translations/zh_CN/filesystems/sysfs.txt-219-  如果可以保证不会发生缓冲区溢出，可以使用sprintf()，否则必须使用
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt=240=static ssize_t store_name(struct device *dev, struct device_attribute *attr,
 --
 Documentation/translations/zh_CN/filesystems/sysfs.txt-242-{
 Documentation/translations/zh_CN/filesystems/sysfs.txt:243:        snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/translations/zh_CN/filesystems/sysfs.txt-244-                 (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt=193=Sysfs 將會爲每次讀寫操作調用一次這個方法。這使得這些方法在執行時
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt-220-
 Documentation/translations/zh_TW/filesystems/sysfs.txt:221:- show() 方法在將格式化返回值返回用戶空間的時候，禁止使用snprintf()。
 Documentation/translations/zh_TW/filesystems/sysfs.txt-222-  如果可以保證不會發生緩衝區溢出，可以使用sprintf()，否則必須使用
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt=243=static ssize_t store_name(struct device *dev, struct device_attribute *attr,
 --
 Documentation/translations/zh_TW/filesystems/sysfs.txt-245-{
 Documentation/translations/zh_TW/filesystems/sysfs.txt:246:        snprintf(dev->name, sizeof(dev->name), "%.*s",
 Documentation/translations/zh_TW/filesystems/sysfs.txt-247-                 (int)min(count, sizeof(dev->name) - 1), buf);
 --
 Documentation/userspace-api/media/v4l/dev-osd.rst=57=Example: Finding a framebuffer device for OSD
 --
 Documentation/userspace-api/media/v4l/dev-osd.rst-76-
 Documentation/userspace-api/media/v4l/dev-osd.rst:77:	snprintf(dev_name, sizeof(dev_name), "/dev/fb%u", i);
 Documentation/userspace-api/media/v4l/dev-osd.rst-78-
 --
 arch/arm/kernel/process.c=112=void __show_regs(struct pt_regs *regs)
 --
 arch/arm/kernel/process.c-188-			    : "=r" (transbase));
 arch/arm/kernel/process.c:189:			snprintf(buf, sizeof(buf), "  Table: %08x  DAC: %08x",
 arch/arm/kernel/process.c-190-				transbase, domain);
 --
 arch/arm/kernel/setup.c=358=void __init early_print(const char *str, ...)
 --
 arch/arm/kernel/setup.c-364-	va_start(ap, str);
 arch/arm/kernel/setup.c:365:	vsnprintf(buf, sizeof(buf), str, ap);
 arch/arm/kernel/setup.c-366-	va_end(ap);
 --
 arch/arm/kernel/setup.c=700=static void __init setup_processor(void)
 --
 arch/arm/kernel/setup.c-722-
 arch/arm/kernel/setup.c:723:	snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
 arch/arm/kernel/setup.c-724-		 list->arch_name, ENDIANNESS);
 arch/arm/kernel/setup.c:725:	snprintf(elf_platform, ELF_PLATFORM_SIZE, "%s%c",
 arch/arm/kernel/setup.c-726-		 list->elf_name, ENDIANNESS);
 --
 arch/arm/mach-dove/pcie.c=35=static int __init dove_pcie_setup(int nr, struct pci_sys_data *sys)
 --
 arch/arm/mach-dove/pcie.c-61-	 */
 arch/arm/mach-dove/pcie.c:62:	snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
 arch/arm/mach-dove/pcie.c-63-		 "PCIe %d MEM", pp->index);
 --
 arch/arm/mach-mv78xx0/pcie.c=54=static void __init mv78xx0_pcie_preinit(void)
 --
 arch/arm/mach-mv78xx0/pcie.c-76-
 arch/arm/mach-mv78xx0/pcie.c:77:		snprintf(pp->mem_space_name, sizeof(pp->mem_space_name),
 arch/arm/mach-mv78xx0/pcie.c-78-			"PCIe %d.%d MEM", pp->maj, pp->min);
 --
 arch/arm/mm/cache-l2x0-pmu.c=340=static ssize_t l2x0_pmu_event_show(struct device *dev,
 --
 arch/arm/mm/cache-l2x0-pmu.c-345-	lattr = container_of(attr, typeof(*lattr), attr);
 arch/arm/mm/cache-l2x0-pmu.c:346:	return snprintf(buf, PAGE_SIZE, "config=0x%x\n", lattr->config);
 arch/arm/mm/cache-l2x0-pmu.c-347-}
 --
 arch/arm/plat-orion/gpio.c=520=void __init orion_gpio_init(int gpio_base, int ngpio,
 --
 arch/arm/plat-orion/gpio.c-533-
 arch/arm/plat-orion/gpio.c:534:	snprintf(gc_label, sizeof(gc_label), "orion_gpio%d",
 arch/arm/plat-orion/gpio.c-535-		orion_gpio_chip_count);
 --
 arch/arm64/kvm/ptdump.c=93=static int kvm_ptdump_build_levels(struct ptdump_pg_level *level, u32 start_lvl)
 --
 arch/arm64/kvm/ptdump.c-105-	for (i = start_lvl; i < KVM_PGTABLE_MAX_LEVELS; i++) {
 arch/arm64/kvm/ptdump.c:106:		snprintf(level[i].name, sizeof(level[i].name), "%u", i);
 arch/arm64/kvm/ptdump.c-107-
 --
 arch/arm64/kvm/ptdump.c=276=void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu)
 --
 arch/arm64/kvm/ptdump.c-280-
 arch/arm64/kvm/ptdump.c:281:	snprintf(file_name, sizeof(file_name), "0x%016llx-0x%016llx-s2-%sabled",
 arch/arm64/kvm/ptdump.c-282-		 mmu->tlb_vttbr,
 --
 arch/loongarch/kernel/kdebugfs.c=20=static ssize_t sfb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-26-
 arch/loongarch/kernel/kdebugfs.c:27:	s = snprintf(str, sizeof(str), "Boot State: %x\nCurrent State: %x\n", sfb_state, state);
 arch/loongarch/kernel/kdebugfs.c-28-
 --
 arch/loongarch/kernel/kdebugfs.c=93=static ssize_t tso_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/loongarch/kernel/kdebugfs.c-99-
 arch/loongarch/kernel/kdebugfs.c:100:	s = snprintf(str, sizeof(str), "Boot State: %d (%s)\n"
 arch/loongarch/kernel/kdebugfs.c-101-			               "Current State: %d (%s)\n\n"
 --
 arch/m68k/emu/natfeat.c=55=void nfprint(const char *fmt, ...)
 --
 arch/m68k/emu/natfeat.c-60-	va_start(ap, fmt);
 arch/m68k/emu/natfeat.c:61:	vsnprintf(buf, 256, fmt, ap);
 arch/m68k/emu/natfeat.c-62-	nf_call(nf_get_id("NF_STDERR"), virt_to_phys(buf));
 --
 arch/m68k/emu/nfblock.c=97=static int __init nfhd_init_one(int id, u32 blocks, u32 bsize)
 --
 arch/m68k/emu/nfblock.c-134-	dev->disk->private_data = dev;
 arch/m68k/emu/nfblock.c:135:	snprintf(dev->disk->disk_name, sizeof(dev->disk->disk_name), "nfhd%u",
 arch/m68k/emu/nfblock.c-136-		 dev_id);
 --
 arch/m68k/sun3/prom/printf.c=24=prom_printf(char *fmt, ...)
 --
 arch/m68k/sun3/prom/printf.c-32-	ppbuf[0] = 'O';
 arch/m68k/sun3/prom/printf.c:33:	vsnprintf(ppbuf + 1, sizeof(ppbuf) - 1, fmt, args);
 arch/m68k/sun3/prom/printf.c-34-#else
 arch/m68k/sun3/prom/printf.c:35:	vsnprintf(ppbuf, sizeof(ppbuf), fmt, args);
 arch/m68k/sun3/prom/printf.c-36-#endif
 --
 arch/m68k/virt/config.c=80=void __init config_virt(void)
 --
 arch/m68k/virt/config.c-83-
 arch/m68k/virt/config.c:84:	snprintf(earlycon, sizeof(earlycon), "early_gf_tty,0x%08x",
 arch/m68k/virt/config.c-85-		 virt_bi_data.tty.mmio);
 --
 arch/mips/bcm47xx/prom.c=48=__init void bcm47xx_set_system_type(u16 chip_id)
 arch/mips/bcm47xx/prom.c-49-{
 arch/mips/bcm47xx/prom.c:50:	snprintf(bcm47xx_system_type, sizeof(bcm47xx_system_type),
 arch/mips/bcm47xx/prom.c-51-		 (chip_id > 0x9999) ? "Broadcom BCM%d" :
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c=728=void __init board_prom_init(void)
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-752-			if(cfe[5] == 'd')
 arch/mips/bcm63xx/boards/board_bcm963xx.c:753:				snprintf(cfe_version, 11, "%s",
 arch/mips/bcm63xx/boards/board_bcm963xx.c-754-					 (char *) &cfe[5]);
 arch/mips/bcm63xx/boards/board_bcm963xx.c-755-			else if (cfe[10] > 0)
 arch/mips/bcm63xx/boards/board_bcm963xx.c:756:				snprintf(cfe_version, sizeof(cfe_version),
 arch/mips/bcm63xx/boards/board_bcm963xx.c-757-					 "%u.%u.%u-%u.%u-%u", cfe[5], cfe[6],
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-759-			else
 arch/mips/bcm63xx/boards/board_bcm963xx.c:760:				snprintf(cfe_version, sizeof(cfe_version),
 arch/mips/bcm63xx/boards/board_bcm963xx.c-761-					 "%u.%u.%u-%u.%u", cfe[5], cfe[6],
 --
 arch/mips/bcm63xx/boards/board_bcm963xx.c-763-		} else {
 arch/mips/bcm63xx/boards/board_bcm963xx.c:764:			snprintf(cfe_version, 12, "%s", (char *) &cfe[4]);
 arch/mips/bcm63xx/boards/board_bcm963xx.c-765-		}
 --
 arch/mips/bcm63xx/setup.c=141=const char *get_system_type(void)
 --
 arch/mips/bcm63xx/setup.c-143-	static char buf[128];
 arch/mips/bcm63xx/setup.c:144:	snprintf(buf, sizeof(buf), "bcm63xx/%s (0x%04x/0x%02X)",
 arch/mips/bcm63xx/setup.c-145-		 board_get_name(),
 --
 arch/mips/cavium-octeon/octeon-platform.c=483=static void __init octeon_fdt_set_phy(int eth, int phy_addr)
 --
 arch/mips/cavium-octeon/octeon-platform.c-555-
 arch/mips/cavium-octeon/octeon-platform.c:556:	snprintf(new_name, sizeof(new_name), "ethernet-phy@%x", phy_addr);
 arch/mips/cavium-octeon/octeon-platform.c-557-
 --
 arch/mips/cavium-octeon/octeon-platform.c=649=static void __init octeon_fdt_pip_port(int iface, int i, int p, int max)
 --
 arch/mips/cavium-octeon/octeon-platform.c-656-
 arch/mips/cavium-octeon/octeon-platform.c:657:	snprintf(name_buffer, sizeof(name_buffer), "ethernet@%x", p);
 arch/mips/cavium-octeon/octeon-platform.c-658-	eth = fdt_subnode_offset(initial_boot_params, iface, name_buffer);
 --
 arch/mips/cavium-octeon/octeon-platform.c=682=static void __init octeon_fdt_pip_iface(int pip, int idx)
 --
 arch/mips/cavium-octeon/octeon-platform.c-688-
 arch/mips/cavium-octeon/octeon-platform.c:689:	snprintf(name_buffer, sizeof(name_buffer), "interface@%d", idx);
 arch/mips/cavium-octeon/octeon-platform.c-690-	iface = fdt_subnode_offset(initial_boot_params, pip, name_buffer);
 --
 arch/mips/cavium-octeon/octeon-platform.c=701=void __init octeon_fill_mac_addresses(void)
 --
 arch/mips/cavium-octeon/octeon-platform.c-724-
 arch/mips/cavium-octeon/octeon-platform.c:725:		snprintf(name_buffer, sizeof(name_buffer), "mix%d", i);
 arch/mips/cavium-octeon/octeon-platform.c-726-		alias_prop = fdt_getprop(initial_boot_params, aliases,
 --
 arch/mips/cavium-octeon/octeon-platform.c-747-
 arch/mips/cavium-octeon/octeon-platform.c:748:		snprintf(name_buffer, sizeof(name_buffer), "interface@%d", i);
 arch/mips/cavium-octeon/octeon-platform.c-749-		iface = fdt_subnode_offset(initial_boot_params, pip,
 --
 arch/mips/cavium-octeon/octeon-platform.c-755-
 arch/mips/cavium-octeon/octeon-platform.c:756:			snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-757-				 "ethernet@%x", p);
 --
 arch/mips/cavium-octeon/octeon-platform.c=767=int __init octeon_prune_device_tree(void)
 --
 arch/mips/cavium-octeon/octeon-platform.c-800-
 arch/mips/cavium-octeon/octeon-platform.c:801:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-802-			 "mix%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-842-
 arch/mips/cavium-octeon/octeon-platform.c:843:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-844-			 "twsi%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-873-
 arch/mips/cavium-octeon/octeon-platform.c:874:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-875-			 "smi%d", i);
 --
 arch/mips/cavium-octeon/octeon-platform.c-900-
 arch/mips/cavium-octeon/octeon-platform.c:901:		snprintf(name_buffer, sizeof(name_buffer),
 arch/mips/cavium-octeon/octeon-platform.c-902-			 "uart%d", i);
 --
 arch/mips/cavium-octeon/setup.c=493=static void __init init_octeon_system_type(void)
 --
 arch/mips/cavium-octeon/setup.c-508-
 arch/mips/cavium-octeon/setup.c:509:	snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
 arch/mips/cavium-octeon/setup.c-510-		 board_type, octeon_model_get_string(read_c0_prid()));
 --
 arch/mips/dec/prom/identify.c=44=const char *get_system_type(void)
 --
 arch/mips/dec/prom/identify.c-51-		called = 1;
 arch/mips/dec/prom/identify.c:52:		snprintf(system, STR_BUF_LEN, "Digital %s",
 arch/mips/dec/prom/identify.c-53-			 dec_system_strings[mips_machtype]);
 --
 arch/mips/generic/yamon-dt.c=75=__init int yamon_dt_append_memory(void *fdt,
 --
 arch/mips/generic/yamon-dt.c-109-	for (i = 0; i < ARRAY_SIZE(var_names); i++) {
 arch/mips/generic/yamon-dt.c:110:		snprintf(param_name, sizeof(param_name), "%s=", var_names[i]);
 arch/mips/generic/yamon-dt.c-111-		var = strstr(arcs_cmdline, param_name);
 --
 arch/mips/generic/yamon-dt.c=157=__init int yamon_dt_serial_config(void *fdt)
 --
 arch/mips/generic/yamon-dt.c-179-
 arch/mips/generic/yamon-dt.c:180:	snprintf(mode_var_name, sizeof(mode_var_name), "modetty%u", uart);
 arch/mips/generic/yamon-dt.c-181-	mode_var = fw_getenv(mode_var_name);
 --
 arch/mips/generic/yamon-dt.c-210-
 arch/mips/generic/yamon-dt.c:211:	WARN_ON(snprintf(path, sizeof(path), "serial%u:%u%c%u%s",
 arch/mips/generic/yamon-dt.c-212-			 uart, baud, parity, stop_bits,
 --
 arch/mips/kernel/mips-cm.c=393=void mips_cm_error_report(void)
 --
 arch/mips/kernel/mips-cm.c-421-
 arch/mips/kernel/mips-cm.c:422:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-423-				 "CCA=%lu TR=%s MCmd=%s STag=%lu "
 --
 arch/mips/kernel/mips-cm.c-435-
 arch/mips/kernel/mips-cm.c:436:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-437-				 "C3=%s C2=%s C1=%s C0=%s SC=%s "
 --
 arch/mips/kernel/mips-cm.c-451-
 arch/mips/kernel/mips-cm.c:452:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-453-				 "Type=%s%s Instr=%s DW=%lu Way=%lu "
 --
 arch/mips/kernel/mips-cm.c-490-			unsigned long bank_bit = (cm_error >> 28) & 0x1;
 arch/mips/kernel/mips-cm.c:491:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-492-				 "%s ECC Error: Way=%lu (DWORD=%lu, Sets=%lu)"
 --
 arch/mips/kernel/mips-cm.c-510-
 arch/mips/kernel/mips-cm.c:511:			snprintf(buf, sizeof(buf),
 arch/mips/kernel/mips-cm.c-512-				 "Decode Request Error: Type=%lu, Command=%lu"
 --
 arch/mips/kernel/traps.c=1991=void __noreturn nmi_exception_handler(struct pt_regs *regs)
 --
 arch/mips/kernel/traps.c-1997-	bust_spinlocks(1);
 arch/mips/kernel/traps.c:1998:	snprintf(str, 100, "CPU%d NMI taken, CP0_EPC=%lx\n",
 arch/mips/kernel/traps.c-1999-		 smp_processor_id(), regs->cp0_epc);
 --
 arch/mips/lantiq/prom.c=100=void __init prom_init(void)
 --
 arch/mips/lantiq/prom.c-103-	ltq_soc_detect(&soc_info);
 arch/mips/lantiq/prom.c:104:	snprintf(soc_info.sys_type, LTQ_SYS_TYPE_LEN - 1, "%s rev %s",
 arch/mips/lantiq/prom.c-105-		soc_info.name, soc_info.rev_type);
 --
 arch/mips/mti-malta/malta-dtshim.c=131=static void __init append_memory(void *fdt, int root_off)
 --
 arch/mips/mti-malta/malta-dtshim.c-179-	for (i = 0; i < ARRAY_SIZE(var_names); i++) {
 arch/mips/mti-malta/malta-dtshim.c:180:		snprintf(param_name, sizeof(param_name), "%s=", var_names[i]);
 arch/mips/mti-malta/malta-dtshim.c-181-		var = strstr(arcs_cmdline, param_name);
 --
 arch/mips/pci/pci-xtalk-bridge.c=568=static int bridge_get_partnum(u64 baddr, char *partnum)
 --
 arch/mips/pci/pci-xtalk-bridge.c-575-
 arch/mips/pci/pci-xtalk-bridge.c:576:	snprintf(prefix, sizeof(prefix), "bridge-%012llx-0b-", baddr);
 arch/mips/pci/pci-xtalk-bridge.c-577-
 --
 arch/mips/ralink/mt7620.c=220=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/mt7620.c-226-
 arch/mips/ralink/mt7620.c:227:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/mt7620.c-228-		"MediaTek %s ver:%u eco:%u",
 --
 arch/mips/ralink/mt7621.c=167=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/mt7621.c-198-
 arch/mips/ralink/mt7621.c:199:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/mt7621.c-200-		"MediaTek %s ver:%u eco:%u",
 --
 arch/mips/ralink/rt288x.c=90=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt288x.c-97-
 arch/mips/ralink/rt288x.c:98:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt288x.c-99-		"Ralink %s id:%u rev:%u",
 --
 arch/mips/ralink/rt305x.c=193=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt305x.c-196-
 arch/mips/ralink/rt305x.c:197:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt305x.c-198-		"Ralink %s id:%u rev:%u",
 --
 arch/mips/ralink/rt3883.c=90=void __init prom_soc_init(struct ralink_soc_info *soc_info)
 --
 arch/mips/ralink/rt3883.c-97-
 arch/mips/ralink/rt3883.c:98:	snprintf(soc_info->sys_type, RAMIPS_SYS_TYPE_LEN,
 arch/mips/ralink/rt3883.c-99-		"Ralink %s ver:%u eco:%u",
 --
 arch/mips/sgi-ip27/ip27-xtalk.c=26=static void bridge_platform_create(nasid_t nasid, int widget, int masterwid)
 --
 arch/mips/sgi-ip27/ip27-xtalk.c-42-
 arch/mips/sgi-ip27/ip27-xtalk.c:43:	snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx",
 arch/mips/sgi-ip27/ip27-xtalk.c-44-		 offset + (widget << SWIN_SIZE_BITS));
 --
 arch/mips/sgi-ip30/ip30-xtalk.c=39=static void bridge_platform_create(int widget, int masterwid)
 --
 arch/mips/sgi-ip30/ip30-xtalk.c-52-
 arch/mips/sgi-ip30/ip30-xtalk.c:53:	snprintf(wd->dev_id, sizeof(wd->dev_id), "bridge-%012lx",
 arch/mips/sgi-ip30/ip30-xtalk.c-54-		 IP30_SWIN_BASE(widget));
 --
 arch/mips/txx9/generic/setup.c=635=void __init txx9_iocled_init(unsigned long baseaddr,
 --
 arch/mips/txx9/generic/setup.c-675-		struct gpio_led *led = &iocled->leds[i];
 arch/mips/txx9/generic/setup.c:676:		snprintf(iocled->names[i], sizeof(iocled->names[i]),
 arch/mips/txx9/generic/setup.c-677-			 "iocled:%s:%u", color, i);
 --
 arch/parisc/kernel/cache.c=135=show_cache_info(struct seq_file *m)
 --
 arch/parisc/kernel/cache.c-141-	if (cache_info.dc_loop != 1)
 arch/parisc/kernel/cache.c:142:		snprintf(buf, 32, "%lu-way associative", cache_info.dc_loop);
 arch/parisc/kernel/cache.c-143-	seq_printf(m, "D-cache\t\t: %ld KB (%s%s, %s, alias=%d)\n",
 --
 arch/parisc/kernel/drivers.c=493=alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
 --
 arch/parisc/kernel/drivers.c-536-	name = parisc_hardware_description(&dev->id) ? : "unknown";
 arch/parisc/kernel/drivers.c:537:	snprintf(dev->name, sizeof(dev->name), "%s [%s]",
 arch/parisc/kernel/drivers.c-538-		name, parisc_pathname(dev));
 --
 arch/powerpc/kernel/fadump.c=149=void __init fadump_append_bootargs(void)
 --
 arch/powerpc/kernel/fadump.c-175-	pr_debug("Cmdline: %s\n", boot_command_line);
 arch/powerpc/kernel/fadump.c:176:	snprintf(boot_command_line + len, COMMAND_LINE_SIZE - len, " %s", append_args);
 arch/powerpc/kernel/fadump.c-177-	pr_info("Updated cmdline: %s\n", boot_command_line);
 --
 arch/powerpc/kernel/rtas.c=1644=void rtas_os_term(char *str)
 --
 arch/powerpc/kernel/rtas.c-1659-
 arch/powerpc/kernel/rtas.c:1660:	snprintf(rtas_os_term_buf, 2048, "OS panic: %s", str);
 arch/powerpc/kernel/rtas.c-1661-
 --
 arch/powerpc/kernel/rtas_flash.c=449=static int get_validate_flash_msg(struct rtas_validate_flash_t *args_buf, 
 --
 arch/powerpc/kernel/rtas_flash.c-457-		    (args_buf->update_results == VALIDATE_TMP_UPDATE))
 arch/powerpc/kernel/rtas_flash.c:458:			n += snprintf(msg + n, msglen - n, "%s\n",
 arch/powerpc/kernel/rtas_flash.c-459-					args_buf->buf);
 --
 arch/powerpc/kernel/udbg.c=114=void udbg_printf(const char *fmt, ...)
 --
 arch/powerpc/kernel/udbg.c-120-		va_start(args, fmt);
 arch/powerpc/kernel/udbg.c:121:		vsnprintf(buf, UDBG_BUFSIZE, fmt, args);
 arch/powerpc/kernel/udbg.c-122-		udbg_puts(buf);
 --
 arch/powerpc/kexec/file_load_64.c=194=static int add_usable_mem_property(void *fdt, struct device_node *dn,
 --
 arch/powerpc/kexec/file_load_64.c-203-
 arch/powerpc/kexec/file_load_64.c:204:	if (snprintf(path, NODE_PATH_LEN, "%pOF", dn) > (NODE_PATH_LEN - 1)) {
 arch/powerpc/kexec/file_load_64.c-205-		pr_err("Buffer (%d) too small for memory node: %pOF\n",
 --
 arch/powerpc/kvm/book3s_hv.c=2864=static ssize_t debugfs_timings_read(struct file *file, char __user *buf,
 --
 arch/powerpc/kvm/book3s_hv.c-2899-			if (!ok)
 arch/powerpc/kvm/book3s_hv.c:2900:				snprintf(s, buf_end - s, "%s: stuck\n",
 arch/powerpc/kvm/book3s_hv.c-2901-					timings[i].name);
 arch/powerpc/kvm/book3s_hv.c-2902-			else
 arch/powerpc/kvm/book3s_hv.c:2903:				snprintf(s, buf_end - s,
 arch/powerpc/kvm/book3s_hv.c-2904-					"%s: %llu %llu %llu %llu\n",
 --
 arch/powerpc/perf/hv-24x7.c=388=static char *event_fmt(struct hv_24x7_event_data *event, unsigned int domain)
 --
 arch/powerpc/perf/hv-24x7.c-396-	case HV_PERF_DOMAIN_PHYS_CHIP:
 arch/powerpc/perf/hv-24x7.c:397:		snprintf(buf, sizeof(buf), "%d", domain);
 arch/powerpc/perf/hv-24x7.c-398-		domain_str = buf;
 --
 arch/powerpc/platforms/512x/clock-commonclk.c=704=static void __init mpc512x_clk_setup_clock_tree(struct device_node *np, int busfreq)
 --
 arch/powerpc/platforms/512x/clock-commonclk.c-822-		char name[12];
 arch/powerpc/platforms/512x/clock-commonclk.c:823:		snprintf(name, sizeof(name), "psc%d", mclk_idx);
 arch/powerpc/platforms/512x/clock-commonclk.c-824-		clks[MPC512x_CLK_PSC0 + mclk_idx] = mpc512x_clk_gated(
 --
 arch/powerpc/platforms/512x/clock-commonclk.c=951=static void __init mpc5121_clk_provide_migration_support(void)
 --
 arch/powerpc/platforms/512x/clock-commonclk.c-988-	of_address_to_resource(np, 0, &res); \
 arch/powerpc/platforms/512x/clock-commonclk.c:989:	snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
 arch/powerpc/platforms/512x/clock-commonclk.c-990-} while (0)
 --
 arch/powerpc/platforms/82xx/ep8248e.c=109=static int ep8248e_mdio_probe(struct platform_device *ofdev)
 --
 arch/powerpc/platforms/82xx/ep8248e.c-130-	bus->parent = &ofdev->dev;
]
]

gemini-3.1-pro-preview

							input: 88943
							output: 25
							thoughts: 20
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Streamlining the BPF Helper Analysis**

Right, let's cut through the noise. I need to quickly pinpoint where `snprintf` is being used within the BPF helper functions in the kernel. No need for a convoluted manual search. The most efficient approach here is clearly `git grep snprintf kernel/bpf/helpers.c`. That gives me a precise, targeted scan, focusing exactly on the potential areas of interest within that specific helper file. No need to waste time or go any deeper at this stage. That should get me what I need.

log-in to see details

map[Expression:snprintf.*kernel/bpf/helpers.c]

map[Output:]

gemini-3.1-pro-preview

							input: 89137
							output: 16
							thoughts: 20
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**BPF Helper Investigation: Snprintf Deep Dive**

Alright, so I'm thinking, where are we with `snprintf` and the BPF helpers? The most direct approach, as always, seems to be a quick `grep` within the kernel's BPF helper implementation file, specifically `kernel/bpf/helpers.c`. I expect to find a use of the system `snprintf` and want to understand how it is called and used, whether directly or in some indirect wrapper function, to allow for the use of dynamic string formatting in the BPF context. I'm keen to see the implementation details, especially any considerations given to security or resource limitations within the BPF environment. It could be directly exposed, perhaps under tight constraints, or wrapped for some security reasons. I'm hoping to get a clearer picture of the function signature, any limitations on the format string (e.g., restricted format specifiers), and if there's any sophisticated error handling in place. Furthermore, I'll pay attention to any performance considerations; BPF is all about efficiency, so I expect they've optimized it to the nth degree. Ultimately, I'm aiming to grasp the integration of `snprintf` with the BPF subsystem and understand the nuances.

log-in to see details

map[Expression:snprintf]

gemini-3.1-pro-preview

							input: 89491
							output: 23
							thoughts: 17
						

Okay, here's the summary, rendered as your thoughts:

**The Familiar Comfort of `patch-diff`**

Right, let me think... I need to review those recent modifications I made. Hmm, no need to overcomplicate things here. I can just reach for `patch-diff` again. It's a tried-and-true method, really efficient for quickly highlighting the specific differences between the current version and the previous one. Why reinvent the wheel when a perfectly good tool is already at my disposal? It's a simple command, but it gets the job done reliably. And frankly, the speed of its execution feels like a good use of my time.

map[File:kernel/bpf/helpers.c]

map[Output:diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 2bb60200c..cc4994804 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -804,259 +804,266 @@ void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
 /*
  * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
  *
  * Returns a negative value if fmt is an invalid format string or 0 otherwise.
  *
  * This can be used in two ways:
  * - Format string verification only: when data->get_bin_args is false
  * - Arguments preparation: in addition to the above verification, it writes in
  *   data->bin_args a binary representation of arguments usable by bstr_printf
  *   where pointers from BPF have been sanitized.
  *
  * In argument preparation mode, if 0 is returned, safe temporary buffers are
  * allocated and bpf_bprintf_cleanup should be called to free them after use.
  */
 int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 			u32 num_args, struct bpf_bprintf_data *data)
 {
 	bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
 	char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
 	struct bpf_bprintf_buffers *buffers = NULL;
 	size_t sizeof_cur_arg, sizeof_cur_ip;
 	int err, i, num_spec = 0;
 	u64 cur_arg;
 	char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
 
 	fmt_end = strnchr(fmt, fmt_size, 0);
 	if (!fmt_end)
 		return -EINVAL;
 	fmt_size = fmt_end - fmt;
 
 	if (get_buffers && bpf_try_get_buffers(&buffers))
 		return -EBUSY;
 
 	if (data->get_bin_args) {
 		if (num_args)
 			tmp_buf = buffers->bin_args;
 		tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
 		data->bin_args = (u32 *)tmp_buf;
 	}
 
 	if (data->get_buf)
 		data->buf = buffers->buf;
 
 	for (i = 0; i < fmt_size; i++) {
 		unsigned char c = fmt[i];
 
 		/*
 		 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
 		 * through unchanged, while still rejecting ASCII control bytes.
 		 */
 		if (isascii(c) && !isprint(c) && !isspace(c)) {
 			err = -EINVAL;
 			goto out;
 		}
 
 		if (fmt[i] != '%')
 			continue;
 
 		if (fmt[i + 1] == '%') {
 			i++;
 			continue;
 		}
 
 		if (num_spec >= num_args) {
 			err = -EINVAL;
 			goto out;
 		}
 
 		/* The string is zero-terminated so if fmt[i] != 0, we can
 		 * always access fmt[i + 1], in the worst case it will be a 0
 		 */
 		i++;
 		c = fmt[i];
 		/*
 		 * The format parser below only understands ASCII conversion
 		 * specifiers and modifiers, so reject non-ASCII after '%'.
 		 */
 		if (!isascii(c)) {
 			err = -EINVAL;
 			goto out;
 		}
 
 		/* skip optional "[0 +-][num]" width formatting field */
 		while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
 		       fmt[i] == ' ')
 			i++;
 		if (fmt[i] >= '1' && fmt[i] <= '9') {
 			i++;
 			while (fmt[i] >= '0' && fmt[i] <= '9')
 				i++;
 		}
 
 		if (fmt[i] == 'p') {
 			sizeof_cur_arg = sizeof(long);
 
 			if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
 			    ispunct(fmt[i + 1])) {
 				if (tmp_buf)
 					cur_arg = raw_args[num_spec];
 				goto nocopy_fmt;
 			}
 
 			if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 			    fmt[i + 2] == 's') {
 				fmt_ptype = fmt[i + 1];
 				i += 2;
 				goto fmt_str;
 			}
 
 			if (fmt[i + 1] == 'K' ||
 			    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 			    fmt[i + 1] == 'S') {
 				if (tmp_buf)
 					cur_arg = raw_args[num_spec];
 				i++;
 				goto nocopy_fmt;
 			}
 
 			if (fmt[i + 1] == 'B') {
 				if (tmp_buf)  {
-					err = snprintf(tmp_buf,
-						       (tmp_buf_end - tmp_buf),
+					size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;
+
+					err = snprintf(tmp_buf, limit,
 						       "%pB",
 						       (void *)(long)raw_args[num_spec]);
-					tmp_buf += (err + 1);
+					if (err < 0)
+						err = 0;
+					tmp_buf += min_t(size_t, err + 1, limit);
 				}
 
 				i++;
 				num_spec++;
 				continue;
 			}
 
 			/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
 			if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
 			    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
 				err = -EINVAL;
 				goto out;
 			}
 
 			i += 2;
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
 			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
-			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
+			if (tmp_buf + sizeof_cur_ip > tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			unsafe_ptr = (char *)(long)raw_args[num_spec];
 			err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 						       sizeof_cur_ip);
 			if (err < 0)
 				memset(cur_ip, 0, sizeof_cur_ip);
 
 			/* hack: bstr_printf expects IP addresses to be
 			 * pre-formatted as strings, ironically, the easiest way
 			 * to do that is to call snprintf.
 			 */
 			ip_spec[2] = fmt[i - 1];
 			ip_spec[3] = fmt[i];
-			err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
-				       ip_spec, &cur_ip);
+			{
+				size_t limit = tmp_buf < tmp_buf_end ? tmp_buf_end - tmp_buf : 0;
 
-			tmp_buf += err + 1;
+				err = snprintf(tmp_buf, limit, ip_spec, &cur_ip);
+				if (err < 0)
+					err = 0;
+				tmp_buf += min_t(size_t, err + 1, limit);
+			}
 			num_spec++;
 
 			continue;
 		} else if (fmt[i] == 's') {
 			fmt_ptype = fmt[i];
 fmt_str:
 			if (fmt[i + 1] != 0 &&
 			    !isspace(fmt[i + 1]) &&
 			    !ispunct(fmt[i + 1])) {
 				err = -EINVAL;
 				goto out;
 			}
 
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			if (tmp_buf_end == tmp_buf) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			unsafe_ptr = (char *)(long)raw_args[num_spec];
 			err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
 						    fmt_ptype,
 						    tmp_buf_end - tmp_buf);
 			if (err < 0) {
 				tmp_buf[0] = '\0';
 				err = 1;
 			}
 
 			tmp_buf += err;
 			num_spec++;
 
 			continue;
 		} else if (fmt[i] == 'c') {
 			if (!tmp_buf)
 				goto nocopy_fmt;
 
-			if (tmp_buf_end == tmp_buf) {
+			if (tmp_buf >= tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			*tmp_buf = raw_args[num_spec];
 			tmp_buf++;
 			num_spec++;
 
 			continue;
 		}
 
 		sizeof_cur_arg = sizeof(int);
 
 		if (fmt[i] == 'l') {
 			sizeof_cur_arg = sizeof(long);
 			i++;
 		}
 		if (fmt[i] == 'l') {
 			sizeof_cur_arg = sizeof(long long);
 			i++;
 		}
 
 		if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
 		    fmt[i] != 'x' && fmt[i] != 'X') {
 			err = -EINVAL;
 			goto out;
 		}
 
 		if (tmp_buf)
 			cur_arg = raw_args[num_spec];
 nocopy_fmt:
 		if (tmp_buf) {
 			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
-			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
+			if (tmp_buf + sizeof_cur_arg > tmp_buf_end) {
 				err = -ENOSPC;
 				goto out;
 			}
 
 			if (sizeof_cur_arg == 8) {
 				*(u32 *)tmp_buf = *(u32 *)&cur_arg;
 				*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
 			} else {
 				*(u32 *)tmp_buf = (u32)(long)cur_arg;
 			}
 			tmp_buf += sizeof_cur_arg;
 		}
 		num_spec++;
 	}
 
 	err = 0;
 out:
 	if (err)
 		bpf_bprintf_cleanup(data);
 	return err;
 }
]

gemini-3.1-pro-preview

							input: 92772
							output: 50
							thoughts: 1420
						

**Code Review: Addressing Potential Buffer Overflows**

Okay, let's break this down. The initial code seems sound, but I need to make absolutely sure there aren't any subtle buffer overflows.  I'm looking closely at how `tmp_buf` is managed within the kernel.

First, I examined `tmp_buf + sizeof_cur_arg > tmp_buf_end`, making sure that pointer arithmetic isn't going to cause an overflow, especially since `sizeof_cur_arg` is small. No problems there; pointer arithmetic is safe given the size of the buffer and the size of the arguments.  `tmp_buf_end` is essentially a fixed offset from `tmp_buf`, so that check is sound.

Next, I scrutinized `min_t(size_t, err + 1, limit)`.  The potential for negative `err` values worried me, but the code already handles those by setting `err = 0` if `err < 0`, so `err + 1` is always greater than or equal to 1. If `limit` is zero, `min_t` is zero; otherwise it's `err + 1` or the specified `limit`.  I made sure if `err >= limit`, the `min_t` will never let me go past `limit`, so I know `tmp_buf` will advance by at most `limit` - that's safe.  Then, I considered the edge case of `tmp_buf` *already* being beyond `tmp_buf_end`.  In that scenario, `limit` would effectively be zero, preventing any further advance.  Safe.

Now, I systematically checked every place `tmp_buf` gets incremented:

*   **`%pB` and `%pI`:**  `tmp_buf += min_t(size_t, err + 1, limit);`  Perfect. The `min_t` function has been validated.

*   **`%s`:** `tmp_buf += err;` This depends on `bpf_trace_copy_string`.  My immediate concern was that if `tmp_buf > tmp_buf_end`, `tmp_buf_end - tmp_buf` would be a huge `size_t` value. However, the code *now* includes a check:

    ```c
    		if (tmp_buf >= tmp_buf_end) {
    			err = -ENOSPC;
    			goto out;
    		}
    ```

    Before calling `bpf_trace_copy_string`, it now exits if the bounds check is exceeded. Thus `bpf_trace_copy_string` receives a positive `bufsz` and returns the number of bytes that have been copied which is at most `bufsz`, so `tmp_buf` remains within bounds.

*   **`%c`:**

    ```c
    		if (tmp_buf >= tmp_buf_end) {
    			err = -ENOSPC;
    			goto out;
    		}
    		*tmp_buf = raw_args[num_spec];
    		tmp_buf++;
    ```

    The bounds check is now `tmp_buf >= tmp_buf_end`. If the check fails the function exits, and if it passes `tmp_buf` gets incremented, which will be valid if `tmp_buf < tmp_buf_end`.

*   **`nocopy_fmt`:**

    ```c
    		tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
    		if (tmp_buf + sizeof_cur_arg > tmp_buf_end) {
    			err = -ENOSPC;
    			goto out;
    		}
    		...
    		tmp_buf += sizeof_cur_arg;
    ```

    I confirmed that `PTR_ALIGN` aligns `tmp_buf`. If `tmp_buf <= tmp_buf_end`, `PTR_ALIGN` ensures that after alignment it will still be `<= tmp_buf_end`. If the check `tmp_buf + sizeof_cur_arg > tmp_buf_end` fails, it exits. Otherwise, incrementing `tmp_buf` will maintain the bound.

I can now confidently say that `tmp_buf` *will* never exceed `tmp_buf_end` in any circumstance. This absolutely and completely resolves the potential out-of-bounds write and the subtle signedness bug.

Now, let's summarize the root cause and the fix. The original problem arose because `snprintf` (used by `%pB` and `%pI`) could return the number of bytes *required* to write the

map[Question:Is there any other place in `kernel/bpf/helpers.c` where `snprintf` is used to format strings into a buffer without checking the return value properly?]

map[Answer:Based on a comprehensive review of `kernel/bpf/helpers.c`, the improper use of `snprintf` is localized to exactly one function: `bpf_bprintf_prepare`.

### Findings

1.  **Vulnerable Function:** `bpf_bprintf_prepare`
    This function is responsible for pre-formatting complex arguments (like symbol names `%pB` and IP addresses `%pI4`/`%pI6`) into a binary buffer (`bin_args`) before they are processed by the final formatting engine (`bstr_printf`).

2.  **Specific Vulnerable Instances:**
    There are exactly two calls to `snprintf` in `kernel/bpf/helpers.c`, both within this function:
    *   **Instance 1 (Line 924):** Used for symbol formatting (`%pB`).
        ```c
        err = snprintf(tmp_buf, (tmp_buf_end - tmp_buf), "%pB", (void *)(long)raw_args[num_spec]);
        tmp_buf += (err + 1); // BUG: err can exceed remaining space
        ```
    *   **Instance 2 (Line 965):** Used for IP address formatting.
        ```c
        err = snprintf(tmp_buf, tmp_buf_end - tmp_buf, ip_spec, &cur_ip);
        tmp_buf += err + 1; // BUG: err can exceed remaining space
        ```

3.  **The Vulnerability Mechanism:**
    In both cases, the code assumes `snprintf` returns the number of bytes actually written. However, according to standard C and kernel semantics, `snprintf` returns the number of bytes that *would* have been written if the buffer were large enough. If truncation occurs, `err` becomes greater than or equal to the remaining space (`tmp_buf_end - tmp_buf`). Advancing `tmp_buf` by `err + 1` pushes the pointer beyond the allocated buffer boundary (`tmp_buf_end`), leading to out-of-bounds writes in subsequent loop iterations.

4.  **Exhaustive Search for Other Formatting Functions:**
    *   **`scnprintf` / `vsnprintf` / `vscnprintf` / `sprintf`:** None of these functions are called directly within `kernel/bpf/helpers.c`.
    *   **`bstr_printf`:** This is used in `____bpf_snprintf` (the implementation of the `bpf_snprintf` helper). Its usage there is safe because it does not use the return value to perform pointer arithmetic on an internal buffer; it simply returns the value (plus 1) to the BPF program as intended.
    *   **String Copying Helpers:** Functions like `bpf_trace_copy_string` use `strncpy_from_kernel_nofault`, which correctly respects the buffer size and returns the actual number of bytes copied, avoiding the `snprintf` pitfall.

### Conclusion
There are **no other places** in `kernel/bpf/helpers.c` where `snprintf` (or any similar formatting function) is used to format strings into a buffer without proper return value checking. The issue is entirely contained within the `bpf_bprintf_prepare` function, although its impact is significant as it is a shared utility used by multiple BPF helpers including `bpf_trace_printk`, `bpf_snprintf`, and `bpf_seq_printf`.]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

Is there any other place in `kernel/bpf/helpers.c` where `snprintf` is used to format strings into a buffer without checking the return value properly?

Based on a comprehensive review of `kernel/bpf/helpers.c`, the improper use of `snprintf` is localized to exactly one function: `bpf_bprintf_prepare`.

### Findings

1.  **Vulnerable Function:** `bpf_bprintf_prepare`
    This function is responsible for pre-formatting complex arguments (like symbol names `%pB` and IP addresses `%pI4`/`%pI6`) into a binary buffer (`bin_args`) before they are processed by the final formatting engine (`bstr_printf`).

2.  **Specific Vulnerable Instances:**
    There are exactly two calls to `snprintf` in `kernel/bpf/helpers.c`, both within this function:
    *   **Instance 1 (Line 924):** Used for symbol formatting (`%pB`).
        ```c
        err = snprintf(tmp_buf, (tmp_buf_end - tmp_buf), "%pB", (void *)(long)raw_args[num_spec]);
        tmp_buf += (err + 1); // BUG: err can exceed remaining space
        ```
    *   **Instance 2 (Line 965):** Used for IP address formatting.
        ```c
        err = snprintf(tmp_buf, tmp_buf_end - tmp_buf, ip_spec, &cur_ip);
        tmp_buf += err + 1; // BUG: err can exceed remaining space
        ```

3.  **The Vulnerability Mechanism:**
    In both cases, the code assumes `snprintf` returns the number of bytes actually written. However, according to standard C and kernel semantics, `snprintf` returns the number of bytes that *would* have been written if the buffer were large enough. If truncation occurs, `err` becomes greater than or equal to the remaining space (`tmp_buf_end - tmp_buf`). Advancing `tmp_buf` by `err + 1` pushes the pointer beyond the allocated buffer boundary (`tmp_buf_end`), leading to out-of-bounds writes in subsequent loop iterations.

4.  **Exhaustive Search for Other Formatting Functions:**
    *   **`scnprintf` / `vsnprintf` / `vscnprintf` / `sprintf`:** None of these functions are called directly within `kernel/bpf/helpers.c`.
    *   **`bstr_printf`:** This is used in `____bpf_snprintf` (the implementation of the `bpf_snprintf` helper). Its usage there is safe because it does not use the return value to perform pointer arithmetic on an internal buffer; it simply returns the value (plus 1) to the BPF program as intended.
    *   **String Copying Helpers:** Functions like `bpf_trace_copy_string` use `strncpy_from_kernel_nofault`, which correctly respects the buffer size and returns the actual number of bytes copied, avoiding the `snprintf` pitfall.

### Conclusion
There are **no other places** in `kernel/bpf/helpers.c` where `snprintf` (or any similar formatting function) is used to format strings into a buffer without proper return value checking. The issue is entirely contained within the `bpf_bprintf_prepare` function, although its impact is significant as it is a shared utility used by multiple BPF helpers including `bpf_trace_printk`, `bpf_snprintf`, and `bpf_seq_printf`.

gemini-3-flash-preview

							input: 2288
							output: 41
							thoughts: 144
						

**Analyzing `snprintf` Usage in `kernel/bpf/helpers.c`**

Okay, so the user's got a question about `snprintf` within `kernel/bpf/helpers.c`, and they're wondering if there are any potential vulnerabilities stemming from improper return value checks. Makes sense; always a good idea to scrutinize string formatting functions, especially in kernel space.

Alright, so my immediate plan of action is pretty straightforward:

1.  **Locate the instances:** I'm going to kick things off by grepping for `snprintf` directly within `kernel/bpf/helpers.c`. Gotta get a list of all the call sites first.
2.  **Inspect Each One:** For each occurrence, I need to do a code review. I'll need to meticulously analyze the surrounding code to determine if the return value of `snprintf` is being checked, and more importantly, *how* it's being checked.
3.  **Define "Proper":** And here's where my expertise comes into play. A "proper" check means that the return value check needs to account for both negative return values (indicating an error) and potentially truncation (when the return value is greater than or equal to the buffer size). Those are the primary failure modes I'll be looking for.

Let's start by getting that list of occurrences. Time to get to work!

map[IncludeSnippetLines:5 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 919:					goto nocopy_fmt;
 920:				}
 921:	
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 960:				 * pre-formatted as strings, ironically, the easiest way
 961:				 * to do that is to call snprintf.
 962:				 */
 963:				ip_spec[2] = fmt[i - 1];
 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
 967:	
 968:				tmp_buf += err + 1;
 969:				num_spec++;
 970:	
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 3232
							output: 44
							thoughts: 505
						

**Analyzing Potential Buffer Overflows in `bpf_bprintf_prepare`**

Okay, so I've spotted two uses of `snprintf` within `kernel/bpf/helpers.c`, specifically inside the `bpf_bprintf_prepare` function, and that's immediately caught my attention. I need to dig deeper.

The first instance, line 923, looks concerning. `snprintf` is called to format a pointer representation (`%pB`) into `tmp_buf`. The return value, `err`, which represents the number of characters written (or would have been written), is then directly *added* to `tmp_buf`. My initial thought is that if `snprintf` truncates the output—which is perfectly possible given the buffer size `(tmp_buf_end - tmp_buf)`—then `err` will be greater than or equal to `(tmp_buf_end - tmp_buf)`. Adding that potentially large `err` to `tmp_buf` without any bounds check could easily cause `tmp_buf` to point outside the allocated buffer, leading to a classic buffer overflow.

The second occurrence, on line 965, has the same vulnerability pattern. `snprintf` is used with a different format string (`ip_spec` and `&cur_ip`), and again, the return value `err` is directly added to `tmp_buf`, creating a similar risk of overflow if the output is truncated or an error is encountered.

Now, wait a minute... I need to be precise. I need to make sure I am accounting for `snprintf`'s return value semantics. `snprintf` returns the *number of characters* that *would* have been written, including the null terminator, if the buffer had been large enough. If the return value (`err`) is *greater than or equal to* `(tmp_buf_end - tmp_buf)`, truncation *has* occurred. If `err` is negative, an error occurred. And in either of these situations, the `tmp_buf += err + 1;` line causes a real problem. No error-checking, no bounds-checking, just raw pointer arithmetic. My Spidey-sense is tingling.

The crucial next step is understanding the context. I must examine the *entire* `bpf_bprintf_prepare` function. I need to know how `tmp_buf` and `tmp_buf_end` are initialized, how the buffer is managed *before* and *after* these `snprintf` calls. Are there any other checks? Is this buffer allocated dynamically, or is it a fixed-size buffer? The answers to these questions are going to tell me the real severity of this potential overflow. I need to see the complete picture to assess the real risk.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_bprintf_prepare]

map[SourceCode: 804:	/*
 805:	 * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
 806:	 *
 807:	 * Returns a negative value if fmt is an invalid format string or 0 otherwise.
 808:	 *
 809:	 * This can be used in two ways:
 810:	 * - Format string verification only: when data->get_bin_args is false
 811:	 * - Arguments preparation: in addition to the above verification, it writes in
 812:	 *   data->bin_args a binary representation of arguments usable by bstr_printf
 813:	 *   where pointers from BPF have been sanitized.
 814:	 *
 815:	 * In argument preparation mode, if 0 is returned, safe temporary buffers are
 816:	 * allocated and bpf_bprintf_cleanup should be called to free them after use.
 817:	 */
 818:	int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
 819:				u32 num_args, struct bpf_bprintf_data *data)
 820:	{
 821:		bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
 822:		char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
 823:		struct bpf_bprintf_buffers *buffers = NULL;
 824:		size_t sizeof_cur_arg, sizeof_cur_ip;
 825:		int err, i, num_spec = 0;
 826:		u64 cur_arg;
 827:		char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
 828:	
 829:		fmt_end = strnchr(fmt, fmt_size, 0);
 830:		if (!fmt_end)
 831:			return -EINVAL;
 832:		fmt_size = fmt_end - fmt;
 833:	
 834:		if (get_buffers && bpf_try_get_buffers(&buffers))
 835:			return -EBUSY;
 836:	
 837:		if (data->get_bin_args) {
 838:			if (num_args)
 839:				tmp_buf = buffers->bin_args;
 840:			tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
 841:			data->bin_args = (u32 *)tmp_buf;
 842:		}
 843:	
 844:		if (data->get_buf)
 845:			data->buf = buffers->buf;
 846:	
 847:		for (i = 0; i < fmt_size; i++) {
 848:			unsigned char c = fmt[i];
 849:	
 850:			/*
 851:			 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
 852:			 * through unchanged, while still rejecting ASCII control bytes.
 853:			 */
 854:			if (isascii(c) && !isprint(c) && !isspace(c)) {
 855:				err = -EINVAL;
 856:				goto out;
 857:			}
 858:	
 859:			if (fmt[i] != '%')
 860:				continue;
 861:	
 862:			if (fmt[i + 1] == '%') {
 863:				i++;
 864:				continue;
 865:			}
 866:	
 867:			if (num_spec >= num_args) {
 868:				err = -EINVAL;
 869:				goto out;
 870:			}
 871:	
 872:			/* The string is zero-terminated so if fmt[i] != 0, we can
 873:			 * always access fmt[i + 1], in the worst case it will be a 0
 874:			 */
 875:			i++;
 876:			c = fmt[i];
 877:			/*
 878:			 * The format parser below only understands ASCII conversion
 879:			 * specifiers and modifiers, so reject non-ASCII after '%'.
 880:			 */
 881:			if (!isascii(c)) {
 882:				err = -EINVAL;
 883:				goto out;
 884:			}
 885:	
 886:			/* skip optional "[0 +-][num]" width formatting field */
 887:			while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
 888:			       fmt[i] == ' ')
 889:				i++;
 890:			if (fmt[i] >= '1' && fmt[i] <= '9') {
 891:				i++;
 892:				while (fmt[i] >= '0' && fmt[i] <= '9')
 893:					i++;
 894:			}
 895:	
 896:			if (fmt[i] == 'p') {
 897:				sizeof_cur_arg = sizeof(long);
 898:	
 899:				if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
 900:				    ispunct(fmt[i + 1])) {
 901:					if (tmp_buf)
 902:						cur_arg = raw_args[num_spec];
 903:					goto nocopy_fmt;
 904:				}
 905:	
 906:				if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
 907:				    fmt[i + 2] == 's') {
 908:					fmt_ptype = fmt[i + 1];
 909:					i += 2;
 910:					goto fmt_str;
 911:				}
 912:	
 913:				if (fmt[i + 1] == 'K' ||
 914:				    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
 915:				    fmt[i + 1] == 'S') {
 916:					if (tmp_buf)
 917:						cur_arg = raw_args[num_spec];
 918:					i++;
 919:					goto nocopy_fmt;
 920:				}
 921:	
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
 930:	
 931:					i++;
 932:					num_spec++;
 933:					continue;
 934:				}
 935:	
 936:				/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
 937:				if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
 938:				    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
 939:					err = -EINVAL;
 940:					goto out;
 941:				}
 942:	
 943:				i += 2;
 944:				if (!tmp_buf)
 945:					goto nocopy_fmt;
 946:	
 947:				sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
 948:				if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
 949:					err = -ENOSPC;
 950:					goto out;
 951:				}
 952:	
 953:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 954:				err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
 955:							       sizeof_cur_ip);
 956:				if (err < 0)
 957:					memset(cur_ip, 0, sizeof_cur_ip);
 958:	
 959:				/* hack: bstr_printf expects IP addresses to be
 960:				 * pre-formatted as strings, ironically, the easiest way
 961:				 * to do that is to call snprintf.
 962:				 */
 963:				ip_spec[2] = fmt[i - 1];
 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
 967:	
 968:				tmp_buf += err + 1;
 969:				num_spec++;
 970:	
 971:				continue;
 972:			} else if (fmt[i] == 's') {
 973:				fmt_ptype = fmt[i];
 974:	fmt_str:
 975:				if (fmt[i + 1] != 0 &&
 976:				    !isspace(fmt[i + 1]) &&
 977:				    !ispunct(fmt[i + 1])) {
 978:					err = -EINVAL;
 979:					goto out;
 980:				}
 981:	
 982:				if (!tmp_buf)
 983:					goto nocopy_fmt;
 984:	
 985:				if (tmp_buf_end == tmp_buf) {
 986:					err = -ENOSPC;
 987:					goto out;
 988:				}
 989:	
 990:				unsafe_ptr = (char *)(long)raw_args[num_spec];
 991:				err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
 992:							    fmt_ptype,
 993:							    tmp_buf_end - tmp_buf);
 994:				if (err < 0) {
 995:					tmp_buf[0] = '\0';
 996:					err = 1;
 997:				}
 998:	
 999:				tmp_buf += err;
1000:				num_spec++;
1001:	
1002:				continue;
1003:			} else if (fmt[i] == 'c') {
1004:				if (!tmp_buf)
1005:					goto nocopy_fmt;
1006:	
1007:				if (tmp_buf_end == tmp_buf) {
1008:					err = -ENOSPC;
1009:					goto out;
1010:				}
1011:	
1012:				*tmp_buf = raw_args[num_spec];
1013:				tmp_buf++;
1014:				num_spec++;
1015:	
1016:				continue;
1017:			}
1018:	
1019:			sizeof_cur_arg = sizeof(int);
1020:	
1021:			if (fmt[i] == 'l') {
1022:				sizeof_cur_arg = sizeof(long);
1023:				i++;
1024:			}
1025:			if (fmt[i] == 'l') {
1026:				sizeof_cur_arg = sizeof(long long);
1027:				i++;
1028:			}
1029:	
1030:			if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
1031:			    fmt[i] != 'x' && fmt[i] != 'X') {
1032:				err = -EINVAL;
1033:				goto out;
1034:			}
1035:	
1036:			if (tmp_buf)
1037:				cur_arg = raw_args[num_spec];
1038:	nocopy_fmt:
1039:			if (tmp_buf) {
1040:				tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
1041:				if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
1042:					err = -ENOSPC;
1043:					goto out;
1044:				}
1045:	
1046:				if (sizeof_cur_arg == 8) {
1047:					*(u32 *)tmp_buf = *(u32 *)&cur_arg;
1048:					*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
1049:				} else {
1050:					*(u32 *)tmp_buf = (u32)(long)cur_arg;
1051:				}
1052:				tmp_buf += sizeof_cur_arg;
1053:			}
1054:			num_spec++;
1055:		}
1056:	
1057:		err = 0;
1058:	out:
1059:		if (err)
1060:			bpf_bprintf_cleanup(data);
1061:		return err;
1062:	}
 SourceFile:kernel/bpf/helpers.c]

gemini-3-flash-preview

							input: 8214
							output: 41
							thoughts: 833
						

**Analyzing Potential Buffer Overflows in `snprintf` Calls**

Okay, let's dissect these `snprintf` calls within this context. I need to be thorough. First, that initial one, lines 924-928, demands attention:

```c
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
```

The core issue I'm seeing is this: if `snprintf` truncates, `err` will be greater than or equal to the remaining buffer space, which is `tmp_buf_end - tmp_buf`. The update `tmp_buf += (err + 1)` *will* push `tmp_buf` past `tmp_buf_end`, right? That's a classic overflow scenario! I need to be sure.

My immediate thought is, what's downstream from this? Ah, line 948...

```c
 948:				if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
```

If my earlier hypothesis is correct, then `tmp_buf` *is* beyond `tmp_buf_end`.  That difference will be a potentially large negative value since `tmp_buf` and `tmp_buf_end` are `char *`.  This is a pointer difference, which is a `ptrdiff_t`. If `tmp_buf > tmp_buf_end`, then the result of the subtraction, `tmp_buf_end - tmp_buf`, is negative. When compared to the `size_t` `sizeof_cur_ip`, the compiler will do an implicit conversion to `size_t`, which will make the negative value wrap around to a very large positive number! That's it!

So, the comparison becomes effectively  `(a very large size_t) < sizeof_cur_ip`, which will almost always be *false*. Therefore, the check *won't* catch the overflow. It will write where it shouldn't.

Now, let's verify my assumptions. Let's see...  `tmp_buf` and `tmp_buf_end` are `char *` and `sizeof_cur_ip` is `size_t`. That's important. With that, a negative `ptrdiff_t` in the comparison becomes a large `size_t`. The comparison's evaluation is the root of the vulnerability. This needs fixing.

The second call, lines 965-968:

```c
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
 967:	
 968:				tmp_buf += err + 1;
```

This one has the exact same problem! Same root cause, same potential for buffer overrun.

And, what about negative return values? That would be a failure. The standard says `snprintf` can return negative values upon error (though it's unlikely here). If `err` is negative, `tmp_buf += err + 1` could move `tmp_buf` *backwards* or keep it at the same location. That needs to be addressed as a separate concern.

I better scan the file for other `snprintf` calls. I want to be 100% sure this isn't a systemic issue. I'll search for it again. There's a lot on the line here.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 10161
							output: 46
							thoughts: 1426
						

**Vulnerability Analysis of `bpf_bprintf_prepare`**

Okay, let's break this down. First, I'm noting the use of `bpf_trace_copy_string`.  It's a potentially safer approach to string copying because of its error handling. That's good.

Now, I'm focusing on those `snprintf` calls. The first one is concerning because there's no check that ensures `tmp_buf` is actually *before* `tmp_buf_end` before the function is called. If the buffer pointers are somehow skewed, the size calculation (`tmp_buf_end - tmp_buf`) could result in a huge `size_t` value. Passing a huge size to `snprintf` when the buffer is actually smaller leads to a buffer overflow. It's using `%pB`, which seems to be a pointer in a binary format, so it's probably using the raw argument.

The second `snprintf` call, dealing with IP addresses, is more interesting. There's a check here, thankfully, at line 948.  But the check is against the binary size of the IP address (`sizeof_cur_ip`), not the string representation that `snprintf` will produce. This is a critical oversight. The IP address can take up a string of 15 or 39 characters plus null termination.  If the available buffer space is less than the string's length but greater than the binary representation, `snprintf` will write past the allocated space. And after the call, line 968 increments `tmp_buf`, likely by more than the remaining buffer space. So, the check is inadequate.

The note about `bstr_printf` raises another point. It looks like `bstr_printf` expects *strings*. This means it's calling `snprintf` to format these IP addresses. The comments are explaining it's a "hack" to use `snprintf` to get this formatting.  The `bstr_printf` function takes binary arguments, and in this case, the `bpf_bprintf_prepare` function is putting string representations of IP addresses into a binary argument buffer.

The `tmp_buf` variable is likely `buffers->bin_args`, meaning it's using a buffer of size `MAX_BPRINTF_BIN_ARGS`. I need to verify that buffer size and how it is being initialized, to confirm the vulnerability.

log-in to see details

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:MAX_BPRINTF_BIN_ARGS]

map[SourceCode: SourceFile:]

gemini-3-flash-preview

							input: 12176
							output: 33
							thoughts: 12
						

Okay, here's the summary, expressed as my internal thought process, assuming I'm a seasoned professional in a field where macros are common:

**Investigating the Potential for a Macro**

Hmm, based on this pattern or behavior I'm seeing, my initial instinct is that this could be driven by a macro. I should investigate that possibility first. It's a very common approach in these types of situations, and often the simplest explanation is the most likely. Right, let's initiate a search and see if a relevant macro exists within the relevant system, code, or documentation. Let's see what turns up.

log-in to see details

map[IncludeSnippetLines:1 Name:MAX_BPRINTF_BIN_ARGS]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 12373
							output: 45
							thoughts: 111
						

**Investigating the Elusive `MAX_BPRINTF_BIN_ARGS`**

Okay, so I encountered this undefined term, `MAX_BPRINTF_BIN_ARGS`, and my first thought was, "Could it be a simple typo, or is it lurking in a header somewhere?" That's usually the first thing I check when dealing with these sorts of issues. Time to revisit `kernel/bpf/helpers.c`, as that's often a good starting point for BPF helper function definitions. I'll scan that file again, maybe I missed it initially. Wait a second, I think I just saw something! Ah, yes, there it is in the `bpf_bprintf_prepare` function, line 840 to be exact: `tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;`. Okay, so it *is* used. Now, I need to know what it *means*. Let's do a quick global search through the code tree for that string to find its declaration and usage context. Hopefully, that will give me the clue I need to understand what's going on.

log-in to see details

map[IncludeSnippetLines:1 Name:MAX_BPRINTF_BIN_ARGS SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 12796
							output: 23
							thoughts: 23
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial Observation and Immediate Action**

That's an unexpected observation, and I need to dive into this immediately. Given my expertise, I'll start with the obvious starting point and read the beginning of `kernel/bpf/helpers.c`. I need to get a high-level view and refresh my memory on the initial implementation and the overall structure of that file. This is the foundation I build on.

map[File:kernel/bpf/helpers.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
 */
#include <linux/bpf.h>
#include <linux/btf.h>
#include <linux/bpf-cgroup.h>
#include <linux/cgroup.h>
#include <linux/rcupdate.h>
#include <linux/random.h>
#include <linux/smp.h>
#include <linux/topology.h>
#include <linux/ktime.h>
#include <linux/sched.h>
#include <linux/uidgid.h>
#include <linux/filter.h>
#include <linux/ctype.h>
#include <linux/jiffies.h>
#include <linux/pid_namespace.h>
#include <linux/poison.h>
#include <linux/proc_ns.h>
#include <linux/sched/task.h>
#include <linux/security.h>
#include <linux/btf_ids.h>
#include <linux/bpf_mem_alloc.h>
#include <linux/kasan.h>
#include <linux/bpf_verifier.h>
#include <linux/uaccess.h>
#include <linux/verification.h>
#include <linux/task_work.h>
#include <linux/irq_work.h>
#include <linux/buildid.h>

#include "../../lib/kstrtox.h"

/* If kernel subsystem is allowing eBPF programs to call this function,
 * inside its own verifier_ops->get_func_proto() callback it should return
 * bpf_map_lookup_elem_proto, so that verifier can properly check the arguments
 *
 * Different map implementations will rely on rcu in map methods
 * lookup/update/delete, therefore eBPF programs must run under rcu lock
 * if program is allowed to access maps, so check rcu_read_lock_held() or
 * rcu_read_lock_trace_held() in all three functions.
 */
BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return (unsigned long) map->ops->map_lookup_elem(map, key);
}

const struct bpf_func_proto bpf_map_lookup_elem_proto = {
	.func		= bpf_map_lookup_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_PTR_TO_MAP_VALUE_OR_NULL,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
};

BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key,
	   void *, value, u64, flags)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return map->ops->map_update_elem(map, key, value, flags);
}

const struct bpf_func_proto bpf_map_update_elem_proto = {
	.func		= bpf_map_update_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
	.arg3_type	= ARG_PTR_TO_MAP_VALUE,
	.arg4_type	= ARG_ANYTHING,
};

BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return map->ops->map_delete_elem(map, key);
}

const struct bpf_func_proto bpf_map_delete_elem_proto = {
	.func		= bpf_map_delete_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
};

BPF_CALL_3(bpf_map_push_elem, struct bpf_map *, map, void *, value, u64, flags)
{
	return map->ops->map_push_elem(map, value, flags);
}

const struct bpf_func_proto bpf_map_push_elem_proto = {
	.func		= bpf_map_push_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_VALUE,
	.arg3_type	= ARG_ANYTHING,
};

BPF_CALL_2(bpf_map_pop_elem, struct bpf_map *, map, void *, value)
{
	return map->ops->map_pop_elem(map, value);
}

const struct bpf_func_proto bpf_map_pop_elem_proto = {
	.func		= bpf_map_pop_elem,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE,
};

BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
{
	return map->ops->map_peek_elem(map, value);
}

const struct bpf_func_proto bpf_map_peek_elem_proto = {
	.func		= bpf_map_peek_elem,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_VALUE | MEM_UNINIT | MEM_WRITE,
};

BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu)
{
	WARN_ON_ONCE(!bpf_rcu_lock_held());
	return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu);
}

const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto = {
	.func		= bpf_map_lookup_percpu_elem,
	.gpl_only	= false,
	.pkt_access	= true,
	.ret_type	= RET_PTR_TO_MAP_VALUE_OR_NULL,
	.arg1_type	= ARG_CONST_MAP_PTR,
	.arg2_type	= ARG_PTR_TO_MAP_KEY,
	.arg3_type	= ARG_ANYTHING,
};

const struct bpf_func_proto bpf_get_prandom_u32_proto = {
	.func		= bpf_user_rnd_u32,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_get_smp_processor_id)
{
	return smp_processor_id();
}

const struct bpf_func_proto bpf_get_smp_processor_id_proto = {
	.func		= bpf_get_smp_processor_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.allow_fastcall	= true,
};

BPF_CALL_0(bpf_get_numa_node_id)
{
	return numa_node_id();
}

const struct bpf_func_proto bpf_get_numa_node_id_proto = {
	.func		= bpf_get_numa_node_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_ns)
{
	/* NMI safe access to clock monotonic */
	return ktime_get_mono_fast_ns();
}

const struct bpf_func_proto bpf_ktime_get_ns_proto = {
	.func		= bpf_ktime_get_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_boot_ns)
{
	/* NMI safe access to clock boottime */
	return ktime_get_boot_fast_ns();
}

const struct bpf_func_proto bpf_ktime_get_boot_ns_proto = {
	.func		= bpf_ktime_get_boot_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_coarse_ns)
{
	return ktime_get_coarse_ns();
}

const struct bpf_func_proto bpf_ktime_get_coarse_ns_proto = {
	.func		= bpf_ktime_get_coarse_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_ktime_get_tai_ns)
{
	/* NMI safe access to clock tai */
	return ktime_get_tai_fast_ns();
}

const struct bpf_func_proto bpf_ktime_get_tai_ns_proto = {
	.func		= bpf_ktime_get_tai_ns,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_get_current_pid_tgid)
{
	struct task_struct *task = current;

	if (unlikely(!task))
		return -EINVAL;

	return (u64) task->tgid << 32 | task->pid;
}

const struct bpf_func_proto bpf_get_current_pid_tgid_proto = {
	.func		= bpf_get_current_pid_tgid,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_0(bpf_get_current_uid_gid)
{
	struct task_struct *task = current;
	kuid_t uid;
	kgid_t gid;

	if (unlikely(!task))
		return -EINVAL;

	current_uid_gid(&uid, &gid);
	return (u64) from_kgid(&init_user_ns, gid) << 32 |
		     from_kuid(&init_user_ns, uid);
}

const struct bpf_func_proto bpf_get_current_uid_gid_proto = {
	.func		= bpf_get_current_uid_gid,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_2(bpf_get_current_comm, char *, buf, u32, size)
{
	struct task_struct *task = current;

	if (unlikely(!task))
		goto err_clear;

	/* Verifier guarantees that size > 0 */
	strscpy_pad(buf, task->comm, size);
	return 0;
err_clear:
	memset(buf, 0, size);
	return -EINVAL;
}

const struct bpf_func_proto bpf_get_current_comm_proto = {
	.func		= bpf_get_current_comm,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE,
};

#if defined(CONFIG_QUEUED_SPINLOCKS) || defined(CONFIG_BPF_ARCH_SPINLOCK)

static inline void __bpf_spin_lock(struct bpf_spin_lock *lock)
{
	arch_spinlock_t *l = (void *)lock;
	union {
		__u32 val;
		arch_spinlock_t lock;
	} u = { .lock = __ARCH_SPIN_LOCK_UNLOCKED };

	compiletime_assert(u.val == 0, "__ARCH_SPIN_LOCK_UNLOCKED not 0");
	BUILD_BUG_ON(sizeof(*l) != sizeof(__u32));
	BUILD_BUG_ON(sizeof(*lock) != sizeof(__u32));
	preempt_disable();
	arch_spin_lock(l);
}

static inline void __bpf_spin_unlock(struct bpf_spin_lock *lock)
{
	arch_spinlock_t *l = (void *)lock;

	arch_spin_unlock(l);
	preempt_enable();
}

#else

static inline void __bpf_spin_lock(struct bpf_spin_lock *lock)
{
	atomic_t *l = (void *)lock;

	BUILD_BUG_ON(sizeof(*l) != sizeof(*lock));
	do {
		atomic_cond_read_relaxed(l, !VAL);
	} while (atomic_xchg(l, 1));
}

static inline void __bpf_spin_unlock(struct bpf_spin_lock *lock)
{
	atomic_t *l = (void *)lock;

	atomic_set_release(l, 0);
}

#endif

static DEFINE_PER_CPU(unsigned long, irqsave_flags);

static inline void __bpf_spin_lock_irqsave(struct bpf_spin_lock *lock)
{
	unsigned long flags;

	local_irq_save(flags);
	__bpf_spin_lock(lock);
	__this_cpu_write(irqsave_flags, flags);
}

NOTRACE_BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
{
	__bpf_spin_lock_irqsave(lock);
	return 0;
}

const struct bpf_func_proto bpf_spin_lock_proto = {
	.func		= bpf_spin_lock,
	.gpl_only	= false,
	.ret_type	= RET_VOID,
	.arg1_type	= ARG_PTR_TO_SPIN_LOCK,
	.arg1_btf_id    = BPF_PTR_POISON,
};

static inline void __bpf_spin_unlock_irqrestore(struct bpf_spin_lock *lock)
{
	unsigned long flags;

	flags = __this_cpu_read(irqsave_flags);
	__bpf_spin_unlock(lock);
	local_irq_restore(flags);
}

NOTRACE_BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
{
	__bpf_spin_unlock_irqrestore(lock);
	return 0;
}

const struct bpf_func_proto bpf_spin_unlock_proto = {
	.func		= bpf_spin_unlock,
	.gpl_only	= false,
	.ret_type	= RET_VOID,
	.arg1_type	= ARG_PTR_TO_SPIN_LOCK,
	.arg1_btf_id    = BPF_PTR_POISON,
};

void copy_map_value_locked(struct bpf_map *map, void *dst, void *src,
			   bool lock_src)
{
	struct bpf_spin_lock *lock;

	if (lock_src)
		lock = src + map->record->spin_lock_off;
	else
		lock = dst + map->record->spin_lock_off;
	preempt_disable();
	__bpf_spin_lock_irqsave(lock);
	copy_map_value(map, dst, src);
	__bpf_spin_unlock_irqrestore(lock);
	preempt_enable();
}

BPF_CALL_0(bpf_jiffies64)
{
	return get_jiffies_64();
}

const struct bpf_func_proto bpf_jiffies64_proto = {
	.func		= bpf_jiffies64,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

#ifdef CONFIG_CGROUPS
BPF_CALL_0(bpf_get_current_cgroup_id)
{
	struct cgroup *cgrp;
	u64 cgrp_id;

	rcu_read_lock();
	cgrp = task_dfl_cgroup(current);
	cgrp_id = cgroup_id(cgrp);
	rcu_read_unlock();

	return cgrp_id;
}

const struct bpf_func_proto bpf_get_current_cgroup_id_proto = {
	.func		= bpf_get_current_cgroup_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_1(bpf_get_current_ancestor_cgroup_id, int, ancestor_level)
{
	struct cgroup *cgrp;
	struct cgroup *ancestor;
	u64 cgrp_id;

	rcu_read_lock();
	cgrp = task_dfl_cgroup(current);
	ancestor = cgroup_ancestor(cgrp, ancestor_level);
	cgrp_id = ancestor ? cgroup_id(ancestor) : 0;
	rcu_read_unlock();

	return cgrp_id;
}

const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto = {
	.func		= bpf_get_current_ancestor_cgroup_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_ANYTHING,
};
#endif /* CONFIG_CGROUPS */

#define BPF_STRTOX_BASE_MASK 0x1F

static int __bpf_strtoull(const char *buf, size_t buf_len, u64 flags,
			  unsigned long long *res, bool *is_negative)
{
	unsigned int base = flags & BPF_STRTOX_BASE_MASK;
	const char *cur_buf = buf;
	size_t cur_len = buf_len;
	unsigned int consumed;
	size_t val_len;
	char str[64];

	if (!buf || !buf_len || !res || !is_negative)
		return -EINVAL;

	if (base != 0 && base != 8 && base != 10 && base != 16)
		return -EINVAL;

	if (flags & ~BPF_STRTOX_BASE_MASK)
		return -EINVAL;

	while (cur_buf < buf + buf_len && isspace(*cur_buf))
		++cur_buf;

	*is_negative = (cur_buf < buf + buf_len && *cur_buf == '-');
	if (*is_negative)
		++cur_buf;

	consumed = cur_buf - buf;
	cur_len -= consumed;
	if (!cur_len)
		return -EINVAL;

	cur_len = min(cur_len, sizeof(str) - 1);
	memcpy(str, cur_buf, cur_len);
	str[cur_len] = '\0';
	cur_buf = str;

	cur_buf = _parse_integer_fixup_radix(cur_buf, &base);
	val_len = _parse_integer(cur_buf, base, res);

	if (val_len & KSTRTOX_OVERFLOW)
		return -ERANGE;

	if (val_len == 0)
		return -EINVAL;

	cur_buf += val_len;
	consumed += cur_buf - str;

	return consumed;
}

static int __bpf_strtoll(const char *buf, size_t buf_len, u64 flags,
			 long long *res)
{
	unsigned long long _res;
	bool is_negative;
	int err;

	err = __bpf_strtoull(buf, buf_len, flags, &_res, &is_negative);
	if (err < 0)
		return err;
	if (is_negative) {
		if ((long long)-_res > 0)
			return -ERANGE;
		*res = -_res;
	} else {
		if ((long long)_res < 0)
			return -ERANGE;
		*res = _res;
	}
	return err;
}

BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags,
	   s64 *, res)
{
	long long _res;
	int err;

	*res = 0;
	err = __bpf_strtoll(buf, buf_len, flags, &_res);
	if (err < 0)
		return err;
	*res = _res;
	return err;
}

const struct bpf_func_proto bpf_strtol_proto = {
	.func		= bpf_strtol,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg2_type	= ARG_CONST_SIZE,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
	.arg4_size	= sizeof(s64),
};

BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
	   u64 *, res)
{
	unsigned long long _res;
	bool is_negative;
	int err;

	*res = 0;
	err = __bpf_strtoull(buf, buf_len, flags, &_res, &is_negative);
	if (err < 0)
		return err;
	if (is_negative)
		return -EINVAL;
	*res = _res;
	return err;
}

const struct bpf_func_proto bpf_strtoul_proto = {
	.func		= bpf_strtoul,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg2_type	= ARG_CONST_SIZE,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_FIXED_SIZE_MEM | MEM_UNINIT | MEM_WRITE | MEM_ALIGNED,
	.arg4_size	= sizeof(u64),
};

BPF_CALL_3(bpf_strncmp, const char *, s1, u32, s1_sz, const char *, s2)
{
	return strncmp(s1, s2, s1_sz);
}

static const struct bpf_func_proto bpf_strncmp_proto = {
	.func		= bpf_strncmp,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg2_type	= ARG_CONST_SIZE,
	.arg3_type	= ARG_PTR_TO_CONST_STR,
};

BPF_CALL_4(bpf_get_ns_current_pid_tgid, u64, dev, u64, ino,
	   struct bpf_pidns_info *, nsdata, u32, size)
{
	struct task_struct *task = current;
	struct pid_namespace *pidns;
	int err = -EINVAL;

	if (unlikely(size != sizeof(struct bpf_pidns_info)))
		goto clear;

	if (unlikely((u64)(dev_t)dev != dev))
		goto clear;

	if (unlikely(!task))
		goto clear;

	pidns = task_active_pid_ns(task);
	if (unlikely(!pidns)) {
		err = -ENOENT;
		goto clear;
	}

	if (!ns_match(&pidns->ns, (dev_t)dev, ino))
		goto clear;

	nsdata->pid = task_pid_nr_ns(task, pidns);
	nsdata->tgid = task_tgid_nr_ns(task, pidns);
	return 0;
clear:
	memset((void *)nsdata, 0, (size_t) size);
	return err;
}

const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto = {
	.func		= bpf_get_ns_current_pid_tgid,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_ANYTHING,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type      = ARG_PTR_TO_UNINIT_MEM,
	.arg4_type      = ARG_CONST_SIZE,
};

static const struct bpf_func_proto bpf_get_raw_smp_processor_id_proto = {
	.func		= bpf_get_raw_cpu_id,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
};

BPF_CALL_5(bpf_event_output_data, void *, ctx, struct bpf_map *, map,
	   u64, flags, void *, data, u64, size)
{
	if (unlikely(flags & ~(BPF_F_INDEX_MASK)))
		return -EINVAL;

	return bpf_event_output(map, flags, data, size, NULL, 0, NULL);
}

const struct bpf_func_proto bpf_event_output_data_proto =  {
	.func		= bpf_event_output_data,
	.gpl_only       = true,
	.ret_type       = RET_INTEGER,
	.arg1_type      = ARG_PTR_TO_CTX,
	.arg2_type      = ARG_CONST_MAP_PTR,
	.arg3_type      = ARG_ANYTHING,
	.arg4_type      = ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg5_type      = ARG_CONST_SIZE_OR_ZERO,
};

BPF_CALL_3(bpf_copy_from_user, void *, dst, u32, size,
	   const void __user *, user_ptr)
{
	int ret = copy_from_user(dst, user_ptr, size);

	if (unlikely(ret)) {
		memset(dst, 0, size);
		ret = -EFAULT;
	}

	return ret;
}

const struct bpf_func_proto bpf_copy_from_user_proto = {
	.func		= bpf_copy_from_user,
	.gpl_only	= false,
	.might_sleep	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_ANYTHING,
};

BPF_CALL_5(bpf_copy_from_user_task, void *, dst, u32, size,
	   const void __user *, user_ptr, struct task_struct *, tsk, u64, flags)
{
	int ret;

	/* flags is not used yet */
	if (unlikely(flags))
		return -EINVAL;

	if (unlikely(!size))
		return 0;

	ret = access_process_vm(tsk, (unsigned long)user_ptr, dst, size, 0);
	if (ret == size)
		return 0;

	memset(dst, 0, size);
	/* Return -EFAULT for partial read */
	return ret < 0 ? ret : -EFAULT;
}

const struct bpf_func_proto bpf_copy_from_user_task_proto = {
	.func		= bpf_copy_from_user_task,
	.gpl_only	= true,
	.might_sleep	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_BTF_ID,
	.arg4_btf_id	= &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
	.arg5_type	= ARG_ANYTHING
};

BPF_CALL_2(bpf_per_cpu_ptr, const void *, ptr, u32, cpu)
{
	if (cpu >= nr_cpu_ids)
		return (unsigned long)NULL;

	return (unsigned long)per_cpu_ptr((const void __percpu *)(const uintptr_t)ptr, cpu);
}

const struct bpf_func_proto bpf_per_cpu_ptr_proto = {
	.func		= bpf_per_cpu_ptr,
	.gpl_only	= false,
	.ret_type	= RET_PTR_TO_MEM_OR_BTF_ID | PTR_MAYBE_NULL | MEM_RDONLY,
	.arg1_type	= ARG_PTR_TO_PERCPU_BTF_ID,
	.arg2_type	= ARG_ANYTHING,
};

BPF_CALL_1(bpf_this_cpu_ptr, const void *, percpu_ptr)
{
	return (unsigned long)this_cpu_ptr((const void __percpu *)(const uintptr_t)percpu_ptr);
}

const struct bpf_func_proto bpf_this_cpu_ptr_proto = {
	.func		= bpf_this_cpu_ptr,
	.gpl_only	= false,
	.ret_type	= RET_PTR_TO_MEM_OR_BTF_ID | MEM_RDONLY,
	.arg1_type	= ARG_PTR_TO_PERCPU_BTF_ID,
};

static int bpf_trace_copy_string(char *buf, void *unsafe_ptr, char fmt_ptype,
		size_t bufsz)
{
	void __user *user_ptr = (__force void __user *)unsafe_ptr;

	buf[0] = 0;

	switch (fmt_ptype) {
	case 's':
#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
		if ((unsigned long)unsafe_ptr < TASK_SIZE)
			return strncpy_from_user_nofault(buf, user_ptr, bufsz);
		fallthrough;
#endif
	case 'k':
		return strncpy_from_kernel_nofault(buf, unsafe_ptr, bufsz);
	case 'u':
		return strncpy_from_user_nofault(buf, user_ptr, bufsz);
	}

	return -EINVAL;
}

/* Support executing three nested bprintf helper calls on a given CPU */
#define MAX_BPRINTF_NEST_LEVEL	3

static DEFINE_PER_CPU(struct bpf_bprintf_buffers[MAX_BPRINTF_NEST_LEVEL], bpf_bprintf_bufs);
static DEFINE_PER_CPU(int, bpf_bprintf_nest_level);

int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
{
	int nest_level;

	preempt_disable();
	nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
	if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
		this_cpu_dec(bpf_bprintf_nest_level);
		preempt_enable();
		return -EBUSY;
	}
	*bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);

	return 0;
}

void bpf_put_buffers(void)
{
	if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
		return;
	this_cpu_dec(bpf_bprintf_nest_level);
	preempt_enable();
}

void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
{
	if (!data->bin_args && !data->buf)
		return;
	bpf_put_buffers();
}

/*
 * bpf_bprintf_prepare - Generic pass on format strings for bprintf-like helpers
 *
 * Returns a negative value if fmt is an invalid format string or 0 otherwise.
 *
 * This can be used in two ways:
 * - Format string verification only: when data->get_bin_args is false
 * - Arguments preparation: in addition to the above verification, it writes in
 *   data->bin_args a binary representation of arguments usable by bstr_printf
 *   where pointers from BPF have been sanitized.
 *
 * In argument preparation mode, if 0 is returned, safe temporary buffers are
 * allocated and bpf_bprintf_cleanup should be called to free them after use.
 */
int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
			u32 num_args, struct bpf_bprintf_data *data)
{
	bool get_buffers = (data->get_bin_args && num_args) || data->get_buf;
	char *unsafe_ptr = NULL, *tmp_buf = NULL, *tmp_buf_end, *fmt_end;
	struct bpf_bprintf_buffers *buffers = NULL;
	size_t sizeof_cur_arg, sizeof_cur_ip;
	int err, i, num_spec = 0;
	u64 cur_arg;
	char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";

	fmt_end = strnchr(fmt, fmt_size, 0);
	if (!fmt_end)
		return -EINVAL;
	fmt_size = fmt_end - fmt;

	if (get_buffers && bpf_try_get_buffers(&buffers))
		return -EBUSY;

	if (data->get_bin_args) {
		if (num_args)
			tmp_buf = buffers->bin_args;
		tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
		data->bin_args = (u32 *)tmp_buf;
	}

	if (data->get_buf)
		data->buf = buffers->buf;

	for (i = 0; i < fmt_size; i++) {
		unsigned char c = fmt[i];

		/*
		 * Permit bytes >= 0x80 in plain text so UTF-8 literals can pass
		 * through unchanged, while still rejecting ASCII control bytes.
		 */
		if (isascii(c) && !isprint(c) && !isspace(c)) {
			err = -EINVAL;
			goto out;
		}

		if (fmt[i] != '%')
			continue;

		if (fmt[i + 1] == '%') {
			i++;
			continue;
		}

		if (num_spec >= num_args) {
			err = -EINVAL;
			goto out;
		}

		/* The string is zero-terminated so if fmt[i] != 0, we can
		 * always access fmt[i + 1], in the worst case it will be a 0
		 */
		i++;
		c = fmt[i];
		/*
		 * The format parser below only understands ASCII conversion
		 * specifiers and modifiers, so reject non-ASCII after '%'.
		 */
		if (!isascii(c)) {
			err = -EINVAL;
			goto out;
		}

		/* skip optional "[0 +-][num]" width formatting field */
		while (fmt[i] == '0' || fmt[i] == '+'  || fmt[i] == '-' ||
		       fmt[i] == ' ')
			i++;
		if (fmt[i] >= '1' && fmt[i] <= '9') {
			i++;
			while (fmt[i] >= '0' && fmt[i] <= '9')
				i++;
		}

		if (fmt[i] == 'p') {
			sizeof_cur_arg = sizeof(long);

			if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) ||
			    ispunct(fmt[i + 1])) {
				if (tmp_buf)
					cur_arg = raw_args[num_spec];
				goto nocopy_fmt;
			}

			if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') &&
			    fmt[i + 2] == 's') {
				fmt_ptype = fmt[i + 1];
				i += 2;
				goto fmt_str;
			}

			if (fmt[i + 1] == 'K' ||
			    fmt[i + 1] == 'x' || fmt[i + 1] == 's' ||
			    fmt[i + 1] == 'S') {
				if (tmp_buf)
					cur_arg = raw_args[num_spec];
				i++;
				goto nocopy_fmt;
			}

			if (fmt[i + 1] == 'B') {
				if (tmp_buf)  {
					err = snprintf(tmp_buf,
						       (tmp_buf_end - tmp_buf),
						       "%pB",
						       (void *)(long)raw_args[num_spec]);
					tmp_buf += (err + 1);
				}

				i++;
				num_spec++;
				continue;
			}

			/* only support "%pI4", "%pi4", "%pI6" and "%pi6". */
			if ((fmt[i + 1] != 'i' && fmt[i + 1] != 'I') ||
			    (fmt[i + 2] != '4' && fmt[i + 2] != '6')) {
				err = -EINVAL;
				goto out;
			}

			i += 2;
			if (!tmp_buf)
				goto nocopy_fmt;

			sizeof_cur_ip = (fmt[i] == '4') ? 4 : 16;
			if (tmp_buf_end - tmp_buf < sizeof_cur_ip) {
				err = -ENOSPC;
				goto out;
			}

			unsafe_ptr = (char *)(long)raw_args[num_spec];
			err = copy_from_kernel_nofault(cur_ip, unsafe_ptr,
						       sizeof_cur_ip);
			if (err < 0)
				memset(cur_ip, 0, sizeof_cur_ip);

			/* hack: bstr_printf expects IP addresses to be
			 * pre-formatted as strings, ironically, the easiest way
			 * to do that is to call snprintf.
			 */
			ip_spec[2] = fmt[i - 1];
			ip_spec[3] = fmt[i];
			err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
				       ip_spec, &cur_ip);

			tmp_buf += err + 1;
			num_spec++;

			continue;
		} else if (fmt[i] == 's') {
			fmt_ptype = fmt[i];
fmt_str:
			if (fmt[i + 1] != 0 &&
			    !isspace(fmt[i + 1]) &&
			    !ispunct(fmt[i + 1])) {
				err = -EINVAL;
				goto out;
			}

			if (!tmp_buf)
				goto nocopy_fmt;

			if (tmp_buf_end == tmp_buf) {
				err = -ENOSPC;
				goto out;
			}

			unsafe_ptr = (char *)(long)raw_args[num_spec];
			err = bpf_trace_copy_string(tmp_buf, unsafe_ptr,
						    fmt_ptype,
						    tmp_buf_end - tmp_buf);
			if (err < 0) {
				tmp_buf[0] = '\0';
				err = 1;
			}

			tmp_buf += err;
			num_spec++;

			continue;
		} else if (fmt[i] == 'c') {
			if (!tmp_buf)
				goto nocopy_fmt;

			if (tmp_buf_end == tmp_buf) {
				err = -ENOSPC;
				goto out;
			}

			*tmp_buf = raw_args[num_spec];
			tmp_buf++;
			num_spec++;

			continue;
		}

		sizeof_cur_arg = sizeof(int);

		if (fmt[i] == 'l') {
			sizeof_cur_arg = sizeof(long);
			i++;
		}
		if (fmt[i] == 'l') {
			sizeof_cur_arg = sizeof(long long);
			i++;
		}

		if (fmt[i] != 'i' && fmt[i] != 'd' && fmt[i] != 'u' &&
		    fmt[i] != 'x' && fmt[i] != 'X') {
			err = -EINVAL;
			goto out;
		}

		if (tmp_buf)
			cur_arg = raw_args[num_spec];
nocopy_fmt:
		if (tmp_buf) {
			tmp_buf = PTR_ALIGN(tmp_buf, sizeof(u32));
			if (tmp_buf_end - tmp_buf < sizeof_cur_arg) {
				err = -ENOSPC;
				goto out;
			}

			if (sizeof_cur_arg == 8) {
				*(u32 *)tmp_buf = *(u32 *)&cur_arg;
				*(u32 *)(tmp_buf + 4) = *((u32 *)&cur_arg + 1);
			} else {
				*(u32 *)tmp_buf = (u32)(long)cur_arg;
			}
			tmp_buf += sizeof_cur_arg;
		}
		num_spec++;
	}

	err = 0;
out:
	if (err)
		bpf_bprintf_cleanup(data);
	return err;
}

BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt,
	   const void *, args, u32, data_len)
{
	struct bpf_bprintf_data data = {
		.get_bin_args	= true,
	};
	int err, num_args;

	if (data_len % 8 || data_len > MAX_BPRINTF_VARARGS * 8 ||
	    (data_len && !args))
		return -EINVAL;
	num_args = data_len / 8;

	/* ARG_PTR_TO_CONST_STR guarantees that fmt is zero-terminated so we
	 * can safely give an unbounded size.
	 */
	err = bpf_bprintf_prepare(fmt, UINT_MAX, args, num_args, &data);
	if (err < 0)
		return err;

	err = bstr_printf(str, str_size, fmt, data.bin_args);

	bpf_bprintf_cleanup(&data);

	return err + 1;
}

const struct bpf_func_proto bpf_snprintf_proto = {
	.func		= bpf_snprintf,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_MEM_OR_NULL | MEM_WRITE,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_PTR_TO_CONST_STR,
	.arg4_type	= ARG_PTR_TO_MEM | PTR_MAYBE_NULL | MEM_RDONLY,
	.arg5_type	= ARG_CONST_SIZE_OR_ZERO,
};

static void *map_key_from_value(struct bpf_map *map, void *value, u32 *arr_idx)
{
	if (map->map_type == BPF_MAP_TYPE_ARRAY) {
		struct bpf_array *array = container_of(map, struct bpf_array, map);

		*arr_idx = ((char *)value - array->value) / array->elem_size;
		return arr_idx;
	}
	return (void *)value - round_up(map->key_size, 8);
}

enum bpf_async_type {
	BPF_ASYNC_TYPE_TIMER = 0,
	BPF_ASYNC_TYPE_WQ,
};

enum bpf_async_op {
	BPF_ASYNC_START,
	BPF_ASYNC_CANCEL
};

struct bpf_async_cmd {
	struct llist_node node;
	u64 nsec;
	u32 mode;
	enum bpf_async_op op;
};

struct bpf_async_cb {
	struct bpf_map *map;
	struct bpf_prog *prog;
	void __rcu *callback_fn;
	void *value;
	struct rcu_head rcu;
	u64 flags;
	struct irq_work worker;
	refcount_t refcnt;
	enum bpf_async_type type;
	struct llist_head async_cmds;
};

/* BPF map elements can contain 'struct bpf_timer'.
 * Such map owns all of its BPF timers.
 * 'struct bpf_timer' is allocated as part of map element allocation
 * and it's zero initialized.
 * That space is used to keep 'struct bpf_async_kern'.
 * bpf_timer_init() allocates 'struct bpf_hrtimer', inits hrtimer, and
 * remembers 'struct bpf_map *' pointer it's part of.
 * bpf_timer_set_callback() increments prog refcnt and assign bpf callback_fn.
 * bpf_timer_start() arms the timer.
 * If user space reference to a map goes to zero at this point
 * ops->map_release_uref callback is responsible for cancelling the timers,
 * freeing their memory, and decrementing prog's refcnts.
 * bpf_timer_cancel() cancels the timer and decrements prog's refcnt.
 * Inner maps can contain bpf timers as well. ops->map_release_uref is
 * freeing the timers when inner map is replaced or deleted by user space.
 */
struct bpf_hrtimer {
	struct bpf_async_cb cb;
	struct hrtimer timer;
	atomic_t cancelling;
};

struct bpf_work {
	struct bpf_async_cb cb;
	struct work_struct work;
};

/* the actual struct hidden inside uapi struct bpf_timer and bpf_wq */
struct bpf_async_kern {
	union {
		struct bpf_async_cb *cb;
		struct bpf_hrtimer *timer;
		struct bpf_work *work;
	};
} __attribute__((aligned(8)));

static DEFINE_PER_CPU(struct bpf_hrtimer *, hrtimer_running);

static void bpf_async_refcount_put(struct bpf_async_cb *cb);

static enum hrtimer_restart bpf_timer_cb(struct hrtimer *hrtimer)
{
	struct bpf_hrtimer *t = container_of(hrtimer, struct bpf_hrtimer, timer);
	struct bpf_map *map = t->cb.map;
	void *value = t->cb.value;
	bpf_callback_t callback_fn;
	void *key;
	u32 idx;

	BTF_TYPE_EMIT(struct bpf_timer);
	callback_fn = rcu_dereference_check(t->cb.callback_fn, rcu_read_lock_bh_held());
	if (!callback_fn)
		goto out;

	/* bpf_timer_cb() runs in hrtimer_run_softirq. It doesn't migrate and
	 * cannot be preempted by another bpf_timer_cb() on the same cpu.
	 * Remember the timer this callback is servicing to prevent
	 * deadlock if callback_fn() calls bpf_timer_cancel() or
	 * bpf_map_delete_elem() on the same timer.
	 */
	this_cpu_write(hrtimer_running, t);

	key = map_key_from_value(map, value, &idx);

	callback_fn((u64)(long)map, (u64)(long)key, (u64)(long)value, 0, 0);
	/* The verifier checked that return value is zero. */

	this_cpu_write(hrtimer_running, NULL);
out:
	return HRTIMER_NORESTART;
}

static void bpf_wq_work(struct work_struct *work)
{
	struct bpf_work *w = container_of(work, struct bpf_work, work);
	struct bpf_async_cb *cb = &w->cb;
	struct bpf_map *map = cb->map;
	bpf_callback_t callback_fn;
	void *value = cb->value;
	void *key;
	u32 idx;

	BTF_TYPE_EMIT(struct bpf_wq);

	callback_fn = READ_ONCE(cb->callback_fn);
	if (!callback_fn)
		return;

	key = map_key_from_value(map, value, &idx);

        rcu_read_lock_trace();
        migrate_disable();

	callback_fn((u64)(long)map, (u64)(long)key, (u64)(long)value, 0, 0);

	migrate_enable();
	rcu_read_unlock_trace();
}

static void bpf_async_cb_rcu_free(struct rcu_head *rcu)
{
	struct bpf_async_cb *cb = container_of(rcu, struct bpf_async_cb, rcu);

	/*
	 * Drop the last reference to prog only after RCU GP, as set_callback()
	 * may race with cancel_and_free()
	 */
	if (cb->prog)
		bpf_prog_put(cb->prog);

	kfree_nolock(cb);
}

/* Callback from call_rcu_tasks_trace, chains to call_rcu for final free */
static void bpf_async_cb_rcu_tasks_trace_free(struct rcu_head *rcu)
{
	struct bpf_async_cb *cb = container_of(rcu, struct bpf_async_cb, rcu);
	struct bpf_hrtimer *t = container_of(cb, struct bpf_hrtimer, cb);
	struct bpf_work *w = container_of(cb, struct bpf_work, cb);
	bool retry = false;

	/*
	 * bpf_async_cancel_and_free() tried to cancel timer/wq, but it
	 * could have raced with timer/wq_start. Now refcnt is zero and
	 * srcu/rcu GP completed. Cancel timer/wq again.
	 */
	switch (cb->type) {
	case BPF_ASYNC_TYPE_TIMER:
		if (hrtimer_try_to_cancel(&t->timer) < 0)
			retry = true;
		break;
	case BPF_ASYNC_TYPE_WQ:
		if (!cancel_work(&w->work) && work_busy(&w->work))
			retry = true;
		break;
	}
	if (retry) {
		/*
		 * hrtimer or wq callback may still be running. It must be
		 * in rcu_tasks_trace or rcu CS, so wait for GP again.
		 * It won't retry forever, since refcnt zero prevents all
		 * operations on timer/wq.
		 */
		call_rcu_tasks_trace(&cb->rcu, bpf_async_cb_rcu_tasks_trace_free);
		return;
	}

	/* RCU Tasks Trace grace period implies RCU grace period. */
	bpf_async_cb_rcu_free(rcu);
}

static void worker_for_call_rcu(struct irq_work *work)
{
	struct bpf_async_cb *cb = container_of(work, struct bpf_async_cb, worker);

	call_rcu_tasks_trace(&cb->rcu, bpf_async_cb_rcu_tasks_trace_free);
}

static void bpf_async_refcount_put(struct bpf_async_cb *cb)
{
	if (!refcount_dec_and_test(&cb->refcnt))
		return;

	if (irqs_disabled()) {
		cb->worker = IRQ_WORK_INIT(worker_for_call_rcu);
		irq_work_queue(&cb->worker);
	} else {
		call_rcu_tasks_trace(&cb->rcu, bpf_async_cb_rcu_tasks_trace_free);
	}
}

static void bpf_async_cancel_and_free(struct bpf_async_kern *async);
static void bpf_async_irq_worker(struct irq_work *work);

static int __bpf_async_init(struct bpf_async_kern *async, struct bpf_map *map, u64 flags,
			    enum bpf_async_type type)
{
	struct bpf_async_cb *cb, *old_cb;
	struct bpf_hrtimer *t;
	struct bpf_work *w;
	clockid_t clockid;
	size_t size;

	switch (type) {
	case BPF_ASYNC_TYPE_TIMER:
		size = sizeof(struct bpf_hrtimer);
		break;
	case BPF_ASYNC_TYPE_WQ:
		size = sizeof(struct bpf_work);
		break;
	default:
		return -EINVAL;
	}

	old_cb = READ_ONCE(async->cb);
	if (old_cb)
		return -EBUSY;

	cb = bpf_map_kmalloc_nolock(map, size, 0, map->numa_node);
	if (!cb)
		return -ENOMEM;

	switch (type) {
	case BPF_ASYNC_TYPE_TIMER:
		clockid = flags & (MAX_CLOCKS - 1);
		t = (struct bpf_hrtimer *)cb;

		atomic_set(&t->cancelling, 0);
		hrtimer_setup(&t->timer, bpf_timer_cb, clockid, HRTIMER_MODE_REL_SOFT);
		cb->value = (void *)async - map->record->timer_off;
		break;
	case BPF_ASYNC_TYPE_WQ:
		w = (struct bpf_work *)cb;

		INIT_WORK(&w->work, bpf_wq_work);
		cb->value = (void *)async - map->record->wq_off;
		break;
	}
	cb->map = map;
	cb->prog = NULL;
	cb->flags = flags;
	cb->worker = IRQ_WORK_INIT(bpf_async_irq_worker);
	init_llist_head(&cb->async_cmds);
	refcount_set(&cb->refcnt, 1); /* map's reference */
	cb->type = type;
	rcu_assign_pointer(cb->callback_fn, NULL);

	old_cb = cmpxchg(&async->cb, NULL, cb);
	if (old_cb) {
		/* Lost the race to initialize this bpf_async_kern, drop the allocated object */
		kfree_nolock(cb);
		return -EBUSY;
	}
	/* Guarantee the order between async->cb and map->usercnt. So
	 * when there are concurrent uref release and bpf timer init, either
	 * bpf_timer_cancel_and_free() called by uref release reads a no-NULL
	 * timer or atomic64_read() below returns a zero usercnt.
	 */
	smp_mb();
	if (!atomic64_read(&map->usercnt)) {
		/* maps with timers must be either held by user space
		 * or pinned in bpffs.
		 */
		bpf_async_cancel_and_free(async);
		return -EPERM;
	}

	return 0;
}

BPF_CALL_3(bpf_timer_init, struct bpf_async_kern *, timer, struct bpf_map *, map,
	   u64, flags)
{
	clock_t clockid = flags & (MAX_CLOCKS - 1);

	BUILD_BUG_ON(MAX_CLOCKS != 16);
	BUILD_BUG_ON(sizeof(struct bpf_async_kern) > sizeof(struct bpf_timer));
	BUILD_BUG_ON(__alignof__(struct bpf_async_kern) != __alignof__(struct bpf_timer));

	if (flags >= MAX_CLOCKS ||
	    /* similar to timerfd except _ALARM variants are not supported */
	    (clockid != CLOCK_MONOTONIC &&
	     clockid != CLOCK_REALTIME &&
	     clockid != CLOCK_BOOTTIME))
		return -EINVAL;

	return __bpf_async_init(timer, map, flags, BPF_ASYNC_TYPE_TIMER);
}

static const struct bpf_func_proto bpf_timer_init_proto = {
	.func		= bpf_timer_init,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
	.arg2_type	= ARG_CONST_MAP_PTR,
	.arg3_type	= ARG_ANYTHING,
};

static int bpf_async_update_prog_callback(struct bpf_async_cb *cb,
					  struct bpf_prog *prog,
					  void *callback_fn)
{
	struct bpf_prog *prev;

	/* Acquire a guard reference on prog to prevent it from being freed during the loop */
	if (prog) {
		prog = bpf_prog_inc_not_zero(prog);
		if (IS_ERR(prog))
			return PTR_ERR(prog);
	}

	do {
		if (prog)
			prog = bpf_prog_inc_not_zero(prog);
		prev = xchg(&cb->prog, prog);
		rcu_assign_pointer(cb->callback_fn, callback_fn);

		/*
		 * Release previous prog, make sure that if other CPU is contending,
		 * to set bpf_prog, references are not leaked as each iteration acquires and
		 * releases one reference.
		 */
		if (prev)
			bpf_prog_put(prev);

	} while (READ_ONCE(cb->prog) != prog ||
		 (void __force *)READ_ONCE(cb->callback_fn) != callback_fn);

	if (prog)
		bpf_prog_put(prog);

	return 0;
}

static DEFINE_PER_CPU(struct bpf_async_cb *, async_cb_running);

static int bpf_async_schedule_op(struct bpf_async_cb *cb, enum bpf_async_op op,
				 u64 nsec, u32 timer_mode)
{
	/*
	 * Do not schedule another operation on this cpu if it's in irq_work
	 * callback that is processing async_cmds queue. Otherwise the following
	 * loop is possible:
	 * bpf_timer_start() -> bpf_async_schedule_op() -> irq_work_queue().
	 * irqrestore -> bpf_async_irq_worker() -> tracepoint -> bpf_timer_start().
	 */
	if (this_cpu_read(async_cb_running) == cb) {
		bpf_async_refcount_put(cb);
		return -EDEADLK;
	}

	struct bpf_async_cmd *cmd = kmalloc_nolock(sizeof(*cmd), 0, NUMA_NO_NODE);

	if (!cmd) {
		bpf_async_refcount_put(cb);
		return -ENOMEM;
	}
	init_llist_node(&cmd->node);
	cmd->nsec = nsec;
	cmd->mode = timer_mode;
	cmd->op = op;
	if (llist_add(&cmd->node, &cb->async_cmds))
		irq_work_queue(&cb->worker);
	return 0;
}

static int __bpf_async_set_callback(struct bpf_async_kern *async, void *callback_fn,
				    struct bpf_prog *prog)
{
	struct bpf_async_cb *cb;

	cb = READ_ONCE(async->cb);
	if (!cb)
		return -EINVAL;

	return bpf_async_update_prog_callback(cb, prog, callback_fn);
}

BPF_CALL_3(bpf_timer_set_callback, struct bpf_async_kern *, timer, void *, callback_fn,
	   struct bpf_prog_aux *, aux)
{
	return __bpf_async_set_callback(timer, callback_fn, aux->prog);
}

static const struct bpf_func_proto bpf_timer_set_callback_proto = {
	.func		= bpf_timer_set_callback,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
	.arg2_type	= ARG_PTR_TO_FUNC,
};

static bool defer_timer_wq_op(void)
{
	return in_hardirq() || irqs_disabled();
}

BPF_CALL_3(bpf_timer_start, struct bpf_async_kern *, async, u64, nsecs, u64, flags)
{
	struct bpf_hrtimer *t;
	u32 mode;

	if (flags & ~(BPF_F_TIMER_ABS | BPF_F_TIMER_CPU_PIN))
		return -EINVAL;

	t = READ_ONCE(async->timer);
	if (!t || !READ_ONCE(t->cb.prog))
		return -EINVAL;

	if (flags & BPF_F_TIMER_ABS)
		mode = HRTIMER_MODE_ABS_SOFT;
	else
		mode = HRTIMER_MODE_REL_SOFT;

	if (flags & BPF_F_TIMER_CPU_PIN)
		mode |= HRTIMER_MODE_PINNED;

	/*
	 * bpf_async_cancel_and_free() could have dropped refcnt to zero. In
	 * such case BPF progs are not allowed to arm the timer to prevent UAF.
	 */
	if (!refcount_inc_not_zero(&t->cb.refcnt))
		return -ENOENT;

	if (!defer_timer_wq_op()) {
		hrtimer_start(&t->timer, ns_to_ktime(nsecs), mode);
		bpf_async_refcount_put(&t->cb);
		return 0;
	} else {
		return bpf_async_schedule_op(&t->cb, BPF_ASYNC_START, nsecs, mode);
	}
}

static const struct bpf_func_proto bpf_timer_start_proto = {
	.func		= bpf_timer_start,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type	= ARG_ANYTHING,
};

BPF_CALL_1(bpf_timer_cancel, struct bpf_async_kern *, async)
{
	struct bpf_hrtimer *t, *cur_t;
	bool inc = false;
	int ret = 0;

	if (defer_timer_wq_op())
		return -EOPNOTSUPP;

	t = READ_ONCE(async->timer);
	if (!t)
		return -EINVAL;

	cur_t = this_cpu_read(hrtimer_running);
	if (cur_t == t) {
		/* If bpf callback_fn is trying to bpf_timer_cancel()
		 * its own timer the hrtimer_cancel() will deadlock
		 * since it waits for callback_fn to finish.
		 */
		return -EDEADLK;
	}

	/* Only account in-flight cancellations when invoked from a timer
	 * callback, since we want to avoid waiting only if other _callbacks_
	 * are waiting on us, to avoid introducing lockups. Non-callback paths
	 * are ok, since nobody would synchronously wait for their completion.
	 */
	if (!cur_t)
		goto drop;
	atomic_inc(&t->cancelling);
	/* Need full barrier after relaxed atomic_inc */
	smp_mb__after_atomic();
	inc = true;
	if (atomic_read(&cur_t->cancelling)) {
		/* We're cancelling timer t, while some other timer callback is
		 * attempting to cancel us. In such a case, it might be possible
		 * that timer t belongs to the other callback, or some other
		 * callback waiting upon it (creating transitive dependencies
		 * upon us), and we will enter a deadlock if we continue
		 * cancelling and waiting for it synchronously, since it might
		 * do the same. Bail!
		 */
		atomic_dec(&t->cancelling);
		return -EDEADLK;
	}
drop:
	bpf_async_update_prog_callback(&t->cb, NULL, NULL);
	/* Cancel the timer and wait for associated callback to finish
	 * if it was running.
	 */
	ret = hrtimer_cancel(&t->timer);
	if (inc)
		atomic_dec(&t->cancelling);
	return ret;
}

static const struct bpf_func_proto bpf_timer_cancel_proto = {
	.func		= bpf_timer_cancel,
	.gpl_only	= true,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_TIMER,
};

static void bpf_async_process_op(struct bpf_async_cb *cb, u32 op,
				 u64 timer_nsec, u32 timer_mode)
{
	switch (cb->type) {
	case BPF_ASYNC_TYPE_TIMER: {
		struct bpf_hrtimer *t = container_of(cb, struct bpf_hrtimer, cb);

		switch (op) {
		case BPF_ASYNC_START:
			hrtimer_start(&t->timer, ns_to_ktime(timer_nsec), timer_mode);
			break;
		case BPF_ASYNC_CANCEL:
			hrtimer_try_to_cancel(&t->timer);
			break;
		}
		break;
	}
	case BPF_ASYNC_TYPE_WQ: {
		struct bpf_work *w = container_of(cb, struct bpf_work, cb);

		switch (op) {
		case BPF_ASYNC_START:
			schedule_work(&w->work);
			break;
		case BPF_ASYNC_CANCEL:
			cancel_work(&w->work);
			break;
		}
		break;
	}
	}
	bpf_async_refcount_put(cb);
}

static void bpf_async_irq_worker(struct irq_work *work)
{
	struct bpf_async_cb *cb = container_of(work, struct bpf_async_cb, worker);
	struct llist_node *pos, *n, *list;

	list = llist_del_all(&cb->async_cmds);
	if (!list)
		return;

	list = llist_reverse_order(list);
	this_cpu_write(async_cb_running, cb);
	llist_for_each_safe(pos, n, list) {
		struct bpf_async_cmd *cmd;

		cmd = container_of(pos, struct bpf_async_cmd, node);
		bpf_async_process_op(cb, cmd->op, cmd->nsec, cmd->mode);
		kfree_nolock(cmd);
	}
	this_cpu_write(async_cb_running, NULL);
}

static void bpf_async_cancel_and_free(struct bpf_async_kern *async)
{
	struct bpf_async_cb *cb;

	if (!READ_ONCE(async->cb))
		return;

	cb = xchg(&async->cb, NULL);
	if (!cb)
		return;

	bpf_async_update_prog_callback(cb, NULL, NULL);
	/*
	 * No refcount_inc_not_zero(&cb->refcnt) here. Dropping the last
	 * refcnt. Either synchronously or asynchronously in irq_work.
	 */

	if (!defer_timer_wq_op()) {
		bpf_async_process_op(cb, BPF_ASYNC_CANCEL, 0, 0);
	} else {
		(void)bpf_async_schedule_op(cb, BPF_ASYNC_CANCEL, 0, 0);
		/*
		 * bpf_async_schedule_op() either enqueues allocated cmd into llist
		 * or fails with ENOMEM and drop the last refcnt.
		 * This is unlikely, but safe, since bpf_async_cb_rcu_tasks_trace_free()
		 * callback will do additional timer/wq_cancel due to races anyway.
		 */
	}
}

/*
 * This function is called by map_delete/update_elem for individual element and
 * by ops->map_release_uref when the user space reference to a map reaches zero.
 */
void bpf_timer_cancel_and_free(void *val)
{
	bpf_async_cancel_and_free(val);
}

/*
 * This function is called by map_delete/update_elem for individual element and
 * by ops->map_release_uref when the user space reference to a map reaches zero.
 */
void bpf_wq_cancel_and_free(void *val)
{
	bpf_async_cancel_and_free(val);
}

BPF_CALL_2(bpf_kptr_xchg, void *, dst, void *, ptr)
{
	unsigned long *kptr = dst;

	/* This helper may be inlined by verifier. */
	return xchg(kptr, (unsigned long)ptr);
}

/* Unlike other PTR_TO_BTF_ID helpers the btf_id in bpf_kptr_xchg()
 * helper is determined dynamically by the verifier. Use BPF_PTR_POISON to
 * denote type that verifier will determine.
 */
static const struct bpf_func_proto bpf_kptr_xchg_proto = {
	.func         = bpf_kptr_xchg,
	.gpl_only     = false,
	.ret_type     = RET_PTR_TO_BTF_ID_OR_NULL,
	.ret_btf_id   = BPF_PTR_POISON,
	.arg1_type    = ARG_KPTR_XCHG_DEST,
	.arg2_type    = ARG_PTR_TO_BTF_ID_OR_NULL | OBJ_RELEASE,
	.arg2_btf_id  = BPF_PTR_POISON,
};

struct bpf_dynptr_file_impl {
	struct freader freader;
	/* 64 bit offset and size overriding 32 bit ones in bpf_dynptr_kern */
	u64 offset;
	u64 size;
};

/* Since the upper 8 bits of dynptr->size is reserved, the
 * maximum supported size is 2^24 - 1.
 */
#define DYNPTR_MAX_SIZE	((1UL << 24) - 1)
#define DYNPTR_TYPE_SHIFT	28
#define DYNPTR_SIZE_MASK	0xFFFFFF
#define DYNPTR_RDONLY_BIT	BIT(31)

bool __bpf_dynptr_is_rdonly(const struct bpf_dynptr_kern *ptr)
{
	return ptr->size & DYNPTR_RDONLY_BIT;
}

void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr)
{
	ptr->size |= DYNPTR_RDONLY_BIT;
}

static void bpf_dynptr_set_type(struct bpf_dynptr_kern *ptr, enum bpf_dynptr_type type)
{
	ptr->size |= type << DYNPTR_TYPE_SHIFT;
}

static enum bpf_dynptr_type bpf_dynptr_get_type(const struct bpf_dynptr_kern *ptr)
{
	return (ptr->size & ~(DYNPTR_RDONLY_BIT)) >> DYNPTR_TYPE_SHIFT;
}

u64 __bpf_dynptr_size(const struct bpf_dynptr_kern *ptr)
{
	if (bpf_dynptr_get_type(ptr) == BPF_DYNPTR_TYPE_FILE) {
		struct bpf_dynptr_file_impl *df = ptr->data;

		return df->size;
	}

	return ptr->size & DYNPTR_SIZE_MASK;
}

static void bpf_dynptr_advance_offset(struct bpf_dynptr_kern *ptr, u64 off)
{
	if (bpf_dynptr_get_type(ptr) == BPF_DYNPTR_TYPE_FILE) {
		struct bpf_dynptr_file_impl *df = ptr->data;

		df->offset += off;
		return;
	}
	ptr->offset += off;
}

static void bpf_dynptr_set_size(struct bpf_dynptr_kern *ptr, u64 new_size)
{
	u32 metadata = ptr->size & ~DYNPTR_SIZE_MASK;

	if (bpf_dynptr_get_type(ptr) == BPF_DYNPTR_TYPE_FILE) {
		struct bpf_dynptr_file_impl *df = ptr->data;

		df->size = new_size;
		return;
	}
	ptr->size = (u32)new_size | metadata;
}

int bpf_dynptr_check_size(u64 size)
{
	return size > DYNPTR_MAX_SIZE ? -E2BIG : 0;
}

static int bpf_file_fetch_bytes(struct bpf_dynptr_file_impl *df, u64 offset, void *buf, u64 len)
{
	const void *ptr;

	if (!buf)
		return -EINVAL;

	df->freader.buf = buf;
	df->freader.buf_sz = len;
	ptr = freader_fetch(&df->freader, offset + df->offset, len);
	if (!ptr)
		return df->freader.err;

	if (ptr != buf) /* Force copying into the buffer */
		memcpy(buf, ptr, len);

	return 0;
}

void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data,
		     enum bpf_dynptr_type type, u32 offset, u32 size)
{
	ptr->data = data;
	ptr->offset = offset;
	ptr->size = size;
	bpf_dynptr_set_type(ptr, type);
}

void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr)
{
	memset(ptr, 0, sizeof(*ptr));
}

BPF_CALL_4(bpf_dynptr_from_mem, void *, data, u64, size, u64, flags, struct bpf_dynptr_kern *, ptr)
{
	int err;

	BTF_TYPE_EMIT(struct bpf_dynptr);

	err = bpf_dynptr_check_size(size);
	if (err)
		goto error;

	/* flags is currently unsupported */
	if (flags) {
		err = -EINVAL;
		goto error;
	}

	bpf_dynptr_init(ptr, data, BPF_DYNPTR_TYPE_LOCAL, 0, size);

	return 0;

error:
	bpf_dynptr_set_null(ptr);
	return err;
}

static const struct bpf_func_proto bpf_dynptr_from_mem_proto = {
	.func		= bpf_dynptr_from_mem,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_ANYTHING,
	.arg4_type	= ARG_PTR_TO_DYNPTR | DYNPTR_TYPE_LOCAL | MEM_UNINIT | MEM_WRITE,
};

static int __bpf_dynptr_read(void *dst, u64 len, const struct bpf_dynptr_kern *src,
			     u64 offset, u64 flags)
{
	enum bpf_dynptr_type type;
	int err;

	if (!src->data || flags)
		return -EINVAL;

	err = bpf_dynptr_check_off_len(src, offset, len);
	if (err)
		return err;

	type = bpf_dynptr_get_type(src);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		/* Source and destination may possibly overlap, hence use memmove to
		 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
		 * pointing to overlapping PTR_TO_MAP_VALUE regions.
		 */
		memmove(dst, src->data + src->offset + offset, len);
		return 0;
	case BPF_DYNPTR_TYPE_SKB:
		return __bpf_skb_load_bytes(src->data, src->offset + offset, dst, len);
	case BPF_DYNPTR_TYPE_XDP:
		return __bpf_xdp_load_bytes(src->data, src->offset + offset, dst, len);
	case BPF_DYNPTR_TYPE_SKB_META:
		memmove(dst, bpf_skb_meta_pointer(src->data, src->offset + offset), len);
		return 0;
	case BPF_DYNPTR_TYPE_FILE:
		return bpf_file_fetch_bytes(src->data, offset, dst, len);
	default:
		WARN_ONCE(true, "bpf_dynptr_read: unknown dynptr type %d\n", type);
		return -EFAULT;
	}
}

BPF_CALL_5(bpf_dynptr_read, void *, dst, u64, len, const struct bpf_dynptr_kern *, src,
	   u64, offset, u64, flags)
{
	return __bpf_dynptr_read(dst, len, src, offset, flags);
}

static const struct bpf_func_proto bpf_dynptr_read_proto = {
	.func		= bpf_dynptr_read,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg3_type	= ARG_PTR_TO_DYNPTR | MEM_RDONLY,
	.arg4_type	= ARG_ANYTHING,
	.arg5_type	= ARG_ANYTHING,
};

int __bpf_dynptr_write(const struct bpf_dynptr_kern *dst, u64 offset, void *src,
		       u64 len, u64 flags)
{
	enum bpf_dynptr_type type;
	int err;

	if (!dst->data || __bpf_dynptr_is_rdonly(dst))
		return -EINVAL;

	err = bpf_dynptr_check_off_len(dst, offset, len);
	if (err)
		return err;

	type = bpf_dynptr_get_type(dst);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		if (flags)
			return -EINVAL;
		/* Source and destination may possibly overlap, hence use memmove to
		 * copy the data. E.g. bpf_dynptr_from_mem may create two dynptr
		 * pointing to overlapping PTR_TO_MAP_VALUE regions.
		 */
		memmove(dst->data + dst->offset + offset, src, len);
		return 0;
	case BPF_DYNPTR_TYPE_SKB:
		return __bpf_skb_store_bytes(dst->data, dst->offset + offset, src, len,
					     flags);
	case BPF_DYNPTR_TYPE_XDP:
		if (flags)
			return -EINVAL;
		return __bpf_xdp_store_bytes(dst->data, dst->offset + offset, src, len);
	case BPF_DYNPTR_TYPE_SKB_META:
		return __bpf_skb_meta_store_bytes(dst->data, dst->offset + offset, src,
						  len, flags);
	default:
		WARN_ONCE(true, "bpf_dynptr_write: unknown dynptr type %d\n", type);
		return -EFAULT;
	}
}

BPF_CALL_5(bpf_dynptr_write, const struct bpf_dynptr_kern *, dst, u64, offset, void *, src,
	   u64, len, u64, flags)
{
	return __bpf_dynptr_write(dst, offset, src, len, flags);
}

static const struct bpf_func_proto bpf_dynptr_write_proto = {
	.func		= bpf_dynptr_write,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_PTR_TO_DYNPTR | MEM_RDONLY,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
	.arg4_type	= ARG_CONST_SIZE_OR_ZERO,
	.arg5_type	= ARG_ANYTHING,
};

BPF_CALL_3(bpf_dynptr_data, const struct bpf_dynptr_kern *, ptr, u64, offset, u64, len)
{
	enum bpf_dynptr_type type;
	int err;

	if (!ptr->data)
		return 0;

	err = bpf_dynptr_check_off_len(ptr, offset, len);
	if (err)
		return 0;

	if (__bpf_dynptr_is_rdonly(ptr))
		return 0;

	type = bpf_dynptr_get_type(ptr);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		return (unsigned long)(ptr->data + ptr->offset + offset);
	case BPF_DYNPTR_TYPE_SKB:
	case BPF_DYNPTR_TYPE_XDP:
	case BPF_DYNPTR_TYPE_SKB_META:
		/* skb and xdp dynptrs should use bpf_dynptr_slice / bpf_dynptr_slice_rdwr */
		return 0;
	default:
		WARN_ONCE(true, "bpf_dynptr_data: unknown dynptr type %d\n", type);
		return 0;
	}
}

static const struct bpf_func_proto bpf_dynptr_data_proto = {
	.func		= bpf_dynptr_data,
	.gpl_only	= false,
	.ret_type	= RET_PTR_TO_DYNPTR_MEM_OR_NULL,
	.arg1_type	= ARG_PTR_TO_DYNPTR | MEM_RDONLY,
	.arg2_type	= ARG_ANYTHING,
	.arg3_type	= ARG_CONST_ALLOC_SIZE_OR_ZERO,
};

const struct bpf_func_proto bpf_get_current_task_proto __weak;
const struct bpf_func_proto bpf_get_current_task_btf_proto __weak;
const struct bpf_func_proto bpf_probe_read_user_proto __weak;
const struct bpf_func_proto bpf_probe_read_user_str_proto __weak;
const struct bpf_func_proto bpf_probe_read_kernel_proto __weak;
const struct bpf_func_proto bpf_probe_read_kernel_str_proto __weak;
const struct bpf_func_proto bpf_task_pt_regs_proto __weak;
const struct bpf_func_proto bpf_perf_event_read_proto __weak;
const struct bpf_func_proto bpf_send_signal_proto __weak;
const struct bpf_func_proto bpf_send_signal_thread_proto __weak;
const struct bpf_func_proto bpf_get_task_stack_sleepable_proto __weak;
const struct bpf_func_proto bpf_get_task_stack_proto __weak;
const struct bpf_func_proto bpf_get_branch_snapshot_proto __weak;

const struct bpf_func_proto *
bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	switch (func_id) {
	case BPF_FUNC_map_lookup_elem:
		return &bpf_map_lookup_elem_proto;
	case BPF_FUNC_map_update_elem:
		return &bpf_map_update_elem_proto;
	case BPF_FUNC_map_delete_elem:
		return &bpf_map_delete_elem_proto;
	case BPF_FUNC_map_push_elem:
		return &bpf_map_push_elem_proto;
	case BPF_FUNC_map_pop_elem:
		return &bpf_map_pop_elem_proto;
	case BPF_FUNC_map_peek_elem:
		return &bpf_map_peek_elem_proto;
	case BPF_FUNC_map_lookup_percpu_elem:
		return &bpf_map_lookup_percpu_elem_proto;
	case BPF_FUNC_get_prandom_u32:
		return &bpf_get_prandom_u32_proto;
	case BPF_FUNC_get_smp_processor_id:
		return &bpf_get_raw_smp_processor_id_proto;
	case BPF_FUNC_get_numa_node_id:
		return &bpf_get_numa_node_id_proto;
	case BPF_FUNC_tail_call:
		return &bpf_tail_call_proto;
	case BPF_FUNC_ktime_get_ns:
		return &bpf_ktime_get_ns_proto;
	case BPF_FUNC_ktime_get_boot_ns:
		return &bpf_ktime_get_boot_ns_proto;
	case BPF_FUNC_ktime_get_tai_ns:
		return &bpf_ktime_get_tai_ns_proto;
	case BPF_FUNC_ringbuf_output:
		return &bpf_ringbuf_output_proto;
	case BPF_FUNC_ringbuf_reserve:
		return &bpf_ringbuf_reserve_proto;
	case BPF_FUNC_ringbuf_submit:
		return &bpf_ringbuf_submit_proto;
	case BPF_FUNC_ringbuf_discard:
		return &bpf_ringbuf_discard_proto;
	case BPF_FUNC_ringbuf_query:
		return &bpf_ringbuf_query_proto;
	case BPF_FUNC_strncmp:
		return &bpf_strncmp_proto;
	case BPF_FUNC_strtol:
		return &bpf_strtol_proto;
	case BPF_FUNC_strtoul:
		return &bpf_strtoul_proto;
	case BPF_FUNC_get_current_pid_tgid:
		return &bpf_get_current_pid_tgid_proto;
	case BPF_FUNC_get_ns_current_pid_tgid:
		return &bpf_get_ns_current_pid_tgid_proto;
	case BPF_FUNC_get_current_uid_gid:
		return &bpf_get_current_uid_gid_proto;
	default:
		break;
	}

	if (!bpf_token_capable(prog->aux->token, CAP_BPF))
		return NULL;

	switch (func_id) {
	case BPF_FUNC_spin_lock:
		return &bpf_spin_lock_proto;
	case BPF_FUNC_spin_unlock:
		return &bpf_spin_unlock_proto;
	case BPF_FUNC_jiffies64:
		return &bpf_jiffies64_proto;
	case BPF_FUNC_per_cpu_ptr:
		return &bpf_per_cpu_ptr_proto;
	case BPF_FUNC_this_cpu_ptr:
		return &bpf_this_cpu_ptr_proto;
	case BPF_FUNC_timer_init:
		return &bpf_timer_init_proto;
	case BPF_FUNC_timer_set_callback:
		return &bpf_timer_set_callback_proto;
	case BPF_FUNC_timer_start:
		return &bpf_timer_start_proto;
	case BPF_FUNC_timer_cancel:
		return &bpf_timer_cancel_proto;
	case BPF_FUNC_kptr_xchg:
		return &bpf_kptr_xchg_proto;
	case BPF_FUNC_for_each_map_elem:
		return &bpf_for_each_map_elem_proto;
	case BPF_FUNC_loop:
		return &bpf_loop_proto;
	case BPF_FUNC_user_ringbuf_drain:
		return &bpf_user_ringbuf_drain_proto;
	case BPF_FUNC_ringbuf_reserve_dynptr:
		return &bpf_ringbuf_reserve_dynptr_proto;
	case BPF_FUNC_ringbuf_submit_dynptr:
		return &bpf_ringbuf_submit_dynptr_proto;
	case BPF_FUNC_ringbuf_discard_dynptr:
		return &bpf_ringbuf_discard_dynptr_proto;
	case BPF_FUNC_dynptr_from_mem:
		return &bpf_dynptr_from_mem_proto;
	case BPF_FUNC_dynptr_read:
		return &bpf_dynptr_read_proto;
	case BPF_FUNC_dynptr_write:
		return &bpf_dynptr_write_proto;
	case BPF_FUNC_dynptr_data:
		return &bpf_dynptr_data_proto;
#ifdef CONFIG_CGROUPS
	case BPF_FUNC_cgrp_storage_get:
		return &bpf_cgrp_storage_get_proto;
	case BPF_FUNC_cgrp_storage_delete:
		return &bpf_cgrp_storage_delete_proto;
	case BPF_FUNC_get_current_cgroup_id:
		return &bpf_get_current_cgroup_id_proto;
	case BPF_FUNC_get_current_ancestor_cgroup_id:
		return &bpf_get_current_ancestor_cgroup_id_proto;
	case BPF_FUNC_current_task_under_cgroup:
		return &bpf_current_task_under_cgroup_proto;
#endif
#ifdef CONFIG_CGROUP_NET_CLASSID
	case BPF_FUNC_get_cgroup_classid:
		return &bpf_get_cgroup_classid_curr_proto;
#endif
	case BPF_FUNC_task_storage_get:
		return &bpf_task_storage_get_proto;
	case BPF_FUNC_task_storage_delete:
		return &bpf_task_storage_delete_proto;
	default:
		break;
	}

	if (!bpf_token_capable(prog->aux->token, CAP_PERFMON))
		return NULL;

	switch (func_id) {
	case BPF_FUNC_trace_printk:
		return bpf_get_trace_printk_proto();
	case BPF_FUNC_get_current_task:
		return &bpf_get_current_task_proto;
	case BPF_FUNC_get_current_task_btf:
		return &bpf_get_current_task_btf_proto;
	case BPF_FUNC_get_current_comm:
		return &bpf_get_current_comm_proto;
	case BPF_FUNC_probe_read_user:
		return &bpf_probe_read_user_proto;
	case BPF_FUNC_probe_read_kernel:
		return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
		       NULL : &bpf_probe_read_kernel_proto;
	case BPF_FUNC_probe_read_user_str:
		return &bpf_probe_read_user_str_proto;
	case BPF_FUNC_probe_read_kernel_str:
		return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
		       NULL : &bpf_probe_read_kernel_str_proto;
	case BPF_FUNC_copy_from_user:
		return &bpf_copy_from_user_proto;
	case BPF_FUNC_copy_from_user_task:
		return &bpf_copy_from_user_task_proto;
	case BPF_FUNC_snprintf_btf:
		return &bpf_snprintf_btf_proto;
	case BPF_FUNC_snprintf:
		return &bpf_snprintf_proto;
	case BPF_FUNC_task_pt_regs:
		return &bpf_task_pt_regs_proto;
	case BPF_FUNC_trace_vprintk:
		return bpf_get_trace_vprintk_proto();
	case BPF_FUNC_perf_event_read_value:
		return bpf_get_perf_event_read_value_proto();
	case BPF_FUNC_perf_event_read:
		return &bpf_perf_event_read_proto;
	case BPF_FUNC_send_signal:
		return &bpf_send_signal_proto;
	case BPF_FUNC_send_signal_thread:
		return &bpf_send_signal_thread_proto;
	case BPF_FUNC_get_task_stack:
		return prog->sleepable ? &bpf_get_task_stack_sleepable_proto
				       : &bpf_get_task_stack_proto;
	case BPF_FUNC_get_branch_snapshot:
		return &bpf_get_branch_snapshot_proto;
	case BPF_FUNC_find_vma:
		return &bpf_find_vma_proto;
	default:
		return NULL;
	}
}
EXPORT_SYMBOL_GPL(bpf_base_func_proto);

void bpf_list_head_free(const struct btf_field *field, void *list_head,
			struct bpf_spin_lock *spin_lock)
{
	struct list_head *head = list_head, *orig_head = list_head;

	BUILD_BUG_ON(sizeof(struct list_head) > sizeof(struct bpf_list_head));
	BUILD_BUG_ON(__alignof__(struct list_head) > __alignof__(struct bpf_list_head));

	/* Do the actual list draining outside the lock to not hold the lock for
	 * too long, and also prevent deadlocks if tracing programs end up
	 * executing on entry/exit of functions called inside the critical
	 * section, and end up doing map ops that call bpf_list_head_free for
	 * the same map value again.
	 */
	__bpf_spin_lock_irqsave(spin_lock);
	if (!head->next || list_empty(head))
		goto unlock;
	head = head->next;
unlock:
	INIT_LIST_HEAD(orig_head);
	__bpf_spin_unlock_irqrestore(spin_lock);

	while (head != orig_head) {
		void *obj = head;

		obj -= field->graph_root.node_offset;
		head = head->next;
		/* The contained type can also have resources, including a
		 * bpf_list_head which needs to be freed.
		 */
		__bpf_obj_drop_impl(obj, field->graph_root.value_rec, false);
	}
}

/* Like rbtree_postorder_for_each_entry_safe, but 'pos' and 'n' are
 * 'rb_node *', so field name of rb_node within containing struct is not
 * needed.
 *
 * Since bpf_rb_tree's node type has a corresponding struct btf_field with
 * graph_root.node_offset, it's not necessary to know field name
 * or type of node struct
 */
#define bpf_rbtree_postorder_for_each_entry_safe(pos, n, root) \
	for (pos = rb_first_postorder(root); \
	    pos && ({ n = rb_next_postorder(pos); 1; }); \
	    pos = n)

void bpf_rb_root_free(const struct btf_field *field, void *rb_root,
		      struct bpf_spin_lock *spin_lock)
{
	struct rb_root_cached orig_root, *root = rb_root;
	struct rb_node *pos, *n;
	void *obj;

	BUILD_BUG_ON(sizeof(struct rb_root_cached) > sizeof(struct bpf_rb_root));
	BUILD_BUG_ON(__alignof__(struct rb_root_cached) > __alignof__(struct bpf_rb_root));

	__bpf_spin_lock_irqsave(spin_lock);
	orig_root = *root;
	*root = RB_ROOT_CACHED;
	__bpf_spin_unlock_irqrestore(spin_lock);

	bpf_rbtree_postorder_for_each_entry_safe(pos, n, &orig_root.rb_root) {
		obj = pos;
		obj -= field->graph_root.node_offset;


		__bpf_obj_drop_impl(obj, field->graph_root.value_rec, false);
	}
}

__bpf_kfunc_start_defs();

/**
 * bpf_obj_new() - allocate an object described by program BTF
 * @local_type_id__k: type ID in program BTF
 * @meta: verifier-supplied struct metadata
 *
 * Allocate an object of the type identified by @local_type_id__k and
 * initialize its special fields. BPF programs can use
 * bpf_core_type_id_local() to provide @local_type_id__k. The verifier
 * rewrites @meta; BPF programs do not set it.
 *
 * Return: Pointer to the allocated object, or %NULL on failure.
 */
__bpf_kfunc void *bpf_obj_new(u64 local_type_id__k, struct btf_struct_meta *meta)
{
	u64 size = local_type_id__k;
	void *p;

	p = bpf_mem_alloc(&bpf_global_ma, size);
	if (!p)
		return NULL;
	if (meta)
		bpf_obj_init(meta->record, p);

	return p;
}

__bpf_kfunc void *bpf_obj_new_impl(u64 local_type_id__k, void *meta__ign)
{
	return bpf_obj_new(local_type_id__k, meta__ign);
}

/**
 * bpf_percpu_obj_new() - allocate a percpu object described by program BTF
 * @local_type_id__k: type ID in program BTF
 * @meta: verifier-supplied struct metadata
 *
 * Allocate a percpu object of the type identified by @local_type_id__k. BPF
 * programs can use bpf_core_type_id_local() to provide @local_type_id__k.
 * The verifier rewrites @meta; BPF programs do not set it.
 *
 * Return: Pointer to the allocated percpu object, or %NULL on failure.
 */
__bpf_kfunc void *bpf_percpu_obj_new(u64 local_type_id__k, struct btf_struct_meta *meta)
{
	u64 size = local_type_id__k;

	/* The verifier has ensured that meta must be NULL */
	return bpf_mem_alloc(&bpf_global_percpu_ma, size);
}

__bpf_kfunc void *bpf_percpu_obj_new_impl(u64 local_type_id__k, void *meta__ign)
{
	return bpf_percpu_obj_new(local_type_id__k, meta__ign);
}

/* Must be called under migrate_disable(), as required by bpf_mem_free */
void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu)
{
	struct bpf_mem_alloc *ma;

	if (rec && rec->refcount_off >= 0 &&
	    !refcount_dec_and_test((refcount_t *)(p + rec->refcount_off))) {
		/* Object is refcounted and refcount_dec didn't result in 0
		 * refcount. Return without freeing the object
		 */
		return;
	}

	if (rec)
		bpf_obj_free_fields(rec, p);

	if (percpu)
		ma = &bpf_global_percpu_ma;
	else
		ma = &bpf_global_ma;
	bpf_mem_free_rcu(ma, p);
}

/**
 * bpf_obj_drop() - drop a previously allocated object
 * @p__alloc: object to free
 * @meta: verifier-supplied struct metadata
 *
 * Destroy special fields in @p__alloc as needed and free the object. The
 * verifier rewrites @meta; BPF programs do not set it.
 */
__bpf_kfunc void bpf_obj_drop(void *p__alloc, struct btf_struct_meta *meta)
{
	void *p = p__alloc;

	__bpf_obj_drop_impl(p, meta ? meta->record : NULL, false);
}

__bpf_kfunc void bpf_obj_drop_impl(void *p__alloc, void *meta__ign)
{
	return bpf_obj_drop(p__alloc, meta__ign);
}

/**
 * bpf_percpu_obj_drop() - drop a previously allocated percpu object
 * @p__alloc: percpu object to free
 * @meta: verifier-supplied struct metadata
 *
 * Free @p__alloc. The verifier rewrites @meta; BPF programs do not set it.
 */
__bpf_kfunc void bpf_percpu_obj_drop(void *p__alloc, struct btf_struct_meta *meta)
{
	/* The verifier has ensured that meta must be NULL */
	bpf_mem_free_rcu(&bpf_global_percpu_ma, p__alloc);
}

__bpf_kfunc void bpf_percpu_obj_drop_impl(void *p__alloc, void *meta__ign)
{
	bpf_percpu_obj_drop(p__alloc, meta__ign);
}

/**
 * bpf_refcount_acquire() - turn a local kptr into an owning reference
 * @p__refcounted_kptr: non-owning local kptr
 * @meta: verifier-supplied struct metadata
 *
 * Increment the refcount for @p__refcounted_kptr. The verifier rewrites
 * @meta; BPF programs do not set it.
 *
 * Return: Owning reference to @p__refcounted_kptr, or %NULL on failure.
 */
__bpf_kfunc void *bpf_refcount_acquire(void *p__refcounted_kptr, struct btf_struct_meta *meta)
{
	struct bpf_refcount *ref;

	/* Could just cast directly to refcount_t *, but need some code using
	 * bpf_refcount type so that it is emitted in vmlinux BTF
	 */
	ref = (struct bpf_refcount *)(p__refcounted_kptr + meta->record->refcount_off);
	if (!refcount_inc_not_zero((refcount_t *)ref))
		return NULL;

	/* Verifier strips KF_RET_NULL if input is owned ref, see is_kfunc_ret_null
	 * in verifier.c
	 */
	return (void *)p__refcounted_kptr;
}

__bpf_kfunc void *bpf_refcount_acquire_impl(void *p__refcounted_kptr, void *meta__ign)
{
	return bpf_refcount_acquire(p__refcounted_kptr, meta__ign);
}

static int __bpf_list_add(struct bpf_list_node_kern *node,
			  struct bpf_list_head *head,
			  bool tail, struct btf_record *rec, u64 off)
{
	struct list_head *n = &node->list_head, *h = (void *)head;

	/* If list_head was 0-initialized by map, bpf_obj_init_field wasn't
	 * called on its fields, so init here
	 */
	if (unlikely(!h->next))
		INIT_LIST_HEAD(h);

	/* node->owner != NULL implies !list_empty(n), no need to separately
	 * check the latter
	 */
	if (cmpxchg(&node->owner, NULL, BPF_PTR_POISON)) {
		/* Only called from BPF prog, no need to migrate_disable */
		__bpf_obj_drop_impl((void *)n - off, rec, false);
		return -EINVAL;
	}

	tail ? list_add_tail(n, h) : list_add(n, h);
	WRITE_ONCE(node->owner, head);

	return 0;
}

/**
 * bpf_list_push_front() - add a node to the front of a BPF linked list
 * @head: list head
 * @node: node to insert
 * @meta: verifier-supplied struct metadata
 * @off: verifier-supplied offset of @node within the containing object
 *
 * Insert @node at the front of @head. The verifier rewrites @meta and @off;
 * BPF programs do not set them.
 *
 * Return: 0 on success, or %-EINVAL if @node is already linked.
 */
__bpf_kfunc int bpf_list_push_front(struct bpf_list_head *head,
				    struct bpf_list_node *node,
				    struct btf_struct_meta *meta,
				    u64 off)
{
	struct bpf_list_node_kern *n = (void *)node;

	return __bpf_list_add(n, head, false, meta ? meta->record : NULL, off);
}

__bpf_kfunc int bpf_list_push_front_impl(struct bpf_list_head *head,
					 struct bpf_list_node *node,
					 void *meta__ign, u64 off)
{
	return bpf_list_push_front(head, node, meta__ign, off);
}

/**
 * bpf_list_push_back() - add a node to the back of a BPF linked list
 * @head: list head
 * @node: node to insert
 * @meta: verifier-supplied struct metadata
 * @off: verifier-supplied offset of @node within the containing object
 *
 * Insert @node at the back of @head. The verifier rewrites @meta and @off;
 * BPF programs do not set them.
 *
 * Return: 0 on success, or %-EINVAL if @node is already linked.
 */
__bpf_kfunc int bpf_list_push_back(struct bpf_list_head *head,
				   struct bpf_list_node *node,
				   struct btf_struct_meta *meta,
				   u64 off)
{
	struct bpf_list_node_kern *n = (void *)node;

	return __bpf_list_add(n, head, true, meta ? meta->record : NULL, off);
}

__bpf_kfunc int bpf_list_push_back_impl(struct bpf_list_head *head,
					struct bpf_list_node *node,
					void *meta__ign, u64 off)
{
	return bpf_list_push_back(head, node, meta__ign, off);
}

static struct bpf_list_node *__bpf_list_del(struct bpf_list_head *head, bool tail)
{
	struct list_head *n, *h = (void *)head;
	struct bpf_list_node_kern *node;

	/* If list_head was 0-initialized by map, bpf_obj_init_field wasn't
	 * called on its fields, so init here
	 */
	if (unlikely(!h->next))
		INIT_LIST_HEAD(h);
	if (list_empty(h))
		return NULL;

	n = tail ? h->prev : h->next;
	node = container_of(n, struct bpf_list_node_kern, list_head);
	if (WARN_ON_ONCE(READ_ONCE(node->owner) != head))
		return NULL;

	list_del_init(n);
	WRITE_ONCE(node->owner, NULL);
	return (struct bpf_list_node *)n;
}

__bpf_kfunc struct bpf_list_node *bpf_list_pop_front(struct bpf_list_head *head)
{
	return __bpf_list_del(head, false);
}

__bpf_kfunc struct bpf_list_node *bpf_list_pop_back(struct bpf_list_head *head)
{
	return __bpf_list_del(head, true);
}

__bpf_kfunc struct bpf_list_node *bpf_list_front(struct bpf_list_head *head)
{
	struct list_head *h = (struct list_head *)head;

	if (list_empty(h) || unlikely(!h->next))
		return NULL;

	return (struct bpf_list_node *)h->next;
}

__bpf_kfunc struct bpf_list_node *bpf_list_back(struct bpf_list_head *head)
{
	struct list_head *h = (struct list_head *)head;

	if (list_empty(h) || unlikely(!h->next))
		return NULL;

	return (struct bpf_list_node *)h->prev;
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_remove(struct bpf_rb_root *root,
						  struct bpf_rb_node *node)
{
	struct bpf_rb_node_kern *node_internal = (struct bpf_rb_node_kern *)node;
	struct rb_root_cached *r = (struct rb_root_cached *)root;
	struct rb_node *n = &node_internal->rb_node;

	/* node_internal->owner != root implies either RB_EMPTY_NODE(n) or
	 * n is owned by some other tree. No need to check RB_EMPTY_NODE(n)
	 */
	if (READ_ONCE(node_internal->owner) != root)
		return NULL;

	rb_erase_cached(n, r);
	RB_CLEAR_NODE(n);
	WRITE_ONCE(node_internal->owner, NULL);
	return (struct bpf_rb_node *)n;
}

/* Need to copy rbtree_add_cached's logic here because our 'less' is a BPF
 * program
 */
static int __bpf_rbtree_add(struct bpf_rb_root *root,
			    struct bpf_rb_node_kern *node,
			    void *less, struct btf_record *rec, u64 off)
{
	struct rb_node **link = &((struct rb_root_cached *)root)->rb_root.rb_node;
	struct rb_node *parent = NULL, *n = &node->rb_node;
	bpf_callback_t cb = (bpf_callback_t)less;
	bool leftmost = true;

	/* node->owner != NULL implies !RB_EMPTY_NODE(n), no need to separately
	 * check the latter
	 */
	if (cmpxchg(&node->owner, NULL, BPF_PTR_POISON)) {
		/* Only called from BPF prog, no need to migrate_disable */
		__bpf_obj_drop_impl((void *)n - off, rec, false);
		return -EINVAL;
	}

	while (*link) {
		parent = *link;
		if (cb((uintptr_t)node, (uintptr_t)parent, 0, 0, 0)) {
			link = &parent->rb_left;
		} else {
			link = &parent->rb_right;
			leftmost = false;
		}
	}

	rb_link_node(n, parent, link);
	rb_insert_color_cached(n, (struct rb_root_cached *)root, leftmost);
	WRITE_ONCE(node->owner, root);
	return 0;
}

/**
 * bpf_rbtree_add() - add a node to a BPF rbtree
 * @root: tree root
 * @node: node to insert
 * @less: comparator used to order nodes
 * @meta: verifier-supplied struct metadata
 * @off: verifier-supplied offset of @node within the containing object
 *
 * Insert @node into @root using @less. The verifier rewrites @meta and @off;
 * BPF programs do not set them.
 *
 * Return: 0 on success, or %-EINVAL if @node is already linked in a tree.
 */
__bpf_kfunc int bpf_rbtree_add(struct bpf_rb_root *root,
			       struct bpf_rb_node *node,
			       bool (less)(struct bpf_rb_node *a, const struct bpf_rb_node *b),
			       struct btf_struct_meta *meta,
			       u64 off)
{
	struct bpf_rb_node_kern *n = (void *)node;

	return __bpf_rbtree_add(root, n, (void *)less, meta ? meta->record : NULL, off);
}

__bpf_kfunc int bpf_rbtree_add_impl(struct bpf_rb_root *root, struct bpf_rb_node *node,
				    bool (less)(struct bpf_rb_node *a, const struct bpf_rb_node *b),
				    void *meta__ign, u64 off)
{
	return bpf_rbtree_add(root, node, less, meta__ign, off);
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_first(struct bpf_rb_root *root)
{
	struct rb_root_cached *r = (struct rb_root_cached *)root;

	return (struct bpf_rb_node *)rb_first_cached(r);
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_root(struct bpf_rb_root *root)
{
	struct rb_root_cached *r = (struct rb_root_cached *)root;

	return (struct bpf_rb_node *)r->rb_root.rb_node;
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_left(struct bpf_rb_root *root, struct bpf_rb_node *node)
{
	struct bpf_rb_node_kern *node_internal = (struct bpf_rb_node_kern *)node;

	if (READ_ONCE(node_internal->owner) != root)
		return NULL;

	return (struct bpf_rb_node *)node_internal->rb_node.rb_left;
}

__bpf_kfunc struct bpf_rb_node *bpf_rbtree_right(struct bpf_rb_root *root, struct bpf_rb_node *node)
{
	struct bpf_rb_node_kern *node_internal = (struct bpf_rb_node_kern *)node;

	if (READ_ONCE(node_internal->owner) != root)
		return NULL;

	return (struct bpf_rb_node *)node_internal->rb_node.rb_right;
}

/**
 * bpf_task_acquire - Acquire a reference to a task. A task acquired by this
 * kfunc which is not stored in a map as a kptr, must be released by calling
 * bpf_task_release().
 * @p: The task on which a reference is being acquired.
 */
__bpf_kfunc struct task_struct *bpf_task_acquire(struct task_struct *p)
{
	if (refcount_inc_not_zero(&p->rcu_users))
		return p;
	return NULL;
}

/**
 * bpf_task_release - Release the reference acquired on a task.
 * @p: The task on which a reference is being released.
 */
__bpf_kfunc void bpf_task_release(struct task_struct *p)
{
	put_task_struct_rcu_user(p);
}

__bpf_kfunc void bpf_task_release_dtor(void *p)
{
	put_task_struct_rcu_user(p);
}
CFI_NOSEAL(bpf_task_release_dtor);

#ifdef CONFIG_CGROUPS
/**
 * bpf_cgroup_acquire - Acquire a reference to a cgroup. A cgroup acquired by
 * this kfunc which is not stored in a map as a kptr, must be released by
 * calling bpf_cgroup_release().
 * @cgrp: The cgroup on which a reference is being acquired.
 */
__bpf_kfunc struct cgroup *bpf_cgroup_acquire(struct cgroup *cgrp)
{
	return cgroup_tryget(cgrp) ? cgrp : NULL;
}

/**
 * bpf_cgroup_release - Release the reference acquired on a cgroup.
 * If this kfunc is invoked in an RCU read region, the cgroup is guaranteed to
 * not be freed until the current grace period has ended, even if its refcount
 * drops to 0.
 * @cgrp: The cgroup on which a reference is being released.
 */
__bpf_kfunc void bpf_cgroup_release(struct cgroup *cgrp)
{
	cgroup_put(cgrp);
}

__bpf_kfunc void bpf_cgroup_release_dtor(void *cgrp)
{
	cgroup_put(cgrp);
}
CFI_NOSEAL(bpf_cgroup_release_dtor);

/**
 * bpf_cgroup_ancestor - Perform a lookup on an entry in a cgroup's ancestor
 * array. A cgroup returned by this kfunc which is not subsequently stored in a
 * map, must be released by calling bpf_cgroup_release().
 * @cgrp: The cgroup for which we're performing a lookup.
 * @level: The level of ancestor to look up.
 */
__bpf_kfunc struct cgroup *bpf_cgroup_ancestor(struct cgroup *cgrp, int level)
{
	struct cgroup *ancestor;

	if (level > cgrp->level || level < 0)
		return NULL;

	/* cgrp's refcnt could be 0 here, but ancestors can still be accessed */
	ancestor = cgrp->ancestors[level];
	if (!cgroup_tryget(ancestor))
		return NULL;
	return ancestor;
}

/**
 * bpf_cgroup_from_id - Find a cgroup from its ID. A cgroup returned by this
 * kfunc which is not subsequently stored in a map, must be released by calling
 * bpf_cgroup_release().
 * @cgid: cgroup id.
 */
__bpf_kfunc struct cgroup *bpf_cgroup_from_id(u64 cgid)
{
	struct cgroup *cgrp;

	cgrp = __cgroup_get_from_id(cgid);
	if (IS_ERR(cgrp))
		return NULL;
	return cgrp;
}

/**
 * bpf_task_under_cgroup - wrap task_under_cgroup_hierarchy() as a kfunc, test
 * task's membership of cgroup ancestry.
 * @task: the task to be tested
 * @ancestor: possible ancestor of @task's cgroup
 *
 * Tests whether @task's default cgroup hierarchy is a descendant of @ancestor.
 * It follows all the same rules as cgroup_is_descendant, and only applies
 * to the default hierarchy.
 */
__bpf_kfunc long bpf_task_under_cgroup(struct task_struct *task,
				       struct cgroup *ancestor)
{
	long ret;

	rcu_read_lock();
	ret = task_under_cgroup_hierarchy(task, ancestor);
	rcu_read_unlock();
	return ret;
}

BPF_CALL_2(bpf_current_task_under_cgroup, struct bpf_map *, map, u32, idx)
{
	struct bpf_array *array = container_of(map, struct bpf_array, map);
	struct cgroup *cgrp;

	if (unlikely(idx >= array->map.max_entries))
		return -E2BIG;

	cgrp = READ_ONCE(array->ptrs[idx]);
	if (unlikely(!cgrp))
		return -EAGAIN;

	return task_under_cgroup_hierarchy(current, cgrp);
}

const struct bpf_func_proto bpf_current_task_under_cgroup_proto = {
	.func           = bpf_current_task_under_cgroup,
	.gpl_only       = false,
	.ret_type       = RET_INTEGER,
	.arg1_type      = ARG_CONST_MAP_PTR,
	.arg2_type      = ARG_ANYTHING,
};

/**
 * bpf_task_get_cgroup1 - Acquires the associated cgroup of a task within a
 * specific cgroup1 hierarchy. The cgroup1 hierarchy is identified by its
 * hierarchy ID.
 * @task: The target task
 * @hierarchy_id: The ID of a cgroup1 hierarchy
 *
 * On success, the cgroup is returen. On failure, NULL is returned.
 */
__bpf_kfunc struct cgroup *
bpf_task_get_cgroup1(struct task_struct *task, int hierarchy_id)
{
	struct cgroup *cgrp = task_get_cgroup1(task, hierarchy_id);

	if (IS_ERR(cgrp))
		return NULL;
	return cgrp;
}
#endif /* CONFIG_CGROUPS */

/**
 * bpf_task_from_pid - Find a struct task_struct from its pid by looking it up
 * in the root pid namespace idr. If a task is returned, it must either be
 * stored in a map, or released with bpf_task_release().
 * @pid: The pid of the task being looked up.
 */
__bpf_kfunc struct task_struct *bpf_task_from_pid(s32 pid)
{
	struct task_struct *p;

	rcu_read_lock();
	p = find_task_by_pid_ns(pid, &init_pid_ns);
	if (p)
		p = bpf_task_acquire(p);
	rcu_read_unlock();

	return p;
}

/**
 * bpf_task_from_vpid - Find a struct task_struct from its vpid by looking it up
 * in the pid namespace of the current task. If a task is returned, it must
 * either be stored in a map, or released with bpf_task_release().
 * @vpid: The vpid of the task being looked up.
 */
__bpf_kfunc struct task_struct *bpf_task_from_vpid(s32 vpid)
{
	struct task_struct *p;

	rcu_read_lock();
	p = find_task_by_vpid(vpid);
	if (p)
		p = bpf_task_acquire(p);
	rcu_read_unlock();

	return p;
}

/**
 * bpf_dynptr_slice() - Obtain a read-only pointer to the dynptr data.
 * @p: The dynptr whose data slice to retrieve
 * @offset: Offset into the dynptr
 * @buffer__nullable: User-provided buffer to copy contents into.  May be NULL
 * @buffer__szk: Size (in bytes) of the buffer if present. This is the
 *               length of the requested slice. This must be a constant.
 *
 * For non-skb and non-xdp type dynptrs, there is no difference between
 * bpf_dynptr_slice and bpf_dynptr_data.
 *
 *  If buffer__nullable is NULL, the call will fail if buffer_opt was needed.
 *
 * If the intention is to write to the data slice, please use
 * bpf_dynptr_slice_rdwr.
 *
 * The user must check that the returned pointer is not null before using it.
 *
 * Please note that in the case of skb and xdp dynptrs, bpf_dynptr_slice
 * does not change the underlying packet data pointers, so a call to
 * bpf_dynptr_slice will not invalidate any ctx->data/data_end pointers in
 * the bpf program.
 *
 * Return: NULL if the call failed (eg invalid dynptr), pointer to a read-only
 * data slice (can be either direct pointer to the data or a pointer to the user
 * provided buffer, with its contents containing the data, if unable to obtain
 * direct pointer)
 */
__bpf_kfunc void *bpf_dynptr_slice(const struct bpf_dynptr *p, u64 offset,
				   void *buffer__nullable, u64 buffer__szk)
{
	const struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
	enum bpf_dynptr_type type;
	u64 len = buffer__szk;
	int err;

	if (!ptr->data)
		return NULL;

	err = bpf_dynptr_check_off_len(ptr, offset, len);
	if (err)
		return NULL;

	type = bpf_dynptr_get_type(ptr);

	switch (type) {
	case BPF_DYNPTR_TYPE_LOCAL:
	case BPF_DYNPTR_TYPE_RINGBUF:
		return ptr->data + ptr->offset + offset;
	case BPF_DYNPTR_TYPE_SKB:
		if (buffer__nullable)
			return skb_header_pointer(ptr->data, ptr->offset + offset, len, buffer__nullable);
		else
			return skb_pointer_if_linear(ptr->data, ptr->offset + offset, len);
	case BPF_DYNPTR_TYPE_XDP:
	{
		void *xdp_ptr = bpf_xdp_pointer(ptr->data, ptr->offset + offset, len);
		if (!IS_ERR_OR_NULL(xdp_ptr))
			return xdp_ptr;

		if (!buffer__nullable)
			return NULL;
		bpf_xdp_copy_buf(ptr->data, ptr->offset + offset, buffer__nullable, len, false);
		return buffer__nullable;
	}
	case BPF_DYNPTR_TYPE_SKB_META:
		return bpf_skb_meta_pointer(ptr->data, ptr->offset + offset);
	case BPF_DYNPTR_TYPE_FILE:
		err = bpf_file_fetch_bytes(ptr->data, offset, buffer__nullable, buffer__szk);
		return err ? NULL : buffer__nullable;
	default:
		WARN_ONCE(true, "unknown dynptr type %d\n", type);
		return NULL;
	}
}

/**
 * bpf_dynptr_slice_rdwr() - Obtain a writable pointer to the dynptr data.
 * @p: The dynptr whose data slice to retrieve
 * @offset: Offset into the dynptr
 * @buffer__nullable: User-provided buffer to copy contents into. May be NULL
 * @buffer__szk: Size (in bytes) of the buffer if present. This is the
 *               length of the requested slice. This must be a constant.
 *
 * For non-skb and non-xdp type dynptrs, there is no difference between
 * bpf_dynptr_slice and bpf_dynptr_data.
 *
 * If buffer__nullable is NULL, the call will fail if buffer_opt was needed.
 *
 * The returned pointer is writable and may point to either directly the dynptr
 * data at the requested offset or to the buffer if unable to obtain a direct
 * data pointer to (example: the requested slice is to the paged area of an skb
 * packet). In the case where the returned pointer is to the buffer, the user
 * is responsible for persisting writes through calling bpf_dynptr_write(). This
 * usually looks something like this pattern:
 *
 * struct eth_hdr *eth = bpf_dynptr_slice_rdwr(&dynptr, 0, buffer, sizeof(buffer));
 * if (!eth)
 *	return TC_ACT_SHOT;
 *
 * // mutate eth header //
 *
 * if (eth == buffer)
 *	bpf_dynptr_write(&ptr, 0, buffer, sizeof(buffer), 0);
 *
 * Please note that, as in the example above, the user must check that the
 * returned pointer is not null before using it.
 *
 * Please also note that in the case of skb and xdp dynptrs, bpf_dynptr_slice_rdwr
 * does not change the underlying packet data pointers, so a call to
 * bpf_dynptr_slice_rdwr will not invalidate any ctx->data/data_end pointers in
 * the bpf program.
 *
 * Return: NULL if the call failed (eg invalid dynptr), pointer to a
 * data slice (can be either direct pointer to the data or a pointer to the user
 * provided buffer, with its contents containing the data, if unable to obtain
 * direct pointer)
 */
__bpf_kfunc void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *p, u64 offset,
					void *buffer__nullable, u64 buffer__szk)
{
	const struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data || __bpf_dynptr_is_rdonly(ptr))
		return NULL;

	/* bpf_dynptr_slice_rdwr is the same logic as bpf_dynptr_slice.
	 *
	 * For skb-type dynptrs, it is safe to write into the returned pointer
	 * if the bpf program allows skb data writes. There are two possibilities
	 * that may occur when calling bpf_dynptr_slice_rdwr:
	 *
	 * 1) The requested slice is in the head of the skb. In this case, the
	 * returned pointer is directly to skb data, and if the skb is cloned, the
	 * verifier will have uncloned it (see bpf_unclone_prologue()) already.
	 * The pointer can be directly written into.
	 *
	 * 2) Some portion of the requested slice is in the paged buffer area.
	 * In this case, the requested data will be copied out into the buffer
	 * and the returned pointer will be a pointer to the buffer. The skb
	 * will not be pulled. To persist the write, the user will need to call
	 * bpf_dynptr_write(), which will pull the skb and commit the write.
	 *
	 * Similarly for xdp programs, if the requested slice is not across xdp
	 * fragments, then a direct pointer will be returned, otherwise the data
	 * will be copied out into the buffer and the user will need to call
	 * bpf_dynptr_write() to commit changes.
	 */
	return bpf_dynptr_slice(p, offset, buffer__nullable, buffer__szk);
}

__bpf_kfunc int bpf_dynptr_adjust(const struct bpf_dynptr *p, u64 start, u64 end)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
	u64 size;

	if (!ptr->data || start > end)
		return -EINVAL;

	size = __bpf_dynptr_size(ptr);

	if (start > size || end > size)
		return -ERANGE;

	bpf_dynptr_advance_offset(ptr, start);
	bpf_dynptr_set_size(ptr, end - start);

	return 0;
}

__bpf_kfunc bool bpf_dynptr_is_null(const struct bpf_dynptr *p)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	return !ptr->data;
}

__bpf_kfunc bool bpf_dynptr_is_rdonly(const struct bpf_dynptr *p)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data)
		return false;

	return __bpf_dynptr_is_rdonly(ptr);
}

__bpf_kfunc u64 bpf_dynptr_size(const struct bpf_dynptr *p)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data)
		return -EINVAL;

	return __bpf_dynptr_size(ptr);
}

__bpf_kfunc int bpf_dynptr_clone(const struct bpf_dynptr *p,
				 struct bpf_dynptr *clone__uninit)
{
	struct bpf_dynptr_kern *clone = (struct bpf_dynptr_kern *)clone__uninit;
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;

	if (!ptr->data) {
		bpf_dynptr_set_null(clone);
		return -EINVAL;
	}

	*clone = *ptr;

	return 0;
}

/**
 * bpf_dynptr_copy() - Copy data from one dynptr to another.
 * @dst_ptr: Destination dynptr - where data should be copied to
 * @dst_off: Offset into the destination dynptr
 * @src_ptr: Source dynptr - where data should be copied from
 * @src_off: Offset into the source dynptr
 * @size: Length of the data to copy from source to destination
 *
 * Copies data from source dynptr to destination dynptr.
 * Returns 0 on success; negative error, otherwise.
 */
__bpf_kfunc int bpf_dynptr_copy(struct bpf_dynptr *dst_ptr, u64 dst_off,
				struct bpf_dynptr *src_ptr, u64 src_off, u64 size)
{
	struct bpf_dynptr_kern *dst = (struct bpf_dynptr_kern *)dst_ptr;
	struct bpf_dynptr_kern *src = (struct bpf_dynptr_kern *)src_ptr;
	void *src_slice, *dst_slice;
	char buf[256];
	u64 off;

	src_slice = bpf_dynptr_slice(src_ptr, src_off, NULL, size);
	dst_slice = bpf_dynptr_slice_rdwr(dst_ptr, dst_off, NULL, size);

	if (src_slice && dst_slice) {
		memmove(dst_slice, src_slice, size);
		return 0;
	}

	if (src_slice)
		return __bpf_dynptr_write(dst, dst_off, src_slice, size, 0);

	if (dst_slice)
		return __bpf_dynptr_read(dst_slice, size, src, src_off, 0);

	if (bpf_dynptr_check_off_len(dst, dst_off, size) ||
	    bpf_dynptr_check_off_len(src, src_off, size))
		return -E2BIG;

	off = 0;
	while (off < size) {
		u64 chunk_sz = min_t(u64, sizeof(buf), size - off);
		int err;

		err = __bpf_dynptr_read(buf, chunk_sz, src, src_off + off, 0);
		if (err)
			return err;
		err = __bpf_dynptr_write(dst, dst_off + off, buf, chunk_sz, 0);
		if (err)
			return err;

		off += chunk_sz;
	}
	return 0;
}

/**
 * bpf_dynptr_memset() - Fill dynptr memory with a constant byte.
 * @p: Destination dynptr - where data will be filled
 * @offset: Offset into the dynptr to start filling from
 * @size: Number of bytes to fill
 * @val: Constant byte to fill the memory with
 *
 * Fills the @size bytes of the memory area pointed to by @p
 * at @offset with the constant byte @val.
 * Returns 0 on success; negative error, otherwise.
 */
__bpf_kfunc int bpf_dynptr_memset(struct bpf_dynptr *p, u64 offset, u64 size, u8 val)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)p;
	u64 chunk_sz, write_off;
	char buf[256];
	void* slice;
	int err;

	slice = bpf_dynptr_slice_rdwr(p, offset, NULL, size);
	if (likely(slice)) {
		memset(slice, val, size);
		return 0;
	}

	if (__bpf_dynptr_is_rdonly(ptr))
		return -EINVAL;

	err = bpf_dynptr_check_off_len(ptr, offset, size);
	if (err)
		return err;

	/* Non-linear data under the dynptr, write from a local buffer */
	chunk_sz = min_t(u64, sizeof(buf), size);
	memset(buf, val, chunk_sz);

	for (write_off = 0; write_off < size; write_off += chunk_sz) {
		chunk_sz = min_t(u64, sizeof(buf), size - write_off);
		err = __bpf_dynptr_write(ptr, offset + write_off, buf, chunk_sz, 0);
		if (err)
			return err;
	}

	return 0;
}

__bpf_kfunc void *bpf_cast_to_kern_ctx(void *obj)
{
	return obj;
}

__bpf_kfunc void *bpf_rdonly_cast(const void *obj__ign, u32 btf_id__k)
{
	return (void *)obj__ign;
}

__bpf_kfunc void bpf_rcu_read_lock(void)
{
	rcu_read_lock();
}

__bpf_kfunc void bpf_rcu_read_unlock(void)
{
	rcu_read_unlock();
}

struct bpf_throw_ctx {
	struct bpf_prog_aux *aux;
	u64 sp;
	u64 bp;
	int cnt;
};

static bool bpf_stack_walker(void *cookie, u64 ip, u64 sp, u64 bp)
{
	struct bpf_throw_ctx *ctx = cookie;
	struct bpf_prog *prog;

	/*
	 * The RCU read lock is held to safely traverse the latch tree, but we
	 * don't need its protection when accessing the prog, since it has an
	 * active stack frame on the current stack trace, and won't disappear.
	 */
	rcu_read_lock();
	prog = bpf_prog_ksym_find(ip);
	rcu_read_unlock();
	if (!prog)
		return !ctx->cnt;
	ctx->cnt++;
	if (bpf_is_subprog(prog))
		return true;
	ctx->aux = prog->aux;
	ctx->sp = sp;
	ctx->bp = bp;
	return false;
}

__bpf_kfunc void bpf_throw(u64 cookie)
{
	struct bpf_throw_ctx ctx = {};

	arch_bpf_stack_walk(bpf_stack_walker, &ctx);
	WARN_ON_ONCE(!ctx.aux);
	if (ctx.aux)
		WARN_ON_ONCE(!ctx.aux->exception_boundary);
	WARN_ON_ONCE(!ctx.bp);
	WARN_ON_ONCE(!ctx.cnt);
	/* Prevent KASAN false positives for CONFIG_KASAN_STACK by unpoisoning
	 * deeper stack depths than ctx.sp as we do not return from bpf_throw,
	 * which skips compiler generated instrumentation to do the same.
	 */
	kasan_unpoison_task_stack_below((void *)(long)ctx.sp);
	ctx.aux->bpf_exception_cb(cookie, ctx.sp, ctx.bp, 0, 0);
	WARN(1, "A call to BPF exception callback should never return\n");
}

__bpf_kfunc int bpf_wq_init(struct bpf_wq *wq, void *p__map, unsigned int flags)
{
	struct bpf_async_kern *async = (struct bpf_async_kern *)wq;
	struct bpf_map *map = p__map;

	BUILD_BUG_ON(sizeof(struct bpf_async_kern) > sizeof(struct bpf_wq));
	BUILD_BUG_ON(__alignof__(struct bpf_async_kern) != __alignof__(struct bpf_wq));

	if (flags)
		return -EINVAL;

	return __bpf_async_init(async, map, flags, BPF_ASYNC_TYPE_WQ);
}

__bpf_kfunc int bpf_wq_start(struct bpf_wq *wq, unsigned int flags)
{
	struct bpf_async_kern *async = (struct bpf_async_kern *)wq;
	struct bpf_work *w;

	if (flags)
		return -EINVAL;

	w = READ_ONCE(async->work);
	if (!w || !READ_ONCE(w->cb.prog))
		return -EINVAL;

	if (!refcount_inc_not_zero(&w->cb.refcnt))
		return -ENOENT;

	if (!defer_timer_wq_op()) {
		schedule_work(&w->work);
		bpf_async_refcount_put(&w->cb);
		return 0;
	} else {
		return bpf_async_schedule_op(&w->cb, BPF_ASYNC_START, 0, 0);
	}
}

__bpf_kfunc int bpf_wq_set_callback(struct bpf_wq *wq,
				    int (callback_fn)(void *map, int *key, void *value),
				    unsigned int flags,
				    struct bpf_prog_aux *aux)
{
	struct bpf_async_kern *async = (struct bpf_async_kern *)wq;

	if (flags)
		return -EINVAL;

	return __bpf_async_set_callback(async, callback_fn, aux->prog);
}

__bpf_kfunc void bpf_preempt_disable(void)
{
	preempt_disable();
}

__bpf_kfunc void bpf_preempt_enable(void)
{
	preempt_enable();
}

struct bpf_iter_bits {
	__u64 __opaque[2];
} __aligned(8);

#define BITS_ITER_NR_WORDS_MAX 511

struct bpf_iter_bits_kern {
	union {
		__u64 *bits;
		__u64 bits_copy;
	};
	int nr_bits;
	int bit;
} __aligned(8);

/* On 64-bit hosts, unsigned long and u64 have the same size, so passing
 * a u64 pointer and an unsigned long pointer to find_next_bit() will
 * return the same result, as both point to the same 8-byte area.
 *
 * For 32-bit little-endian hosts, using a u64 pointer or unsigned long
 * pointer also makes no difference. This is because the first iterated
 * unsigned long is composed of bits 0-31 of the u64 and the second unsigned
 * long is composed of bits 32-63 of the u64.
 *
 * However, for 32-bit big-endian hosts, this is not the case. The first
 * iterated unsigned long will be bits 32-63 of the u64, so swap these two
 * ulong values within the u64.
 */
static void swap_ulong_in_u64(u64 *bits, unsigned int nr)
{
#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN)
	unsigned int i;

	for (i = 0; i < nr; i++)
		bits[i] = (bits[i] >> 32) | ((u64)(u32)bits[i] << 32);
#endif
}

/**
 * bpf_iter_bits_new() - Initialize a new bits iterator for a given memory area
 * @it: The new bpf_iter_bits to be created
 * @unsafe_ptr__ign: A pointer pointing to a memory area to be iterated over
 * @nr_words: The size of the specified memory area, measured in 8-byte units.
 * The maximum value of @nr_words is @BITS_ITER_NR_WORDS_MAX. This limit may be
 * further reduced by the BPF memory allocator implementation.
 *
 * This function initializes a new bpf_iter_bits structure for iterating over
 * a memory area which is specified by the @unsafe_ptr__ign and @nr_words. It
 * copies the data of the memory area to the newly created bpf_iter_bits @it for
 * subsequent iteration operations.
 *
 * On success, 0 is returned. On failure, ERR is returned.
 */
__bpf_kfunc int
bpf_iter_bits_new(struct bpf_iter_bits *it, const u64 *unsafe_ptr__ign, u32 nr_words)
{
	struct bpf_iter_bits_kern *kit = (void *)it;
	u32 nr_bytes = nr_words * sizeof(u64);
	u32 nr_bits = BYTES_TO_BITS(nr_bytes);
	int err;

	BUILD_BUG_ON(sizeof(struct bpf_iter_bits_kern) != sizeof(struct bpf_iter_bits));
	BUILD_BUG_ON(__alignof__(struct bpf_iter_bits_kern) !=
		     __alignof__(struct bpf_iter_bits));

	kit->nr_bits = 0;
	kit->bits_copy = 0;
	kit->bit = -1;

	if (!unsafe_ptr__ign || !nr_words)
		return -EINVAL;
	if (nr_words > BITS_ITER_NR_WORDS_MAX)
		return -E2BIG;

	/* Optimization for u64 mask */
	if (nr_bits == 64) {
		err = bpf_probe_read_kernel_common(&kit->bits_copy, nr_bytes, unsafe_ptr__ign);
		if (err)
			return -EFAULT;

		swap_ulong_in_u64(&kit->bits_copy, nr_words);

		kit->nr_bits = nr_bits;
		return 0;
	}

	if (bpf_mem_alloc_check_size(false, nr_bytes))
		return -E2BIG;

	/* Fallback to memalloc */
	kit->bits = bpf_mem_alloc(&bpf_global_ma, nr_bytes);
	if (!kit->bits)
		return -ENOMEM;

	err = bpf_probe_read_kernel_common(kit->bits, nr_bytes, unsafe_ptr__ign);
	if (err) {
		bpf_mem_free(&bpf_global_ma, kit->bits);
		return err;
	}

	swap_ulong_in_u64(kit->bits, nr_words);

	kit->nr_bits = nr_bits;
	return 0;
}

/**
 * bpf_iter_bits_next() - Get the next bit in a bpf_iter_bits
 * @it: The bpf_iter_bits to be checked
 *
 * This function returns a pointer to a number representing the value of the
 * next bit in the bits.
 *
 * If there are no further bits available, it returns NULL.
 */
__bpf_kfunc int *bpf_iter_bits_next(struct bpf_iter_bits *it)
{
	struct bpf_iter_bits_kern *kit = (void *)it;
	int bit = kit->bit, nr_bits = kit->nr_bits;
	const void *bits;

	if (!nr_bits || bit >= nr_bits)
		return NULL;

	bits = nr_bits == 64 ? &kit->bits_copy : kit->bits;
	bit = find_next_bit(bits, nr_bits, bit + 1);
	if (bit >= nr_bits) {
		kit->bit = bit;
		return NULL;
	}

	kit->bit = bit;
	return &kit->bit;
}

/**
 * bpf_iter_bits_destroy() - Destroy a bpf_iter_bits
 * @it: The bpf_iter_bits to be destroyed
 *
 * Destroy the resource associated with the bpf_iter_bits.
 */
__bpf_kfunc void bpf_iter_bits_destroy(struct bpf_iter_bits *it)
{
	struct bpf_iter_bits_kern *kit = (void *)it;

	if (kit->nr_bits <= 64)
		return;
	bpf_mem_free(&bpf_global_ma, kit->bits);
}

/**
 * bpf_copy_from_user_str() - Copy a string from an unsafe user address
 * @dst:             Destination address, in kernel space.  This buffer must be
 *                   at least @dst__sz bytes long.
 * @dst__sz:         Maximum number of bytes to copy, includes the trailing NUL.
 * @unsafe_ptr__ign: Source address, in user space.
 * @flags:           The only supported flag is BPF_F_PAD_ZEROS
 *
 * Copies a NUL-terminated string from userspace to BPF space. If user string is
 * too long this will still ensure zero termination in the dst buffer unless
 * buffer size is 0.
 *
 * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
 * memset all of @dst on failure.
 */
__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__sz, const void __user *unsafe_ptr__ign, u64 flags)
{
	int ret;

	if (unlikely(flags & ~BPF_F_PAD_ZEROS))
		return -EINVAL;

	if (unlikely(!dst__sz))
		return 0;

	ret = strncpy_from_user(dst, unsafe_ptr__ign, dst__sz - 1);
	if (ret < 0) {
		if (flags & BPF_F_PAD_ZEROS)
			memset((char *)dst, 0, dst__sz);

		return ret;
	}

	if (flags & BPF_F_PAD_ZEROS)
		memset((char *)dst + ret, 0, dst__sz - ret);
	else
		((char *)dst)[ret] = '\0';

	return ret + 1;
}

/**
 * bpf_copy_from_user_task_str() - Copy a string from an task's address space
 * @dst:             Destination address, in kernel space.  This buffer must be
 *                   at least @dst__sz bytes long.
 * @dst__sz:         Maximum number of bytes to copy, includes the trailing NUL.
 * @unsafe_ptr__ign: Source address in the task's address space.
 * @tsk:             The task whose address space will be used
 * @flags:           The only supported flag is BPF_F_PAD_ZEROS
 *
 * Copies a NUL terminated string from a task's address space to @dst__sz
 * buffer. If user string is too long this will still ensure zero termination
 * in the @dst__sz buffer unless buffer size is 0.
 *
 * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst__sz to 0 on success
 * and memset all of @dst__sz on failure.
 *
 * Return: The number of copied bytes on success including the NUL terminator.
 * A negative error code on failure.
 */
__bpf_kfunc int bpf_copy_from_user_task_str(void *dst, u32 dst__sz,
					    const void __user *unsafe_ptr__ign,
					    struct task_struct *tsk, u64 flags)
{
	int ret;

	if (unlikely(flags & ~BPF_F_PAD_ZEROS))
		return -EINVAL;

	if (unlikely(dst__sz == 0))
		return 0;

	ret = copy_remote_vm_str(tsk, (unsigned long)unsafe_ptr__ign, dst, dst__sz, 0);
	if (ret < 0) {
		if (flags & BPF_F_PAD_ZEROS)
			memset(dst, 0, dst__sz);
		return ret;
	}

	if (flags & BPF_F_PAD_ZEROS)
		memset(dst + ret, 0, dst__sz - ret);

	return ret + 1;
}

/* Keep unsinged long in prototype so that kfunc is usable when emitted to
 * vmlinux.h in BPF programs directly, but note that while in BPF prog, the
 * unsigned long always points to 8-byte region on stack, the kernel may only
 * read and write the 4-bytes on 32-bit.
 */
__bpf_kfunc void bpf_local_irq_save(unsigned long *flags__irq_flag)
{
	local_irq_save(*flags__irq_flag);
}

__bpf_kfunc void bpf_local_irq_restore(unsigned long *flags__irq_flag)
{
	local_irq_restore(*flags__irq_flag);
}

__bpf_kfunc void __bpf_trap(void)
{
}

/*
 * Kfuncs for string operations.
 *
 * Since strings are not necessarily %NUL-terminated, we cannot directly call
 * in-kernel implementations. Instead, we open-code the implementations using
 * __get_kernel_nofault instead of plain dereference to make them safe.
 */

static int __bpf_strncasecmp(const char *s1, const char *s2, bool ignore_case, size_t len)
{
	char c1, c2;
	int i;

	if (!copy_from_kernel_nofault_allowed(s1, 1) ||
	    !copy_from_kernel_nofault_allowed(s2, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < len && i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&c1, s1, char, err_out);
		__get_kernel_nofault(&c2, s2, char, err_out);
		if (ignore_case) {
			c1 = tolower(c1);
			c2 = tolower(c2);
		}
		if (c1 != c2)
			return c1 < c2 ? -1 : 1;
		if (c1 == '\0')
			return 0;
		s1++;
		s2++;
	}
	return i == XATTR_SIZE_MAX ? -E2BIG : 0;
err_out:
	return -EFAULT;
}

/**
 * bpf_strcmp - Compare two strings
 * @s1__ign: One string
 * @s2__ign: Another string
 *
 * Return:
 * * %0       - Strings are equal
 * * %-1      - @s1__ign is smaller
 * * %1       - @s2__ign is smaller
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of strings is too large
 * * %-ERANGE - One of strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcmp(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strncasecmp(s1__ign, s2__ign, false, XATTR_SIZE_MAX);
}

/**
 * bpf_strcasecmp - Compare two strings, ignoring the case of the characters
 * @s1__ign: One string
 * @s2__ign: Another string
 *
 * Return:
 * * %0       - Strings are equal
 * * %-1      - @s1__ign is smaller
 * * %1       - @s2__ign is smaller
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of strings is too large
 * * %-ERANGE - One of strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcasecmp(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strncasecmp(s1__ign, s2__ign, true, XATTR_SIZE_MAX);
}

/*
 * bpf_strncasecmp - Compare two length-limited strings, ignoring case
 * @s1__ign: One string
 * @s2__ign: Another string
 * @len: The maximum number of characters to compare
 *
 * Return:
 * * %0       - Strings are equal
 * * %-1      - @s1__ign is smaller
 * * %1       - @s2__ign is smaller
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of strings is too large
 * * %-ERANGE - One of strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strncasecmp(const char *s1__ign, const char *s2__ign, size_t len)
{
	return __bpf_strncasecmp(s1__ign, s2__ign, true, len);
}

/**
 * bpf_strnchr - Find a character in a length limited string
 * @s__ign: The string to be searched
 * @count: The number of characters to be searched
 * @c: The character to search for
 *
 * Note that the %NUL-terminator is considered part of the string, and can
 * be searched for.
 *
 * Return:
 * * >=0      - Index of the first occurrence of @c within @s__ign
 * * %-ENOENT - @c not found in the first @count characters of @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strnchr(const char *s__ign, size_t count, char c)
{
	char sc;
	int i;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&sc, s__ign, char, err_out);
		if (sc == c)
			return i;
		if (sc == '\0')
			return -ENOENT;
		s__ign++;
	}
	return i == XATTR_SIZE_MAX ? -E2BIG : -ENOENT;
err_out:
	return -EFAULT;
}

/**
 * bpf_strchr - Find the first occurrence of a character in a string
 * @s__ign: The string to be searched
 * @c: The character to search for
 *
 * Note that the %NUL-terminator is considered part of the string, and can
 * be searched for.
 *
 * Return:
 * * >=0      - The index of the first occurrence of @c within @s__ign
 * * %-ENOENT - @c not found in @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strchr(const char *s__ign, char c)
{
	return bpf_strnchr(s__ign, XATTR_SIZE_MAX, c);
}

/**
 * bpf_strchrnul - Find and return a character in a string, or end of string
 * @s__ign: The string to be searched
 * @c: The character to search for
 *
 * Return:
 * * >=0      - Index of the first occurrence of @c within @s__ign or index of
 *              the null byte at the end of @s__ign when @c is not found
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strchrnul(const char *s__ign, char c)
{
	char sc;
	int i;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&sc, s__ign, char, err_out);
		if (sc == '\0' || sc == c)
			return i;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strrchr - Find the last occurrence of a character in a string
 * @s__ign: The string to be searched
 * @c: The character to search for
 *
 * Return:
 * * >=0      - Index of the last occurrence of @c within @s__ign
 * * %-ENOENT - @c not found in @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strrchr(const char *s__ign, int c)
{
	char sc;
	int i, last = -ENOENT;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&sc, s__ign, char, err_out);
		if (sc == c)
			last = i;
		if (sc == '\0')
			return last;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strnlen - Calculate the length of a length-limited string
 * @s__ign: The string
 * @count: The maximum number of characters to count
 *
 * Return:
 * * >=0      - The length of @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strnlen(const char *s__ign, size_t count)
{
	char c;
	int i;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1))
		return -ERANGE;

	guard(pagefault)();
	for (i = 0; i < count && i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&c, s__ign, char, err_out);
		if (c == '\0')
			return i;
		s__ign++;
	}
	return i == XATTR_SIZE_MAX ? -E2BIG : i;
err_out:
	return -EFAULT;
}

/**
 * bpf_strlen - Calculate the length of a string
 * @s__ign: The string
 *
 * Return:
 * * >=0      - The length of @s__ign
 * * %-EFAULT - Cannot read @s__ign
 * * %-E2BIG  - @s__ign is too large
 * * %-ERANGE - @s__ign is outside of kernel address space
 */
__bpf_kfunc int bpf_strlen(const char *s__ign)
{
	return bpf_strnlen(s__ign, XATTR_SIZE_MAX);
}

/**
 * bpf_strspn - Calculate the length of the initial substring of @s__ign which
 *              only contains letters in @accept__ign
 * @s__ign: The string to be searched
 * @accept__ign: The string to search for
 *
 * Return:
 * * >=0      - The length of the initial substring of @s__ign which only
 *              contains letters from @accept__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strspn(const char *s__ign, const char *accept__ign)
{
	char cs, ca;
	int i, j;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1) ||
	    !copy_from_kernel_nofault_allowed(accept__ign, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&cs, s__ign, char, err_out);
		if (cs == '\0')
			return i;
		for (j = 0; j < XATTR_SIZE_MAX; j++) {
			__get_kernel_nofault(&ca, accept__ign + j, char, err_out);
			if (cs == ca || ca == '\0')
				break;
		}
		if (j == XATTR_SIZE_MAX)
			return -E2BIG;
		if (ca == '\0')
			return i;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strcspn - Calculate the length of the initial substring of @s__ign which
 *               does not contain letters in @reject__ign
 * @s__ign: The string to be searched
 * @reject__ign: The string to search for
 *
 * Return:
 * * >=0      - The length of the initial substring of @s__ign which does not
 *              contain letters from @reject__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcspn(const char *s__ign, const char *reject__ign)
{
	char cs, cr;
	int i, j;

	if (!copy_from_kernel_nofault_allowed(s__ign, 1) ||
	    !copy_from_kernel_nofault_allowed(reject__ign, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		__get_kernel_nofault(&cs, s__ign, char, err_out);
		if (cs == '\0')
			return i;
		for (j = 0; j < XATTR_SIZE_MAX; j++) {
			__get_kernel_nofault(&cr, reject__ign + j, char, err_out);
			if (cs == cr || cr == '\0')
				break;
		}
		if (j == XATTR_SIZE_MAX)
			return -E2BIG;
		if (cr != '\0')
			return i;
		s__ign++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

static int __bpf_strnstr(const char *s1, const char *s2, size_t len,
			 bool ignore_case)
{
	char c1, c2;
	int i, j;

	if (!copy_from_kernel_nofault_allowed(s1, 1) ||
	    !copy_from_kernel_nofault_allowed(s2, 1)) {
		return -ERANGE;
	}

	guard(pagefault)();
	for (i = 0; i < XATTR_SIZE_MAX; i++) {
		for (j = 0; i + j <= len && j < XATTR_SIZE_MAX; j++) {
			__get_kernel_nofault(&c2, s2 + j, char, err_out);
			if (c2 == '\0')
				return i;
			/*
			 * We allow reading an extra byte from s2 (note the
			 * `i + j <= len` above) to cover the case when s2 is
			 * a suffix of the first len chars of s1.
			 */
			if (i + j == len)
				break;
			__get_kernel_nofault(&c1, s1 + j, char, err_out);

			if (ignore_case) {
				c1 = tolower(c1);
				c2 = tolower(c2);
			}

			if (c1 == '\0')
				return -ENOENT;
			if (c1 != c2)
				break;
		}
		if (j == XATTR_SIZE_MAX)
			return -E2BIG;
		if (i + j == len)
			return -ENOENT;
		s1++;
	}
	return -E2BIG;
err_out:
	return -EFAULT;
}

/**
 * bpf_strstr - Find the first substring in a string
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within @s1__ign
 * * %-ENOENT - @s2__ign is not a substring of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strstr(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strnstr(s1__ign, s2__ign, XATTR_SIZE_MAX, false);
}

/**
 * bpf_strcasestr - Find the first substring in a string, ignoring the case of
 *                  the characters
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within @s1__ign
 * * %-ENOENT - @s2__ign is not a substring of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strcasestr(const char *s1__ign, const char *s2__ign)
{
	return __bpf_strnstr(s1__ign, s2__ign, XATTR_SIZE_MAX, true);
}

/**
 * bpf_strnstr - Find the first substring in a length-limited string
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 * @len: the maximum number of characters to search
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within the first @len characters of @s1__ign
 * * %-ENOENT - @s2__ign not found in the first @len characters of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strnstr(const char *s1__ign, const char *s2__ign,
			    size_t len)
{
	return __bpf_strnstr(s1__ign, s2__ign, len, false);
}

/**
 * bpf_strncasestr - Find the first substring in a length-limited string,
 *                   ignoring the case of the characters
 * @s1__ign: The string to be searched
 * @s2__ign: The string to search for
 * @len: the maximum number of characters to search
 *
 * Return:
 * * >=0      - Index of the first character of the first occurrence of @s2__ign
 *              within the first @len characters of @s1__ign
 * * %-ENOENT - @s2__ign not found in the first @len characters of @s1__ign
 * * %-EFAULT - Cannot read one of the strings
 * * %-E2BIG  - One of the strings is too large
 * * %-ERANGE - One of the strings is outside of kernel address space
 */
__bpf_kfunc int bpf_strncasestr(const char *s1__ign, const char *s2__ign,
				size_t len)
{
	return __bpf_strnstr(s1__ign, s2__ign, len, true);
}

#ifdef CONFIG_KEYS
/**
 * bpf_lookup_user_key - lookup a key by its serial
 * @serial: key handle serial number
 * @flags: lookup-specific flags
 *
 * Search a key with a given *serial* and the provided *flags*.
 * If found, increment the reference count of the key by one, and
 * return it in the bpf_key structure.
 *
 * The bpf_key structure must be passed to bpf_key_put() when done
 * with it, so that the key reference count is decremented and the
 * bpf_key structure is freed.
 *
 * Permission checks are deferred to the time the key is used by
 * one of the available key-specific kfuncs.
 *
 * Set *flags* with KEY_LOOKUP_CREATE, to attempt creating a requested
 * special keyring (e.g. session keyring), if it doesn't yet exist.
 * Set *flags* with KEY_LOOKUP_PARTIAL, to lookup a key without waiting
 * for the key construction, and to retrieve uninstantiated keys (keys
 * without data attached to them).
 *
 * Return: a bpf_key pointer with a valid key pointer if the key is found, a
 *         NULL pointer otherwise.
 */
__bpf_kfunc struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags)
{
	key_ref_t key_ref;
	struct bpf_key *bkey;

	if (flags & ~KEY_LOOKUP_ALL)
		return NULL;

	/*
	 * Permission check is deferred until the key is used, as the
	 * intent of the caller is unknown here.
	 */
	key_ref = lookup_user_key(serial, flags, KEY_DEFER_PERM_CHECK);
	if (IS_ERR(key_ref))
		return NULL;

	bkey = kmalloc_obj(*bkey);
	if (!bkey) {
		key_put(key_ref_to_ptr(key_ref));
		return NULL;
	}

	bkey->key = key_ref_to_ptr(key_ref);
	bkey->has_ref = true;

	return bkey;
}

/**
 * bpf_lookup_system_key - lookup a key by a system-defined ID
 * @id: key ID
 *
 * Obtain a bpf_key structure with a key pointer set to the passed key ID.
 * The key pointer is marked as invalid, to prevent bpf_key_put() from
 * attempting to decrement the key reference count on that pointer. The key
 * pointer set in such way is currently understood only by
 * verify_pkcs7_signature().
 *
 * Set *id* to one of the values defined in include/linux/verification.h:
 * 0 for the primary keyring (immutable keyring of system keys);
 * VERIFY_USE_SECONDARY_KEYRING for both the primary and secondary keyring
 * (where keys can be added only if they are vouched for by existing keys
 * in those keyrings); VERIFY_USE_PLATFORM_KEYRING for the platform
 * keyring (primarily used by the integrity subsystem to verify a kexec'ed
 * kerned image and, possibly, the initramfs signature).
 *
 * Return: a bpf_key pointer with an invalid key pointer set from the
 *         pre-determined ID on success, a NULL pointer otherwise
 */
__bpf_kfunc struct bpf_key *bpf_lookup_system_key(u64 id)
{
	struct bpf_key *bkey;

	if (system_keyring_id_check(id) < 0)
		return NULL;

	bkey = kmalloc_obj(*bkey, GFP_ATOMIC);
	if (!bkey)
		return NULL;

	bkey->key = (struct key *)(unsigned long)id;
	bkey->has_ref = false;

	return bkey;
}

/**
 * bpf_key_put - decrement key reference count if key is valid and free bpf_key
 * @bkey: bpf_key structure
 *
 * Decrement the reference count of the key inside *bkey*, if the pointer
 * is valid, and free *bkey*.
 */
__bpf_kfunc void bpf_key_put(struct bpf_key *bkey)
{
	if (bkey->has_ref)
		key_put(bkey->key);

	kfree(bkey);
}

/**
 * bpf_verify_pkcs7_signature - verify a PKCS#7 signature
 * @data_p: data to verify
 * @sig_p: signature of the data
 * @trusted_keyring: keyring with keys trusted for signature verification
 *
 * Verify the PKCS#7 signature *sig_ptr* against the supplied *data_ptr*
 * with keys in a keyring referenced by *trusted_keyring*.
 *
 * Return: 0 on success, a negative value on error.
 */
__bpf_kfunc int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
			       struct bpf_dynptr *sig_p,
			       struct bpf_key *trusted_keyring)
{
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
	struct bpf_dynptr_kern *data_ptr = (struct bpf_dynptr_kern *)data_p;
	struct bpf_dynptr_kern *sig_ptr = (struct bpf_dynptr_kern *)sig_p;
	const void *data, *sig;
	u32 data_len, sig_len;
	int ret;

	if (trusted_keyring->has_ref) {
		/*
		 * Do the permission check deferred in bpf_lookup_user_key().
		 * See bpf_lookup_user_key() for more details.
		 *
		 * A call to key_task_permission() here would be redundant, as
		 * it is already done by keyring_search() called by
		 * find_asymmetric_key().
		 */
		ret = key_validate(trusted_keyring->key);
		if (ret < 0)
			return ret;
	}

	data_len = __bpf_dynptr_size(data_ptr);
	data = __bpf_dynptr_data(data_ptr, data_len);
	sig_len = __bpf_dynptr_size(sig_ptr);
	sig = __bpf_dynptr_data(sig_ptr, sig_len);

	return verify_pkcs7_signature(data, data_len, sig, sig_len,
				      trusted_keyring->key,
				      VERIFYING_BPF_SIGNATURE, NULL,
				      NULL);
#else
	return -EOPNOTSUPP;
#endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
}
#endif /* CONFIG_KEYS */

typedef int (*bpf_task_work_callback_t)(struct bpf_map *map, void *key, void *value);

enum bpf_task_work_state {
	/* bpf_task_work is ready to be used */
	BPF_TW_STANDBY = 0,
	/* irq work scheduling in progress */
	BPF_TW_PENDING,
	/* task work scheduling in progress */
	BPF_TW_SCHEDULING,
	/* task work is scheduled successfully */
	BPF_TW_SCHEDULED,
	/* callback is running */
	BPF_TW_RUNNING,
	/* associated BPF map value is deleted */
	BPF_TW_FREED,
};

struct bpf_task_work_ctx {
	enum bpf_task_work_state state;
	refcount_t refcnt;
	struct callback_head work;
	struct irq_work irq_work;
	/* bpf_prog that schedules task work */
	struct bpf_prog *prog;
	/* task for which callback is scheduled */
	struct task_struct *task;
	/* the map and map value associated with this context */
	struct bpf_map *map;
	void *map_val;
	enum task_work_notify_mode mode;
	bpf_task_work_callback_t callback_fn;
	struct rcu_head rcu;
} __aligned(8);

/* Actual type for struct bpf_task_work */
struct bpf_task_work_kern {
	struct bpf_task_work_ctx *ctx;
};

static void bpf_task_work_ctx_reset(struct bpf_task_work_ctx *ctx)
{
	if (ctx->prog) {
		bpf_prog_put(ctx->prog);
		ctx->prog = NULL;
	}
	if (ctx->task) {
		bpf_task_release(ctx->task);
		ctx->task = NULL;
	}
}

static bool bpf_task_work_ctx_tryget(struct bpf_task_work_ctx *ctx)
{
	return refcount_inc_not_zero(&ctx->refcnt);
}

static void bpf_task_work_destroy(struct irq_work *irq_work)
{
	struct bpf_task_work_ctx *ctx = container_of(irq_work, struct bpf_task_work_ctx, irq_work);

	bpf_task_work_ctx_reset(ctx);
	kfree_rcu(ctx, rcu);
}

static void bpf_task_work_ctx_put(struct bpf_task_work_ctx *ctx)
{
	if (!refcount_dec_and_test(&ctx->refcnt))
		return;

	if (irqs_disabled()) {
		ctx->irq_work = IRQ_WORK_INIT(bpf_task_work_destroy);
		irq_work_queue(&ctx->irq_work);
	} else {
		bpf_task_work_destroy(&ctx->irq_work);
	}
}

static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
{
	/*
	 * Scheduled task_work callback holds ctx ref, so if we successfully
	 * cancelled, we put that ref on callback's behalf. If we couldn't
	 * cancel, callback will inevitably run or has already completed
	 * running, and it would have taken care of its ctx ref itself.
	 */
	if (task_work_cancel(ctx->task, &ctx->work))
		bpf_task_work_ctx_put(ctx);
}

static void bpf_task_work_callback(struct callback_head *cb)
{
	struct bpf_task_work_ctx *ctx = container_of(cb, struct bpf_task_work_ctx, work);
	enum bpf_task_work_state state;
	u32 idx;
	void *key;

	/* Read lock is needed to protect ctx and map key/value access */
	guard(rcu_tasks_trace)();
	/*
	 * This callback may start running before bpf_task_work_irq() switched to
	 * SCHEDULED state, so handle both transition variants SCHEDULING|SCHEDULED -> RUNNING.
	 */
	state = cmpxchg(&ctx->state, BPF_TW_SCHEDULING, BPF_TW_RUNNING);
	if (state == BPF_TW_SCHEDULED)
		state = cmpxchg(&ctx->state, BPF_TW_SCHEDULED, BPF_TW_RUNNING);
	if (state == BPF_TW_FREED) {
		bpf_task_work_ctx_put(ctx);
		return;
	}

	key = (void *)map_key_from_value(ctx->map, ctx->map_val, &idx);

	migrate_disable();
	ctx->callback_fn(ctx->map, key, ctx->map_val);
	migrate_enable();

	bpf_task_work_ctx_reset(ctx);
	(void)cmpxchg(&ctx->state, BPF_TW_RUNNING, BPF_TW_STANDBY);

	bpf_task_work_ctx_put(ctx);
}

static void bpf_task_work_irq(struct irq_work *irq_work)
{
	struct bpf_task_work_ctx *ctx = container_of(irq_work, struct bpf_task_work_ctx, irq_work);
	enum bpf_task_work_state state;
	int err;

	guard(rcu)();

	if (cmpxchg(&ctx->state, BPF_TW_PENDING, BPF_TW_SCHEDULING) != BPF_TW_PENDING) {
		bpf_task_work_ctx_put(ctx);
		return;
	}

	err = task_work_add(ctx->task, &ctx->work, ctx->mode);
	if (err) {
		bpf_task_work_ctx_reset(ctx);
		/*
		 * try to switch back to STANDBY for another task_work reuse, but we might have
		 * gone to FREED already, which is fine as we already cleaned up after ourselves
		 */
		(void)cmpxchg(&ctx->state, BPF_TW_SCHEDULING, BPF_TW_STANDBY);
		bpf_task_work_ctx_put(ctx);
		return;
	}

	/*
	 * It's technically possible for just scheduled task_work callback to
	 * complete running by now, going SCHEDULING -> RUNNING and then
	 * dropping its ctx refcount. Instead of capturing an extra ref just
	 * to protect below ctx->state access, we rely on rcu_read_lock
	 * above to prevent kfree_rcu from freeing ctx before we return.
	 */
	state = cmpxchg(&ctx->state, BPF_TW_SCHEDULING, BPF_TW_SCHEDULED);
	if (state == BPF_TW_FREED)
		bpf_task_work_cancel(ctx); /* clean up if we switched into FREED state */
}

static struct bpf_task_work_ctx *bpf_task_work_fetch_ctx(struct bpf_task_work *tw,
							 struct bpf_map *map)
{
	struct bpf_task_work_kern *twk = (void *)tw;
	struct bpf_task_work_ctx *ctx, *old_ctx;

	ctx = READ_ONCE(twk->ctx);
	if (ctx)
		return ctx;

	ctx = bpf_map_kmalloc_nolock(map, sizeof(*ctx), 0, NUMA_NO_NODE);
	if (!ctx)
		return ERR_PTR(-ENOMEM);

	memset(ctx, 0, sizeof(*ctx));
	refcount_set(&ctx->refcnt, 1); /* map's own ref */
	ctx->state = BPF_TW_STANDBY;

	old_ctx = cmpxchg(&twk->ctx, NULL, ctx);
	if (old_ctx) {
		/*
		 * tw->ctx is set by concurrent BPF program, release allocated
		 * memory and try to reuse already set context.
		 */
		kfree_nolock(ctx);
		return old_ctx;
	}

	return ctx; /* Success */
}

static struct bpf_task_work_ctx *bpf_task_work_acquire_ctx(struct bpf_task_work *tw,
							   struct bpf_map *map)
{
	struct bpf_task_work_ctx *ctx;

	/*
	 * Sleepable BPF programs hold rcu_read_lock_trace but not
	 * regular rcu_read_lock. Since kfree_rcu waits for regular
	 * RCU GP, the ctx can be freed while we're between reading
	 * the pointer and incrementing the refcount. Take regular
	 * rcu_read_lock to prevent kfree_rcu from freeing the ctx
	 * before we can tryget it.
	 */
	scoped_guard(rcu) {
		ctx = bpf_task_work_fetch_ctx(tw, map);
		if (IS_ERR(ctx))
			return ctx;

		/* try to get ref for task_work callback to hold */
		if (!bpf_task_work_ctx_tryget(ctx))
			return ERR_PTR(-EBUSY);
	}

	if (cmpxchg(&ctx->state, BPF_TW_STANDBY, BPF_TW_PENDING) != BPF_TW_STANDBY) {
		/* lost acquiring race or map_release_uref() stole it from us, put ref and bail */
		bpf_task_work_ctx_put(ctx);
		return ERR_PTR(-EBUSY);
	}

	/*
	 * If no process or bpffs is holding a reference to the map, no new callbacks should be
	 * scheduled. This does not address any race or correctness issue, but rather is a policy
	 * choice: dropping user references should stop everything.
	 */
	if (!atomic64_read(&map->usercnt)) {
		/* drop ref we just got for task_work callback itself */
		bpf_task_work_ctx_put(ctx);
		/* transfer map's ref into cancel_and_free() */
		bpf_task_work_cancel_and_free(tw);
		return ERR_PTR(-EBUSY);
	}

	return ctx;
}

static int bpf_task_work_schedule(struct task_struct *task, struct bpf_task_work *tw,
				  struct bpf_map *map, bpf_task_work_callback_t callback_fn,
				  struct bpf_prog_aux *aux, enum task_work_notify_mode mode)
{
	struct bpf_prog *prog;
	struct bpf_task_work_ctx *ctx;
	int err;

	BTF_TYPE_EMIT(struct bpf_task_work);

	prog = bpf_prog_inc_not_zero(aux->prog);
	if (IS_ERR(prog))
		return -EBADF;
	task = bpf_task_acquire(task);
	if (!task) {
		err = -EBADF;
		goto release_prog;
	}

	ctx = bpf_task_work_acquire_ctx(tw, map);
	if (IS_ERR(ctx)) {
		err = PTR_ERR(ctx);
		goto release_all;
	}

	ctx->task = task;
	ctx->callback_fn = callback_fn;
	ctx->prog = prog;
	ctx->mode = mode;
	ctx->map = map;
	ctx->map_val = (void *)tw - map->record->task_work_off;
	init_task_work(&ctx->work, bpf_task_work_callback);
	init_irq_work(&ctx->irq_work, bpf_task_work_irq);

	irq_work_queue(&ctx->irq_work);
	return 0;

release_all:
	bpf_task_release(task);
release_prog:
	bpf_prog_put(prog);
	return err;
}

/**
 * bpf_task_work_schedule_signal - Schedule BPF callback using task_work_add with TWA_SIGNAL
 * mode
 * @task: Task struct for which callback should be scheduled
 * @tw: Pointer to struct bpf_task_work in BPF map value for internal bookkeeping
 * @map__map: bpf_map that embeds struct bpf_task_work in the values
 * @callback: pointer to BPF subprogram to call
 * @aux: pointer to bpf_prog_aux of the caller BPF program, implicitly set by the verifier
 *
 * Return: 0 if task work has been scheduled successfully, negative error code otherwise
 */
__bpf_kfunc int bpf_task_work_schedule_signal(struct task_struct *task, struct bpf_task_work *tw,
					      void *map__map, bpf_task_work_callback_t callback,
					      struct bpf_prog_aux *aux)
{
	return bpf_task_work_schedule(task, tw, map__map, callback, aux, TWA_SIGNAL);
}

/**
 * bpf_task_work_schedule_resume - Schedule BPF callback using task_work_add with TWA_RESUME
 * mode
 * @task: Task struct for which callback should be scheduled
 * @tw: Pointer to struct bpf_task_work in BPF map value for internal bookkeeping
 * @map__map: bpf_map that embeds struct bpf_task_work in the values
 * @callback: pointer to BPF subprogram to call
 * @aux: pointer to bpf_prog_aux of the caller BPF program, implicitly set by the verifier
 *
 * Return: 0 if task work has been scheduled successfully, negative error code otherwise
 */
__bpf_kfunc int bpf_task_work_schedule_resume(struct task_struct *task, struct bpf_task_work *tw,
					      void *map__map, bpf_task_work_callback_t callback,
					      struct bpf_prog_aux *aux)
{
	return bpf_task_work_schedule(task, tw, map__map, callback, aux, TWA_RESUME);
}

static int make_file_dynptr(struct file *file, u32 flags, bool may_sleep,
			    struct bpf_dynptr_kern *ptr)
{
	struct bpf_dynptr_file_impl *state;

	/* flags is currently unsupported */
	if (flags) {
		bpf_dynptr_set_null(ptr);
		return -EINVAL;
	}

	state = kmalloc_nolock(sizeof(*state), 0, NUMA_NO_NODE);
	if (!state) {
		bpf_dynptr_set_null(ptr);
		return -ENOMEM;
	}
	state->offset = 0;
	state->size = U64_MAX; /* Don't restrict size, as file may change anyways */
	freader_init_from_file(&state->freader, NULL, 0, file, may_sleep);
	bpf_dynptr_init(ptr, state, BPF_DYNPTR_TYPE_FILE, 0, 0);
	bpf_dynptr_set_rdonly(ptr);
	return 0;
}

__bpf_kfunc int bpf_dynptr_from_file(struct file *file, u32 flags, struct bpf_dynptr *ptr__uninit)
{
	return make_file_dynptr(file, flags, false, (struct bpf_dynptr_kern *)ptr__uninit);
}

int bpf_dynptr_from_file_sleepable(struct file *file, u32 flags, struct bpf_dynptr *ptr__uninit)
{
	return make_file_dynptr(file, flags, true, (struct bpf_dynptr_kern *)ptr__uninit);
}

__bpf_kfunc int bpf_dynptr_file_discard(struct bpf_dynptr *dynptr)
{
	struct bpf_dynptr_kern *ptr = (struct bpf_dynptr_kern *)dynptr;
	struct bpf_dynptr_file_impl *df = ptr->data;

	if (!df)
		return 0;

	freader_cleanup(&df->freader);
	kfree_nolock(df);
	bpf_dynptr_set_null(ptr);
	return 0;
}

/**
 * bpf_timer_cancel_async - try to deactivate a timer
 * @timer:	bpf_timer to stop
 *
 * Returns:
 *
 *  *  0 when the timer was not active
 *  *  1 when the timer was active
 *  * -1 when the timer is currently executing the callback function and
 *       cannot be stopped
 *  * -ECANCELED when the timer will be cancelled asynchronously
 *  * -ENOMEM when out of memory
 *  * -EINVAL when the timer was not initialized
 *  * -ENOENT when this kfunc is racing with timer deletion
 */
__bpf_kfunc int bpf_timer_cancel_async(struct bpf_timer *timer)
{
	struct bpf_async_kern *async = (void *)timer;
	struct bpf_async_cb *cb;
	int ret;

	cb = READ_ONCE(async->cb);
	if (!cb)
		return -EINVAL;

	/*
	 * Unlike hrtimer_start() it's ok to synchronously call
	 * hrtimer_try_to_cancel() when refcnt reached zero, but deferring to
	 * irq_work is not, since irq callback may execute after RCU GP and
	 * cb could be freed at that time. Check for refcnt zero for
	 * consistency.
	 */
	if (!refcount_inc_not_zero(&cb->refcnt))
		return -ENOENT;

	if (!defer_timer_wq_op()) {
		struct bpf_hrtimer *t = container_of(cb, struct bpf_hrtimer, cb);

		ret = hrtimer_try_to_cancel(&t->timer);
		bpf_async_refcount_put(cb);
		return ret;
	} else {
		ret = bpf_async_schedule_op(cb, BPF_ASYNC_CANCEL, 0, 0);
		return ret ? ret : -ECANCELED;
	}
}

__bpf_kfunc_end_defs();

static void bpf_task_work_cancel_scheduled(struct irq_work *irq_work)
{
	struct bpf_task_work_ctx *ctx = container_of(irq_work, struct bpf_task_work_ctx, irq_work);

	bpf_task_work_cancel(ctx); /* this might put task_work callback's ref */
	bpf_task_work_ctx_put(ctx); /* and here we put map's own ref that was transferred to us */
}

void bpf_task_work_cancel_and_free(void *val)
{
	struct bpf_task_work_kern *twk = val;
	struct bpf_task_work_ctx *ctx;
	enum bpf_task_work_state state;

	ctx = xchg(&twk->ctx, NULL);
	if (!ctx)
		return;

	state = xchg(&ctx->state, BPF_TW_FREED);
	if (state == BPF_TW_SCHEDULED) {
		/* run in irq_work to avoid locks in NMI */
		init_irq_work(&ctx->irq_work, bpf_task_work_cancel_scheduled);
		irq_work_queue(&ctx->irq_work);
		return;
	}

	bpf_task_work_ctx_put(ctx); /* put bpf map's ref */
}

BTF_KFUNCS_START(generic_btf_ids)
#ifdef CONFIG_CRASH_DUMP
BTF_ID_FLAGS(func, crash_kexec, KF_DESTRUCTIVE)
#endif
BTF_ID_FLAGS(func, bpf_obj_new, KF_ACQUIRE | KF_RET_NULL | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_percpu_obj_new, KF_ACQUIRE | KF_RET_NULL | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_percpu_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_percpu_obj_drop, KF_RELEASE | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_refcount_acquire, KF_ACQUIRE | KF_RET_NULL | KF_RCU | KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL | KF_RCU)
BTF_ID_FLAGS(func, bpf_list_push_front, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_list_push_front_impl)
BTF_ID_FLAGS(func, bpf_list_push_back, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_list_push_back_impl)
BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_list_pop_back, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_list_front, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_list_back, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_release, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_rbtree_remove, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_add, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_rbtree_add_impl)
BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_root, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_left, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_rbtree_right, KF_RET_NULL)

#ifdef CONFIG_CGROUPS
BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_cgroup_release, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_cgroup_ancestor, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_cgroup_from_id, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_under_cgroup, KF_RCU)
BTF_ID_FLAGS(func, bpf_task_get_cgroup1, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
#endif
BTF_ID_FLAGS(func, bpf_task_from_pid, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_task_from_vpid, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_throw)
#ifdef CONFIG_BPF_EVENTS
BTF_ID_FLAGS(func, bpf_send_signal_task)
#endif
#ifdef CONFIG_KEYS
BTF_ID_FLAGS(func, bpf_lookup_user_key, KF_ACQUIRE | KF_RET_NULL | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_lookup_system_key, KF_ACQUIRE | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_key_put, KF_RELEASE)
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
BTF_ID_FLAGS(func, bpf_verify_pkcs7_signature, KF_SLEEPABLE)
#endif
#endif
#ifdef CONFIG_S390
BTF_ID_FLAGS(func, bpf_get_lowcore)
#endif
BTF_KFUNCS_END(generic_btf_ids)

static const struct btf_kfunc_id_set generic_kfunc_set = {
	.owner = THIS_MODULE,
	.set   = &generic_btf_ids,
};


BTF_ID_LIST(generic_dtor_ids)
BTF_ID(struct, task_struct)
BTF_ID(func, bpf_task_release_dtor)
#ifdef CONFIG_CGROUPS
BTF_ID(struct, cgroup)
BTF_ID(func, bpf_cgroup_release_dtor)
#endif

BTF_KFUNCS_START(common_btf_ids)
BTF_ID_FLAGS(func, bpf_cast_to_kern_ctx, KF_FASTCALL)
BTF_ID_FLAGS(func, bpf_rdonly_cast, KF_FASTCALL)
BTF_ID_FLAGS(func, bpf_rcu_read_lock)
BTF_ID_FLAGS(func, bpf_rcu_read_unlock)
BTF_ID_FLAGS(func, bpf_dynptr_slice, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW)
BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_iter_task_vma_new, KF_ITER_NEW | KF_RCU)
BTF_ID_FLAGS(func, bpf_iter_task_vma_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_task_vma_destroy, KF_ITER_DESTROY)
#ifdef CONFIG_CGROUPS
BTF_ID_FLAGS(func, bpf_iter_css_task_new, KF_ITER_NEW)
BTF_ID_FLAGS(func, bpf_iter_css_task_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_css_task_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_iter_css_new, KF_ITER_NEW | KF_RCU_PROTECTED)
BTF_ID_FLAGS(func, bpf_iter_css_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_css_destroy, KF_ITER_DESTROY)
#endif
BTF_ID_FLAGS(func, bpf_iter_task_new, KF_ITER_NEW | KF_RCU_PROTECTED)
BTF_ID_FLAGS(func, bpf_iter_task_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_task_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_dynptr_adjust)
BTF_ID_FLAGS(func, bpf_dynptr_is_null)
BTF_ID_FLAGS(func, bpf_dynptr_is_rdonly)
BTF_ID_FLAGS(func, bpf_dynptr_size)
BTF_ID_FLAGS(func, bpf_dynptr_clone)
BTF_ID_FLAGS(func, bpf_dynptr_copy)
BTF_ID_FLAGS(func, bpf_dynptr_memset)
#ifdef CONFIG_NET
BTF_ID_FLAGS(func, bpf_modify_return_test_tp)
#endif
BTF_ID_FLAGS(func, bpf_wq_init)
BTF_ID_FLAGS(func, bpf_wq_set_callback, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_wq_start)
BTF_ID_FLAGS(func, bpf_preempt_disable)
BTF_ID_FLAGS(func, bpf_preempt_enable)
BTF_ID_FLAGS(func, bpf_iter_bits_new, KF_ITER_NEW)
BTF_ID_FLAGS(func, bpf_iter_bits_next, KF_ITER_NEXT | KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_iter_bits_destroy, KF_ITER_DESTROY)
BTF_ID_FLAGS(func, bpf_copy_from_user_str, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_task_str, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_get_kmem_cache)
BTF_ID_FLAGS(func, bpf_iter_kmem_cache_new, KF_ITER_NEW | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_kmem_cache_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_kmem_cache_destroy, KF_ITER_DESTROY | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_local_irq_save)
BTF_ID_FLAGS(func, bpf_local_irq_restore)
#ifdef CONFIG_BPF_EVENTS
BTF_ID_FLAGS(func, bpf_probe_read_user_dynptr)
BTF_ID_FLAGS(func, bpf_probe_read_kernel_dynptr)
BTF_ID_FLAGS(func, bpf_probe_read_user_str_dynptr)
BTF_ID_FLAGS(func, bpf_probe_read_kernel_str_dynptr)
BTF_ID_FLAGS(func, bpf_copy_from_user_dynptr, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_str_dynptr, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_task_dynptr, KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_copy_from_user_task_str_dynptr, KF_SLEEPABLE)
#endif
#ifdef CONFIG_DMA_SHARED_BUFFER
BTF_ID_FLAGS(func, bpf_iter_dmabuf_new, KF_ITER_NEW | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_dmabuf_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLEEPABLE)
BTF_ID_FLAGS(func, bpf_iter_dmabuf_destroy, KF_ITER_DESTROY | KF_SLEEPABLE)
#endif
BTF_ID_FLAGS(func, __bpf_trap)
BTF_ID_FLAGS(func, bpf_strcmp);
BTF_ID_FLAGS(func, bpf_strcasecmp);
BTF_ID_FLAGS(func, bpf_strncasecmp);
BTF_ID_FLAGS(func, bpf_strchr);
BTF_ID_FLAGS(func, bpf_strchrnul);
BTF_ID_FLAGS(func, bpf_strnchr);
BTF_ID_FLAGS(func, bpf_strrchr);
BTF_ID_FLAGS(func, bpf_strlen);
BTF_ID_FLAGS(func, bpf_strnlen);
BTF_ID_FLAGS(func, bpf_strspn);
BTF_ID_FLAGS(func, bpf_strcspn);
BTF_ID_FLAGS(func, bpf_strstr);
BTF_ID_FLAGS(func, bpf_strcasestr);
BTF_ID_FLAGS(func, bpf_strnstr);
BTF_ID_FLAGS(func, bpf_strncasestr);
#if defined(CONFIG_BPF_LSM) && defined(CONFIG_CGROUPS)
BTF_ID_FLAGS(func, bpf_cgroup_read_xattr, KF_RCU)
#endif
BTF_ID_FLAGS(func, bpf_stream_vprintk, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS)
BTF_ID_FLAGS(func, bpf_dynptr_from_file)
BTF_ID_FLAGS(func, bpf_dynptr_file_discard)
BTF_ID_FLAGS(func, bpf_timer_cancel_async)
BTF_KFUNCS_END(common_btf_ids)

static const struct btf_kfunc_id_set common_kfunc_set = {
	.owner = THIS_MODULE,
	.set   = &common_btf_ids,
};

static int __init kfunc_init(void)
{
	int ret;
	const struct btf_id_dtor_kfunc generic_dtors[] = {
		{
			.btf_id       = generic_dtor_ids[0],
			.kfunc_btf_id = generic_dtor_ids[1]
		},
#ifdef CONFIG_CGROUPS
		{
			.btf_id       = generic_dtor_ids[2],
			.kfunc_btf_id = generic_dtor_ids[3]
		},
#endif
	};

	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &generic_kfunc_set);
	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &generic_kfunc_set);
	ret = ret ?: register_btf_id_dtor_kfuncs(generic_dtors,
						  ARRAY_SIZE(generic_dtors),
						  THIS_MODULE);
	return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_UNSPEC, &common_kfunc_set);
}

late_initcall(kfunc_init);

/* Get a pointer to dynptr data up to len bytes for read only access. If
 * the dynptr doesn't have continuous data up to len bytes, return NULL.
 */
const void *__bpf_dynptr_data(const struct bpf_dynptr_kern *ptr, u64 len)
{
	const struct bpf_dynptr *p = (struct bpf_dynptr *)ptr;

	return bpf_dynptr_slice(p, 0, NULL, len);
}

/* Get a pointer to dynptr data up to len bytes for read write access. If
 * the dynptr doesn't have continuous data up to len bytes, or the dynptr
 * is read only, return NULL.
 */
void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u64 len)
{
	if (__bpf_dynptr_is_rdonly(ptr))
		return NULL;
	return (void *)__bpf_dynptr_data(ptr, len);
}

void bpf_map_free_internal_structs(struct bpf_map *map, void *val)
{
	if (btf_record_has_field(map->record, BPF_TIMER))
		bpf_obj_free_timer(map->record, val);
	if (btf_record_has_field(map->record, BPF_WORKQUEUE))
		bpf_obj_free_workqueue(map->record, val);
	if (btf_record_has_field(map->record, BPF_TASK_WORK))
		bpf_obj_free_task_work(map->record, val);
}
]

gemini-3-flash-preview

							input: 67513
							output: 41
							thoughts: 79
						

Okay, here's my assessment of the situation:

**Potential Buffer Overflow Vulnerability Review**

Alright, I've just finished going over the `bpf_bprintf_prepare` file. My initial concern, as I suspected, is spot on. Those two `snprintf` calls are screaming potential buffer overflow. The fact that there's no truncation check and the code increments `tmp_buf` based on `err + 1` is a classic recipe for trouble. We're directly writing into the buffer without proper bounds checking – a disaster waiting to happen.

Now, I can't just stop there. I need to be absolutely certain this isn't a systemic issue. One dangerous `snprintf` is bad enough, but a pattern would be a red flag. I’ll run a quick `grep` to verify there aren't any other suspicious calls in the codebase. Let's make sure this is isolated and not a recurring design flaw. I have a strong feeling about this.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 68090
							output: 40
							thoughts: 125
						

Okay, let me think this through.

**Investigating a Potential String Formatting Vulnerability**

Alright, I'm taking a look at this code, and the first thing that jumps out is `bpf_snprintf` on line 1064. Interesting... I'm immediately thinking about format string vulnerabilities. I see the function signature: `BPF_CALL_5(bpf_snprintf, char *, str, u32, str_size, char *, fmt, const void *, args, u32, data_len)`.  But hold on... that calls `bstr_printf` internally, not `snprintf`. Okay, so `bpf_snprintf` itself might not be the problem directly, but it's a good starting point. This means I need to dig deeper into how the inputs to `bstr_printf` are handled. I need to be sure.

Let me broaden the scope of my search. I'll scan the entire code base for other potentially vulnerable instances. I'll search for uses of both `sprintf` and `snprintf`. I want a comprehensive picture of all the string formatting functions being used, and how they are handled. This will tell me where the critical points are.

map[IncludeSnippetLines:1 Name:sprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 68534
							output: 42
							thoughts: 13
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Considering String Formatting in this Context**

Right, so I'm thinking about string formatting here. The obvious initial thought is, "No `sprintf`." It's just inherently unsafe, especially with potential user-provided inputs or data from untrusted sources. Buffer overflows are a nightmare. I've seen far too many security vulnerabilities stem from its use.

Then I immediately shift gears and consider `vsnprintf`. That's the go-to alternative, isn't it? A safer approach... I'm thinking about the control it gives me over the output buffer size, that's crucial. I need to ensure I'm handling the size correctly to prevent any memory issues. I can avoid those risks. So, `vsnprintf` is definitely a consideration, assuming I'm handling it with due care. I need to be aware of the edge cases and potential complexities, and handle any return codes.

map[IncludeSnippetLines:1 Name:vsnprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 68815
							output: 27
							thoughts: 657
						

**Analyzing Potential Buffer Overflows in `kernel/bpf/helpers.c`**

Okay, so the user specifically mentioned `kernel/bpf/helpers.c` and is asking about the use of `snprintf` and the potential for improper return value handling. The phrasing of the question suggests they might already know about a specific instance of this issue. My initial thought was to quickly check for `vsnprintf` usage, but I didn't see any, so I need to dig deeper.

Let's re-examine the two identified `snprintf` calls. In the first instance, at line 924, `snprintf` is used with a format specifier `%pB`, which seems related to printing a kernel pointer. The critical point is that if `snprintf` truncates the output, the `err` variable will contain the *length* of the string that *would* have been written, and the code increments `tmp_buf` by `err + 1`. If `err` is large, `tmp_buf` could easily exceed the allocated buffer size (`tmp_buf_end - tmp_buf`). This is especially worrisome because in the next iteration of the loop, the code potentially uses this out-of-bounds `tmp_buf` in a call like `bpf_trace_copy_string`. A negative size calculation can become a huge size when cast to `size_t`. This results in `strncpy_from_kernel_nofault` copying a vast amount of data into the already out-of-bounds `tmp_buf`, leading to a buffer overflow. It's a textbook vulnerability!

The second call, at line 965, shares the identical vulnerability because it also increments `tmp_buf` by `err + 1`. It also calls `snprintf` into `tmp_buf` and then increments `tmp_buf` in a similar fashion. The risks are identical.

The question "Is there any **other** place in `kernel/bpf/helpers.c` where `snprintf` is used to format strings into a buffer without checking the return value properly?" is the key here. It suggests that there is a known issue. I'm wondering if this is a known bug or a recent patch, so I need to be thorough.

To avoid missing anything, I need to make sure I don't overlook any other uses of `snprintf`. I'll use `codesearch-file-index` to get a full list of all entities in the file and then search the file content to be sure that I haven't missed any.

map[SourceFile:kernel/bpf/helpers.c]

map[Entities:[map[Kind:function Name:____bpf_copy_from_user] map[Kind:function Name:____bpf_copy_from_user_task] map[Kind:function Name:____bpf_current_task_under_cgroup] map[Kind:function Name:____bpf_dynptr_data] map[Kind:function Name:____bpf_dynptr_from_mem] map[Kind:function Name:____bpf_dynptr_read] map[Kind:function Name:____bpf_dynptr_write] map[Kind:function Name:____bpf_event_output_data] map[Kind:function Name:____bpf_get_current_ancestor_cgroup_id] map[Kind:function Name:____bpf_get_current_cgroup_id] map[Kind:function Name:____bpf_get_current_comm] map[Kind:function Name:____bpf_get_current_pid_tgid] map[Kind:function Name:____bpf_get_current_uid_gid] map[Kind:function Name:____bpf_get_ns_current_pid_tgid] map[Kind:function Name:____bpf_get_numa_node_id] map[Kind:function Name:____bpf_get_smp_processor_id] map[Kind:function Name:____bpf_jiffies64] map[Kind:function Name:____bpf_kptr_xchg] map[Kind:function Name:____bpf_ktime_get_boot_ns] map[Kind:function Name:____bpf_ktime_get_coarse_ns] map[Kind:function Name:____bpf_ktime_get_ns] map[Kind:function Name:____bpf_ktime_get_tai_ns] map[Kind:function Name:____bpf_map_delete_elem] map[Kind:function Name:____bpf_map_lookup_elem] map[Kind:function Name:____bpf_map_lookup_percpu_elem] map[Kind:function Name:____bpf_map_peek_elem] map[Kind:function Name:____bpf_map_pop_elem] map[Kind:function Name:____bpf_map_push_elem] map[Kind:function Name:____bpf_map_update_elem] map[Kind:function Name:____bpf_per_cpu_ptr] map[Kind:function Name:____bpf_snprintf] map[Kind:function Name:____bpf_spin_lock] map[Kind:function Name:____bpf_spin_unlock] map[Kind:function Name:____bpf_strncmp] map[Kind:function Name:____bpf_strtol] map[Kind:function Name:____bpf_strtoul] map[Kind:function Name:____bpf_this_cpu_ptr] map[Kind:function Name:____bpf_timer_cancel] map[Kind:function Name:____bpf_timer_init] map[Kind:function Name:____bpf_timer_set_callback] map[Kind:function Name:____bpf_timer_start] map[Kind:function Name:__bpf_async_init] map[Kind:function Name:__bpf_async_set_callback] map[Kind:function Name:__bpf_dynptr_data] map[Kind:function Name:__bpf_dynptr_data_rw] map[Kind:function Name:__bpf_dynptr_is_rdonly] map[Kind:function Name:__bpf_dynptr_read] map[Kind:function Name:__bpf_dynptr_size] map[Kind:function Name:__bpf_dynptr_write] map[Kind:function Name:__bpf_list_add] map[Kind:function Name:__bpf_list_del] map[Kind:function Name:__bpf_obj_drop_impl] map[Kind:function Name:__bpf_rbtree_add] map[Kind:function Name:__bpf_spin_lock] map[Kind:function Name:__bpf_spin_lock_irqsave] map[Kind:function Name:__bpf_spin_unlock] map[Kind:function Name:__bpf_spin_unlock_irqrestore] map[Kind:function Name:__bpf_strncasecmp] map[Kind:function Name:__bpf_strnstr] map[Kind:function Name:__bpf_strtoll] map[Kind:function Name:__bpf_strtoull] map[Kind:function Name:__bpf_trap] map[Kind:function Name:bpf_async_cancel_and_free] map[Kind:function Name:bpf_async_cb_rcu_free] map[Kind:function Name:bpf_async_cb_rcu_tasks_trace_free] map[Kind:function Name:bpf_async_irq_worker] map[Kind:function Name:bpf_async_process_op] map[Kind:function Name:bpf_async_refcount_put] map[Kind:function Name:bpf_async_schedule_op] map[Kind:function Name:bpf_async_update_prog_callback] map[Kind:function Name:bpf_base_func_proto] map[Kind:function Name:bpf_bprintf_cleanup] map[Kind:function Name:bpf_bprintf_prepare] map[Kind:function Name:bpf_cast_to_kern_ctx] map[Kind:function Name:bpf_cgroup_acquire] map[Kind:function Name:bpf_cgroup_ancestor] map[Kind:function Name:bpf_cgroup_from_id] map[Kind:function Name:bpf_cgroup_release] map[Kind:function Name:bpf_cgroup_release_dtor] map[Kind:function Name:bpf_copy_from_user] map[Kind:function Name:bpf_copy_from_user_str] map[Kind:function Name:bpf_copy_from_user_task] map[Kind:function Name:bpf_copy_from_user_task_str] map[Kind:function Name:bpf_current_task_under_cgroup] map[Kind:function Name:bpf_dynptr_adjust] map[Kind:function Name:bpf_dynptr_advance_offset] map[Kind:function Name:bpf_dynptr_check_size] map[Kind:function Name:bpf_dynptr_clone] map[Kind:function Name:bpf_dynptr_copy] map[Kind:function Name:bpf_dynptr_data] map[Kind:function Name:bpf_dynptr_file_discard] map[Kind:function Name:bpf_dynptr_from_file] map[Kind:function Name:bpf_dynptr_from_file_sleepable] map[Kind:function Name:bpf_dynptr_from_mem] map[Kind:function Name:bpf_dynptr_get_type] map[Kind:function Name:bpf_dynptr_init] map[Kind:function Name:bpf_dynptr_is_null] map[Kind:function Name:bpf_dynptr_is_rdonly] map[Kind:function Name:bpf_dynptr_memset] map[Kind:function Name:bpf_dynptr_read] map[Kind:function Name:bpf_dynptr_set_null] map[Kind:function Name:bpf_dynptr_set_rdonly] map[Kind:function Name:bpf_dynptr_set_size] map[Kind:function Name:bpf_dynptr_set_type] map[Kind:function Name:bpf_dynptr_size] map[Kind:function Name:bpf_dynptr_slice] map[Kind:function Name:bpf_dynptr_slice_rdwr] map[Kind:function Name:bpf_dynptr_write] map[Kind:function Name:bpf_event_output_data] map[Kind:function Name:bpf_file_fetch_bytes] map[Kind:function Name:bpf_get_current_ancestor_cgroup_id] map[Kind:function Name:bpf_get_current_cgroup_id] map[Kind:function Name:bpf_get_current_comm] map[Kind:function Name:bpf_get_current_pid_tgid] map[Kind:function Name:bpf_get_current_uid_gid] map[Kind:function Name:bpf_get_ns_current_pid_tgid] map[Kind:function Name:bpf_get_numa_node_id] map[Kind:function Name:bpf_get_smp_processor_id] map[Kind:function Name:bpf_iter_bits_destroy] map[Kind:function Name:bpf_iter_bits_new] map[Kind:function Name:bpf_iter_bits_next] map[Kind:function Name:bpf_jiffies64] map[Kind:function Name:bpf_key_put] map[Kind:function Name:bpf_kptr_xchg] map[Kind:function Name:bpf_ktime_get_boot_ns] map[Kind:function Name:bpf_ktime_get_coarse_ns] map[Kind:function Name:bpf_ktime_get_ns] map[Kind:function Name:bpf_ktime_get_tai_ns] map[Kind:function Name:bpf_list_back] map[Kind:function Name:bpf_list_front] map[Kind:function Name:bpf_list_head_free] map[Kind:function Name:bpf_list_pop_back] map[Kind:function Name:bpf_list_pop_front] map[Kind:function Name:bpf_list_push_back] map[Kind:function Name:bpf_list_push_back_impl] map[Kind:function Name:bpf_list_push_front] map[Kind:function Name:bpf_list_push_front_impl] map[Kind:function Name:bpf_local_irq_restore] map[Kind:function Name:bpf_local_irq_save] map[Kind:function Name:bpf_lookup_system_key] map[Kind:function Name:bpf_lookup_user_key] map[Kind:function Name:bpf_map_delete_elem] map[Kind:function Name:bpf_map_free_internal_structs] map[Kind:function Name:bpf_map_lookup_elem] map[Kind:function Name:bpf_map_lookup_percpu_elem] map[Kind:function Name:bpf_map_peek_elem] map[Kind:function Name:bpf_map_pop_elem] map[Kind:function Name:bpf_map_push_elem] map[Kind:function Name:bpf_map_update_elem] map[Kind:function Name:bpf_obj_drop] map[Kind:function Name:bpf_obj_drop_impl] map[Kind:function Name:bpf_obj_new] map[Kind:function Name:bpf_obj_new_impl] map[Kind:function Name:bpf_per_cpu_ptr] map[Kind:function Name:bpf_percpu_obj_drop] map[Kind:function Name:bpf_percpu_obj_drop_impl] map[Kind:function Name:bpf_percpu_obj_new] map[Kind:function Name:bpf_percpu_obj_new_impl] map[Kind:function Name:bpf_preempt_disable] map[Kind:function Name:bpf_preempt_enable] map[Kind:function Name:bpf_put_buffers] map[Kind:function Name:bpf_rb_root_free] map[Kind:function Name:bpf_rbtree_add] map[Kind:function Name:bpf_rbtree_add_impl] map[Kind:function Name:bpf_rbtree_first] map[Kind:function Name:bpf_rbtree_left] map[Kind:function Name:bpf_rbtree_remove] map[Kind:function Name:bpf_rbtree_right] map[Kind:function Name:bpf_rbtree_root] map[Kind:function Name:bpf_rcu_read_lock] map[Kind:function Name:bpf_rcu_read_unlock] map[Kind:function Name:bpf_rdonly_cast] map[Kind:function Name:bpf_refcount_acquire] map[Kind:function Name:bpf_refcount_acquire_impl] map[Kind:function Name:bpf_snprintf] map[Kind:function Name:bpf_spin_lock] map[Kind:function Name:bpf_spin_unlock] map[Kind:function Name:bpf_stack_walker] map[Kind:function Name:bpf_strcasecmp] map[Kind:function Name:bpf_strcasestr] map[Kind:function Name:bpf_strchr] map[Kind:function Name:bpf_strchrnul] map[Kind:function Name:bpf_strcmp] map[Kind:function Name:bpf_strcspn] map[Kind:function Name:bpf_strlen] map[Kind:function Name:bpf_strncasecmp] map[Kind:function Name:bpf_strncasestr] map[Kind:function Name:bpf_strnchr] map[Kind:function Name:bpf_strncmp] map[Kind:function Name:bpf_strnlen] map[Kind:function Name:bpf_strnstr] map[Kind:function Name:bpf_strrchr] map[Kind:function Name:bpf_strspn] map[Kind:function Name:bpf_strstr] map[Kind:function Name:bpf_strtol] map[Kind:function Name:bpf_strtoul] map[Kind:function Name:bpf_task_acquire] map[Kind:function Name:bpf_task_from_pid] map[Kind:function Name:bpf_task_from_vpid] map[Kind:function Name:bpf_task_get_cgroup1] map[Kind:function Name:bpf_task_release] map[Kind:function Name:bpf_task_release_dtor] map[Kind:function Name:bpf_task_under_cgroup] map[Kind:function Name:bpf_task_work_acquire_ctx] map[Kind:function Name:bpf_task_work_callback] map[Kind:function Name:bpf_task_work_cancel] map[Kind:function Name:bpf_task_work_cancel_and_free] map[Kind:function Name:bpf_task_work_cancel_scheduled] map[Kind:function Name:bpf_task_work_ctx_put] map[Kind:function Name:bpf_task_work_ctx_reset] map[Kind:function Name:bpf_task_work_ctx_tryget] map[Kind:function Name:bpf_task_work_destroy] map[Kind:function Name:bpf_task_work_fetch_ctx] map[Kind:function Name:bpf_task_work_irq] map[Kind:function Name:bpf_task_work_schedule] map[Kind:function Name:bpf_task_work_schedule_resume] map[Kind:function Name:bpf_task_work_schedule_signal] map[Kind:function Name:bpf_this_cpu_ptr] map[Kind:function Name:bpf_throw] map[Kind:function Name:bpf_timer_cancel] map[Kind:function Name:bpf_timer_cancel_and_free] map[Kind:function Name:bpf_timer_cancel_async] map[Kind:function Name:bpf_timer_cb] map[Kind:function Name:bpf_timer_init] map[Kind:function Name:bpf_timer_set_callback] map[Kind:function Name:bpf_timer_start] map[Kind:function Name:bpf_trace_copy_string] map[Kind:function Name:bpf_try_get_buffers] map[Kind:function Name:bpf_verify_pkcs7_signature] map[Kind:function Name:bpf_wq_cancel_and_free] map[Kind:function Name:bpf_wq_init] map[Kind:function Name:bpf_wq_set_callback] map[Kind:function Name:bpf_wq_start] map[Kind:function Name:bpf_wq_work] map[Kind:function Name:copy_map_value_locked] map[Kind:function Name:defer_timer_wq_op] map[Kind:function Name:kfunc_init] map[Kind:function Name:make_file_dynptr] map[Kind:function Name:map_key_from_value] map[Kind:function Name:swap_ulong_in_u64] map[Kind:function Name:worker_for_call_rcu] map[Kind:struct Name:bpf_async_cb] map[Kind:struct Name:bpf_async_cmd] map[Kind:struct Name:bpf_async_kern] map[Kind:struct Name:bpf_dynptr_file_impl] map[Kind:struct Name:bpf_hrtimer] map[Kind:struct Name:bpf_iter_bits] map[Kind:struct Name:bpf_iter_bits_kern] map[Kind:struct Name:bpf_task_work_ctx] map[Kind:struct Name:bpf_task_work_kern] map[Kind:struct Name:bpf_throw_ctx] map[Kind:struct Name:bpf_work] map[Kind:global_variable Name:__UNIQUE_ID_addressable_bpf_base_func_proto_789] map[Kind:global_variable Name:__UNIQUE_ID_addressable_kfunc_init_832] map[Kind:global_variable Name:bpf_copy_from_user_proto] map[Kind:global_variable Name:bpf_copy_from_user_task_proto] map[Kind:global_variable Name:bpf_current_task_under_cgroup_proto] map[Kind:global_variable Name:bpf_dynptr_data_proto] map[Kind:global_variable Name:bpf_dynptr_from_mem_proto] map[Kind:global_variable Name:bpf_dynptr_read_proto] map[Kind:global_variable Name:bpf_dynptr_write_proto] map[Kind:global_variable Name:bpf_event_output_data_proto] map[Kind:global_variable Name:bpf_get_current_ancestor_cgroup_id_proto] map[Kind:global_variable Name:bpf_get_current_cgroup_id_proto] map[Kind:global_variable Name:bpf_get_current_comm_proto] map[Kind:global_variable Name:bpf_get_current_pid_tgid_proto] map[Kind:global_variable Name:bpf_get_current_uid_gid_proto] map[Kind:global_variable Name:bpf_get_ns_current_pid_tgid_proto] map[Kind:global_variable Name:bpf_get_numa_node_id_proto] map[Kind:global_variable Name:bpf_get_prandom_u32_proto] map[Kind:global_variable Name:bpf_get_raw_smp_processor_id_proto] map[Kind:global_variable Name:bpf_get_smp_processor_id_proto] map[Kind:global_variable Name:bpf_jiffies64_proto] map[Kind:global_variable Name:bpf_kptr_xchg_proto] map[Kind:global_variable Name:bpf_ktime_get_boot_ns_proto] map[Kind:global_variable Name:bpf_ktime_get_coarse_ns_proto] map[Kind:global_variable Name:bpf_ktime_get_ns_proto] map[Kind:global_variable Name:bpf_ktime_get_tai_ns_proto] map[Kind:global_variable Name:bpf_map_delete_elem_proto] map[Kind:global_variable Name:bpf_map_lookup_elem_proto] map[Kind:global_variable Name:bpf_map_lookup_percpu_elem_proto] map[Kind:global_variable Name:bpf_map_peek_elem_proto] map[Kind:global_variable Name:bpf_map_pop_elem_proto] map[Kind:global_variable Name:bpf_map_push_elem_proto] map[Kind:global_variable Name:bpf_map_update_elem_proto] map[Kind:global_variable Name:bpf_per_cpu_ptr_proto] map[Kind:global_variable Name:bpf_snprintf_proto] map[Kind:global_variable Name:bpf_spin_lock_proto] map[Kind:global_variable Name:bpf_spin_unlock_proto] map[Kind:global_variable Name:bpf_strncmp_proto] map[Kind:global_variable Name:bpf_strtol_proto] map[Kind:global_variable Name:bpf_strtoul_proto] map[Kind:global_variable Name:bpf_this_cpu_ptr_proto] map[Kind:global_variable Name:bpf_timer_cancel_proto] map[Kind:global_variable Name:bpf_timer_init_proto] map[Kind:global_variable Name:bpf_timer_set_callback_proto] map[Kind:global_variable Name:bpf_timer_start_proto] map[Kind:global_variable Name:common_btf_ids] map[Kind:global_variable Name:common_kfunc_set] map[Kind:global_variable Name:generic_btf_ids] map[Kind:global_variable Name:generic_kfunc_set] map[Kind:enum Name:bpf_async_op] map[Kind:enum Name:bpf_async_type] map[Kind:enum Name:bpf_task_work_state] map[Kind:typedef Name:bpf_task_work_callback_t] map[Kind:typedef Name:btf_bpf_copy_from_user] map[Kind:typedef Name:btf_bpf_copy_from_user_task] map[Kind:typedef Name:btf_bpf_current_task_under_cgroup] map[Kind:typedef Name:btf_bpf_dynptr_data] map[Kind:typedef Name:btf_bpf_dynptr_from_mem] map[Kind:typedef Name:btf_bpf_dynptr_read] map[Kind:typedef Name:btf_bpf_dynptr_write] map[Kind:typedef Name:btf_bpf_event_output_data] map[Kind:typedef Name:btf_bpf_get_current_ancestor_cgroup_id] map[Kind:typedef Name:btf_bpf_get_current_cgroup_id] map[Kind:typedef Name:btf_bpf_get_current_comm] map[Kind:typedef Name:btf_bpf_get_current_pid_tgid] map[Kind:typedef Name:btf_bpf_get_current_uid_gid] map[Kind:typedef Name:btf_bpf_get_ns_current_pid_tgid] map[Kind:typedef Name:btf_bpf_get_numa_node_id] map[Kind:typedef Name:btf_bpf_get_smp_processor_id] map[Kind:typedef Name:btf_bpf_jiffies64] map[Kind:typedef Name:btf_bpf_kptr_xchg] map[Kind:typedef Name:btf_bpf_ktime_get_boot_ns] map[Kind:typedef Name:btf_bpf_ktime_get_coarse_ns] map[Kind:typedef Name:btf_bpf_ktime_get_ns] map[Kind:typedef Name:btf_bpf_ktime_get_tai_ns] map[Kind:typedef Name:btf_bpf_map_delete_elem] map[Kind:typedef Name:btf_bpf_map_lookup_elem] map[Kind:typedef Name:btf_bpf_map_lookup_percpu_elem] map[Kind:typedef Name:btf_bpf_map_peek_elem] map[Kind:typedef Name:btf_bpf_map_pop_elem] map[Kind:typedef Name:btf_bpf_map_push_elem] map[Kind:typedef Name:btf_bpf_map_update_elem] map[Kind:typedef Name:btf_bpf_per_cpu_ptr] map[Kind:typedef Name:btf_bpf_snprintf] map[Kind:typedef Name:btf_bpf_spin_lock] map[Kind:typedef Name:btf_bpf_spin_unlock] map[Kind:typedef Name:btf_bpf_strncmp] map[Kind:typedef Name:btf_bpf_strtol] map[Kind:typedef Name:btf_bpf_strtoul] map[Kind:typedef Name:btf_bpf_this_cpu_ptr] map[Kind:typedef Name:btf_bpf_timer_cancel] map[Kind:typedef Name:btf_bpf_timer_init] map[Kind:typedef Name:btf_bpf_timer_set_callback] map[Kind:typedef Name:btf_bpf_timer_start]]]

gemini-3-flash-preview

							input: 77081
							output: 41
							thoughts: 260
						

**My BPF Snprintf Analysis**

Okay, I've already pinpointed those two `snprintf` calls within `bpf_bprintf_prepare`. Let me just double-check that function again, just to be absolutely certain. Yes, I see them: lines 924-928, the `%pB` handling, and lines 965-968 with the `ip_spec` and `cur_ip` formatting.

But I need to be thorough. Are there *any* other instances of `snprintf` in the `kernel/bpf/helpers.c` file that I might have missed initially? Just because I'm confident doesn't mean I can't be wrong. I'll rerun my `grep` search using `codesearch-find-references`, but I'll pay closer attention this time, looking out for any subtle formatting variations that could have thrown off the initial search. We can't let any potential security issues slip through the cracks.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 77843
							output: 33
							thoughts: 322
						

**Analyzing `snprintf` Usage in `kernel/bpf/helpers.c`**

Alright, just these two instances of `snprintf` to focus on for now. But, before I get too deep, it's a good practice to check for any *other* relevant uses of `snprintf` within the `kernel/bpf/` directory, just in case something else is intertwined, even though the user specifically asked about `helpers.c`. Though, I'll keep the focus on *this* file for now.

Let's revisit that first snippet in `helpers.c`. Ah, right, that's line 922:

```c
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
```

Okay, `%pB` is our key here – that's the symbol lookup with offset specifier.  And that has the potential to produce a *long* string. `tmp_buf`, that's part of `buffers->bin_args`. So, the size of `tmp_buf` is limited by `MAX_BPRINTF_BIN_ARGS`. Time to find the value of this. I'd expect it to be defined in either `include/linux/bpf.h` or, perhaps, even `kernel/bpf/helpers.c`. I did not find it in `helpers.c` and haven't looked in `bpf.h` yet, but I'll search the entire tree to be thorough, just to be sure.

log-in to see details

map[IncludeSnippetLines:1 Name:MAX_BPRINTF_BIN_ARGS]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 78656
							output: 48
							thoughts: 22
						

Okay, here's my summarized thought process, presented as if I were thinking it:

**Analyzing the Search Strategy**

Right, let's get down to brass tacks. I'm going to need to locate that `MAX_BPRINTF_BIN_ARGS` string within the codebase. Given the nature of this project, and my experience, `grep` is the obvious tool of choice here. It's fast, efficient, and perfectly suited for this kind of quick text search across multiple files. I can quickly scan the entire project directory with grep for the string I am looking for.

log-in to see details

map[IncludeSnippetLines:1 Name:MAX_BPRINTF_BIN_ARGS SourceTreePrefix:include/linux/bpf.h]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 78872
							output: 45
							thoughts: 14
						

Okay, here's my summary, presented as a direct, first-person narrative, as if I were experiencing these thoughts:

**Navigating the BPF Landscape**

Alright, so I need to find something... and my instinct tells me the best place to start looking is within the `kernel/bpf/` directory. It's the most logical starting point for any BPF-related kernel functionality or code. That's where I'd expect to find the core implementations, definitions, or at least pointers to whatever I'm after. It's essentially the BPF home base, and I'll begin my search there, it's the right level of abstraction.

log-in to see details

map[IncludeSnippetLines:1 Name:MAX_BPRINTF_BIN_ARGS SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 79095
							output: 48
							thoughts: 182
						

Here's my thought process, summarized:

**Investigating a Suspected Macro Definition**

Okay, I'm pretty sure I remember encountering this `MAX_BPRINTF_BIN_ARGS` in some code recently. I should probably double-check the file content – yep, it's there, specifically line 840 of `kernel/bpf/helpers.c`.

I wonder why my `codesearch-find-references` didn't turn anything up. Could it be a macro? That would explain it. Maybe I should have used `codesearch-definition-source` instead. Wait, no, I already tried that and it didn't work.

Alright, time to go back to the top of `kernel/bpf/helpers.c` and take a closer look. Actually, maybe just searching the file for that line directly is the most efficient approach for now.

log-in to see details

map[IncludeSnippetLines:1 Name:MAX_BPRINTF_BIN_ARGS SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 79535
							output: 44
							thoughts: 129
						

**Debugging a Peculiar `read-file` Output**

Okay, this is seriously strange. I'm staring at this `read-file` output, and something just doesn't sit right. It's in the C code, specifically this snippet:

```c
	if (data->get_bin_args) {
		if (num_args)
			tmp_buf = buffers->bin_args;
		tmp_buf_end = tmp_buf + MAX_BPRINTF_BIN_ARGS;
		data->bin_args = (u32 *)tmp_buf;
	}
```

My initial thought is, what's going on with these `bin_args`? It's assigning a buffer pointer and seems like the intention is to use a section of the provided buffer. Let me try to understand this.

I need to quickly dig into the definition of `struct bpf_bprintf_buffers`. My hunch is that the crucial information regarding this structure is probably defined in `include/linux/bpf.h`. I'll open that header and check what's going on there.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_bprintf_buffers]

map[SourceCode:3877:	struct bpf_bprintf_buffers {
3878:		char bin_args[MAX_BPRINTF_BIN_ARGS];
3879:		char buf[MAX_BPRINTF_BUF];
3880:	};
 SourceFile:include/linux/bpf.h]

gemini-3-flash-preview

							input: 80045
							output: 23
							thoughts: 37
						

Here's my thought process, summarized as you requested:

**Navigating the BPF Landscape**

Alright, let's dive in. I need to track down the definition of `MAX_BPRINTF_BIN_ARGS`. Given that it's BPF-related, I'm pretty certain it's hanging out in the kernel's include directory, specifically under `linux/`. That's where all the core BPF structures and definitions reside. So, first stop: `include/linux/bpf.h`. That's the most logical place to begin my search. I'll need to open that header file and locate `MAX_BPRINTF_BIN_ARGS` within its contents. Hopefully it's not too deeply nested or obscured by a ton of preprocessor directives. Let's see what we find.

map[File:include/linux/bpf.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0-only */
/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
 */
#ifndef _LINUX_BPF_H
#define _LINUX_BPF_H 1

#include <uapi/linux/bpf.h>
#include <uapi/linux/filter.h>

#include <crypto/sha2.h>
#include <linux/workqueue.h>
#include <linux/file.h>
#include <linux/percpu.h>
#include <linux/err.h>
#include <linux/rbtree_latch.h>
#include <linux/numa.h>
#include <linux/mm_types.h>
#include <linux/wait.h>
#include <linux/refcount.h>
#include <linux/mutex.h>
#include <linux/module.h>
#include <linux/kallsyms.h>
#include <linux/capability.h>
#include <linux/sched/mm.h>
#include <linux/slab.h>
#include <linux/percpu-refcount.h>
#include <linux/stddef.h>
#include <linux/bpfptr.h>
#include <linux/btf.h>
#include <linux/rcupdate_trace.h>
#include <linux/static_call.h>
#include <linux/memcontrol.h>
#include <linux/cfi.h>
#include <asm/rqspinlock.h>

struct bpf_verifier_env;
struct bpf_verifier_log;
struct perf_event;
struct bpf_prog;
struct bpf_prog_aux;
struct bpf_map;
struct bpf_arena;
struct sock;
struct seq_file;
struct btf;
struct btf_type;
struct exception_table_entry;
struct seq_operations;
struct bpf_iter_aux_info;
struct bpf_local_storage;
struct bpf_local_storage_map;
struct kobject;
struct mem_cgroup;
struct module;
struct bpf_func_state;
struct ftrace_ops;
struct cgroup;
struct bpf_token;
struct user_namespace;
struct super_block;
struct inode;

extern struct idr btf_idr;
extern spinlock_t btf_idr_lock;
extern struct kobject *btf_kobj;
extern struct bpf_mem_alloc bpf_global_ma, bpf_global_percpu_ma;
extern bool bpf_global_ma_set;

typedef u64 (*bpf_callback_t)(u64, u64, u64, u64, u64);
typedef int (*bpf_iter_init_seq_priv_t)(void *private_data,
					struct bpf_iter_aux_info *aux);
typedef void (*bpf_iter_fini_seq_priv_t)(void *private_data);
typedef unsigned int (*bpf_func_t)(const void *,
				   const struct bpf_insn *);
struct bpf_iter_seq_info {
	const struct seq_operations *seq_ops;
	bpf_iter_init_seq_priv_t init_seq_private;
	bpf_iter_fini_seq_priv_t fini_seq_private;
	u32 seq_priv_size;
};

/* map is generic key/value storage optionally accessible by eBPF programs */
struct bpf_map_ops {
	/* funcs callable from userspace (via syscall) */
	int (*map_alloc_check)(union bpf_attr *attr);
	struct bpf_map *(*map_alloc)(union bpf_attr *attr);
	void (*map_release)(struct bpf_map *map, struct file *map_file);
	void (*map_free)(struct bpf_map *map);
	int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key);
	void (*map_release_uref)(struct bpf_map *map);
	void *(*map_lookup_elem_sys_only)(struct bpf_map *map, void *key);
	int (*map_lookup_batch)(struct bpf_map *map, const union bpf_attr *attr,
				union bpf_attr __user *uattr);
	int (*map_lookup_and_delete_elem)(struct bpf_map *map, void *key,
					  void *value, u64 flags);
	int (*map_lookup_and_delete_batch)(struct bpf_map *map,
					   const union bpf_attr *attr,
					   union bpf_attr __user *uattr);
	int (*map_update_batch)(struct bpf_map *map, struct file *map_file,
				const union bpf_attr *attr,
				union bpf_attr __user *uattr);
	int (*map_delete_batch)(struct bpf_map *map, const union bpf_attr *attr,
				union bpf_attr __user *uattr);

	/* funcs callable from userspace and from eBPF programs */
	void *(*map_lookup_elem)(struct bpf_map *map, void *key);
	long (*map_update_elem)(struct bpf_map *map, void *key, void *value, u64 flags);
	long (*map_delete_elem)(struct bpf_map *map, void *key);
	long (*map_push_elem)(struct bpf_map *map, void *value, u64 flags);
	long (*map_pop_elem)(struct bpf_map *map, void *value);
	long (*map_peek_elem)(struct bpf_map *map, void *value);
	void *(*map_lookup_percpu_elem)(struct bpf_map *map, void *key, u32 cpu);
	int (*map_get_hash)(struct bpf_map *map, u32 hash_buf_size, void *hash_buf);

	/* funcs called by prog_array and perf_event_array map */
	void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
				int fd);
	/* If need_defer is true, the implementation should guarantee that
	 * the to-be-put element is still alive before the bpf program, which
	 * may manipulate it, exists.
	 */
	void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer);
	int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
	u32 (*map_fd_sys_lookup_elem)(void *ptr);
	void (*map_seq_show_elem)(struct bpf_map *map, void *key,
				  struct seq_file *m);
	int (*map_check_btf)(struct bpf_map *map,
			     const struct btf *btf,
			     const struct btf_type *key_type,
			     const struct btf_type *value_type);

	/* Prog poke tracking helpers. */
	int (*map_poke_track)(struct bpf_map *map, struct bpf_prog_aux *aux);
	void (*map_poke_untrack)(struct bpf_map *map, struct bpf_prog_aux *aux);
	void (*map_poke_run)(struct bpf_map *map, u32 key, struct bpf_prog *old,
			     struct bpf_prog *new);

	/* Direct value access helpers. */
	int (*map_direct_value_addr)(const struct bpf_map *map,
				     u64 *imm, u32 off);
	int (*map_direct_value_meta)(const struct bpf_map *map,
				     u64 imm, u32 *off);
	int (*map_mmap)(struct bpf_map *map, struct vm_area_struct *vma);
	__poll_t (*map_poll)(struct bpf_map *map, struct file *filp,
			     struct poll_table_struct *pts);
	unsigned long (*map_get_unmapped_area)(struct file *filep, unsigned long addr,
					       unsigned long len, unsigned long pgoff,
					       unsigned long flags);

	/* Functions called by bpf_local_storage maps */
	int (*map_local_storage_charge)(struct bpf_local_storage_map *smap,
					void *owner, u32 size);
	void (*map_local_storage_uncharge)(struct bpf_local_storage_map *smap,
					   void *owner, u32 size);
	struct bpf_local_storage __rcu ** (*map_owner_storage_ptr)(void *owner);

	/* Misc helpers.*/
	long (*map_redirect)(struct bpf_map *map, u64 key, u64 flags);

	/* map_meta_equal must be implemented for maps that can be
	 * used as an inner map.  It is a runtime check to ensure
	 * an inner map can be inserted to an outer map.
	 *
	 * Some properties of the inner map has been used during the
	 * verification time.  When inserting an inner map at the runtime,
	 * map_meta_equal has to ensure the inserting map has the same
	 * properties that the verifier has used earlier.
	 */
	bool (*map_meta_equal)(const struct bpf_map *meta0,
			       const struct bpf_map *meta1);


	int (*map_set_for_each_callback_args)(struct bpf_verifier_env *env,
					      struct bpf_func_state *caller,
					      struct bpf_func_state *callee);
	long (*map_for_each_callback)(struct bpf_map *map,
				     bpf_callback_t callback_fn,
				     void *callback_ctx, u64 flags);

	u64 (*map_mem_usage)(const struct bpf_map *map);

	/* BTF id of struct allocated by map_alloc */
	int *map_btf_id;

	/* bpf_iter info used to open a seq_file */
	const struct bpf_iter_seq_info *iter_seq_info;
};

enum {
	/* Support at most 11 fields in a BTF type */
	BTF_FIELDS_MAX	   = 11,
};

enum btf_field_type {
	BPF_SPIN_LOCK  = (1 << 0),
	BPF_TIMER      = (1 << 1),
	BPF_KPTR_UNREF = (1 << 2),
	BPF_KPTR_REF   = (1 << 3),
	BPF_KPTR_PERCPU = (1 << 4),
	BPF_KPTR       = BPF_KPTR_UNREF | BPF_KPTR_REF | BPF_KPTR_PERCPU,
	BPF_LIST_HEAD  = (1 << 5),
	BPF_LIST_NODE  = (1 << 6),
	BPF_RB_ROOT    = (1 << 7),
	BPF_RB_NODE    = (1 << 8),
	BPF_GRAPH_NODE = BPF_RB_NODE | BPF_LIST_NODE,
	BPF_GRAPH_ROOT = BPF_RB_ROOT | BPF_LIST_HEAD,
	BPF_REFCOUNT   = (1 << 9),
	BPF_WORKQUEUE  = (1 << 10),
	BPF_UPTR       = (1 << 11),
	BPF_RES_SPIN_LOCK = (1 << 12),
	BPF_TASK_WORK  = (1 << 13),
};

enum bpf_cgroup_storage_type {
	BPF_CGROUP_STORAGE_SHARED,
	BPF_CGROUP_STORAGE_PERCPU,
	__BPF_CGROUP_STORAGE_MAX
#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX
};

#ifdef CONFIG_CGROUP_BPF
# define for_each_cgroup_storage_type(stype) \
	for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)
#else
# define for_each_cgroup_storage_type(stype) for (; false; )
#endif /* CONFIG_CGROUP_BPF */

typedef void (*btf_dtor_kfunc_t)(void *);

struct btf_field_kptr {
	struct btf *btf;
	struct module *module;
	/* dtor used if btf_is_kernel(btf), otherwise the type is
	 * program-allocated, dtor is NULL,  and __bpf_obj_drop_impl is used
	 */
	btf_dtor_kfunc_t dtor;
	u32 btf_id;
};

struct btf_field_graph_root {
	struct btf *btf;
	u32 value_btf_id;
	u32 node_offset;
	struct btf_record *value_rec;
};

struct btf_field {
	u32 offset;
	u32 size;
	enum btf_field_type type;
	union {
		struct btf_field_kptr kptr;
		struct btf_field_graph_root graph_root;
	};
};

struct btf_record {
	u32 cnt;
	u32 field_mask;
	int spin_lock_off;
	int res_spin_lock_off;
	int timer_off;
	int wq_off;
	int refcount_off;
	int task_work_off;
	struct btf_field fields[];
};

/* Non-opaque version of bpf_rb_node in uapi/linux/bpf.h */
struct bpf_rb_node_kern {
	struct rb_node rb_node;
	void *owner;
} __attribute__((aligned(8)));

/* Non-opaque version of bpf_list_node in uapi/linux/bpf.h */
struct bpf_list_node_kern {
	struct list_head list_head;
	void *owner;
} __attribute__((aligned(8)));

/* 'Ownership' of program-containing map is claimed by the first program
 * that is going to use this map or by the first program which FD is
 * stored in the map to make sure that all callers and callees have the
 * same prog type, JITed flag and xdp_has_frags flag.
 */
struct bpf_map_owner {
	enum bpf_prog_type type;
	bool jited;
	bool xdp_has_frags;
	bool sleepable;
	u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
	const struct btf_type *attach_func_proto;
	enum bpf_attach_type expected_attach_type;
};

struct bpf_map {
	u8 sha[SHA256_DIGEST_SIZE];
	const struct bpf_map_ops *ops;
	struct bpf_map *inner_map_meta;
#ifdef CONFIG_SECURITY
	void *security;
#endif
	enum bpf_map_type map_type;
	u32 key_size;
	u32 value_size;
	u32 max_entries;
	u64 map_extra; /* any per-map-type extra fields */
	u32 map_flags;
	u32 id;
	struct btf_record *record;
	int numa_node;
	u32 btf_key_type_id;
	u32 btf_value_type_id;
	u32 btf_vmlinux_value_type_id;
	struct btf *btf;
#ifdef CONFIG_MEMCG
	struct obj_cgroup *objcg;
#endif
	char name[BPF_OBJ_NAME_LEN];
	struct mutex freeze_mutex;
	atomic64_t refcnt;
	atomic64_t usercnt;
	/* rcu is used before freeing and work is only used during freeing */
	union {
		struct work_struct work;
		struct rcu_head rcu;
	};
	atomic64_t writecnt;
	spinlock_t owner_lock;
	struct bpf_map_owner *owner;
	bool bypass_spec_v1;
	bool frozen; /* write-once; write-protected by freeze_mutex */
	bool free_after_mult_rcu_gp;
	bool free_after_rcu_gp;
	atomic64_t sleepable_refcnt;
	s64 __percpu *elem_count;
	u64 cookie; /* write-once */
	char *excl_prog_sha;
};

static inline const char *btf_field_type_name(enum btf_field_type type)
{
	switch (type) {
	case BPF_SPIN_LOCK:
		return "bpf_spin_lock";
	case BPF_RES_SPIN_LOCK:
		return "bpf_res_spin_lock";
	case BPF_TIMER:
		return "bpf_timer";
	case BPF_WORKQUEUE:
		return "bpf_wq";
	case BPF_KPTR_UNREF:
	case BPF_KPTR_REF:
		return "kptr";
	case BPF_KPTR_PERCPU:
		return "percpu_kptr";
	case BPF_UPTR:
		return "uptr";
	case BPF_LIST_HEAD:
		return "bpf_list_head";
	case BPF_LIST_NODE:
		return "bpf_list_node";
	case BPF_RB_ROOT:
		return "bpf_rb_root";
	case BPF_RB_NODE:
		return "bpf_rb_node";
	case BPF_REFCOUNT:
		return "bpf_refcount";
	case BPF_TASK_WORK:
		return "bpf_task_work";
	default:
		WARN_ON_ONCE(1);
		return "unknown";
	}
}

#if IS_ENABLED(CONFIG_DEBUG_KERNEL)
#define BPF_WARN_ONCE(cond, format...) WARN_ONCE(cond, format)
#else
#define BPF_WARN_ONCE(cond, format...) BUILD_BUG_ON_INVALID(cond)
#endif

static inline u32 btf_field_type_size(enum btf_field_type type)
{
	switch (type) {
	case BPF_SPIN_LOCK:
		return sizeof(struct bpf_spin_lock);
	case BPF_RES_SPIN_LOCK:
		return sizeof(struct bpf_res_spin_lock);
	case BPF_TIMER:
		return sizeof(struct bpf_timer);
	case BPF_WORKQUEUE:
		return sizeof(struct bpf_wq);
	case BPF_KPTR_UNREF:
	case BPF_KPTR_REF:
	case BPF_KPTR_PERCPU:
	case BPF_UPTR:
		return sizeof(u64);
	case BPF_LIST_HEAD:
		return sizeof(struct bpf_list_head);
	case BPF_LIST_NODE:
		return sizeof(struct bpf_list_node);
	case BPF_RB_ROOT:
		return sizeof(struct bpf_rb_root);
	case BPF_RB_NODE:
		return sizeof(struct bpf_rb_node);
	case BPF_REFCOUNT:
		return sizeof(struct bpf_refcount);
	case BPF_TASK_WORK:
		return sizeof(struct bpf_task_work);
	default:
		WARN_ON_ONCE(1);
		return 0;
	}
}

static inline u32 btf_field_type_align(enum btf_field_type type)
{
	switch (type) {
	case BPF_SPIN_LOCK:
		return __alignof__(struct bpf_spin_lock);
	case BPF_RES_SPIN_LOCK:
		return __alignof__(struct bpf_res_spin_lock);
	case BPF_TIMER:
		return __alignof__(struct bpf_timer);
	case BPF_WORKQUEUE:
		return __alignof__(struct bpf_wq);
	case BPF_KPTR_UNREF:
	case BPF_KPTR_REF:
	case BPF_KPTR_PERCPU:
	case BPF_UPTR:
		return __alignof__(u64);
	case BPF_LIST_HEAD:
		return __alignof__(struct bpf_list_head);
	case BPF_LIST_NODE:
		return __alignof__(struct bpf_list_node);
	case BPF_RB_ROOT:
		return __alignof__(struct bpf_rb_root);
	case BPF_RB_NODE:
		return __alignof__(struct bpf_rb_node);
	case BPF_REFCOUNT:
		return __alignof__(struct bpf_refcount);
	case BPF_TASK_WORK:
		return __alignof__(struct bpf_task_work);
	default:
		WARN_ON_ONCE(1);
		return 0;
	}
}

static inline void bpf_obj_init_field(const struct btf_field *field, void *addr)
{
	memset(addr, 0, field->size);

	switch (field->type) {
	case BPF_REFCOUNT:
		refcount_set((refcount_t *)addr, 1);
		break;
	case BPF_RB_NODE:
		RB_CLEAR_NODE((struct rb_node *)addr);
		break;
	case BPF_LIST_HEAD:
	case BPF_LIST_NODE:
		INIT_LIST_HEAD((struct list_head *)addr);
		break;
	case BPF_RB_ROOT:
		/* RB_ROOT_CACHED 0-inits, no need to do anything after memset */
	case BPF_SPIN_LOCK:
	case BPF_RES_SPIN_LOCK:
	case BPF_TIMER:
	case BPF_WORKQUEUE:
	case BPF_KPTR_UNREF:
	case BPF_KPTR_REF:
	case BPF_KPTR_PERCPU:
	case BPF_UPTR:
	case BPF_TASK_WORK:
		break;
	default:
		WARN_ON_ONCE(1);
		return;
	}
}

static inline bool btf_record_has_field(const struct btf_record *rec, enum btf_field_type type)
{
	if (IS_ERR_OR_NULL(rec))
		return false;
	return rec->field_mask & type;
}

static inline void bpf_obj_init(const struct btf_record *rec, void *obj)
{
	int i;

	if (IS_ERR_OR_NULL(rec))
		return;
	for (i = 0; i < rec->cnt; i++)
		bpf_obj_init_field(&rec->fields[i], obj + rec->fields[i].offset);
}

/* 'dst' must be a temporary buffer and should not point to memory that is being
 * used in parallel by a bpf program or bpf syscall, otherwise the access from
 * the bpf program or bpf syscall may be corrupted by the reinitialization,
 * leading to weird problems. Even 'dst' is newly-allocated from bpf memory
 * allocator, it is still possible for 'dst' to be used in parallel by a bpf
 * program or bpf syscall.
 */
static inline void check_and_init_map_value(struct bpf_map *map, void *dst)
{
	bpf_obj_init(map->record, dst);
}

/* memcpy that is used with 8-byte aligned pointers, power-of-8 size and
 * forced to use 'long' read/writes to try to atomically copy long counters.
 * Best-effort only.  No barriers here, since it _will_ race with concurrent
 * updates from BPF programs. Called from bpf syscall and mostly used with
 * size 8 or 16 bytes, so ask compiler to inline it.
 */
static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
{
	const long *lsrc = src;
	long *ldst = dst;

	size /= sizeof(long);
	while (size--)
		data_race(*ldst++ = *lsrc++);
}

/* copy everything but bpf_spin_lock, bpf_timer, and kptrs. There could be one of each. */
static inline void bpf_obj_memcpy(struct btf_record *rec,
				  void *dst, void *src, u32 size,
				  bool long_memcpy)
{
	u32 curr_off = 0;
	int i;

	if (IS_ERR_OR_NULL(rec)) {
		if (long_memcpy)
			bpf_long_memcpy(dst, src, round_up(size, 8));
		else
			memcpy(dst, src, size);
		return;
	}

	for (i = 0; i < rec->cnt; i++) {
		u32 next_off = rec->fields[i].offset;
		u32 sz = next_off - curr_off;

		memcpy(dst + curr_off, src + curr_off, sz);
		curr_off += rec->fields[i].size + sz;
	}
	memcpy(dst + curr_off, src + curr_off, size - curr_off);
}

static inline void copy_map_value(struct bpf_map *map, void *dst, void *src)
{
	bpf_obj_memcpy(map->record, dst, src, map->value_size, false);
}

static inline void copy_map_value_long(struct bpf_map *map, void *dst, void *src)
{
	bpf_obj_memcpy(map->record, dst, src, map->value_size, true);
}

static inline void bpf_obj_swap_uptrs(const struct btf_record *rec, void *dst, void *src)
{
	unsigned long *src_uptr, *dst_uptr;
	const struct btf_field *field;
	int i;

	if (!btf_record_has_field(rec, BPF_UPTR))
		return;

	for (i = 0, field = rec->fields; i < rec->cnt; i++, field++) {
		if (field->type != BPF_UPTR)
			continue;

		src_uptr = src + field->offset;
		dst_uptr = dst + field->offset;
		swap(*src_uptr, *dst_uptr);
	}
}

static inline void bpf_obj_memzero(struct btf_record *rec, void *dst, u32 size)
{
	u32 curr_off = 0;
	int i;

	if (IS_ERR_OR_NULL(rec)) {
		memset(dst, 0, size);
		return;
	}

	for (i = 0; i < rec->cnt; i++) {
		u32 next_off = rec->fields[i].offset;
		u32 sz = next_off - curr_off;

		memset(dst + curr_off, 0, sz);
		curr_off += rec->fields[i].size + sz;
	}
	memset(dst + curr_off, 0, size - curr_off);
}

static inline void zero_map_value(struct bpf_map *map, void *dst)
{
	bpf_obj_memzero(map->record, dst, map->value_size);
}

void copy_map_value_locked(struct bpf_map *map, void *dst, void *src,
			   bool lock_src);
void bpf_timer_cancel_and_free(void *timer);
void bpf_wq_cancel_and_free(void *timer);
void bpf_task_work_cancel_and_free(void *timer);
void bpf_list_head_free(const struct btf_field *field, void *list_head,
			struct bpf_spin_lock *spin_lock);
void bpf_rb_root_free(const struct btf_field *field, void *rb_root,
		      struct bpf_spin_lock *spin_lock);
u64 bpf_arena_get_kern_vm_start(struct bpf_arena *arena);
u64 bpf_arena_get_user_vm_start(struct bpf_arena *arena);
int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size);

struct bpf_offload_dev;
struct bpf_offloaded_map;

struct bpf_map_dev_ops {
	int (*map_get_next_key)(struct bpf_offloaded_map *map,
				void *key, void *next_key);
	int (*map_lookup_elem)(struct bpf_offloaded_map *map,
			       void *key, void *value);
	int (*map_update_elem)(struct bpf_offloaded_map *map,
			       void *key, void *value, u64 flags);
	int (*map_delete_elem)(struct bpf_offloaded_map *map, void *key);
};

struct bpf_offloaded_map {
	struct bpf_map map;
	struct net_device *netdev;
	const struct bpf_map_dev_ops *dev_ops;
	void *dev_priv;
	struct list_head offloads;
};

static inline struct bpf_offloaded_map *map_to_offmap(struct bpf_map *map)
{
	return container_of(map, struct bpf_offloaded_map, map);
}

static inline bool bpf_map_offload_neutral(const struct bpf_map *map)
{
	return map->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY;
}

static inline bool bpf_map_support_seq_show(const struct bpf_map *map)
{
	return (map->btf_value_type_id || map->btf_vmlinux_value_type_id) &&
		map->ops->map_seq_show_elem;
}

int map_check_no_btf(struct bpf_map *map,
		     const struct btf *btf,
		     const struct btf_type *key_type,
		     const struct btf_type *value_type);

bool bpf_map_meta_equal(const struct bpf_map *meta0,
			const struct bpf_map *meta1);

static inline bool bpf_map_has_internal_structs(struct bpf_map *map)
{
	return btf_record_has_field(map->record, BPF_TIMER | BPF_WORKQUEUE | BPF_TASK_WORK);
}

void bpf_map_free_internal_structs(struct bpf_map *map, void *obj);

int bpf_dynptr_from_file_sleepable(struct file *file, u32 flags,
				   struct bpf_dynptr *ptr__uninit);

#if defined(CONFIG_MMU) && defined(CONFIG_64BIT)
void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr__ign, u32 page_cnt, int node_id,
					  u64 flags);
void bpf_arena_free_pages_non_sleepable(void *p__map, void *ptr__ign, u32 page_cnt);
#else
static inline void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr__ign, u32 page_cnt,
							int node_id, u64 flags)
{
	return NULL;
}

static inline void bpf_arena_free_pages_non_sleepable(void *p__map, void *ptr__ign, u32 page_cnt)
{
}
#endif

extern const struct bpf_map_ops bpf_map_offload_ops;

/* bpf_type_flag contains a set of flags that are applicable to the values of
 * arg_type, ret_type and reg_type. For example, a pointer value may be null,
 * or a memory is read-only. We classify types into two categories: base types
 * and extended types. Extended types are base types combined with a type flag.
 *
 * Currently there are no more than 32 base types in arg_type, ret_type and
 * reg_types.
 */
#define BPF_BASE_TYPE_BITS	8

enum bpf_type_flag {
	/* PTR may be NULL. */
	PTR_MAYBE_NULL		= BIT(0 + BPF_BASE_TYPE_BITS),

	/* MEM is read-only. When applied on bpf_arg, it indicates the arg is
	 * compatible with both mutable and immutable memory.
	 */
	MEM_RDONLY		= BIT(1 + BPF_BASE_TYPE_BITS),

	/* MEM points to BPF ring buffer reservation. */
	MEM_RINGBUF		= BIT(2 + BPF_BASE_TYPE_BITS),

	/* MEM is in user address space. */
	MEM_USER		= BIT(3 + BPF_BASE_TYPE_BITS),

	/* MEM is a percpu memory. MEM_PERCPU tags PTR_TO_BTF_ID. When tagged
	 * with MEM_PERCPU, PTR_TO_BTF_ID _cannot_ be directly accessed. In
	 * order to drop this tag, it must be passed into bpf_per_cpu_ptr()
	 * or bpf_this_cpu_ptr(), which will return the pointer corresponding
	 * to the specified cpu.
	 */
	MEM_PERCPU		= BIT(4 + BPF_BASE_TYPE_BITS),

	/* Indicates that the argument will be released. */
	OBJ_RELEASE		= BIT(5 + BPF_BASE_TYPE_BITS),

	/* PTR is not trusted. This is only used with PTR_TO_BTF_ID, to mark
	 * unreferenced and referenced kptr loaded from map value using a load
	 * instruction, so that they can only be dereferenced but not escape the
	 * BPF program into the kernel (i.e. cannot be passed as arguments to
	 * kfunc or bpf helpers).
	 */
	PTR_UNTRUSTED		= BIT(6 + BPF_BASE_TYPE_BITS),

	/* MEM can be uninitialized. */
	MEM_UNINIT		= BIT(7 + BPF_BASE_TYPE_BITS),

	/* DYNPTR points to memory local to the bpf program. */
	DYNPTR_TYPE_LOCAL	= BIT(8 + BPF_BASE_TYPE_BITS),

	/* DYNPTR points to a kernel-produced ringbuf record. */
	DYNPTR_TYPE_RINGBUF	= BIT(9 + BPF_BASE_TYPE_BITS),

	/* Size is known at compile time. */
	MEM_FIXED_SIZE		= BIT(10 + BPF_BASE_TYPE_BITS),

	/* MEM is of an allocated object of type in program BTF. This is used to
	 * tag PTR_TO_BTF_ID allocated using bpf_obj_new.
	 */
	MEM_ALLOC		= BIT(11 + BPF_BASE_TYPE_BITS),

	/* PTR was passed from the kernel in a trusted context, and may be
	 * passed to kfuncs or BPF helper functions.
	 * Confusingly, this is _not_ the opposite of PTR_UNTRUSTED above.
	 * PTR_UNTRUSTED refers to a kptr that was read directly from a map
	 * without invoking bpf_kptr_xchg(). What we really need to know is
	 * whether a pointer is safe to pass to a kfunc or BPF helper function.
	 * While PTR_UNTRUSTED pointers are unsafe to pass to kfuncs and BPF
	 * helpers, they do not cover all possible instances of unsafe
	 * pointers. For example, a pointer that was obtained from walking a
	 * struct will _not_ get the PTR_UNTRUSTED type modifier, despite the
	 * fact that it may be NULL, invalid, etc. This is due to backwards
	 * compatibility requirements, as this was the behavior that was first
	 * introduced when kptrs were added. The behavior is now considered
	 * deprecated, and PTR_UNTRUSTED will eventually be removed.
	 *
	 * PTR_TRUSTED, on the other hand, is a pointer that the kernel
	 * guarantees to be valid and safe to pass to kfuncs and BPF helpers.
	 * For example, pointers passed to tracepoint arguments are considered
	 * PTR_TRUSTED, as are pointers that are passed to struct_ops
	 * callbacks. As alluded to above, pointers that are obtained from
	 * walking PTR_TRUSTED pointers are _not_ trusted. For example, if a
	 * struct task_struct *task is PTR_TRUSTED, then accessing
	 * task->last_wakee will lose the PTR_TRUSTED modifier when it's stored
	 * in a BPF register. Similarly, pointers passed to certain programs
	 * types such as kretprobes are not guaranteed to be valid, as they may
	 * for example contain an object that was recently freed.
	 */
	PTR_TRUSTED		= BIT(12 + BPF_BASE_TYPE_BITS),

	/* MEM is tagged with rcu and memory access needs rcu_read_lock protection. */
	MEM_RCU			= BIT(13 + BPF_BASE_TYPE_BITS),

	/* Used to tag PTR_TO_BTF_ID | MEM_ALLOC references which are non-owning.
	 * Currently only valid for linked-list and rbtree nodes. If the nodes
	 * have a bpf_refcount_field, they must be tagged MEM_RCU as well.
	 */
	NON_OWN_REF		= BIT(14 + BPF_BASE_TYPE_BITS),

	/* DYNPTR points to sk_buff */
	DYNPTR_TYPE_SKB		= BIT(15 + BPF_BASE_TYPE_BITS),

	/* DYNPTR points to xdp_buff */
	DYNPTR_TYPE_XDP		= BIT(16 + BPF_BASE_TYPE_BITS),

	/* Memory must be aligned on some architectures, used in combination with
	 * MEM_FIXED_SIZE.
	 */
	MEM_ALIGNED		= BIT(17 + BPF_BASE_TYPE_BITS),

	/* MEM is being written to, often combined with MEM_UNINIT. Non-presence
	 * of MEM_WRITE means that MEM is only being read. MEM_WRITE without the
	 * MEM_UNINIT means that memory needs to be initialized since it is also
	 * read.
	 */
	MEM_WRITE		= BIT(18 + BPF_BASE_TYPE_BITS),

	/* DYNPTR points to skb_metadata_end()-skb_metadata_len() */
	DYNPTR_TYPE_SKB_META	= BIT(19 + BPF_BASE_TYPE_BITS),

	/* DYNPTR points to file */
	DYNPTR_TYPE_FILE	= BIT(20 + BPF_BASE_TYPE_BITS),

	__BPF_TYPE_FLAG_MAX,
	__BPF_TYPE_LAST_FLAG	= __BPF_TYPE_FLAG_MAX - 1,
};

#define DYNPTR_TYPE_FLAG_MASK	(DYNPTR_TYPE_LOCAL | DYNPTR_TYPE_RINGBUF | DYNPTR_TYPE_SKB \
				 | DYNPTR_TYPE_XDP | DYNPTR_TYPE_SKB_META | DYNPTR_TYPE_FILE)

/* Max number of base types. */
#define BPF_BASE_TYPE_LIMIT	(1UL << BPF_BASE_TYPE_BITS)

/* Max number of all types. */
#define BPF_TYPE_LIMIT		(__BPF_TYPE_LAST_FLAG | (__BPF_TYPE_LAST_FLAG - 1))

/* function argument constraints */
enum bpf_arg_type {
	ARG_DONTCARE = 0,	/* unused argument in helper function */

	/* the following constraints used to prototype
	 * bpf_map_lookup/update/delete_elem() functions
	 */
	ARG_CONST_MAP_PTR,	/* const argument used as pointer to bpf_map */
	ARG_PTR_TO_MAP_KEY,	/* pointer to stack used as map key */
	ARG_PTR_TO_MAP_VALUE,	/* pointer to stack used as map value */

	/* Used to prototype bpf_memcmp() and other functions that access data
	 * on eBPF program stack
	 */
	ARG_PTR_TO_MEM,		/* pointer to valid memory (stack, packet, map value) */
	ARG_PTR_TO_ARENA,

	ARG_CONST_SIZE,		/* number of bytes accessed from memory */
	ARG_CONST_SIZE_OR_ZERO,	/* number of bytes accessed from memory or 0 */

	ARG_PTR_TO_CTX,		/* pointer to context */
	ARG_ANYTHING,		/* any (initialized) argument is ok */
	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock (fullsock) */
	ARG_PTR_TO_BTF_ID,	/* pointer to in-kernel struct */
	ARG_PTR_TO_RINGBUF_MEM,	/* pointer to dynamically reserved ringbuf memory */
	ARG_CONST_ALLOC_SIZE_OR_ZERO,	/* number of allocated bytes requested */
	ARG_PTR_TO_BTF_ID_SOCK_COMMON,	/* pointer to in-kernel sock_common or bpf-mirrored bpf_sock */
	ARG_PTR_TO_PERCPU_BTF_ID,	/* pointer to in-kernel percpu type */
	ARG_PTR_TO_FUNC,	/* pointer to a bpf program function */
	ARG_PTR_TO_STACK,	/* pointer to stack */
	ARG_PTR_TO_CONST_STR,	/* pointer to a null terminated read-only string */
	ARG_PTR_TO_TIMER,	/* pointer to bpf_timer */
	ARG_KPTR_XCHG_DEST,	/* pointer to destination that kptrs are bpf_kptr_xchg'd into */
	ARG_PTR_TO_DYNPTR,      /* pointer to bpf_dynptr. See bpf_type_flag for dynptr type */
	__BPF_ARG_TYPE_MAX,

	/* Extended arg_types. */
	ARG_PTR_TO_MAP_VALUE_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_MAP_VALUE,
	ARG_PTR_TO_MEM_OR_NULL		= PTR_MAYBE_NULL | ARG_PTR_TO_MEM,
	ARG_PTR_TO_CTX_OR_NULL		= PTR_MAYBE_NULL | ARG_PTR_TO_CTX,
	ARG_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_SOCKET,
	ARG_PTR_TO_STACK_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_STACK,
	ARG_PTR_TO_BTF_ID_OR_NULL	= PTR_MAYBE_NULL | ARG_PTR_TO_BTF_ID,
	/* Pointer to memory does not need to be initialized, since helper function
	 * fills all bytes or clears them in error case.
	 */
	ARG_PTR_TO_UNINIT_MEM		= MEM_UNINIT | MEM_WRITE | ARG_PTR_TO_MEM,
	/* Pointer to valid memory of size known at compile time. */
	ARG_PTR_TO_FIXED_SIZE_MEM	= MEM_FIXED_SIZE | ARG_PTR_TO_MEM,

	/* This must be the last entry. Its purpose is to ensure the enum is
	 * wide enough to hold the higher bits reserved for bpf_type_flag.
	 */
	__BPF_ARG_TYPE_LIMIT	= BPF_TYPE_LIMIT,
};
static_assert(__BPF_ARG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT);

/* type of values returned from helper functions */
enum bpf_return_type {
	RET_INTEGER,			/* function returns integer */
	RET_VOID,			/* function doesn't return anything */
	RET_PTR_TO_MAP_VALUE,		/* returns a pointer to map elem value */
	RET_PTR_TO_SOCKET,		/* returns a pointer to a socket */
	RET_PTR_TO_TCP_SOCK,		/* returns a pointer to a tcp_sock */
	RET_PTR_TO_SOCK_COMMON,		/* returns a pointer to a sock_common */
	RET_PTR_TO_MEM,			/* returns a pointer to memory */
	RET_PTR_TO_MEM_OR_BTF_ID,	/* returns a pointer to a valid memory or a btf_id */
	RET_PTR_TO_BTF_ID,		/* returns a pointer to a btf_id */
	__BPF_RET_TYPE_MAX,

	/* Extended ret_types. */
	RET_PTR_TO_MAP_VALUE_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_MAP_VALUE,
	RET_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_SOCKET,
	RET_PTR_TO_TCP_SOCK_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_TCP_SOCK,
	RET_PTR_TO_SOCK_COMMON_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_SOCK_COMMON,
	RET_PTR_TO_RINGBUF_MEM_OR_NULL	= PTR_MAYBE_NULL | MEM_RINGBUF | RET_PTR_TO_MEM,
	RET_PTR_TO_DYNPTR_MEM_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_MEM,
	RET_PTR_TO_BTF_ID_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_BTF_ID,
	RET_PTR_TO_BTF_ID_TRUSTED	= PTR_TRUSTED	 | RET_PTR_TO_BTF_ID,

	/* This must be the last entry. Its purpose is to ensure the enum is
	 * wide enough to hold the higher bits reserved for bpf_type_flag.
	 */
	__BPF_RET_TYPE_LIMIT	= BPF_TYPE_LIMIT,
};
static_assert(__BPF_RET_TYPE_MAX <= BPF_BASE_TYPE_LIMIT);

/* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs
 * to in-kernel helper functions and for adjusting imm32 field in BPF_CALL
 * instructions after verifying
 */
struct bpf_func_proto {
	u64 (*func)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
	bool gpl_only;
	bool pkt_access;
	bool might_sleep;
	/* set to true if helper follows contract for llvm
	 * attribute bpf_fastcall:
	 * - void functions do not scratch r0
	 * - functions taking N arguments scratch only registers r1-rN
	 */
	bool allow_fastcall;
	enum bpf_return_type ret_type;
	union {
		struct {
			enum bpf_arg_type arg1_type;
			enum bpf_arg_type arg2_type;
			enum bpf_arg_type arg3_type;
			enum bpf_arg_type arg4_type;
			enum bpf_arg_type arg5_type;
		};
		enum bpf_arg_type arg_type[5];
	};
	union {
		struct {
			u32 *arg1_btf_id;
			u32 *arg2_btf_id;
			u32 *arg3_btf_id;
			u32 *arg4_btf_id;
			u32 *arg5_btf_id;
		};
		u32 *arg_btf_id[5];
		struct {
			size_t arg1_size;
			size_t arg2_size;
			size_t arg3_size;
			size_t arg4_size;
			size_t arg5_size;
		};
		size_t arg_size[5];
	};
	int *ret_btf_id; /* return value btf_id */
	bool (*allowed)(const struct bpf_prog *prog);
};

/* bpf_context is intentionally undefined structure. Pointer to bpf_context is
 * the first argument to eBPF programs.
 * For socket filters: 'struct bpf_context *' == 'struct sk_buff *'
 */
struct bpf_context;

enum bpf_access_type {
	BPF_READ = 1,
	BPF_WRITE = 2
};

/* types of values stored in eBPF registers */
/* Pointer types represent:
 * pointer
 * pointer + imm
 * pointer + (u16) var
 * pointer + (u16) var + imm
 * if (range > 0) then [ptr, ptr + range - off) is safe to access
 * if (id > 0) means that some 'var' was added
 * if (off > 0) means that 'imm' was added
 */
enum bpf_reg_type {
	NOT_INIT = 0,		 /* nothing was written into register */
	SCALAR_VALUE,		 /* reg doesn't contain a valid pointer */
	PTR_TO_CTX,		 /* reg points to bpf_context */
	CONST_PTR_TO_MAP,	 /* reg points to struct bpf_map */
	PTR_TO_MAP_VALUE,	 /* reg points to map element value */
	PTR_TO_MAP_KEY,		 /* reg points to a map element key */
	PTR_TO_STACK,		 /* reg == frame_pointer + offset */
	PTR_TO_PACKET_META,	 /* skb->data - meta_len */
	PTR_TO_PACKET,		 /* reg points to skb->data */
	PTR_TO_PACKET_END,	 /* skb->data + headlen */
	PTR_TO_FLOW_KEYS,	 /* reg points to bpf_flow_keys */
	PTR_TO_SOCKET,		 /* reg points to struct bpf_sock */
	PTR_TO_SOCK_COMMON,	 /* reg points to sock_common */
	PTR_TO_TCP_SOCK,	 /* reg points to struct tcp_sock */
	PTR_TO_TP_BUFFER,	 /* reg points to a writable raw tp's buffer */
	PTR_TO_XDP_SOCK,	 /* reg points to struct xdp_sock */
	/* PTR_TO_BTF_ID points to a kernel struct that does not need
	 * to be null checked by the BPF program. This does not imply the
	 * pointer is _not_ null and in practice this can easily be a null
	 * pointer when reading pointer chains. The assumption is program
	 * context will handle null pointer dereference typically via fault
	 * handling. The verifier must keep this in mind and can make no
	 * assumptions about null or non-null when doing branch analysis.
	 * Further, when passed into helpers the helpers can not, without
	 * additional context, assume the value is non-null.
	 */
	PTR_TO_BTF_ID,
	PTR_TO_MEM,		 /* reg points to valid memory region */
	PTR_TO_ARENA,
	PTR_TO_BUF,		 /* reg points to a read/write buffer */
	PTR_TO_FUNC,		 /* reg points to a bpf program function */
	PTR_TO_INSN,		 /* reg points to a bpf program instruction */
	CONST_PTR_TO_DYNPTR,	 /* reg points to a const struct bpf_dynptr */
	__BPF_REG_TYPE_MAX,

	/* Extended reg_types. */
	PTR_TO_MAP_VALUE_OR_NULL	= PTR_MAYBE_NULL | PTR_TO_MAP_VALUE,
	PTR_TO_SOCKET_OR_NULL		= PTR_MAYBE_NULL | PTR_TO_SOCKET,
	PTR_TO_SOCK_COMMON_OR_NULL	= PTR_MAYBE_NULL | PTR_TO_SOCK_COMMON,
	PTR_TO_TCP_SOCK_OR_NULL		= PTR_MAYBE_NULL | PTR_TO_TCP_SOCK,
	/* PTR_TO_BTF_ID_OR_NULL points to a kernel struct that has not
	 * been checked for null. Used primarily to inform the verifier
	 * an explicit null check is required for this struct.
	 */
	PTR_TO_BTF_ID_OR_NULL		= PTR_MAYBE_NULL | PTR_TO_BTF_ID,

	/* This must be the last entry. Its purpose is to ensure the enum is
	 * wide enough to hold the higher bits reserved for bpf_type_flag.
	 */
	__BPF_REG_TYPE_LIMIT	= BPF_TYPE_LIMIT,
};
static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT);

/* The information passed from prog-specific *_is_valid_access
 * back to the verifier.
 */
struct bpf_insn_access_aux {
	enum bpf_reg_type reg_type;
	bool is_ldsx;
	union {
		int ctx_field_size;
		struct {
			struct btf *btf;
			u32 btf_id;
			u32 ref_obj_id;
		};
	};
	struct bpf_verifier_log *log; /* for verbose logs */
	bool is_retval; /* is accessing function return value ? */
};

static inline void
bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, u32 size)
{
	aux->ctx_field_size = size;
}

static bool bpf_is_ldimm64(const struct bpf_insn *insn)
{
	return insn->code == (BPF_LD | BPF_IMM | BPF_DW);
}

static inline bool bpf_pseudo_func(const struct bpf_insn *insn)
{
	return bpf_is_ldimm64(insn) && insn->src_reg == BPF_PSEUDO_FUNC;
}

/* Given a BPF_ATOMIC instruction @atomic_insn, return true if it is an
 * atomic load or store, and false if it is a read-modify-write instruction.
 */
static inline bool
bpf_atomic_is_load_store(const struct bpf_insn *atomic_insn)
{
	switch (atomic_insn->imm) {
	case BPF_LOAD_ACQ:
	case BPF_STORE_REL:
		return true;
	default:
		return false;
	}
}

struct bpf_prog_ops {
	int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr,
			union bpf_attr __user *uattr);
};

struct bpf_reg_state;
struct bpf_verifier_ops {
	/* return eBPF function prototype for verification */
	const struct bpf_func_proto *
	(*get_func_proto)(enum bpf_func_id func_id,
			  const struct bpf_prog *prog);

	/* return true if 'size' wide access at offset 'off' within bpf_context
	 * with 'type' (read or write) is allowed
	 */
	bool (*is_valid_access)(int off, int size, enum bpf_access_type type,
				const struct bpf_prog *prog,
				struct bpf_insn_access_aux *info);
	int (*gen_prologue)(struct bpf_insn *insn, bool direct_write,
			    const struct bpf_prog *prog);
	int (*gen_epilogue)(struct bpf_insn *insn, const struct bpf_prog *prog,
			    s16 ctx_stack_off);
	int (*gen_ld_abs)(const struct bpf_insn *orig,
			  struct bpf_insn *insn_buf);
	u32 (*convert_ctx_access)(enum bpf_access_type type,
				  const struct bpf_insn *src,
				  struct bpf_insn *dst,
				  struct bpf_prog *prog, u32 *target_size);
	int (*btf_struct_access)(struct bpf_verifier_log *log,
				 const struct bpf_reg_state *reg,
				 int off, int size);
};

struct bpf_prog_offload_ops {
	/* verifier basic callbacks */
	int (*insn_hook)(struct bpf_verifier_env *env,
			 int insn_idx, int prev_insn_idx);
	int (*finalize)(struct bpf_verifier_env *env);
	/* verifier optimization callbacks (called after .finalize) */
	int (*replace_insn)(struct bpf_verifier_env *env, u32 off,
			    struct bpf_insn *insn);
	int (*remove_insns)(struct bpf_verifier_env *env, u32 off, u32 cnt);
	/* program management callbacks */
	int (*prepare)(struct bpf_prog *prog);
	int (*translate)(struct bpf_prog *prog);
	void (*destroy)(struct bpf_prog *prog);
};

struct bpf_prog_offload {
	struct bpf_prog		*prog;
	struct net_device	*netdev;
	struct bpf_offload_dev	*offdev;
	void			*dev_priv;
	struct list_head	offloads;
	bool			dev_state;
	bool			opt_failed;
	void			*jited_image;
	u32			jited_len;
};

/* The longest tracepoint has 12 args.
 * See include/trace/bpf_probe.h
 */
#define MAX_BPF_FUNC_ARGS 12

/* The maximum number of arguments passed through registers
 * a single function may have.
 */
#define MAX_BPF_FUNC_REG_ARGS 5

/* The argument is a structure or a union. */
#define BTF_FMODEL_STRUCT_ARG		BIT(0)

/* The argument is signed. */
#define BTF_FMODEL_SIGNED_ARG		BIT(1)

struct btf_func_model {
	u8 ret_size;
	u8 ret_flags;
	u8 nr_args;
	u8 arg_size[MAX_BPF_FUNC_ARGS];
	u8 arg_flags[MAX_BPF_FUNC_ARGS];
};

/* Restore arguments before returning from trampoline to let original function
 * continue executing. This flag is used for fentry progs when there are no
 * fexit progs.
 */
#define BPF_TRAMP_F_RESTORE_REGS	BIT(0)
/* Call original function after fentry progs, but before fexit progs.
 * Makes sense for fentry/fexit, normal calls and indirect calls.
 */
#define BPF_TRAMP_F_CALL_ORIG		BIT(1)
/* Skip current frame and return to parent.  Makes sense for fentry/fexit
 * programs only. Should not be used with normal calls and indirect calls.
 */
#define BPF_TRAMP_F_SKIP_FRAME		BIT(2)
/* Store IP address of the caller on the trampoline stack,
 * so it's available for trampoline's programs.
 */
#define BPF_TRAMP_F_IP_ARG		BIT(3)
/* Return the return value of fentry prog. Only used by bpf_struct_ops. */
#define BPF_TRAMP_F_RET_FENTRY_RET	BIT(4)

/* Get original function from stack instead of from provided direct address.
 * Makes sense for trampolines with fexit or fmod_ret programs.
 */
#define BPF_TRAMP_F_ORIG_STACK		BIT(5)

/* This trampoline is on a function with another ftrace_ops with IPMODIFY,
 * e.g., a live patch. This flag is set and cleared by ftrace call backs,
 */
#define BPF_TRAMP_F_SHARE_IPMODIFY	BIT(6)

/* Indicate that current trampoline is in a tail call context. Then, it has to
 * cache and restore tail_call_cnt to avoid infinite tail call loop.
 */
#define BPF_TRAMP_F_TAIL_CALL_CTX	BIT(7)

/*
 * Indicate the trampoline should be suitable to receive indirect calls;
 * without this indirectly calling the generated code can result in #UD/#CP,
 * depending on the CFI options.
 *
 * Used by bpf_struct_ops.
 *
 * Incompatible with FENTRY usage, overloads @func_addr argument.
 */
#define BPF_TRAMP_F_INDIRECT		BIT(8)

/* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50
 * bytes on x86.
 */
enum {
#if defined(__s390x__)
	BPF_MAX_TRAMP_LINKS = 27,
#else
	BPF_MAX_TRAMP_LINKS = 38,
#endif
};

#define BPF_TRAMP_COOKIE_INDEX_SHIFT	8
#define BPF_TRAMP_IS_RETURN_SHIFT	63

struct bpf_tramp_links {
	struct bpf_tramp_link *links[BPF_MAX_TRAMP_LINKS];
	int nr_links;
};

struct bpf_tramp_run_ctx;

/* Different use cases for BPF trampoline:
 * 1. replace nop at the function entry (kprobe equivalent)
 *    flags = BPF_TRAMP_F_RESTORE_REGS
 *    fentry = a set of programs to run before returning from trampoline
 *
 * 2. replace nop at the function entry (kprobe + kretprobe equivalent)
 *    flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME
 *    orig_call = fentry_ip + MCOUNT_INSN_SIZE
 *    fentry = a set of program to run before calling original function
 *    fexit = a set of program to run after original function
 *
 * 3. replace direct call instruction anywhere in the function body
 *    or assign a function pointer for indirect call (like tcp_congestion_ops->cong_avoid)
 *    With flags = 0
 *      fentry = a set of programs to run before returning from trampoline
 *    With flags = BPF_TRAMP_F_CALL_ORIG
 *      orig_call = original callback addr or direct function addr
 *      fentry = a set of program to run before calling original function
 *      fexit = a set of program to run after original function
 */
struct bpf_tramp_image;
int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *image_end,
				const struct btf_func_model *m, u32 flags,
				struct bpf_tramp_links *tlinks,
				void *func_addr);
void *arch_alloc_bpf_trampoline(unsigned int size);
void arch_free_bpf_trampoline(void *image, unsigned int size);
int __must_check arch_protect_bpf_trampoline(void *image, unsigned int size);
int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,
			     struct bpf_tramp_links *tlinks, void *func_addr);

u64 notrace __bpf_prog_enter_sleepable_recur(struct bpf_prog *prog,
					     struct bpf_tramp_run_ctx *run_ctx);
void notrace __bpf_prog_exit_sleepable_recur(struct bpf_prog *prog, u64 start,
					     struct bpf_tramp_run_ctx *run_ctx);
void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr);
void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr);
typedef u64 (*bpf_trampoline_enter_t)(struct bpf_prog *prog,
				      struct bpf_tramp_run_ctx *run_ctx);
typedef void (*bpf_trampoline_exit_t)(struct bpf_prog *prog, u64 start,
				      struct bpf_tramp_run_ctx *run_ctx);
bpf_trampoline_enter_t bpf_trampoline_enter(const struct bpf_prog *prog);
bpf_trampoline_exit_t bpf_trampoline_exit(const struct bpf_prog *prog);

#ifdef CONFIG_DYNAMIC_FTRACE_WITH_JMP
static inline bool bpf_trampoline_use_jmp(u64 flags)
{
	return flags & BPF_TRAMP_F_CALL_ORIG && !(flags & BPF_TRAMP_F_SKIP_FRAME);
}
#else
static inline bool bpf_trampoline_use_jmp(u64 flags)
{
	return false;
}
#endif

struct bpf_ksym {
	unsigned long		 start;
	unsigned long		 end;
	char			 name[KSYM_NAME_LEN];
	struct list_head	 lnode;
	struct latch_tree_node	 tnode;
	bool			 prog;
	u32			 fp_start;
	u32			 fp_end;
};

enum bpf_tramp_prog_type {
	BPF_TRAMP_FENTRY,
	BPF_TRAMP_FEXIT,
	BPF_TRAMP_MODIFY_RETURN,
	BPF_TRAMP_MAX,
	BPF_TRAMP_REPLACE, /* more than MAX */
	BPF_TRAMP_FSESSION,
};

struct bpf_tramp_image {
	void *image;
	int size;
	struct bpf_ksym ksym;
	struct percpu_ref pcref;
	void *ip_after_call;
	void *ip_epilogue;
	union {
		struct rcu_head rcu;
		struct work_struct work;
	};
};

struct bpf_trampoline {
	/* hlist for trampoline_key_table */
	struct hlist_node hlist_key;
	/* hlist for trampoline_ip_table */
	struct hlist_node hlist_ip;
	struct ftrace_ops *fops;
	/* serializes access to fields of this trampoline */
	struct mutex mutex;
	refcount_t refcnt;
	u32 flags;
	u64 key;
	unsigned long ip;
	struct {
		struct btf_func_model model;
		void *addr;
		bool ftrace_managed;
	} func;
	/* if !NULL this is BPF_PROG_TYPE_EXT program that extends another BPF
	 * program by replacing one of its functions. func.addr is the address
	 * of the function it replaced.
	 */
	struct bpf_prog *extension_prog;
	/* list of BPF programs using this trampoline */
	struct hlist_head progs_hlist[BPF_TRAMP_MAX];
	/* Number of attached programs. A counter per kind. */
	int progs_cnt[BPF_TRAMP_MAX];
	/* Executable image of trampoline */
	struct bpf_tramp_image *cur_image;
};

struct bpf_attach_target_info {
	struct btf_func_model fmodel;
	long tgt_addr;
	struct module *tgt_mod;
	const char *tgt_name;
	const struct btf_type *tgt_type;
};

#define BPF_DISPATCHER_MAX 48 /* Fits in 2048B */

struct bpf_dispatcher_prog {
	struct bpf_prog *prog;
	refcount_t users;
};

struct bpf_dispatcher {
	/* dispatcher mutex */
	struct mutex mutex;
	void *func;
	struct bpf_dispatcher_prog progs[BPF_DISPATCHER_MAX];
	int num_progs;
	void *image;
	void *rw_image;
	u32 image_off;
	struct bpf_ksym ksym;
#ifdef CONFIG_HAVE_STATIC_CALL
	struct static_call_key *sc_key;
	void *sc_tramp;
#endif
};

#ifndef __bpfcall
#define __bpfcall __nocfi
#endif

static __always_inline __bpfcall unsigned int bpf_dispatcher_nop_func(
	const void *ctx,
	const struct bpf_insn *insnsi,
	bpf_func_t bpf_func)
{
	return bpf_func(ctx, insnsi);
}

/* the implementation of the opaque uapi struct bpf_dynptr */
struct bpf_dynptr_kern {
	void *data;
	/* Size represents the number of usable bytes of dynptr data.
	 * If for example the offset is at 4 for a local dynptr whose data is
	 * of type u64, the number of usable bytes is 4.
	 *
	 * The upper 8 bits are reserved. It is as follows:
	 * Bits 0 - 23 = size
	 * Bits 24 - 30 = dynptr type
	 * Bit 31 = whether dynptr is read-only
	 */
	u32 size;
	u32 offset;
} __aligned(8);

enum bpf_dynptr_type {
	BPF_DYNPTR_TYPE_INVALID,
	/* Points to memory that is local to the bpf program */
	BPF_DYNPTR_TYPE_LOCAL,
	/* Underlying data is a ringbuf record */
	BPF_DYNPTR_TYPE_RINGBUF,
	/* Underlying data is a sk_buff */
	BPF_DYNPTR_TYPE_SKB,
	/* Underlying data is a xdp_buff */
	BPF_DYNPTR_TYPE_XDP,
	/* Points to skb_metadata_end()-skb_metadata_len() */
	BPF_DYNPTR_TYPE_SKB_META,
	/* Underlying data is a file */
	BPF_DYNPTR_TYPE_FILE,
};

int bpf_dynptr_check_size(u64 size);
u64 __bpf_dynptr_size(const struct bpf_dynptr_kern *ptr);
const void *__bpf_dynptr_data(const struct bpf_dynptr_kern *ptr, u64 len);
void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u64 len);
bool __bpf_dynptr_is_rdonly(const struct bpf_dynptr_kern *ptr);
int __bpf_dynptr_write(const struct bpf_dynptr_kern *dst, u64 offset,
		       void *src, u64 len, u64 flags);
void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *p, u64 offset,
			    void *buffer__nullable, u64 buffer__szk);

static inline int bpf_dynptr_check_off_len(const struct bpf_dynptr_kern *ptr, u64 offset, u64 len)
{
	u64 size = __bpf_dynptr_size(ptr);

	if (len > size || offset > size - len)
		return -E2BIG;

	return 0;
}

#ifdef CONFIG_BPF_JIT
int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
			     struct bpf_trampoline *tr,
			     struct bpf_prog *tgt_prog);
int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
			       struct bpf_trampoline *tr,
			       struct bpf_prog *tgt_prog);
struct bpf_trampoline *bpf_trampoline_get(u64 key,
					  struct bpf_attach_target_info *tgt_info);
void bpf_trampoline_put(struct bpf_trampoline *tr);
int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs);

/*
 * When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn
 * indirection with a direct call to the bpf program. If the architecture does
 * not have STATIC_CALL, avoid a double-indirection.
 */
#ifdef CONFIG_HAVE_STATIC_CALL

#define __BPF_DISPATCHER_SC_INIT(_name)				\
	.sc_key = &STATIC_CALL_KEY(_name),			\
	.sc_tramp = STATIC_CALL_TRAMP_ADDR(_name),

#define __BPF_DISPATCHER_SC(name)				\
	DEFINE_STATIC_CALL(bpf_dispatcher_##name##_call, bpf_dispatcher_nop_func)

#define __BPF_DISPATCHER_CALL(name)				\
	static_call(bpf_dispatcher_##name##_call)(ctx, insnsi, bpf_func)

#define __BPF_DISPATCHER_UPDATE(_d, _new)			\
	__static_call_update((_d)->sc_key, (_d)->sc_tramp, (_new))

#else
#define __BPF_DISPATCHER_SC_INIT(name)
#define __BPF_DISPATCHER_SC(name)
#define __BPF_DISPATCHER_CALL(name)		bpf_func(ctx, insnsi)
#define __BPF_DISPATCHER_UPDATE(_d, _new)
#endif

#define BPF_DISPATCHER_INIT(_name) {				\
	.mutex = __MUTEX_INITIALIZER(_name.mutex),		\
	.func = &_name##_func,					\
	.progs = {},						\
	.num_progs = 0,						\
	.image = NULL,						\
	.image_off = 0,						\
	.ksym = {						\
		.name  = #_name,				\
		.lnode = LIST_HEAD_INIT(_name.ksym.lnode),	\
	},							\
	__BPF_DISPATCHER_SC_INIT(_name##_call)			\
}

#define DEFINE_BPF_DISPATCHER(name)					\
	__BPF_DISPATCHER_SC(name);					\
	noinline __bpfcall unsigned int bpf_dispatcher_##name##_func(	\
		const void *ctx,					\
		const struct bpf_insn *insnsi,				\
		bpf_func_t bpf_func)					\
	{								\
		return __BPF_DISPATCHER_CALL(name);			\
	}								\
	EXPORT_SYMBOL(bpf_dispatcher_##name##_func);			\
	struct bpf_dispatcher bpf_dispatcher_##name =			\
		BPF_DISPATCHER_INIT(bpf_dispatcher_##name);

#define DECLARE_BPF_DISPATCHER(name)					\
	unsigned int bpf_dispatcher_##name##_func(			\
		const void *ctx,					\
		const struct bpf_insn *insnsi,				\
		bpf_func_t bpf_func);					\
	extern struct bpf_dispatcher bpf_dispatcher_##name;

#define BPF_DISPATCHER_FUNC(name) bpf_dispatcher_##name##_func
#define BPF_DISPATCHER_PTR(name) (&bpf_dispatcher_##name)
void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,
				struct bpf_prog *to);
/* Called only from JIT-enabled code, so there's no need for stubs. */
void bpf_image_ksym_init(void *data, unsigned int size, struct bpf_ksym *ksym);
void bpf_image_ksym_add(struct bpf_ksym *ksym);
void bpf_image_ksym_del(struct bpf_ksym *ksym);
void bpf_ksym_add(struct bpf_ksym *ksym);
void bpf_ksym_del(struct bpf_ksym *ksym);
bool bpf_has_frame_pointer(unsigned long ip);
int bpf_jit_charge_modmem(u32 size);
void bpf_jit_uncharge_modmem(u32 size);
bool bpf_prog_has_trampoline(const struct bpf_prog *prog);
bool bpf_insn_is_indirect_target(const struct bpf_verifier_env *env, const struct bpf_prog *prog,
				 int insn_idx);
#else
static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
					   struct bpf_trampoline *tr,
					   struct bpf_prog *tgt_prog)
{
	return -ENOTSUPP;
}
static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
					     struct bpf_trampoline *tr,
					     struct bpf_prog *tgt_prog)
{
	return -ENOTSUPP;
}
static inline struct bpf_trampoline *bpf_trampoline_get(u64 key,
							struct bpf_attach_target_info *tgt_info)
{
	return NULL;
}
static inline void bpf_trampoline_put(struct bpf_trampoline *tr) {}
#define DEFINE_BPF_DISPATCHER(name)
#define DECLARE_BPF_DISPATCHER(name)
#define BPF_DISPATCHER_FUNC(name) bpf_dispatcher_nop_func
#define BPF_DISPATCHER_PTR(name) NULL
static inline void bpf_dispatcher_change_prog(struct bpf_dispatcher *d,
					      struct bpf_prog *from,
					      struct bpf_prog *to) {}
static inline bool is_bpf_image_address(unsigned long address)
{
	return false;
}
static inline bool bpf_prog_has_trampoline(const struct bpf_prog *prog)
{
	return false;
}
#endif

struct bpf_func_info_aux {
	u16 linkage;
	bool unreliable;
	bool called : 1;
	bool verified : 1;
};

enum bpf_jit_poke_reason {
	BPF_POKE_REASON_TAIL_CALL,
};

/* Descriptor of pokes pointing /into/ the JITed image. */
struct bpf_jit_poke_descriptor {
	void *tailcall_target;
	void *tailcall_bypass;
	void *bypass_addr;
	void *aux;
	union {
		struct {
			struct bpf_map *map;
			u32 key;
		} tail_call;
	};
	bool tailcall_target_stable;
	u8 adj_off;
	u16 reason;
	u32 insn_idx;
};

/* reg_type info for ctx arguments */
struct bpf_ctx_arg_aux {
	u32 offset;
	enum bpf_reg_type reg_type;
	struct btf *btf;
	u32 btf_id;
	u32 ref_obj_id;
	bool refcounted;
};

struct btf_mod_pair {
	struct btf *btf;
	struct module *module;
};

struct bpf_kfunc_desc_tab;

enum bpf_stream_id {
	BPF_STDOUT = 1,
	BPF_STDERR = 2,
};

struct bpf_stream_elem {
	struct llist_node node;
	int total_len;
	int consumed_len;
	char str[];
};

enum {
	/* 100k bytes */
	BPF_STREAM_MAX_CAPACITY = 100000ULL,
};

struct bpf_stream {
	atomic_t capacity;
	struct llist_head log;	/* list of in-flight stream elements in LIFO order */

	struct mutex lock;  /* lock protecting backlog_{head,tail} */
	struct llist_node *backlog_head; /* list of in-flight stream elements in FIFO order */
	struct llist_node *backlog_tail; /* tail of the list above */
};

struct bpf_stream_stage {
	struct llist_head log;
	int len;
};

struct bpf_prog_aux {
	atomic64_t refcnt;
	u32 used_map_cnt;
	u32 used_btf_cnt;
	u32 max_ctx_offset;
	u32 max_pkt_offset;
	u32 max_tp_access;
	u32 stack_depth;
	u32 id;
	u32 func_cnt; /* used by non-func prog as the number of func progs */
	u32 real_func_cnt; /* includes hidden progs, only used for JIT and freeing progs */
	u32 func_idx; /* 0 for non-func prog, the index in func array for func prog */
	u32 attach_btf_id; /* in-kernel BTF type id to attach to */
	u32 attach_st_ops_member_off;
	u32 ctx_arg_info_size;
	u32 max_rdonly_access;
	u32 max_rdwr_access;
	u32 subprog_start;
	struct btf *attach_btf;
	struct bpf_ctx_arg_aux *ctx_arg_info;
	void __percpu *priv_stack_ptr;
	struct mutex dst_mutex; /* protects dst_* pointers below, *after* prog becomes visible */
	struct bpf_prog *dst_prog;
	struct bpf_trampoline *dst_trampoline;
	enum bpf_prog_type saved_dst_prog_type;
	enum bpf_attach_type saved_dst_attach_type;
	bool verifier_zext; /* Zero extensions has been inserted by verifier. */
	bool dev_bound; /* Program is bound to the netdev. */
	bool offload_requested; /* Program is bound and offloaded to the netdev. */
	bool attach_btf_trace; /* true if attaching to BTF-enabled raw tp */
	bool attach_tracing_prog; /* true if tracing another tracing program */
	bool func_proto_unreliable;
	bool tail_call_reachable;
	bool xdp_has_frags;
	bool exception_cb;
	bool exception_boundary;
	bool is_extended; /* true if extended by freplace program */
	bool jits_use_priv_stack;
	bool priv_stack_requested;
	bool changes_pkt_data;
	bool might_sleep;
	bool kprobe_write_ctx;
	u64 prog_array_member_cnt; /* counts how many times as member of prog_array */
	struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */
	struct bpf_arena *arena;
	void (*recursion_detected)(struct bpf_prog *prog); /* callback if recursion is detected */
	/* BTF_KIND_FUNC_PROTO for valid attach_btf_id */
	const struct btf_type *attach_func_proto;
	/* function name for valid attach_btf_id */
	const char *attach_func_name;
	struct bpf_prog **func;
	struct bpf_prog_aux *main_prog_aux;
	void *jit_data; /* JIT specific data. arch dependent */
	struct bpf_jit_poke_descriptor *poke_tab;
	struct bpf_kfunc_desc_tab *kfunc_tab;
	struct bpf_kfunc_btf_tab *kfunc_btf_tab;
	u32 size_poke_tab;
#ifdef CONFIG_FINEIBT
	struct bpf_ksym ksym_prefix;
#endif
	struct bpf_ksym ksym;
	const struct bpf_prog_ops *ops;
	const struct bpf_struct_ops *st_ops;
	struct bpf_map **used_maps;
	struct mutex used_maps_mutex; /* mutex for used_maps and used_map_cnt */
	struct btf_mod_pair *used_btfs;
	struct bpf_prog *prog;
	struct user_struct *user;
	u64 load_time; /* ns since boottime */
	u32 verified_insns;
	int cgroup_atype; /* enum cgroup_bpf_attach_type */
	struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE];
	char name[BPF_OBJ_NAME_LEN];
	u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64);
#ifdef CONFIG_SECURITY
	void *security;
#endif
	struct bpf_token *token;
	struct bpf_prog_offload *offload;
	struct btf *btf;
	struct bpf_func_info *func_info;
	struct bpf_func_info_aux *func_info_aux;
	/* bpf_line_info loaded from userspace.  linfo->insn_off
	 * has the xlated insn offset.
	 * Both the main and sub prog share the same linfo.
	 * The subprog can access its first linfo by
	 * using the linfo_idx.
	 */
	struct bpf_line_info *linfo;
	/* jited_linfo is the jited addr of the linfo.  It has a
	 * one to one mapping to linfo:
	 * jited_linfo[i] is the jited addr for the linfo[i]->insn_off.
	 * Both the main and sub prog share the same jited_linfo.
	 * The subprog can access its first jited_linfo by
	 * using the linfo_idx.
	 */
	void **jited_linfo;
	u32 func_info_cnt;
	u32 nr_linfo;
	/* subprog can use linfo_idx to access its first linfo and
	 * jited_linfo.
	 * main prog always has linfo_idx == 0
	 */
	u32 linfo_idx;
	struct module *mod;
	u32 num_exentries;
	struct exception_table_entry *extable;
	union {
		struct work_struct work;
		struct rcu_head	rcu;
	};
	struct bpf_stream stream[2];
	struct mutex st_ops_assoc_mutex;
	struct bpf_map __rcu *st_ops_assoc;
};

#define BPF_NR_CONTEXTS        4       /* normal, softirq, hardirq, NMI */

struct bpf_prog {
	u16			pages;		/* Number of allocated pages */
	u16			jited:1,	/* Is our filter JIT'ed? */
				jit_requested:1,/* archs need to JIT the prog */
				gpl_compatible:1, /* Is filter GPL compatible? */
				cb_access:1,	/* Is control block accessed? */
				dst_needed:1,	/* Do we need dst entry? */
				blinding_requested:1, /* needs constant blinding */
				blinded:1,	/* Was blinded */
				is_func:1,	/* program is a bpf function */
				kprobe_override:1, /* Do we override a kprobe? */
				has_callchain_buf:1, /* callchain buffer allocated? */
				enforce_expected_attach_type:1, /* Enforce expected_attach_type checking at attach time */
				call_get_stack:1, /* Do we call bpf_get_stack() or bpf_get_stackid() */
				call_get_func_ip:1, /* Do we call get_func_ip() */
				call_session_cookie:1, /* Do we call bpf_session_cookie() */
				tstamp_type_access:1, /* Accessed __sk_buff->tstamp_type */
				sleepable:1;	/* BPF program is sleepable */
	enum bpf_prog_type	type;		/* Type of BPF program */
	enum bpf_attach_type	expected_attach_type; /* For some prog types */
	u32			len;		/* Number of filter blocks */
	u32			jited_len;	/* Size of jited insns in bytes */
	union {
		u8 digest[SHA256_DIGEST_SIZE];
		u8 tag[BPF_TAG_SIZE];
	};
	struct bpf_prog_stats __percpu *stats;
	u8 __percpu		*active;	/* u8[BPF_NR_CONTEXTS] for recursion protection */
	unsigned int		(*bpf_func)(const void *ctx,
					    const struct bpf_insn *insn);
	struct bpf_prog_aux	*aux;		/* Auxiliary fields */
	struct sock_fprog_kern	*orig_prog;	/* Original BPF program */
	/* Instructions for interpreter */
	union {
		DECLARE_FLEX_ARRAY(struct sock_filter, insns);
		DECLARE_FLEX_ARRAY(struct bpf_insn, insnsi);
	};
};

struct bpf_array_aux {
	/* Programs with direct jumps into programs part of this array. */
	struct list_head poke_progs;
	struct bpf_map *map;
	struct mutex poke_mutex;
	struct work_struct work;
};

struct bpf_link {
	atomic64_t refcnt;
	u32 id;
	enum bpf_link_type type;
	const struct bpf_link_ops *ops;
	struct bpf_prog *prog;

	u32 flags;
	enum bpf_attach_type attach_type;

	/* rcu is used before freeing, work can be used to schedule that
	 * RCU-based freeing before that, so they never overlap
	 */
	union {
		struct rcu_head rcu;
		struct work_struct work;
	};
	/* whether BPF link itself has "sleepable" semantics, which can differ
	 * from underlying BPF program having a "sleepable" semantics, as BPF
	 * link's semantics is determined by target attach hook
	 */
	bool sleepable;
};

struct bpf_link_ops {
	void (*release)(struct bpf_link *link);
	/* deallocate link resources callback, called without RCU grace period
	 * waiting
	 */
	void (*dealloc)(struct bpf_link *link);
	/* deallocate link resources callback, called after RCU grace period;
	 * if either the underlying BPF program is sleepable or BPF link's
	 * target hook is sleepable, we'll go through tasks trace RCU GP and
	 * then "classic" RCU GP; this need for chaining tasks trace and
	 * classic RCU GPs is designated by setting bpf_link->sleepable flag
	 *
	 * For non-sleepable tracepoint links we go through SRCU gp instead,
	 * since RCU is not used in that case. Sleepable tracepoints still
	 * follow the scheme above.
	 */
	void (*dealloc_deferred)(struct bpf_link *link);
	int (*detach)(struct bpf_link *link);
	int (*update_prog)(struct bpf_link *link, struct bpf_prog *new_prog,
			   struct bpf_prog *old_prog);
	void (*show_fdinfo)(const struct bpf_link *link, struct seq_file *seq);
	int (*fill_link_info)(const struct bpf_link *link,
			      struct bpf_link_info *info);
	int (*update_map)(struct bpf_link *link, struct bpf_map *new_map,
			  struct bpf_map *old_map);
	__poll_t (*poll)(struct file *file, struct poll_table_struct *pts);
};

struct bpf_tramp_link {
	struct bpf_link link;
	struct hlist_node tramp_hlist;
	u64 cookie;
};

struct bpf_shim_tramp_link {
	struct bpf_tramp_link link;
	struct bpf_trampoline *trampoline;
};

struct bpf_tracing_link {
	struct bpf_tramp_link link;
	struct bpf_trampoline *trampoline;
	struct bpf_prog *tgt_prog;
};

struct bpf_fsession_link {
	struct bpf_tracing_link link;
	struct bpf_tramp_link fexit;
};

struct bpf_raw_tp_link {
	struct bpf_link link;
	struct bpf_raw_event_map *btp;
	u64 cookie;
};

struct bpf_link_primer {
	struct bpf_link *link;
	struct file *file;
	int fd;
	u32 id;
};

struct bpf_mount_opts {
	kuid_t uid;
	kgid_t gid;
	umode_t mode;

	/* BPF token-related delegation options */
	u64 delegate_cmds;
	u64 delegate_maps;
	u64 delegate_progs;
	u64 delegate_attachs;
};

struct bpf_token {
	struct work_struct work;
	atomic64_t refcnt;
	struct user_namespace *userns;
	u64 allowed_cmds;
	u64 allowed_maps;
	u64 allowed_progs;
	u64 allowed_attachs;
#ifdef CONFIG_SECURITY
	void *security;
#endif
};

struct bpf_struct_ops_value;
struct btf_member;

#define BPF_STRUCT_OPS_MAX_NR_MEMBERS 64
/**
 * struct bpf_struct_ops - A structure of callbacks allowing a subsystem to
 *			   define a BPF_MAP_TYPE_STRUCT_OPS map type composed
 *			   of BPF_PROG_TYPE_STRUCT_OPS progs.
 * @verifier_ops: A structure of callbacks that are invoked by the verifier
 *		  when determining whether the struct_ops progs in the
 *		  struct_ops map are valid.
 * @init: A callback that is invoked a single time, and before any other
 *	  callback, to initialize the structure. A nonzero return value means
 *	  the subsystem could not be initialized.
 * @check_member: When defined, a callback invoked by the verifier to allow
 *		  the subsystem to determine if an entry in the struct_ops map
 *		  is valid. A nonzero return value means that the map is
 *		  invalid and should be rejected by the verifier.
 * @init_member: A callback that is invoked for each member of the struct_ops
 *		 map to allow the subsystem to initialize the member. A nonzero
 *		 value means the member could not be initialized. This callback
 *		 is exclusive with the @type, @type_id, @value_type, and
 *		 @value_id fields.
 * @reg: A callback that is invoked when the struct_ops map has been
 *	 initialized and is being attached to. Zero means the struct_ops map
 *	 has been successfully registered and is live. A nonzero return value
 *	 means the struct_ops map could not be registered.
 * @unreg: A callback that is invoked when the struct_ops map should be
 *	   unregistered.
 * @update: A callback that is invoked when the live struct_ops map is being
 *	    updated to contain new values. This callback is only invoked when
 *	    the struct_ops map is loaded with BPF_F_LINK. If not defined, the
 *	    it is assumed that the struct_ops map cannot be updated.
 * @validate: A callback that is invoked after all of the members have been
 *	      initialized. This callback should perform static checks on the
 *	      map, meaning that it should either fail or succeed
 *	      deterministically. A struct_ops map that has been validated may
 *	      not necessarily succeed in being registered if the call to @reg
 *	      fails. For example, a valid struct_ops map may be loaded, but
 *	      then fail to be registered due to there being another active
 *	      struct_ops map on the system in the subsystem already. For this
 *	      reason, if this callback is not defined, the check is skipped as
 *	      the struct_ops map will have final verification performed in
 *	      @reg.
 * @cfi_stubs: Pointer to a structure of stub functions for CFI. These stubs
 *	       provide the correct Control Flow Integrity hashes for the
 *	       trampolines generated by BPF struct_ops.
 * @owner: The module that owns this struct_ops. Used for module reference
 *	   counting to ensure the module providing the struct_ops cannot be
 *	   unloaded while in use.
 * @name: The name of the struct bpf_struct_ops object.
 * @func_models: Func models
 */
struct bpf_struct_ops {
	const struct bpf_verifier_ops *verifier_ops;
	int (*init)(struct btf *btf);
	int (*check_member)(const struct btf_type *t,
			    const struct btf_member *member,
			    const struct bpf_prog *prog);
	int (*init_member)(const struct btf_type *t,
			   const struct btf_member *member,
			   void *kdata, const void *udata);
	int (*reg)(void *kdata, struct bpf_link *link);
	void (*unreg)(void *kdata, struct bpf_link *link);
	int (*update)(void *kdata, void *old_kdata, struct bpf_link *link);
	int (*validate)(void *kdata);
	void *cfi_stubs;
	struct module *owner;
	const char *name;
	struct btf_func_model func_models[BPF_STRUCT_OPS_MAX_NR_MEMBERS];
};

/* Every member of a struct_ops type has an instance even a member is not
 * an operator (function pointer). The "info" field will be assigned to
 * prog->aux->ctx_arg_info of BPF struct_ops programs to provide the
 * argument information required by the verifier to verify the program.
 *
 * btf_ctx_access() will lookup prog->aux->ctx_arg_info to find the
 * corresponding entry for an given argument.
 */
struct bpf_struct_ops_arg_info {
	struct bpf_ctx_arg_aux *info;
	u32 cnt;
};

struct bpf_struct_ops_desc {
	struct bpf_struct_ops *st_ops;

	const struct btf_type *type;
	const struct btf_type *value_type;
	u32 type_id;
	u32 value_id;

	/* Collection of argument information for each member */
	struct bpf_struct_ops_arg_info *arg_info;
};

enum bpf_struct_ops_state {
	BPF_STRUCT_OPS_STATE_INIT,
	BPF_STRUCT_OPS_STATE_INUSE,
	BPF_STRUCT_OPS_STATE_TOBEFREE,
	BPF_STRUCT_OPS_STATE_READY,
};

struct bpf_struct_ops_common_value {
	refcount_t refcnt;
	enum bpf_struct_ops_state state;
};

static inline bool bpf_prog_get_recursion_context(struct bpf_prog *prog)
{
#ifdef CONFIG_ARM64
	u8 rctx = interrupt_context_level();
	u8 *active = this_cpu_ptr(prog->active);
	u32 val;

	preempt_disable();
	active[rctx]++;
	val = le32_to_cpu(*(__le32 *)active);
	preempt_enable();
	if (val != BIT(rctx * 8))
		return false;

	return true;
#else
	return this_cpu_inc_return(*(int __percpu *)(prog->active)) == 1;
#endif
}

static inline void bpf_prog_put_recursion_context(struct bpf_prog *prog)
{
#ifdef CONFIG_ARM64
	u8 rctx = interrupt_context_level();
	u8 *active = this_cpu_ptr(prog->active);

	preempt_disable();
	active[rctx]--;
	preempt_enable();
#else
	this_cpu_dec(*(int __percpu *)(prog->active));
#endif
}

#if defined(CONFIG_BPF_JIT) && defined(CONFIG_BPF_SYSCALL)
/* This macro helps developer to register a struct_ops type and generate
 * type information correctly. Developers should use this macro to register
 * a struct_ops type instead of calling __register_bpf_struct_ops() directly.
 */
#define register_bpf_struct_ops(st_ops, type)				\
	({								\
		struct bpf_struct_ops_##type {				\
			struct bpf_struct_ops_common_value common;	\
			struct type data ____cacheline_aligned_in_smp;	\
		};							\
		BTF_TYPE_EMIT(struct bpf_struct_ops_##type);		\
		__register_bpf_struct_ops(st_ops);			\
	})
#define BPF_MODULE_OWNER ((void *)((0xeB9FUL << 2) + POISON_POINTER_DELTA))
bool bpf_struct_ops_get(const void *kdata);
void bpf_struct_ops_put(const void *kdata);
int bpf_struct_ops_supported(const struct bpf_struct_ops *st_ops, u32 moff);
int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map, void *key,
				       void *value);
int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks,
				      struct bpf_tramp_link *link,
				      const struct btf_func_model *model,
				      void *stub_func,
				      void **image, u32 *image_off,
				      bool allow_alloc);
void bpf_struct_ops_image_free(void *image);
static inline bool bpf_try_module_get(const void *data, struct module *owner)
{
	if (owner == BPF_MODULE_OWNER)
		return bpf_struct_ops_get(data);
	else
		return try_module_get(owner);
}
static inline void bpf_module_put(const void *data, struct module *owner)
{
	if (owner == BPF_MODULE_OWNER)
		bpf_struct_ops_put(data);
	else
		module_put(owner);
}
int bpf_struct_ops_link_create(union bpf_attr *attr);
int bpf_prog_assoc_struct_ops(struct bpf_prog *prog, struct bpf_map *map);
void bpf_prog_disassoc_struct_ops(struct bpf_prog *prog);
void *bpf_prog_get_assoc_struct_ops(const struct bpf_prog_aux *aux);
u32 bpf_struct_ops_id(const void *kdata);

#ifdef CONFIG_NET
/* Define it here to avoid the use of forward declaration */
struct bpf_dummy_ops_state {
	int val;
};

struct bpf_dummy_ops {
	int (*test_1)(struct bpf_dummy_ops_state *cb);
	int (*test_2)(struct bpf_dummy_ops_state *cb, int a1, unsigned short a2,
		      char a3, unsigned long a4);
	int (*test_sleepable)(struct bpf_dummy_ops_state *cb);
};

int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,
			    union bpf_attr __user *uattr);
#endif
int bpf_struct_ops_desc_init(struct bpf_struct_ops_desc *st_ops_desc,
			     struct btf *btf,
			     struct bpf_verifier_log *log);
void bpf_map_struct_ops_info_fill(struct bpf_map_info *info, struct bpf_map *map);
void bpf_struct_ops_desc_release(struct bpf_struct_ops_desc *st_ops_desc);
#else
#define register_bpf_struct_ops(st_ops, type) ({ (void *)(st_ops); 0; })
static inline bool bpf_try_module_get(const void *data, struct module *owner)
{
	return try_module_get(owner);
}
static inline void bpf_module_put(const void *data, struct module *owner)
{
	module_put(owner);
}
static inline int bpf_struct_ops_supported(const struct bpf_struct_ops *st_ops, u32 moff)
{
	return -ENOTSUPP;
}
static inline int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map,
						     void *key,
						     void *value)
{
	return -EINVAL;
}
static inline int bpf_struct_ops_link_create(union bpf_attr *attr)
{
	return -EOPNOTSUPP;
}
static inline int bpf_prog_assoc_struct_ops(struct bpf_prog *prog, struct bpf_map *map)
{
	return -EOPNOTSUPP;
}
static inline void bpf_prog_disassoc_struct_ops(struct bpf_prog *prog)
{
}
static inline void *bpf_prog_get_assoc_struct_ops(const struct bpf_prog_aux *aux)
{
	return NULL;
}
static inline void bpf_map_struct_ops_info_fill(struct bpf_map_info *info, struct bpf_map *map)
{
}

static inline void bpf_struct_ops_desc_release(struct bpf_struct_ops_desc *st_ops_desc)
{
}

#endif

static inline int bpf_fsession_cnt(struct bpf_tramp_links *links)
{
	struct bpf_tramp_links fentries = links[BPF_TRAMP_FENTRY];
	int cnt = 0;

	for (int i = 0; i < links[BPF_TRAMP_FENTRY].nr_links; i++) {
		if (fentries.links[i]->link.prog->expected_attach_type == BPF_TRACE_FSESSION)
			cnt++;
	}

	return cnt;
}

static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_link *link)
{
	return link->link.prog->call_session_cookie;
}

static inline int bpf_fsession_cookie_cnt(struct bpf_tramp_links *links)
{
	struct bpf_tramp_links fentries = links[BPF_TRAMP_FENTRY];
	int cnt = 0;

	for (int i = 0; i < links[BPF_TRAMP_FENTRY].nr_links; i++) {
		if (bpf_prog_calls_session_cookie(fentries.links[i]))
			cnt++;
	}

	return cnt;
}

int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog,
			       const struct bpf_ctx_arg_aux *info, u32 cnt);

#if defined(CONFIG_CGROUP_BPF) && defined(CONFIG_BPF_LSM)
int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
				    int cgroup_atype,
				    enum bpf_attach_type attach_type);
void bpf_trampoline_unlink_cgroup_shim(struct bpf_prog *prog);
#else
static inline int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
						  int cgroup_atype,
						  enum bpf_attach_type attach_type)
{
	return -EOPNOTSUPP;
}
static inline void bpf_trampoline_unlink_cgroup_shim(struct bpf_prog *prog)
{
}
#endif

struct bpf_array {
	struct bpf_map map;
	u32 elem_size;
	u32 index_mask;
	struct bpf_array_aux *aux;
	union {
		DECLARE_FLEX_ARRAY(char, value) __aligned(8);
		DECLARE_FLEX_ARRAY(void *, ptrs) __aligned(8);
		DECLARE_FLEX_ARRAY(void __percpu *, pptrs) __aligned(8);
	};
};

/*
 * The bpf_array_get_next_key() function may be used for all array-like
 * maps, i.e., maps with u32 keys with range [0 ,..., max_entries)
 */
int bpf_array_get_next_key(struct bpf_map *map, void *key, void *next_key);

#define BPF_COMPLEXITY_LIMIT_INSNS      1000000 /* yes. 1M insns */
#define MAX_TAIL_CALL_CNT 33

/* Maximum number of loops for bpf_loop and bpf_iter_num.
 * It's enum to expose it (and thus make it discoverable) through BTF.
 */
enum {
	BPF_MAX_LOOPS = 8 * 1024 * 1024,
	BPF_MAX_TIMED_LOOPS = 0xffff,
};

#define BPF_F_ACCESS_MASK	(BPF_F_RDONLY |		\
				 BPF_F_RDONLY_PROG |	\
				 BPF_F_WRONLY |		\
				 BPF_F_WRONLY_PROG)

#define BPF_MAP_CAN_READ	BIT(0)
#define BPF_MAP_CAN_WRITE	BIT(1)

/* Maximum number of user-producer ring buffer samples that can be drained in
 * a call to bpf_user_ringbuf_drain().
 */
#define BPF_MAX_USER_RINGBUF_SAMPLES (128 * 1024)

static inline u32 bpf_map_flags_to_cap(struct bpf_map *map)
{
	u32 access_flags = map->map_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG);

	/* Combination of BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG is
	 * not possible.
	 */
	if (access_flags & BPF_F_RDONLY_PROG)
		return BPF_MAP_CAN_READ;
	else if (access_flags & BPF_F_WRONLY_PROG)
		return BPF_MAP_CAN_WRITE;
	else
		return BPF_MAP_CAN_READ | BPF_MAP_CAN_WRITE;
}

static inline bool bpf_map_flags_access_ok(u32 access_flags)
{
	return (access_flags & (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG)) !=
	       (BPF_F_RDONLY_PROG | BPF_F_WRONLY_PROG);
}

static inline struct bpf_map_owner *bpf_map_owner_alloc(struct bpf_map *map)
{
	return kzalloc_obj(*map->owner, GFP_ATOMIC);
}

static inline void bpf_map_owner_free(struct bpf_map *map)
{
	kfree(map->owner);
}

struct bpf_event_entry {
	struct perf_event *event;
	struct file *perf_file;
	struct file *map_file;
	struct rcu_head rcu;
};

static inline bool map_type_contains_progs(struct bpf_map *map)
{
	return map->map_type == BPF_MAP_TYPE_PROG_ARRAY ||
	       map->map_type == BPF_MAP_TYPE_DEVMAP ||
	       map->map_type == BPF_MAP_TYPE_CPUMAP;
}

bool bpf_prog_map_compatible(struct bpf_map *map, const struct bpf_prog *fp);
int bpf_prog_calc_tag(struct bpf_prog *fp);

const struct bpf_func_proto *bpf_get_trace_printk_proto(void);
const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void);

const struct bpf_func_proto *bpf_get_perf_event_read_value_proto(void);

typedef unsigned long (*bpf_ctx_copy_t)(void *dst, const void *src,
					unsigned long off, unsigned long len);
typedef u32 (*bpf_convert_ctx_access_t)(enum bpf_access_type type,
					const struct bpf_insn *src,
					struct bpf_insn *dst,
					struct bpf_prog *prog,
					u32 *target_size);

u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size,
		     void *ctx, u64 ctx_size, bpf_ctx_copy_t ctx_copy);

/* an array of programs to be executed under rcu_lock.
 *
 * Typical usage:
 * ret = bpf_prog_run_array(rcu_dereference(&bpf_prog_array), ctx, bpf_prog_run);
 *
 * the structure returned by bpf_prog_array_alloc() should be populated
 * with program pointers and the last pointer must be NULL.
 * The user has to keep refcnt on the program and make sure the program
 * is removed from the array before bpf_prog_put().
 * The 'struct bpf_prog_array *' should only be replaced with xchg()
 * since other cpus are walking the array of pointers in parallel.
 */
struct bpf_prog_array_item {
	struct bpf_prog *prog;
	union {
		struct bpf_cgroup_storage *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE];
		u64 bpf_cookie;
	};
};

struct bpf_prog_array {
	struct rcu_head rcu;
	struct bpf_prog_array_item items[];
};

/* to avoid allocating empty bpf_prog_array for cgroups that
 * don't have bpf program attached use one global 'bpf_empty_prog_array'
 * It will not be modified the caller of bpf_prog_array_alloc()
 * (since caller requested prog_cnt == 0)
 * that pointer should be 'freed' by bpf_prog_array_free()
 */
extern struct bpf_prog_array bpf_empty_prog_array;

struct bpf_prog_array *bpf_prog_array_alloc(u32 prog_cnt, gfp_t flags);
void bpf_prog_array_free(struct bpf_prog_array *progs);
/* Use when traversal over the bpf_prog_array uses tasks_trace rcu */
void bpf_prog_array_free_sleepable(struct bpf_prog_array *progs);
int bpf_prog_array_length(struct bpf_prog_array *progs);
bool bpf_prog_array_is_empty(struct bpf_prog_array *array);
int bpf_prog_array_copy_to_user(struct bpf_prog_array *progs,
				__u32 __user *prog_ids, u32 cnt);

void bpf_prog_array_delete_safe(struct bpf_prog_array *progs,
				struct bpf_prog *old_prog);
int bpf_prog_array_delete_safe_at(struct bpf_prog_array *array, int index);
int bpf_prog_array_update_at(struct bpf_prog_array *array, int index,
			     struct bpf_prog *prog);
int bpf_prog_array_copy_info(struct bpf_prog_array *array,
			     u32 *prog_ids, u32 request_cnt,
			     u32 *prog_cnt);
int bpf_prog_array_copy(struct bpf_prog_array *old_array,
			struct bpf_prog *exclude_prog,
			struct bpf_prog *include_prog,
			u64 bpf_cookie,
			struct bpf_prog_array **new_array);

struct bpf_run_ctx {};

struct bpf_cg_run_ctx {
	struct bpf_run_ctx run_ctx;
	const struct bpf_prog_array_item *prog_item;
	int retval;
};

struct bpf_trace_run_ctx {
	struct bpf_run_ctx run_ctx;
	u64 bpf_cookie;
	bool is_uprobe;
};

struct bpf_tramp_run_ctx {
	struct bpf_run_ctx run_ctx;
	u64 bpf_cookie;
	struct bpf_run_ctx *saved_run_ctx;
};

static inline struct bpf_run_ctx *bpf_set_run_ctx(struct bpf_run_ctx *new_ctx)
{
	struct bpf_run_ctx *old_ctx = NULL;

#ifdef CONFIG_BPF_SYSCALL
	old_ctx = current->bpf_ctx;
	current->bpf_ctx = new_ctx;
#endif
	return old_ctx;
}

static inline void bpf_reset_run_ctx(struct bpf_run_ctx *old_ctx)
{
#ifdef CONFIG_BPF_SYSCALL
	current->bpf_ctx = old_ctx;
#endif
}

/* BPF program asks to bypass CAP_NET_BIND_SERVICE in bind. */
#define BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE			(1 << 0)
/* BPF program asks to set CN on the packet. */
#define BPF_RET_SET_CN						(1 << 0)

typedef u32 (*bpf_prog_run_fn)(const struct bpf_prog *prog, const void *ctx);

static __always_inline u32
bpf_prog_run_array(const struct bpf_prog_array *array,
		   const void *ctx, bpf_prog_run_fn run_prog)
{
	const struct bpf_prog_array_item *item;
	const struct bpf_prog *prog;
	struct bpf_run_ctx *old_run_ctx;
	struct bpf_trace_run_ctx run_ctx;
	u32 ret = 1;

	RCU_LOCKDEP_WARN(!rcu_read_lock_held(), "no rcu lock held");

	if (unlikely(!array))
		return ret;

	run_ctx.is_uprobe = false;

	migrate_disable();
	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
	item = &array->items[0];
	while ((prog = READ_ONCE(item->prog))) {
		run_ctx.bpf_cookie = item->bpf_cookie;
		ret &= run_prog(prog, ctx);
		item++;
	}
	bpf_reset_run_ctx(old_run_ctx);
	migrate_enable();
	return ret;
}

/* Notes on RCU design for bpf_prog_arrays containing sleepable programs:
 *
 * We use the tasks_trace rcu flavor read section to protect the bpf_prog_array
 * overall. As a result, we must use the bpf_prog_array_free_sleepable
 * in order to use the tasks_trace rcu grace period.
 *
 * When a non-sleepable program is inside the array, we take the rcu read
 * section and disable preemption for that program alone, so it can access
 * rcu-protected dynamically sized maps.
 */
static __always_inline u32
bpf_prog_run_array_uprobe(const struct bpf_prog_array *array,
			  const void *ctx, bpf_prog_run_fn run_prog)
{
	const struct bpf_prog_array_item *item;
	const struct bpf_prog *prog;
	struct bpf_run_ctx *old_run_ctx;
	struct bpf_trace_run_ctx run_ctx;
	u32 ret = 1;

	might_fault();
	RCU_LOCKDEP_WARN(!rcu_read_lock_trace_held(), "no rcu lock held");

	if (unlikely(!array))
		return ret;

	migrate_disable();

	run_ctx.is_uprobe = true;

	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
	item = &array->items[0];
	while ((prog = READ_ONCE(item->prog))) {
		if (!prog->sleepable)
			rcu_read_lock();

		run_ctx.bpf_cookie = item->bpf_cookie;
		ret &= run_prog(prog, ctx);
		item++;

		if (!prog->sleepable)
			rcu_read_unlock();
	}
	bpf_reset_run_ctx(old_run_ctx);
	migrate_enable();
	return ret;
}

bool bpf_jit_bypass_spec_v1(void);
bool bpf_jit_bypass_spec_v4(void);

#define bpf_rcu_lock_held() \
	(rcu_read_lock_held() || rcu_read_lock_trace_held() || rcu_read_lock_bh_held())

#ifdef CONFIG_BPF_SYSCALL
DECLARE_PER_CPU(int, bpf_prog_active);
extern struct mutex bpf_stats_enabled_mutex;

/*
 * Block execution of BPF programs attached to instrumentation (perf,
 * kprobes, tracepoints) to prevent deadlocks on map operations as any of
 * these events can happen inside a region which holds a map bucket lock
 * and can deadlock on it.
 */
static inline void bpf_disable_instrumentation(void)
{
	migrate_disable();
	this_cpu_inc(bpf_prog_active);
}

static inline void bpf_enable_instrumentation(void)
{
	this_cpu_dec(bpf_prog_active);
	migrate_enable();
}

extern const struct super_operations bpf_super_ops;
extern const struct file_operations bpf_map_fops;
extern const struct file_operations bpf_prog_fops;
extern const struct file_operations bpf_iter_fops;
extern const struct file_operations bpf_token_fops;

#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
	extern const struct bpf_prog_ops _name ## _prog_ops; \
	extern const struct bpf_verifier_ops _name ## _verifier_ops;
#define BPF_MAP_TYPE(_id, _ops) \
	extern const struct bpf_map_ops _ops;
#define BPF_LINK_TYPE(_id, _name)
#include <linux/bpf_types.h>
#undef BPF_PROG_TYPE
#undef BPF_MAP_TYPE
#undef BPF_LINK_TYPE

extern const struct bpf_prog_ops bpf_offload_prog_ops;
extern const struct bpf_verifier_ops tc_cls_act_analyzer_ops;
extern const struct bpf_verifier_ops xdp_analyzer_ops;

struct bpf_prog *bpf_prog_get(u32 ufd);
struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
				       bool attach_drv);
void bpf_prog_add(struct bpf_prog *prog, int i);
void bpf_prog_sub(struct bpf_prog *prog, int i);
void bpf_prog_inc(struct bpf_prog *prog);
struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog);
void bpf_prog_put(struct bpf_prog *prog);

void bpf_prog_free_id(struct bpf_prog *prog);
void bpf_map_free_id(struct bpf_map *map);

struct btf_field *btf_record_find(const struct btf_record *rec,
				  u32 offset, u32 field_mask);
void btf_record_free(struct btf_record *rec);
void bpf_map_free_record(struct bpf_map *map);
struct btf_record *btf_record_dup(const struct btf_record *rec);
bool btf_record_equal(const struct btf_record *rec_a, const struct btf_record *rec_b);
void bpf_obj_free_timer(const struct btf_record *rec, void *obj);
void bpf_obj_free_workqueue(const struct btf_record *rec, void *obj);
void bpf_obj_free_task_work(const struct btf_record *rec, void *obj);
void bpf_obj_free_fields(const struct btf_record *rec, void *obj);
void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu);

struct bpf_map *bpf_map_get(u32 ufd);
struct bpf_map *bpf_map_get_with_uref(u32 ufd);

/*
 * The __bpf_map_get() and __btf_get_by_fd() functions parse a file
 * descriptor and return a corresponding map or btf object.
 * Their names are double underscored to emphasize the fact that they
 * do not increase refcnt. To also increase refcnt use corresponding
 * bpf_map_get() and btf_get_by_fd() functions.
 */

static inline struct bpf_map *__bpf_map_get(struct fd f)
{
	if (fd_empty(f))
		return ERR_PTR(-EBADF);
	if (unlikely(fd_file(f)->f_op != &bpf_map_fops))
		return ERR_PTR(-EINVAL);
	return fd_file(f)->private_data;
}

static inline struct btf *__btf_get_by_fd(struct fd f)
{
	if (fd_empty(f))
		return ERR_PTR(-EBADF);
	if (unlikely(fd_file(f)->f_op != &btf_fops))
		return ERR_PTR(-EINVAL);
	return fd_file(f)->private_data;
}

void bpf_map_inc(struct bpf_map *map);
void bpf_map_inc_with_uref(struct bpf_map *map);
struct bpf_map *__bpf_map_inc_not_zero(struct bpf_map *map, bool uref);
struct bpf_map * __must_check bpf_map_inc_not_zero(struct bpf_map *map);
void bpf_map_put_with_uref(struct bpf_map *map);
void bpf_map_put(struct bpf_map *map);
void *bpf_map_area_alloc(u64 size, int numa_node);
void *bpf_map_area_mmapable_alloc(u64 size, int numa_node);
void bpf_map_area_free(void *base);
bool bpf_map_write_active(const struct bpf_map *map);
void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr);
int  generic_map_lookup_batch(struct bpf_map *map,
			      const union bpf_attr *attr,
			      union bpf_attr __user *uattr);
int  generic_map_update_batch(struct bpf_map *map, struct file *map_file,
			      const union bpf_attr *attr,
			      union bpf_attr __user *uattr);
int  generic_map_delete_batch(struct bpf_map *map,
			      const union bpf_attr *attr,
			      union bpf_attr __user *uattr);
struct bpf_map *bpf_map_get_curr_or_next(u32 *id);
struct bpf_prog *bpf_prog_get_curr_or_next(u32 *id);


int bpf_map_alloc_pages(const struct bpf_map *map, int nid,
			unsigned long nr_pages, struct page **page_array);
#ifdef CONFIG_MEMCG
void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg,
			 struct mem_cgroup **new_memcg);
void bpf_map_memcg_exit(struct mem_cgroup *old_memcg,
			struct mem_cgroup *memcg);
void *bpf_map_kmalloc_node(const struct bpf_map *map, size_t size, gfp_t flags,
			   int node);
void *bpf_map_kmalloc_nolock(const struct bpf_map *map, size_t size, gfp_t flags,
			     int node);
void *bpf_map_kzalloc(const struct bpf_map *map, size_t size, gfp_t flags);
void *bpf_map_kvcalloc(struct bpf_map *map, size_t n, size_t size,
		       gfp_t flags);
void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
				    size_t align, gfp_t flags);
#else
/*
 * These specialized allocators have to be macros for their allocations to be
 * accounted separately (to have separate alloc_tag).
 */
#define bpf_map_kmalloc_node(_map, _size, _flags, _node)	\
		kmalloc_node(_size, _flags, _node)
#define bpf_map_kmalloc_nolock(_map, _size, _flags, _node)	\
		kmalloc_nolock(_size, _flags, _node)
#define bpf_map_kzalloc(_map, _size, _flags)			\
		kzalloc(_size, _flags)
#define bpf_map_kvcalloc(_map, _n, _size, _flags)		\
		kvcalloc(_n, _size, _flags)
#define bpf_map_alloc_percpu(_map, _size, _align, _flags)	\
		__alloc_percpu_gfp(_size, _align, _flags)
static inline void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg,
				       struct mem_cgroup **new_memcg)
{
	*new_memcg = NULL;
	*old_memcg = NULL;
}

static inline void bpf_map_memcg_exit(struct mem_cgroup *old_memcg,
				      struct mem_cgroup *memcg)
{
}
#endif

static inline int
bpf_map_init_elem_count(struct bpf_map *map)
{
	size_t size = sizeof(*map->elem_count), align = size;
	gfp_t flags = GFP_USER | __GFP_NOWARN;

	map->elem_count = bpf_map_alloc_percpu(map, size, align, flags);
	if (!map->elem_count)
		return -ENOMEM;

	return 0;
}

static inline void
bpf_map_free_elem_count(struct bpf_map *map)
{
	free_percpu(map->elem_count);
}

static inline void bpf_map_inc_elem_count(struct bpf_map *map)
{
	this_cpu_inc(*map->elem_count);
}

static inline void bpf_map_dec_elem_count(struct bpf_map *map)
{
	this_cpu_dec(*map->elem_count);
}

extern int sysctl_unprivileged_bpf_disabled;

bool bpf_token_capable(const struct bpf_token *token, int cap);

static inline bool bpf_allow_ptr_leaks(const struct bpf_token *token)
{
	return bpf_token_capable(token, CAP_PERFMON);
}

static inline bool bpf_allow_uninit_stack(const struct bpf_token *token)
{
	return bpf_token_capable(token, CAP_PERFMON);
}

static inline bool bpf_bypass_spec_v1(const struct bpf_token *token)
{
	return bpf_jit_bypass_spec_v1() ||
		cpu_mitigations_off() ||
		bpf_token_capable(token, CAP_PERFMON);
}

static inline bool bpf_bypass_spec_v4(const struct bpf_token *token)
{
	return bpf_jit_bypass_spec_v4() ||
		cpu_mitigations_off() ||
		bpf_token_capable(token, CAP_PERFMON);
}

int bpf_map_new_fd(struct bpf_map *map, int flags);
int bpf_prog_new_fd(struct bpf_prog *prog);

void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
		   const struct bpf_link_ops *ops, struct bpf_prog *prog,
		   enum bpf_attach_type attach_type);
void bpf_link_init_sleepable(struct bpf_link *link, enum bpf_link_type type,
			     const struct bpf_link_ops *ops, struct bpf_prog *prog,
			     enum bpf_attach_type attach_type, bool sleepable);
int bpf_link_prime(struct bpf_link *link, struct bpf_link_primer *primer);
int bpf_link_settle(struct bpf_link_primer *primer);
void bpf_link_cleanup(struct bpf_link_primer *primer);
void bpf_link_inc(struct bpf_link *link);
struct bpf_link *bpf_link_inc_not_zero(struct bpf_link *link);
void bpf_link_put(struct bpf_link *link);
int bpf_link_new_fd(struct bpf_link *link);
struct bpf_link *bpf_link_get_from_fd(u32 ufd);
struct bpf_link *bpf_link_get_curr_or_next(u32 *id);

void bpf_token_inc(struct bpf_token *token);
void bpf_token_put(struct bpf_token *token);
int bpf_token_create(union bpf_attr *attr);
struct bpf_token *bpf_token_get_from_fd(u32 ufd);
int bpf_token_get_info_by_fd(struct bpf_token *token,
			     const union bpf_attr *attr,
			     union bpf_attr __user *uattr);

bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
bool bpf_token_allow_map_type(const struct bpf_token *token, enum bpf_map_type type);
bool bpf_token_allow_prog_type(const struct bpf_token *token,
			       enum bpf_prog_type prog_type,
			       enum bpf_attach_type attach_type);

int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname);
int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags);
struct inode *bpf_get_inode(struct super_block *sb, const struct inode *dir,
			    umode_t mode);

#define BPF_ITER_FUNC_PREFIX "bpf_iter_"
#define DEFINE_BPF_ITER_FUNC(target, args...)			\
	extern int bpf_iter_ ## target(args);			\
	int __init bpf_iter_ ## target(args) { return 0; }

/*
 * The task type of iterators.
 *
 * For BPF task iterators, they can be parameterized with various
 * parameters to visit only some of tasks.
 *
 * BPF_TASK_ITER_ALL (default)
 *	Iterate over resources of every task.
 *
 * BPF_TASK_ITER_TID
 *	Iterate over resources of a task/tid.
 *
 * BPF_TASK_ITER_TGID
 *	Iterate over resources of every task of a process / task group.
 */
enum bpf_iter_task_type {
	BPF_TASK_ITER_ALL = 0,
	BPF_TASK_ITER_TID,
	BPF_TASK_ITER_TGID,
};

struct bpf_iter_aux_info {
	/* for map_elem iter */
	struct bpf_map *map;

	/* for cgroup iter */
	struct {
		struct cgroup *start; /* starting cgroup */
		enum bpf_cgroup_iter_order order;
	} cgroup;
	struct {
		enum bpf_iter_task_type	type;
		u32 pid;
	} task;
};

typedef int (*bpf_iter_attach_target_t)(struct bpf_prog *prog,
					union bpf_iter_link_info *linfo,
					struct bpf_iter_aux_info *aux);
typedef void (*bpf_iter_detach_target_t)(struct bpf_iter_aux_info *aux);
typedef void (*bpf_iter_show_fdinfo_t) (const struct bpf_iter_aux_info *aux,
					struct seq_file *seq);
typedef int (*bpf_iter_fill_link_info_t)(const struct bpf_iter_aux_info *aux,
					 struct bpf_link_info *info);
typedef const struct bpf_func_proto *
(*bpf_iter_get_func_proto_t)(enum bpf_func_id func_id,
			     const struct bpf_prog *prog);

enum bpf_iter_feature {
	BPF_ITER_RESCHED	= BIT(0),
};

#define BPF_ITER_CTX_ARG_MAX 2
struct bpf_iter_reg {
	const char *target;
	bpf_iter_attach_target_t attach_target;
	bpf_iter_detach_target_t detach_target;
	bpf_iter_show_fdinfo_t show_fdinfo;
	bpf_iter_fill_link_info_t fill_link_info;
	bpf_iter_get_func_proto_t get_func_proto;
	u32 ctx_arg_info_size;
	u32 feature;
	struct bpf_ctx_arg_aux ctx_arg_info[BPF_ITER_CTX_ARG_MAX];
	const struct bpf_iter_seq_info *seq_info;
};

struct bpf_iter_meta {
	__bpf_md_ptr(struct seq_file *, seq);
	u64 session_id;
	u64 seq_num;
};

struct bpf_iter__bpf_map_elem {
	__bpf_md_ptr(struct bpf_iter_meta *, meta);
	__bpf_md_ptr(struct bpf_map *, map);
	__bpf_md_ptr(void *, key);
	__bpf_md_ptr(void *, value);
};

int bpf_iter_reg_target(const struct bpf_iter_reg *reg_info);
void bpf_iter_unreg_target(const struct bpf_iter_reg *reg_info);
int bpf_iter_prog_supported(struct bpf_prog *prog);
const struct bpf_func_proto *
bpf_iter_get_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog);
int bpf_iter_link_attach(const union bpf_attr *attr, bpfptr_t uattr, struct bpf_prog *prog);
int bpf_iter_new_fd(struct bpf_link *link);
bool bpf_link_is_iter(struct bpf_link *link);
struct bpf_prog *bpf_iter_get_info(struct bpf_iter_meta *meta, bool in_stop);
int bpf_iter_run_prog(struct bpf_prog *prog, void *ctx);
void bpf_iter_map_show_fdinfo(const struct bpf_iter_aux_info *aux,
			      struct seq_file *seq);
int bpf_iter_map_fill_link_info(const struct bpf_iter_aux_info *aux,
				struct bpf_link_info *info);

int map_set_for_each_callback_args(struct bpf_verifier_env *env,
				   struct bpf_func_state *caller,
				   struct bpf_func_state *callee);

int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value, u64 flags);
int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value, u64 flags);
int bpf_percpu_hash_update(struct bpf_map *map, void *key, void *value,
			   u64 flags);
int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
			    u64 flags);

int bpf_stackmap_extract(struct bpf_map *map, void *key, void *value, bool delete);

int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
				 void *key, void *value, u64 map_flags);
int bpf_fd_array_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
				void *key, void *value, u64 map_flags);
int bpf_fd_htab_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);

int bpf_get_file_flag(int flags);
int bpf_check_uarg_tail_zero(bpfptr_t uaddr, size_t expected_size,
			     size_t actual_size);

/* verify correctness of eBPF program */
int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size);

#ifndef CONFIG_BPF_JIT_ALWAYS_ON
void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);
#endif

struct btf *bpf_get_btf_vmlinux(void);

/* Map specifics */
struct xdp_frame;
struct sk_buff;
struct bpf_dtab_netdev;
struct bpf_cpu_map_entry;

void __dev_flush(struct list_head *flush_list);
int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf,
		    struct net_device *dev_rx);
int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf,
		    struct net_device *dev_rx);
int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx,
			  struct bpf_map *map, bool exclude_ingress);
int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
			     const struct bpf_prog *xdp_prog);
int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb,
			   const struct bpf_prog *xdp_prog,
			   struct bpf_map *map, bool exclude_ingress);

void __cpu_map_flush(struct list_head *flush_list);
int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu, struct xdp_frame *xdpf,
		    struct net_device *dev_rx);
int cpu_map_generic_redirect(struct bpf_cpu_map_entry *rcpu,
			     struct sk_buff *skb);

/* Return map's numa specified by userspace */
static inline int bpf_map_attr_numa_node(const union bpf_attr *attr)
{
	return (attr->map_flags & BPF_F_NUMA_NODE) ?
		attr->numa_node : NUMA_NO_NODE;
}

struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type);
int array_map_alloc_check(union bpf_attr *attr);

int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
			  union bpf_attr __user *uattr);
int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
			  union bpf_attr __user *uattr);
int bpf_prog_test_run_tracing(struct bpf_prog *prog,
			      const union bpf_attr *kattr,
			      union bpf_attr __user *uattr);
int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
				     const union bpf_attr *kattr,
				     union bpf_attr __user *uattr);
int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
			     const union bpf_attr *kattr,
			     union bpf_attr __user *uattr);
int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,
				const union bpf_attr *kattr,
				union bpf_attr __user *uattr);
int bpf_prog_test_run_nf(struct bpf_prog *prog,
			 const union bpf_attr *kattr,
			 union bpf_attr __user *uattr);
bool btf_ctx_access(int off, int size, enum bpf_access_type type,
		    const struct bpf_prog *prog,
		    struct bpf_insn_access_aux *info);

static inline bool bpf_tracing_ctx_access(int off, int size,
					  enum bpf_access_type type)
{
	if (off < 0 || off >= sizeof(__u64) * MAX_BPF_FUNC_ARGS)
		return false;
	if (type != BPF_READ)
		return false;
	if (off % size != 0)
		return false;
	return true;
}

static inline bool bpf_tracing_btf_ctx_access(int off, int size,
					      enum bpf_access_type type,
					      const struct bpf_prog *prog,
					      struct bpf_insn_access_aux *info)
{
	if (!bpf_tracing_ctx_access(off, size, type))
		return false;
	return btf_ctx_access(off, size, type, prog, info);
}

int btf_struct_access(struct bpf_verifier_log *log,
		      const struct bpf_reg_state *reg,
		      int off, int size, enum bpf_access_type atype,
		      u32 *next_btf_id, enum bpf_type_flag *flag, const char **field_name);
bool btf_struct_ids_match(struct bpf_verifier_log *log,
			  const struct btf *btf, u32 id, int off,
			  const struct btf *need_btf, u32 need_type_id,
			  bool strict);

int btf_distill_func_proto(struct bpf_verifier_log *log,
			   struct btf *btf,
			   const struct btf_type *func_proto,
			   const char *func_name,
			   struct btf_func_model *m);

struct bpf_reg_state;
int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog);
int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *prog,
			 struct btf *btf, const struct btf_type *t);
const char *btf_find_decl_tag_value(const struct btf *btf, const struct btf_type *pt,
				    int comp_idx, const char *tag_key);
int btf_find_next_decl_tag(const struct btf *btf, const struct btf_type *pt,
			   int comp_idx, const char *tag_key, int last_id);

struct bpf_prog *bpf_prog_by_id(u32 id);
struct bpf_link *bpf_link_by_id(u32 id);

const struct bpf_func_proto *bpf_base_func_proto(enum bpf_func_id func_id,
						 const struct bpf_prog *prog);
void bpf_task_storage_free(struct task_struct *task);
void bpf_cgrp_storage_free(struct cgroup *cgroup);
bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog);
const struct btf_func_model *
bpf_jit_find_kfunc_model(const struct bpf_prog *prog,
			 const struct bpf_insn *insn);
int bpf_get_kfunc_addr(const struct bpf_prog *prog, u32 func_id,
		       u16 btf_fd_idx, u8 **func_addr);

struct bpf_core_ctx {
	struct bpf_verifier_log *log;
	const struct btf *btf;
};

bool btf_nested_type_is_trusted(struct bpf_verifier_log *log,
				const struct bpf_reg_state *reg,
				const char *field_name, u32 btf_id, const char *suffix);

bool btf_type_ids_nocast_alias(struct bpf_verifier_log *log,
			       const struct btf *reg_btf, u32 reg_id,
			       const struct btf *arg_btf, u32 arg_id);

int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
		   int relo_idx, void *insn);

static inline bool unprivileged_ebpf_enabled(void)
{
	return !sysctl_unprivileged_bpf_disabled;
}

/* Not all bpf prog type has the bpf_ctx.
 * For the bpf prog type that has initialized the bpf_ctx,
 * this function can be used to decide if a kernel function
 * is called by a bpf program.
 */
static inline bool has_current_bpf_ctx(void)
{
	return !!current->bpf_ctx;
}

void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog);

void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data,
		     enum bpf_dynptr_type type, u32 offset, u32 size);
void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr);
void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr);
void bpf_prog_report_arena_violation(bool write, unsigned long addr, unsigned long fault_ip);

#else /* !CONFIG_BPF_SYSCALL */
static inline struct bpf_prog *bpf_prog_get(u32 ufd)
{
	return ERR_PTR(-EOPNOTSUPP);
}

static inline struct bpf_prog *bpf_prog_get_type_dev(u32 ufd,
						     enum bpf_prog_type type,
						     bool attach_drv)
{
	return ERR_PTR(-EOPNOTSUPP);
}

static inline void bpf_prog_add(struct bpf_prog *prog, int i)
{
}

static inline void bpf_prog_sub(struct bpf_prog *prog, int i)
{
}

static inline void bpf_prog_put(struct bpf_prog *prog)
{
}

static inline void bpf_prog_inc(struct bpf_prog *prog)
{
}

static inline struct bpf_prog *__must_check
bpf_prog_inc_not_zero(struct bpf_prog *prog)
{
	return ERR_PTR(-EOPNOTSUPP);
}

static inline void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
				 const struct bpf_link_ops *ops,
				 struct bpf_prog *prog, enum bpf_attach_type attach_type)
{
}

static inline void bpf_link_init_sleepable(struct bpf_link *link, enum bpf_link_type type,
					   const struct bpf_link_ops *ops, struct bpf_prog *prog,
					   enum bpf_attach_type attach_type, bool sleepable)
{
}

static inline int bpf_link_prime(struct bpf_link *link,
				 struct bpf_link_primer *primer)
{
	return -EOPNOTSUPP;
}

static inline int bpf_link_settle(struct bpf_link_primer *primer)
{
	return -EOPNOTSUPP;
}

static inline void bpf_link_cleanup(struct bpf_link_primer *primer)
{
}

static inline void bpf_link_inc(struct bpf_link *link)
{
}

static inline struct bpf_link *bpf_link_inc_not_zero(struct bpf_link *link)
{
	return NULL;
}

static inline void bpf_link_put(struct bpf_link *link)
{
}

static inline int bpf_obj_get_user(const char __user *pathname, int flags)
{
	return -EOPNOTSUPP;
}

static inline bool bpf_token_capable(const struct bpf_token *token, int cap)
{
	return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN));
}

static inline void bpf_token_inc(struct bpf_token *token)
{
}

static inline void bpf_token_put(struct bpf_token *token)
{
}

static inline struct bpf_token *bpf_token_get_from_fd(u32 ufd)
{
	return ERR_PTR(-EOPNOTSUPP);
}

static inline int bpf_token_get_info_by_fd(struct bpf_token *token,
					   const union bpf_attr *attr,
					   union bpf_attr __user *uattr)
{
	return -EOPNOTSUPP;
}

static inline void __dev_flush(struct list_head *flush_list)
{
}

struct xdp_frame;
struct bpf_dtab_netdev;
struct bpf_cpu_map_entry;

static inline
int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf,
		    struct net_device *dev_rx)
{
	return 0;
}

static inline
int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf,
		    struct net_device *dev_rx)
{
	return 0;
}

static inline
int dev_map_enqueue_multi(struct xdp_frame *xdpf, struct net_device *dev_rx,
			  struct bpf_map *map, bool exclude_ingress)
{
	return 0;
}

struct sk_buff;

static inline int dev_map_generic_redirect(struct bpf_dtab_netdev *dst,
					   struct sk_buff *skb,
					   const struct bpf_prog *xdp_prog)
{
	return 0;
}

static inline
int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb,
			   const struct bpf_prog *xdp_prog,
			   struct bpf_map *map, bool exclude_ingress)
{
	return 0;
}

static inline void __cpu_map_flush(struct list_head *flush_list)
{
}

static inline int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu,
				  struct xdp_frame *xdpf,
				  struct net_device *dev_rx)
{
	return 0;
}

static inline int cpu_map_generic_redirect(struct bpf_cpu_map_entry *rcpu,
					   struct sk_buff *skb)
{
	return -EOPNOTSUPP;
}

static inline struct bpf_prog *bpf_prog_get_type_path(const char *name,
				enum bpf_prog_type type)
{
	return ERR_PTR(-EOPNOTSUPP);
}

static inline int bpf_prog_test_run_xdp(struct bpf_prog *prog,
					const union bpf_attr *kattr,
					union bpf_attr __user *uattr)
{
	return -ENOTSUPP;
}

static inline int bpf_prog_test_run_skb(struct bpf_prog *prog,
					const union bpf_attr *kattr,
					union bpf_attr __user *uattr)
{
	return -ENOTSUPP;
}

static inline int bpf_prog_test_run_tracing(struct bpf_prog *prog,
					    const union bpf_attr *kattr,
					    union bpf_attr __user *uattr)
{
	return -ENOTSUPP;
}

static inline int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
						   const union bpf_attr *kattr,
						   union bpf_attr __user *uattr)
{
	return -ENOTSUPP;
}

static inline int bpf_prog_test_run_sk_lookup(struct bpf_prog *prog,
					      const union bpf_attr *kattr,
					      union bpf_attr __user *uattr)
{
	return -ENOTSUPP;
}

static inline void bpf_map_put(struct bpf_map *map)
{
}

static inline struct bpf_prog *bpf_prog_by_id(u32 id)
{
	return ERR_PTR(-ENOTSUPP);
}

static inline int btf_struct_access(struct bpf_verifier_log *log,
				    const struct bpf_reg_state *reg,
				    int off, int size, enum bpf_access_type atype,
				    u32 *next_btf_id, enum bpf_type_flag *flag,
				    const char **field_name)
{
	return -EACCES;
}

static inline const struct bpf_func_proto *
bpf_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	return NULL;
}

static inline void bpf_task_storage_free(struct task_struct *task)
{
}

static inline bool bpf_prog_has_kfunc_call(const struct bpf_prog *prog)
{
	return false;
}

static inline const struct btf_func_model *
bpf_jit_find_kfunc_model(const struct bpf_prog *prog,
			 const struct bpf_insn *insn)
{
	return NULL;
}

static inline int
bpf_get_kfunc_addr(const struct bpf_prog *prog, u32 func_id,
		   u16 btf_fd_idx, u8 **func_addr)
{
	return -ENOTSUPP;
}

static inline bool unprivileged_ebpf_enabled(void)
{
	return false;
}

static inline bool has_current_bpf_ctx(void)
{
	return false;
}

static inline void bpf_prog_inc_misses_counter(struct bpf_prog *prog)
{
}

static inline void bpf_cgrp_storage_free(struct cgroup *cgroup)
{
}

static inline void bpf_dynptr_init(struct bpf_dynptr_kern *ptr, void *data,
				   enum bpf_dynptr_type type, u32 offset, u32 size)
{
}

static inline void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr)
{
}

static inline void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr)
{
}

static inline void bpf_prog_report_arena_violation(bool write, unsigned long addr,
						   unsigned long fault_ip)
{
}
#endif /* CONFIG_BPF_SYSCALL */

static inline bool bpf_net_capable(void)
{
	return capable(CAP_NET_ADMIN) || capable(CAP_SYS_ADMIN);
}

static __always_inline int
bpf_probe_read_kernel_common(void *dst, u32 size, const void *unsafe_ptr)
{
	int ret = -EFAULT;

	if (IS_ENABLED(CONFIG_BPF_EVENTS))
		ret = copy_from_kernel_nofault(dst, unsafe_ptr, size);
	if (unlikely(ret < 0))
		memset(dst, 0, size);
	return ret;
}

void __bpf_free_used_btfs(struct btf_mod_pair *used_btfs, u32 len);

static inline struct bpf_prog *bpf_prog_get_type(u32 ufd,
						 enum bpf_prog_type type)
{
	return bpf_prog_get_type_dev(ufd, type, false);
}

void __bpf_free_used_maps(struct bpf_prog_aux *aux,
			  struct bpf_map **used_maps, u32 len);

bool bpf_prog_get_ok(struct bpf_prog *, enum bpf_prog_type *, bool);

int bpf_prog_offload_compile(struct bpf_prog *prog);
void bpf_prog_dev_bound_destroy(struct bpf_prog *prog);
int bpf_prog_offload_info_fill(struct bpf_prog_info *info,
			       struct bpf_prog *prog);

int bpf_map_offload_info_fill(struct bpf_map_info *info, struct bpf_map *map);

int bpf_map_offload_lookup_elem(struct bpf_map *map, void *key, void *value);
int bpf_map_offload_update_elem(struct bpf_map *map,
				void *key, void *value, u64 flags);
int bpf_map_offload_delete_elem(struct bpf_map *map, void *key);
int bpf_map_offload_get_next_key(struct bpf_map *map,
				 void *key, void *next_key);

bool bpf_offload_prog_map_match(struct bpf_prog *prog, struct bpf_map *map);

struct bpf_offload_dev *
bpf_offload_dev_create(const struct bpf_prog_offload_ops *ops, void *priv);
void bpf_offload_dev_destroy(struct bpf_offload_dev *offdev);
void *bpf_offload_dev_priv(struct bpf_offload_dev *offdev);
int bpf_offload_dev_netdev_register(struct bpf_offload_dev *offdev,
				    struct net_device *netdev);
void bpf_offload_dev_netdev_unregister(struct bpf_offload_dev *offdev,
				       struct net_device *netdev);
bool bpf_offload_dev_match(struct bpf_prog *prog, struct net_device *netdev);

void unpriv_ebpf_notify(int new_state);

#if defined(CONFIG_NET) && defined(CONFIG_BPF_SYSCALL)
int bpf_dev_bound_kfunc_check(struct bpf_verifier_log *log,
			      struct bpf_prog_aux *prog_aux);
void *bpf_dev_bound_resolve_kfunc(struct bpf_prog *prog, u32 func_id);
int bpf_prog_dev_bound_init(struct bpf_prog *prog, union bpf_attr *attr);
int bpf_prog_dev_bound_inherit(struct bpf_prog *new_prog, struct bpf_prog *old_prog);
void bpf_dev_bound_netdev_unregister(struct net_device *dev);

static inline bool bpf_prog_is_dev_bound(const struct bpf_prog_aux *aux)
{
	return aux->dev_bound;
}

static inline bool bpf_prog_is_offloaded(const struct bpf_prog_aux *aux)
{
	return aux->offload_requested;
}

bool bpf_prog_dev_bound_match(const struct bpf_prog *lhs, const struct bpf_prog *rhs);

static inline bool bpf_map_is_offloaded(struct bpf_map *map)
{
	return unlikely(map->ops == &bpf_map_offload_ops);
}

struct bpf_map *bpf_map_offload_map_alloc(union bpf_attr *attr);
void bpf_map_offload_map_free(struct bpf_map *map);
u64 bpf_map_offload_map_mem_usage(const struct bpf_map *map);
int bpf_prog_test_run_syscall(struct bpf_prog *prog,
			      const union bpf_attr *kattr,
			      union bpf_attr __user *uattr);

int sock_map_get_from_fd(const union bpf_attr *attr, struct bpf_prog *prog);
int sock_map_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);
int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value, u64 flags);
int sock_map_bpf_prog_query(const union bpf_attr *attr,
			    union bpf_attr __user *uattr);
int sock_map_link_create(const union bpf_attr *attr, struct bpf_prog *prog);

void sock_map_unhash(struct sock *sk);
void sock_map_destroy(struct sock *sk);
void sock_map_close(struct sock *sk, long timeout);
#else
static inline int bpf_dev_bound_kfunc_check(struct bpf_verifier_log *log,
					    struct bpf_prog_aux *prog_aux)
{
	return -EOPNOTSUPP;
}

static inline void *bpf_dev_bound_resolve_kfunc(struct bpf_prog *prog,
						u32 func_id)
{
	return NULL;
}

static inline int bpf_prog_dev_bound_init(struct bpf_prog *prog,
					  union bpf_attr *attr)
{
	return -EOPNOTSUPP;
}

static inline int bpf_prog_dev_bound_inherit(struct bpf_prog *new_prog,
					     struct bpf_prog *old_prog)
{
	return -EOPNOTSUPP;
}

static inline void bpf_dev_bound_netdev_unregister(struct net_device *dev)
{
}

static inline bool bpf_prog_is_dev_bound(const struct bpf_prog_aux *aux)
{
	return false;
}

static inline bool bpf_prog_is_offloaded(struct bpf_prog_aux *aux)
{
	return false;
}

static inline bool bpf_prog_dev_bound_match(const struct bpf_prog *lhs, const struct bpf_prog *rhs)
{
	return false;
}

static inline bool bpf_map_is_offloaded(struct bpf_map *map)
{
	return false;
}

static inline struct bpf_map *bpf_map_offload_map_alloc(union bpf_attr *attr)
{
	return ERR_PTR(-EOPNOTSUPP);
}

static inline void bpf_map_offload_map_free(struct bpf_map *map)
{
}

static inline u64 bpf_map_offload_map_mem_usage(const struct bpf_map *map)
{
	return 0;
}

static inline int bpf_prog_test_run_syscall(struct bpf_prog *prog,
					    const union bpf_attr *kattr,
					    union bpf_attr __user *uattr)
{
	return -ENOTSUPP;
}

#ifdef CONFIG_BPF_SYSCALL
static inline int sock_map_get_from_fd(const union bpf_attr *attr,
				       struct bpf_prog *prog)
{
	return -EINVAL;
}

static inline int sock_map_prog_detach(const union bpf_attr *attr,
				       enum bpf_prog_type ptype)
{
	return -EOPNOTSUPP;
}

static inline int sock_map_update_elem_sys(struct bpf_map *map, void *key, void *value,
					   u64 flags)
{
	return -EOPNOTSUPP;
}

static inline int sock_map_bpf_prog_query(const union bpf_attr *attr,
					  union bpf_attr __user *uattr)
{
	return -EINVAL;
}

static inline int sock_map_link_create(const union bpf_attr *attr, struct bpf_prog *prog)
{
	return -EOPNOTSUPP;
}
#endif /* CONFIG_BPF_SYSCALL */
#endif /* CONFIG_NET && CONFIG_BPF_SYSCALL */

static __always_inline void
bpf_prog_inc_misses_counters(const struct bpf_prog_array *array)
{
	const struct bpf_prog_array_item *item;
	struct bpf_prog *prog;

	if (unlikely(!array))
		return;

	item = &array->items[0];
	while ((prog = READ_ONCE(item->prog))) {
		bpf_prog_inc_misses_counter(prog);
		item++;
	}
}

#if defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL)
void bpf_sk_reuseport_detach(struct sock *sk);
int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map, void *key,
				       void *value);
int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key,
				       void *value, u64 map_flags);
#else
static inline void bpf_sk_reuseport_detach(struct sock *sk)
{
}

#ifdef CONFIG_BPF_SYSCALL
static inline int bpf_fd_reuseport_array_lookup_elem(struct bpf_map *map,
						     void *key, void *value)
{
	return -EOPNOTSUPP;
}

static inline int bpf_fd_reuseport_array_update_elem(struct bpf_map *map,
						     void *key, void *value,
						     u64 map_flags)
{
	return -EOPNOTSUPP;
}
#endif /* CONFIG_BPF_SYSCALL */
#endif /* defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL) */

#if defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL)

struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags);
struct bpf_key *bpf_lookup_system_key(u64 id);
void bpf_key_put(struct bpf_key *bkey);
int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
			       struct bpf_dynptr *sig_p,
			       struct bpf_key *trusted_keyring);

#else
static inline struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags)
{
	return NULL;
}

static inline struct bpf_key *bpf_lookup_system_key(u64 id)
{
	return NULL;
}

static inline void bpf_key_put(struct bpf_key *bkey)
{
}

static inline int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p,
					     struct bpf_dynptr *sig_p,
					     struct bpf_key *trusted_keyring)
{
	return -EOPNOTSUPP;
}
#endif /* defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL) */

/* verifier prototypes for helper functions called from eBPF programs */
extern const struct bpf_func_proto bpf_map_lookup_elem_proto;
extern const struct bpf_func_proto bpf_map_update_elem_proto;
extern const struct bpf_func_proto bpf_map_delete_elem_proto;
extern const struct bpf_func_proto bpf_map_push_elem_proto;
extern const struct bpf_func_proto bpf_map_pop_elem_proto;
extern const struct bpf_func_proto bpf_map_peek_elem_proto;
extern const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto;

extern const struct bpf_func_proto bpf_get_prandom_u32_proto;
extern const struct bpf_func_proto bpf_get_smp_processor_id_proto;
extern const struct bpf_func_proto bpf_get_numa_node_id_proto;
extern const struct bpf_func_proto bpf_tail_call_proto;
extern const struct bpf_func_proto bpf_ktime_get_ns_proto;
extern const struct bpf_func_proto bpf_ktime_get_boot_ns_proto;
extern const struct bpf_func_proto bpf_ktime_get_tai_ns_proto;
extern const struct bpf_func_proto bpf_get_current_pid_tgid_proto;
extern const struct bpf_func_proto bpf_get_current_uid_gid_proto;
extern const struct bpf_func_proto bpf_get_current_comm_proto;
extern const struct bpf_func_proto bpf_get_stackid_proto;
extern const struct bpf_func_proto bpf_get_stack_proto;
extern const struct bpf_func_proto bpf_get_stack_sleepable_proto;
extern const struct bpf_func_proto bpf_get_task_stack_proto;
extern const struct bpf_func_proto bpf_get_task_stack_sleepable_proto;
extern const struct bpf_func_proto bpf_get_stackid_proto_pe;
extern const struct bpf_func_proto bpf_get_stack_proto_pe;
extern const struct bpf_func_proto bpf_sock_map_update_proto;
extern const struct bpf_func_proto bpf_sock_hash_update_proto;
extern const struct bpf_func_proto bpf_get_current_cgroup_id_proto;
extern const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto;
extern const struct bpf_func_proto bpf_get_cgroup_classid_curr_proto;
extern const struct bpf_func_proto bpf_current_task_under_cgroup_proto;
extern const struct bpf_func_proto bpf_msg_redirect_hash_proto;
extern const struct bpf_func_proto bpf_msg_redirect_map_proto;
extern const struct bpf_func_proto bpf_sk_redirect_hash_proto;
extern const struct bpf_func_proto bpf_sk_redirect_map_proto;
extern const struct bpf_func_proto bpf_spin_lock_proto;
extern const struct bpf_func_proto bpf_spin_unlock_proto;
extern const struct bpf_func_proto bpf_get_local_storage_proto;
extern const struct bpf_func_proto bpf_strtol_proto;
extern const struct bpf_func_proto bpf_strtoul_proto;
extern const struct bpf_func_proto bpf_tcp_sock_proto;
extern const struct bpf_func_proto bpf_jiffies64_proto;
extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto;
extern const struct bpf_func_proto bpf_event_output_data_proto;
extern const struct bpf_func_proto bpf_ringbuf_output_proto;
extern const struct bpf_func_proto bpf_ringbuf_reserve_proto;
extern const struct bpf_func_proto bpf_ringbuf_submit_proto;
extern const struct bpf_func_proto bpf_ringbuf_discard_proto;
extern const struct bpf_func_proto bpf_ringbuf_query_proto;
extern const struct bpf_func_proto bpf_ringbuf_reserve_dynptr_proto;
extern const struct bpf_func_proto bpf_ringbuf_submit_dynptr_proto;
extern const struct bpf_func_proto bpf_ringbuf_discard_dynptr_proto;
extern const struct bpf_func_proto bpf_skc_to_tcp6_sock_proto;
extern const struct bpf_func_proto bpf_skc_to_tcp_sock_proto;
extern const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto;
extern const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto;
extern const struct bpf_func_proto bpf_skc_to_udp6_sock_proto;
extern const struct bpf_func_proto bpf_skc_to_unix_sock_proto;
extern const struct bpf_func_proto bpf_skc_to_mptcp_sock_proto;
extern const struct bpf_func_proto bpf_copy_from_user_proto;
extern const struct bpf_func_proto bpf_snprintf_btf_proto;
extern const struct bpf_func_proto bpf_snprintf_proto;
extern const struct bpf_func_proto bpf_per_cpu_ptr_proto;
extern const struct bpf_func_proto bpf_this_cpu_ptr_proto;
extern const struct bpf_func_proto bpf_ktime_get_coarse_ns_proto;
extern const struct bpf_func_proto bpf_sock_from_file_proto;
extern const struct bpf_func_proto bpf_get_socket_ptr_cookie_proto;
extern const struct bpf_func_proto bpf_task_storage_get_recur_proto;
extern const struct bpf_func_proto bpf_task_storage_get_proto;
extern const struct bpf_func_proto bpf_task_storage_delete_recur_proto;
extern const struct bpf_func_proto bpf_task_storage_delete_proto;
extern const struct bpf_func_proto bpf_for_each_map_elem_proto;
extern const struct bpf_func_proto bpf_btf_find_by_name_kind_proto;
extern const struct bpf_func_proto bpf_sk_setsockopt_proto;
extern const struct bpf_func_proto bpf_sk_getsockopt_proto;
extern const struct bpf_func_proto bpf_sk_setsockopt_nodelay_proto;
extern const struct bpf_func_proto bpf_unlocked_sk_setsockopt_proto;
extern const struct bpf_func_proto bpf_unlocked_sk_getsockopt_proto;
extern const struct bpf_func_proto bpf_find_vma_proto;
extern const struct bpf_func_proto bpf_loop_proto;
extern const struct bpf_func_proto bpf_copy_from_user_task_proto;
extern const struct bpf_func_proto bpf_set_retval_proto;
extern const struct bpf_func_proto bpf_get_retval_proto;
extern const struct bpf_func_proto bpf_user_ringbuf_drain_proto;
extern const struct bpf_func_proto bpf_cgrp_storage_get_proto;
extern const struct bpf_func_proto bpf_cgrp_storage_delete_proto;

const struct bpf_func_proto *tracing_prog_func_proto(
  enum bpf_func_id func_id, const struct bpf_prog *prog);

/* Shared helpers among cBPF and eBPF. */
void bpf_user_rnd_init_once(void);
u64 bpf_user_rnd_u32(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
u64 bpf_get_raw_cpu_id(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);

#if defined(CONFIG_NET)
bool bpf_sock_common_is_valid_access(int off, int size,
				     enum bpf_access_type type,
				     struct bpf_insn_access_aux *info);
bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type,
			      struct bpf_insn_access_aux *info);
u32 bpf_sock_convert_ctx_access(enum bpf_access_type type,
				const struct bpf_insn *si,
				struct bpf_insn *insn_buf,
				struct bpf_prog *prog,
				u32 *target_size);
int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags,
			       struct bpf_dynptr *ptr);
#else
static inline bool bpf_sock_common_is_valid_access(int off, int size,
						   enum bpf_access_type type,
						   struct bpf_insn_access_aux *info)
{
	return false;
}
static inline bool bpf_sock_is_valid_access(int off, int size,
					    enum bpf_access_type type,
					    struct bpf_insn_access_aux *info)
{
	return false;
}
static inline u32 bpf_sock_convert_ctx_access(enum bpf_access_type type,
					      const struct bpf_insn *si,
					      struct bpf_insn *insn_buf,
					      struct bpf_prog *prog,
					      u32 *target_size)
{
	return 0;
}
static inline int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags,
					     struct bpf_dynptr *ptr)
{
	return -EOPNOTSUPP;
}
#endif

#ifdef CONFIG_INET
struct sk_reuseport_kern {
	struct sk_buff *skb;
	struct sock *sk;
	struct sock *selected_sk;
	struct sock *migrating_sk;
	void *data_end;
	u32 hash;
	u32 reuseport_id;
	bool bind_inany;
};
bool bpf_tcp_sock_is_valid_access(int off, int size, enum bpf_access_type type,
				  struct bpf_insn_access_aux *info);

u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
				    const struct bpf_insn *si,
				    struct bpf_insn *insn_buf,
				    struct bpf_prog *prog,
				    u32 *target_size);

bool bpf_xdp_sock_is_valid_access(int off, int size, enum bpf_access_type type,
				  struct bpf_insn_access_aux *info);

u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type,
				    const struct bpf_insn *si,
				    struct bpf_insn *insn_buf,
				    struct bpf_prog *prog,
				    u32 *target_size);
#else
static inline bool bpf_tcp_sock_is_valid_access(int off, int size,
						enum bpf_access_type type,
						struct bpf_insn_access_aux *info)
{
	return false;
}

static inline u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
						  const struct bpf_insn *si,
						  struct bpf_insn *insn_buf,
						  struct bpf_prog *prog,
						  u32 *target_size)
{
	return 0;
}
static inline bool bpf_xdp_sock_is_valid_access(int off, int size,
						enum bpf_access_type type,
						struct bpf_insn_access_aux *info)
{
	return false;
}

static inline u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type,
						  const struct bpf_insn *si,
						  struct bpf_insn *insn_buf,
						  struct bpf_prog *prog,
						  u32 *target_size)
{
	return 0;
}
#endif /* CONFIG_INET */

enum bpf_text_poke_type {
	BPF_MOD_NOP,
	BPF_MOD_CALL,
	BPF_MOD_JUMP,
};

int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
		       enum bpf_text_poke_type new_t, void *old_addr,
		       void *new_addr);

void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke,
			       struct bpf_prog *new, struct bpf_prog *old);

void *bpf_arch_text_copy(void *dst, void *src, size_t len);
int bpf_arch_text_invalidate(void *dst, size_t len);

struct btf_id_set;
bool btf_id_set_contains(const struct btf_id_set *set, u32 id);

#define MAX_BPRINTF_VARARGS		12
#define MAX_BPRINTF_BUF			1024

/* Per-cpu temp buffers used by printf-like helpers to store the bprintf binary
 * arguments representation.
 */
#define MAX_BPRINTF_BIN_ARGS	512

struct bpf_bprintf_buffers {
	char bin_args[MAX_BPRINTF_BIN_ARGS];
	char buf[MAX_BPRINTF_BUF];
};

struct bpf_bprintf_data {
	u32 *bin_args;
	char *buf;
	bool get_bin_args;
	bool get_buf;
};

int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
			u32 num_args, struct bpf_bprintf_data *data);
void bpf_bprintf_cleanup(struct bpf_bprintf_data *data);
int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs);
void bpf_put_buffers(void);

void bpf_prog_stream_init(struct bpf_prog *prog);
void bpf_prog_stream_free(struct bpf_prog *prog);
int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, int len);
void bpf_stream_stage_init(struct bpf_stream_stage *ss);
void bpf_stream_stage_free(struct bpf_stream_stage *ss);
__printf(2, 3)
int bpf_stream_stage_printk(struct bpf_stream_stage *ss, const char *fmt, ...);
int bpf_stream_stage_commit(struct bpf_stream_stage *ss, struct bpf_prog *prog,
			    enum bpf_stream_id stream_id);
int bpf_stream_stage_dump_stack(struct bpf_stream_stage *ss);

#define bpf_stream_printk(ss, ...) bpf_stream_stage_printk(&ss, __VA_ARGS__)
#define bpf_stream_dump_stack(ss) bpf_stream_stage_dump_stack(&ss)

#define bpf_stream_stage(ss, prog, stream_id, expr)            \
	({                                                     \
		bpf_stream_stage_init(&ss);                    \
		(expr);                                        \
		bpf_stream_stage_commit(&ss, prog, stream_id); \
		bpf_stream_stage_free(&ss);                    \
	})

#ifdef CONFIG_BPF_LSM
void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype);
void bpf_cgroup_atype_put(int cgroup_atype);
#else
static inline void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype) {}
static inline void bpf_cgroup_atype_put(int cgroup_atype) {}
#endif /* CONFIG_BPF_LSM */

struct key;

#ifdef CONFIG_KEYS
struct bpf_key {
	struct key *key;
	bool has_ref;
};
#endif /* CONFIG_KEYS */

static inline bool type_is_alloc(u32 type)
{
	return type & MEM_ALLOC;
}

static inline gfp_t bpf_memcg_flags(gfp_t flags)
{
	if (memcg_bpf_enabled())
		return flags | __GFP_ACCOUNT;
	return flags;
}

static inline bool bpf_is_subprog(const struct bpf_prog *prog)
{
	return prog->aux->func_idx != 0;
}

const struct bpf_line_info *bpf_find_linfo(const struct bpf_prog *prog, u32 insn_off);
void bpf_get_linfo_file_line(struct btf *btf, const struct bpf_line_info *linfo,
			     const char **filep, const char **linep, int *nump);
int bpf_prog_get_file_line(struct bpf_prog *prog, unsigned long ip, const char **filep,
			   const char **linep, int *nump);
struct bpf_prog *bpf_prog_find_from_stack(void);

int bpf_insn_array_init(struct bpf_map *map, const struct bpf_prog *prog);
int bpf_insn_array_ready(struct bpf_map *map);
void bpf_insn_array_release(struct bpf_map *map);
void bpf_insn_array_adjust(struct bpf_map *map, u32 off, u32 len);
void bpf_insn_array_adjust_after_remove(struct bpf_map *map, u32 off, u32 len);

#ifdef CONFIG_BPF_SYSCALL
void bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image);
#else
static inline void
bpf_prog_update_insn_ptrs(struct bpf_prog *prog, u32 *offsets, void *image)
{
}
#endif

static inline bool bpf_map_supports_cpu_flags(enum bpf_map_type map_type)
{
	switch (map_type) {
	case BPF_MAP_TYPE_PERCPU_ARRAY:
	case BPF_MAP_TYPE_PERCPU_HASH:
	case BPF_MAP_TYPE_LRU_PERCPU_HASH:
	case BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE:
		return true;
	default:
		return false;
	}
}

static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 allowed_flags)
{
	u32 cpu;

	if ((u32)flags & ~allowed_flags)
		return -EINVAL;

	if ((flags & BPF_F_LOCK) && !btf_record_has_field(map->record, BPF_SPIN_LOCK))
		return -EINVAL;

	if (!(flags & BPF_F_CPU) && flags >> 32)
		return -EINVAL;

	if (flags & (BPF_F_CPU | BPF_F_ALL_CPUS)) {
		if (!bpf_map_supports_cpu_flags(map->map_type))
			return -EINVAL;
		if ((flags & BPF_F_CPU) && (flags & BPF_F_ALL_CPUS))
			return -EINVAL;

		cpu = flags >> 32;
		if ((flags & BPF_F_CPU) && cpu >= num_possible_cpus())
			return -ERANGE;
	}

	return 0;
}

#endif /* _LINUX_BPF_H */
]

gemini-3-flash-preview

							input: 128125
							output: 36
							thoughts: 647
						

**Analyzing Potential Overflow Vulnerabilities in `kernel/bpf/helpers.c`**

Okay, so I've been looking into the memory management within the BPF printf-like helpers, and the user's question about unchecked return values from `snprintf` is key. My initial focus was on identifying instances of potential buffer overflows. I've noted the buffer size limitations: `MAX_BPRINTF_VARARGS` (12), `MAX_BPRINTF_BUF` (1024), and, crucially, `MAX_BPRINTF_BIN_ARGS` (512 bytes). It appears the `bin_args` buffer, holding intermediate representations of the arguments, is limited to 512 bytes.

I understand that `snprintf` is employed to format, specifically, `%pB` and `%pI4`/`%pI6` specifiers into this `bin_args` buffer. The problem is that the symbol name within `%pB` can be quite long. Even though there's `KSYM_NAME_LEN` (128 bytes), `%pB` also incorporates the offset and module name. This easily expands the string beyond 128 bytes, and if multiple `%pB` formats are used in a single string, the 512-byte limit on the `bin_args` buffer can easily be exceeded. I have already identified a few of these in `bpf_bprintf_prepare`.

The user's question is to identify *other* locations.

I now need to broaden the search beyond my initial findings. I'll need to check the implementation of `bpf_snprintf` itself, which, as I understand, provides a wrapper around the functionality. Let's examine `____bpf_snprintf`.

Looking at the code, it calls `bpf_bprintf_prepare`, which I've already scrutinized. Then, `bpf_snprintf` uses `bstr_printf` to actually perform the formatted output. `bstr_printf` is, from what I know, implemented in `lib/vsprintf.c`. The return value of `bstr_printf` is the number of characters written, not including the null terminator. `bpf_snprintf` returns this value + 1, which is, generally, how the standard `snprintf` works: it shows how many characters would have been written had there been sufficient space.

Given this, I have to go through the code again for other potential issues related to checking the return value.

map[ContextFile:kernel/bpf/helpers.c Name:bstr_printf]

map[Comment:/**
 * bstr_printf - Format a string from binary arguments and place it in a buffer
 * @buf: The buffer to place the result into
 * @size: The size of the buffer, including the trailing null space
 * @fmt_str: The format string to use
 * @bin_buf: Binary arguments for the format string
 *
 * This function like C99 vsnprintf, but the difference is that vsnprintf gets
 * arguments from stack, and bstr_printf gets arguments from @bin_buf which is
 * a binary buffer that generated by vbin_printf.
 *
 * The format follows C99 vsnprintf, but has some extensions:
 *  see vsnprintf comment for details.
 *
 * The return value is the number of characters which would
 * be generated for the given input, excluding the trailing
 * '\0', as per ISO C99. If you want to have the exact
 * number of characters written into @buf as return value
 * (not including the trailing '\0'), use vscnprintf(). If the
 * return is greater than or equal to @size, the resulting
 * string is truncated.
 */
 Kind:function]

gemini-3-flash-preview

							input: 129627
							output: 38
							thoughts: 301
						

**Analyzing `snprintf` Behavior in the BPF Kernel Helpers**

Okay, so I'm digging into how `bstr_printf` and `bpf_snprintf` work, and I'm a bit puzzled. It seems like `bstr_printf` is designed to function like `vsnprintf`, which is pretty standard. But the return value of `bpf_snprintf` being `err + 1` is raising a flag. I'm used to `snprintf` returning the number of characters written *without* including the null terminator. So, if `bstr_printf` is also playing by those rules, then `bpf_snprintf` returning `length + 1` implies it's including the null byte in the returned value. That feels slightly non-standard.

I need to confirm if my understanding of the standard `snprintf` return value is correct – it should be the *would-be* length excluding the NUL, right? If so, this offset of `+1` in `bpf_snprintf` does set it apart from standard `snprintf`. I need to remember that difference!

My main goal is understanding the calls to `snprintf` within `kernel/bpf/helpers.c`, as the prompt directed me there. Right now, I've only found two calls to `snprintf`, and both are located within `bpf_bprintf_prepare`. That seems pretty focused.

However, I need to make sure I'm not missing anything. The prompt specifically mentioned `helpers.c`, but could `snprintf` be used in another helper function, or perhaps somewhere else in the BPF kernel code? Just to be thorough, I'm going to quickly search the entire `kernel/bpf/` directory for any other instances of `snprintf`. I'll broaden the scope a bit, just to eliminate the possibility of overlooking something.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__func_get_name SourceFile:kernel/bpf/disasm.c SourceLine:36 SourceSnippet:  35:		if (insn->src_reg == BPF_PSEUDO_CALL)
  36:			snprintf(buff, len, "%+d", insn->imm);
  37:		else if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL)
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__func_get_name SourceFile:kernel/bpf/disasm.c SourceLine:38 SourceSnippet:  37:		else if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL)
  38:			snprintf(buff, len, "kernel-function");
  39:	
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__func_imm_name SourceFile:kernel/bpf/disasm.c SourceLine:50 SourceSnippet:  49:	
  50:		snprintf(buff, len, "0x%llx", (unsigned long long)full_imm);
  51:		return buff;
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_fmt_stack_mask SourceFile:kernel/bpf/backtrack.c SourceLine:239 SourceSnippet: 238:		for_each_set_bit(i, mask, 64) {
 239:			n = snprintf(buf, buf_sz, "%s%d", first ? "" : ",", -(i + 1) * 8);
 240:			first = false;
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_prog_ksym_set_name SourceFile:kernel/bpf/core.c SourceLine:581 SourceSnippet: 580:	
 581:		sym += snprintf(sym, KSYM_NAME_LEN, "bpf_prog_");
 582:		sym  = bin2hex(sym, prog->tag, sizeof(prog->tag));
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_prog_ksym_set_name SourceFile:kernel/bpf/core.c SourceLine:589 SourceSnippet: 588:			func_name = btf_name_by_offset(prog->aux->btf, type->name_off);
 589:			snprintf(sym, (size_t)(end - sym), "_%s", func_name);
 590:			return;
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_prog_ksym_set_name SourceFile:kernel/bpf/core.c SourceLine:594 SourceSnippet: 593:		if (prog->aux->name[0])
 594:			snprintf(sym, (size_t)(end - sym), "_%s", prog->aux->name);
 595:		else
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_struct_ops_ksym_init SourceFile:kernel/bpf/bpf_struct_ops.c SourceLine:647 SourceSnippet: 646:	{
 647:		snprintf(ksym->name, KSYM_NAME_LEN, "bpf__%s_%s", tname, mname);
 648:		INIT_LIST_HEAD_RCU(&ksym->lnode);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_tramp_image_alloc SourceFile:kernel/bpf/trampoline.c SourceLine:592 SourceSnippet: 591:		INIT_LIST_HEAD_RCU(&ksym->lnode);
 592:		snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", key);
 593:		bpf_image_ksym_init(image, size, ksym);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_check_iter_kfuncs SourceFile:kernel/bpf/btf.c SourceLine:8662 SourceSnippet:8661:	
8662:		snprintf(exp_name, sizeof(exp_name), "bpf_iter_%s_%s", iter_name, sfx);
8663:		if (strcmp(func_name, exp_name))
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_nested_type_is_trusted SourceFile:kernel/bpf/btf.c SourceLine:9592 SourceSnippet:9591:	
9592:		ret = snprintf(safe_tname, sizeof(safe_tname), "%s%s", tname, suffix);
9593:		if (ret >= sizeof(safe_tname))
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_show_name SourceFile:kernel/bpf/btf.c SourceLine:1215 SourceSnippet:1214:		if (show->flags & BTF_SHOW_NONAME)
1215:			snprintf(show->state.name, sizeof(show->state.name), "%s",
1216:				 parens);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_show_name SourceFile:kernel/bpf/btf.c SourceLine:1218 SourceSnippet:1217:		else
1218:			snprintf(show->state.name, sizeof(show->state.name),
1219:				 "%s%s%s(%s%s%s%s%s%s)%s",
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:find_kfunc_impl_proto SourceFile:kernel/bpf/verifier.c SourceLine:2912 SourceSnippet:2911:	
2912:		len = snprintf(buf, TMP_STR_BUF_LEN, "%s%s", func_name, KF_IMPL_SUFFIX);
2913:		if (len < 0 || len >= TMP_STR_BUF_LEN) {
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fmt_instance SourceFile:kernel/bpf/liveness.c SourceLine:419 SourceSnippet: 418:	{
 419:		snprintf(env->tmp_str_buf, sizeof(env->tmp_str_buf),
 420:			 "(d%d,cs%d)", instance->depth, instance->callsite);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fmt_reg_mask SourceFile:kernel/bpf/backtrack.c SourceLine:220 SourceSnippet: 219:		for_each_set_bit(i, mask, 32) {
 220:			n = snprintf(buf, buf_sz, "%sr%d", first ? "" : ",", i);
 221:			first = false;
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fmt_subprog SourceFile:kernel/bpf/liveness.c SourceLine:412 SourceSnippet: 411:	
 412:		snprintf(env->tmp_str_buf, sizeof(env->tmp_str_buf),
 413:			 "subprog#%d%s%s", subprog, name ? " " : "", name ? name : "");
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:format_callchain SourceFile:kernel/bpf/states.c SourceLine:144 SourceSnippet: 143:	
 144:		delta += snprintf(buf + delta, TMP_STR_BUF_LEN - delta, "(");
 145:		for (i = 0; i < ARRAY_SIZE(callchain->callsites); i++) {
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:format_callchain SourceFile:kernel/bpf/states.c SourceLine:148 SourceSnippet: 147:				break;
 148:			delta += snprintf(buf + delta, TMP_STR_BUF_LEN - delta, "%u,",
 149:					  callchain->callsites[i]);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:format_callchain SourceFile:kernel/bpf/states.c SourceLine:151 SourceSnippet: 150:		}
 151:		delta += snprintf(buf + delta, TMP_STR_BUF_LEN - delta, "%u)", callchain->scc);
 152:		return env->tmp_str_buf;
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:reg_type_str SourceFile:kernel/bpf/log.c SourceLine:435 SourceSnippet: 434:	
 435:		snprintf(prefix, sizeof(prefix), "%s%s%s%s%s%s%s",
 436:			 type & MEM_RDONLY ? "rdonly_" : "",
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:reg_type_str SourceFile:kernel/bpf/log.c SourceLine:445 SourceSnippet: 444:	
 445:		snprintf(env->tmp_str_buf, TMP_STR_BUF_LEN, "%s%s%s",
 446:			 prefix, str[base_type(type)], postfix);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tnum_strn SourceFile:kernel/bpf/log.c SourceLine:543 SourceSnippet: 542:			if (is_unum_decimal(a.value))
 543:				return snprintf(str, size, "%llu", a.value);
 544:			if (is_snum_decimal(a.value))
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tnum_strn SourceFile:kernel/bpf/log.c SourceLine:545 SourceSnippet: 544:			if (is_snum_decimal(a.value))
 545:				return snprintf(str, size, "%lld", a.value);
 546:			else
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tnum_strn SourceFile:kernel/bpf/log.c SourceLine:547 SourceSnippet: 546:			else
 547:				return snprintf(str, size, "%#llx", a.value);
 548:		}
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:tnum_strn SourceFile:kernel/bpf/log.c SourceLine:549 SourceSnippet: 548:		}
 549:		return snprintf(str, size, "(%#llx; %#llx)", a.value, a.mask);
 550:	}
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 133711
							output: 34
							thoughts: 627
						

**Analyzing Potential Security Vulnerabilities in `kernel/bpf/helpers.c`**

Okay, so the user specifically honed in on `kernel/bpf/helpers.c`, likely looking for `snprintf` vulnerabilities.  My initial assessment flagged only two calls to `snprintf`.  But I'm not going to be complacent; I need to be thorough. First, I wanted to double-check my initial `codesearch-find-references` with a `grep` through the file. Though, I know I've read this file, so I already know that I will find nothing new there.

Right, let's go back and carefully re-examine the `bpf_bprintf_prepare` function. Line by line.  Specifically, this block:

```c
 922:				if (fmt[i + 1] == 'B') {
 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
 926:							       "%pB",
 927:							       (void *)(long)raw_args[num_spec]);
 928:						tmp_buf += (err + 1);
 929:					}
 930:	
 931:					i++;
 932:					num_spec++;
 933:					continue;
 934:				}
```

Wait a second... what if `tmp_buf` is NULL? The code handles this with `if (tmp_buf)`. Okay, good. But if `tmp_buf` is *not* NULL, then there's an `snprintf`. And the return value, `err`, *is* the number of characters that would be written (not necessarily the number actually written), and if `err >= (tmp_buf_end - tmp_buf)`, that means truncation occurred.  The real problem here is that `tmp_buf` is then incremented by `err + 1`. If `err` is large and truncation occurred, then this looks like a *significant* bug. Potential buffer overflow alert!

Alright, time to expand my search.  Is there *anywhere* else `snprintf` might be lurking in `kernel/bpf/helpers.c`?  I'll search again, and this time, I'll be more mindful of any variations I might have missed. Ah, I see a reference to `bpf_snprintf_btf`. Interesting.

```c
extern const struct bpf_func_proto bpf_snprintf_btf_proto;
```

I didn't see it when I first went through, so I need to find the definition of this. It's probably in either `kernel/bpf/btf.c` or, I suppose, *potentially* still in `kernel/bpf/helpers.c`, though unlikely since I just went through the file. I know I didn't see it in `helpers.c`, so now I'll look over in `kernel/bpf/btf.c`.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf_proto]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 135093
							output: 44
							thoughts: 20
						

Okay, here's my summary, presented as a stream of thought:

**Diving into the BTF Snprintf Implementation**

Alright, I need to understand how `bpf_snprintf_btf` works. Given the context, I think the best approach is to start with a comprehensive code search. I'm going to leverage my familiarity with the codebase to quickly locate every instance of `bpf_snprintf_btf`. This will give me a solid overview of its usage patterns and where it fits within the broader BTF (BPF Type Format) infrastructure. I expect this initial search will reveal important call sites, dependencies, and potential interactions with other BPF functions. This should allow me to formulate a more targeted strategy for deeper analysis.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 135335
							output: 46
							thoughts: 17
						

Here's your summary:

**Initial Investigation: The `bpf_snprintf_btf` String**

Okay, so I need to track down where this `bpf_snprintf_btf` string is being used. Given my background, I'm immediately thinking this likely points to some interaction with the BPF (Berkeley Packet Filter) and possibly BTF (BPF Type Format) data. I'll initiate a search for that specific string within the relevant codebase. I need to understand the context of its usage. Is it in kernel code? User space tools? Compiler toolchains? Understanding the code it exists in is essential. The `snprintf` function suggests it's likely formatting something, so I need to figure out what data is being formatted and for what purpose within this BPF/BTF context. This could be crucial for debugging, performance analysis, or understanding the overall system architecture. I'll need to pay close attention to the surrounding code to determine its role.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf_proto SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 135626
							output: 46
							thoughts: 223
						

**Debugging a `codesearch-find-references` Issue**

Okay, I'm hitting a snag with `codesearch-find-references` – it's not quite giving me what I need. My initial instinct was to fall back on `grep`, utilizing `codesearch-dir-index` to locate the files and then manually `read-file` them. But wait, I should really give `codesearch-find-references` another shot, but with a more generous search scope. I've been down this road before, haven't I?

Ah, right. I remember now. I already did that, and it actually did uncover `bpf_snprintf_btf_proto` within `kernel/bpf/helpers.c`, specifically on line 763, within the context of `bpf_base_func_proto`. Now I remember.

Let's double-check the `read-file` output for `kernel/bpf/helpers.c` to be certain. Yes, there it is again, line 763:

```c
	case BPF_FUNC_snprintf_btf:
		return &bpf_snprintf_btf_proto;
```

Right, so I know where it's *used*, but not where it's *defined*. It's almost certainly declared as `extern`. So, the next step is obvious: I'll focus my search for a definition of `bpf_snprintf_btf_proto` within the `kernel/bpf/` directory. That's the logical next step.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf_proto SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 136259
							output: 50
							thoughts: 15
						

Okay, here's my interpretation of those thoughts, crafted with the understanding that I'm speaking to a fellow expert:

**Investigating BPF with Grep**

Alright, let's see... I'm thinking I'll start with `grep`. It's a quick and dirty way to get a handle on things, especially in a vast codebase like the kernel. Specifically, I'm going to aim it at the `kernel/bpf/` directory. That's the obvious starting point when dealing with anything BPF-related. This should quickly give me a list of relevant files and hopefully reveal some interesting leads, maybe function calls or variable names that catch my eye. It's a pragmatic first step to scoping out the landscape before diving into anything more complex or specialized. Let's see what that uncovers.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf_proto SourceTreePrefix:kernel/bpf/btf.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 136519
							output: 48
							thoughts: 22
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Investigating a BTF-Related BPF Snprintf Function**

Alright, let's dive into this. My initial thought is to zero in on `bpf_snprintf_btf`. Now, before I get too deep into any specifics, I think it's worth starting with a more general search query: I'll search for `bpf_snprintf_btf` – no need to narrow it down initially with the inclusion of the `_proto` extension at this stage. That approach should give me a good baseline view of the current code base. Let me try that... and then I'll see what the results tell me.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf SourceTreePrefix:kernel/bpf/btf.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 136767
							output: 42
							thoughts: 47
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Debugging BTF Snprintf Issues**

Ugh, this is getting tedious. I'm hitting a wall here, and the usual debugging tricks aren't yielding the insights I need. Alright, let's cut the fluff and go straight to the source. Time to dive into `kernel/bpf/btf.c` and get my hands dirty. I'm going to bypass the higher level abstractions for a minute and go right to the code.

Actually, before I waste time with a brute force examination, let's zero in. I'm seeing something specific, right? I'll search for `snprintf` within `kernel/bpf/btf.c`. That's likely the culprit in these formatting issues I'm chasing. Hopefully, this narrows the scope down and I can quickly pinpoint the problem in the implementation or usage of `snprintf` related to BTF. Let's see what that search turns up...

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/btf.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_check_iter_kfuncs SourceFile:kernel/bpf/btf.c SourceLine:8662 SourceSnippet:8661:	
8662:		snprintf(exp_name, sizeof(exp_name), "bpf_iter_%s_%s", iter_name, sfx);
8663:		if (strcmp(func_name, exp_name))
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_nested_type_is_trusted SourceFile:kernel/bpf/btf.c SourceLine:9592 SourceSnippet:9591:	
9592:		ret = snprintf(safe_tname, sizeof(safe_tname), "%s%s", tname, suffix);
9593:		if (ret >= sizeof(safe_tname))
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_show_name SourceFile:kernel/bpf/btf.c SourceLine:1215 SourceSnippet:1214:		if (show->flags & BTF_SHOW_NONAME)
1215:			snprintf(show->state.name, sizeof(show->state.name), "%s",
1216:				 parens);
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:btf_show_name SourceFile:kernel/bpf/btf.c SourceLine:1218 SourceSnippet:1217:		else
1218:			snprintf(show->state.name, sizeof(show->state.name),
1219:				 "%s%s%s(%s%s%s%s%s%s)%s",
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 137576
							output: 41
							thoughts: 340
						

**My Assessment of Potential Security Issues in BPF Helper Functions**

Okay, let's see. My initial thought process focused on `btf_nested_type_is_trusted`. It checks the return value of `snprintf` properly: if it's equal or greater than the buffer size, there's a problem. That's good. But I need to dive deeper.

My immediate question was about `btf_show_name`. The code uses `snprintf`, but there's no return value check. However, the `show->state.name` buffer is fixed-size. So, truncation is probably acceptable here since this is just display and not for security critical processing.

But the real focus here is `kernel/bpf/helpers.c`.

I've already examined `bpf_bprintf_prepare` thoroughly, looking for vulnerabilities related to `snprintf`. I've checked for calls to `snprintf`, `sprintf`, and `vsnprintf`.

Wait, there's a potential blind spot, `bpf_trace_printk`. It's in `kernel/trace/bpf_trace.c`, right? No, I need to stick to `kernel/bpf/helpers.c`. Even though `bpf_snprintf` is defined in `kernel/bpf/helpers.c`.

Okay, I need to be absolutely certain. I'm going to re-examine the `snprintf` calls within `kernel/bpf/helpers.c` again. I'll use `grep -n "snprintf" kernel/bpf/helpers.c` to make sure I don't miss anything.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 138558
							output: 41
							thoughts: 960
						

**Analyzing snprintf Usage in BPF Context**

Alright, I'm initially pretty confident I've pinpointed the relevant instances of `snprintf`. But, as always, it's crucial to double-check. I'm going to revisit my earlier analysis of the `read-file` output, specifically looking for `bpf_bprintf_prepare` and any other potential uses.

Hang on... I've got to consider the `bpf_snprintf` helper, but it appears it doesn't *directly* call `snprintf`, that's a key distinction. And I should also track down the definition of the `bpf_snprintf_btf` function, which is likely in `kernel/bpf/btf.c`.

Now, let's broaden the search a bit. I need to scan `kernel/bpf/helpers.c` for any other string formatting functions. Ah, `bpf_trace_copy_string` uses `strncpy_from_kernel_nofault` which is good to know. But, are there any *other* uses of `snprintf`, perhaps hidden within a macro? Time to go through the `read-file` output again. I'll search for `snprintf` in the `helpers.c` file content. I've got the whole file contents from the earlier `read-file` output.

Okay, I'm seeing it. At line 924 and 965, there are two distinct calls to `snprintf`. There's also `bpf_snprintf` at line 1064, but that's not calling `snprintf` directly.

Wait, I need to understand that `ip_spec` variable. It's using `snprintf` to format an IP address into `tmp_buf`. It is at line 965. This is essential to understand, as it is a format of the argument and how it is formatted.

Okay, are there any *other* calls? Time to use `grep` on my `read-file` output and narrow my search to find all instances of `snprintf`. Okay, grep results are in. I see `snprintf` at:
- 924
- 965
- 1064 (part of `bpf_snprintf` name)
- 1089 (part of `bpf_snprintf_proto` name)
- 763 (part of `BPF_FUNC_snprintf_btf` name)
- 764 (part of `bpf_snprintf_btf_proto` name)
- 765 (part of `BPF_FUNC_snprintf` name)
- 766 (part of `bpf_snprintf_proto` name)

I need to confirm the use of `bpf_snprintf_btf`. Looks like it is not in `kernel/bpf/helpers.c`.

To be absolutely sure, I'll search for `snprintf(` (with the parenthesis) within the `read-file` output. That should filter out any false positives from function names, etc.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 140492
							output: 42
							thoughts: 98
						

Here's my thought process, summarized as requested:

**Navigating the `bpf_bprintf_prepare` Conundrum**

Okay, just these two instances. That's what I initially concluded. But, hang on... the user specifically used the word "**other**" in their question, "Is there any **other** place...". That's a key detail! They might be looking *outside* of `bpf_bprintf_prepare` entirely. My initial focus was too narrow.

Right, so I didn't find anything outside the `bpf_bprintf_prepare` function, but I need to be *absolutely* sure. Just to be completely thorough, I'm going to re-examine `kernel/bpf/helpers.c` and specifically look for `vsnprintf`. I already looked, but it doesn't hurt to double-check. I need to leave no stone unturned in this investigation, especially given the "other" clue. The potential implications are significant, so thoroughness is paramount.

map[IncludeSnippetLines:1 Name:vsnprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 140870
							output: 41
							thoughts: 7
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Regarding `scnprintf` and its Potential**

Hmm, as I'm considering this, the thought that keeps recurring is the potential applicability of `scnprintf`. Could it actually fit into this situation? I'm already envisioning its strengths and possible pitfalls. It offers a certain level of control, but the implications for memory safety and potential buffer overflows are immediately pressing. I need to quickly assess if the benefits, specifically regarding format string parsing and potential control over the output format, outweigh the risks in this specific context. The need for that granular control is the key driver of this consideration. I must consider the ease of implementation with other options and the resulting security posture.

map[IncludeSnippetLines:1 Name:scnprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 141098
							output: 42
							thoughts: 8
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating a Printf-like Function**

Hmm, I'm thinking about string formatting and output, and specifically, what options are available. I need to consider all the possibilities. My initial thought is to explore how to get this done in a memory-efficient way, potentially avoiding unnecessary copies. The core concept here is about efficient variable argument lists. So, what about `vscnprintf`? Does that give me the flexibility and safety I'm looking for in this scenario? I need to weigh the trade-offs: performance, safety, and ease of use. Is `vscnprintf` the correct tool for the job? I need to analyze it further.

map[IncludeSnippetLines:1 Name:vscnprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 141330
							output: 40
							thoughts: 6
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert and adopting a first-person perspective:

**Considering `sprintf` for this Task**

Hmm, now that I'm considering the approach for formatting this, the question of using `sprintf` pops into my head. It's a classic, isn't it? I have to consider the potential for its vulnerabilities related to buffer overflows, and the fact that it's generally considered less safe than some of the newer formatting tools available. However, in certain constrained contexts where performance is critical and I have absolute control over the input, it *could* be considered. I'd have to carefully evaluate if the trade-off of potentially easier syntax (depending on the exact formatting required) is worth the additional scrutiny needed to ensure safety. It depends, really, on the specifics of this situation. Is it a quick-and-dirty script, or a core library function? That will heavily influence my decision. I need to weigh the readability and maintainability against the risks.

map[IncludeSnippetLines:1 Name:sprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 141616
							output: 41
							thoughts: 7
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**The `vsprintf` Conundrum**

Hmm, so the task at hand… I'm thinking about the low-level formatting aspects here. My initial gut reaction is to immediately consider `vsprintf`. It's a powerful tool, no question. The ability to handle variable argument lists directly is incredibly tempting for the flexibility it offers. I can see the immediate appeal for dynamic string construction and the control it provides over the formatting process. But, that also means I need to be careful with the implementation and know its limitations. Is it actually the right approach? I'll need to carefully consider the potential pitfalls, security implications, and potential performance bottlenecks associated with using that function. I need to balance the convenience with the potential risks.

map[IncludeSnippetLines:1 Name:vsprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 141859
							output: 45
							thoughts: 536
						

**My BPF `snprintf` Investigation**

Okay, so the user's initial concern seems focused on `snprintf` calls within `bpf_bprintf_prepare`. Right, that's the starting point. I need to be methodical.

Wait, the user's concern about `snprintf` in the kernel code. Let me quickly scan, is there any other place in `kernel/bpf/helpers.c` that uses `snprintf` directly outside of a function call? No, that wouldn't make sense, so it's not a global declaration or something odd.

Maybe the concern is with the helper function, `bpf_snprintf` itself? But that calls `bstr_printf`.

Okay, let me trace this: does `bstr_printf`'s return value get handled correctly within `bpf_snprintf`? Let me see the code… Yep, line 1083 calls `bstr_printf`, then line 1087 correctly adds 1 to the error. `bstr_printf` returns *would* have been written, and the return from `bpf_snprintf` correctly indicates the required size, including the null terminator. If `err >= str_size`, we know truncation happened. This looks correct based on the documentation of the helper.

Wait, I should confirm I haven't missed any direct uses of `snprintf` elsewhere in `kernel/bpf/helpers.c`. Even though I scanned before, I'll search for `snprintf` in the output again, carefully.

I've already listed them from the search, I've checked.

Wait, I see `bpf_snprintf_btf`! Oh, no, that's just in the `switch` statement in `bpf_base_func_proto`, that's not a direct call, it's just a case statement.

Let's expand the scope: could `snprintf` be used in some other "helper-like" function in another file within `kernel/bpf/`? The user explicitly said `kernel/bpf/helpers.c`, so I should stick to the stated scope.

Okay, I'm going to step through the list of functions in `kernel/bpf/helpers.c` once more. I'll use `codesearch-file-index`, but I've already done that to be efficient.

Wait, I see `bpf_obj_name_cpy`. I'll check that one.

map[ContextFile:kernel/bpf/helpers.c IncludeLines:true Name:bpf_obj_name_cpy]

map[SourceCode:1205:	/* dst and src must have at least "size" number of bytes.
1206:	 * Return strlen on success and < 0 on error.
1207:	 */
1208:	int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size)
1209:	{
1210:		const char *end = src + size;
1211:		const char *orig_src = src;
1212:	
1213:		memset(dst, 0, size);
1214:		/* Copy all isalnum(), '_' and '.' chars. */
1215:		while (src < end && *src) {
1216:			if (!isalnum(*src) &&
1217:			    *src != '_' && *src != '.')
1218:				return -EINVAL;
1219:			*dst++ = *src++;
1220:		}
1221:	
1222:		/* No '\0' found in "size" number of bytes */
1223:		if (src == end)
1224:			return -EINVAL;
1225:	
1226:		return src - orig_src;
1227:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3-flash-preview

							input: 143338
							output: 41
							thoughts: 226
						

**Analyzing String Formatting in `kernel/bpf/helpers.c`**

Okay, first things first. I need to be absolutely precise with this. The user is asking about *other* instances of `snprintf` in `kernel/bpf/helpers.c` that lack proper return value checks. I already identified `bpf_bprintf_prepare`, but the key here is the "other" part. They likely already know about *that* instance, so I need to make sure I haven't missed anything else in that specific file.

I initially spotted `bpf_obj_name_cpy` in `kernel/bpf/syscall.c` and saw some evidence of it in `include/linux/bpf.h`, but that's not the relevant file. The user's question is explicitly focused on `kernel/bpf/helpers.c`, so my focus should remain there.

To be thorough, I will use `grep` again, but this time I'll run a completely unfiltered search for `snprintf` calls within `kernel/bpf/helpers.c`. I need to ensure I haven't missed any instances during my previous quick scan. Once I have the output from the full grep, I will be able to confirm definitively if only the two places in `bpf_bprintf_prepare` utilize `snprintf`. If I confirm there are no others, my answer is "No, other than `bpf_bprintf_prepare`." If there *are* other places, I'll need to analyze them carefully to see if they, too, exhibit the concerning behavior. I must be precise with my answer; if I don't give the complete picture, I may be misleading the user.

map[IncludeSnippetLines:1 Name:snprintf SourceTreePrefix:kernel/bpf/helpers.c]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:924 SourceSnippet: 923:					if (tmp_buf)  {
 924:						err = snprintf(tmp_buf,
 925:							       (tmp_buf_end - tmp_buf),
] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:bpf_bprintf_prepare SourceFile:kernel/bpf/helpers.c SourceLine:965 SourceSnippet: 964:				ip_spec[3] = fmt[i];
 965:				err = snprintf(tmp_buf, tmp_buf_end - tmp_buf,
 966:					       ip_spec, &cur_ip);
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 144219
							output: 41
							thoughts: 181
						

**Investigating Potential `snprintf` Usage in BPF Helpers**

Alright, I've run several searches, and it seems I'm only turning up these two instances. Before I dive too deep, let me double-check. I need to be absolutely certain no other `snprintf` calls are hiding within `kernel/bpf/helpers.c`, *outside* of `bpf_bprintf_prepare`. Let's see... my `codesearch-find-references` output *should* be exhaustive... and yes, it confirms that `bpf_bprintf_prepare` is the *only* place. Good.

Now, hold on a second. While I was specifically told `kernel/bpf/helpers.c`, it's always wise to cast a wider net. Is there *anything* else in the `kernel/bpf/` directory that might be a relevant file to consider, just to make sure I'm not missing something subtle? No, the directive was specific.

Okay, here's a thought: Could `snprintf` be lurking within a macro defined in `kernel/bpf/helpers.c`? That's a sneaky possibility. Let's not assume anything. I'll need to meticulously examine the macros in that file. Time to bust out `grep "^#define kernel/bpf/helpers.c"` and see what's what. Gotta be thorough.

log-in to see details

map[IncludeSnippetLines:1 Name:#define SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 144762
							output: 40
							thoughts: 149
						

**My Initial Investigation into Potential Kernel Vulnerabilities**

Okay, so I have this file open, and the first thing I'll do is just read through it and scan for any macros, especially those that might be related to string handling. I mean, I *already* have the file content in front of me, so that's the starting point. Let me see... Aha, I see a couple of macros in `kernel/bpf/helpers.c`: `BPF_STRTOX_BASE_MASK` on line 424 and `MAX_BPRINTF_NEST_LEVEL` on line 784.

But neither of these looks like they're directly using `snprintf`, which is good. However, that's not enough; I need to be more thorough here. Before I write this off, I really need to broaden my search. I should check for any other string formatting functions, even if `snprintf` is the most obvious.

Right, I've already checked for `sprintf`, `vsnprintf`, `scnprintf`, and `vscnprintf`. Let's not forget the usual suspects, even though they're usually avoided in kernel code. What about `strcat`, `strcpy`, and `strncpy`? They're often red flags, so I'll need to double-check their usage very carefully. Let's see what turns up.

map[IncludeSnippetLines:1 Name:strcpy SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 145263
							output: 41
							thoughts: 5
						

Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person:

**`strcat` - A Flash of Familiarity, then a Quick Review**

Ah, `strcat`. The word just popped into my head. I immediately think of string concatenation in C, the standard library function. My initial reaction is a slight eyebrow raise, a flicker of "Really? We're still talking about this?" because, honestly, I try to steer clear of it when possible. It's that old reliable, isn't it? But, along with its reliability, comes its fragility.

My mind immediately starts running through the usual caveats: buffer overflows, the potential for undefined behavior if the destination buffer isn't large enough. I'm reminded of the numerous security vulnerabilities that have arisen from its misuse. I can almost visualize the old coding guidelines, the "always check your bounds!" mantra echoing in my head. I picture the alternatives, the safer options we often lean towards like `strncpy`, but even then, there's the `NULL` termination that needs to be handled carefully. And, of course, the C++ options, the `std::string` class, which offers so much more in terms of safety and ease of use.

So, I'm mentally parsing the memory layout involved, considering the implications of pointer arithmetic and the need for meticulous memory management if I were ever forced to use it. I'm thinking about the performance implications; whether, in this context, the overhead of a safer function or class might be justifiable. The trade-offs are immediately apparent. It's a reminder of the raw, low-level nature of C, the responsibility it places on the programmer. In a quick moment, I'm already mentally comparing it to other string functions, thinking about the situations where `strcat` might still *arguably* be acceptable, but only with extreme caution and rigorous testing, perhaps in a very controlled environment where the size of the destination string is precisely known and immutable. I then begin thinking about better ways to address the problem entirely.

map[IncludeSnippetLines:1 Name:strcat SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 145764
							output: 40
							thoughts: 4
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**`strncpy` - The Eternal Question**

Alright, `strncpy`. That function... it's a constant reminder of C's legacy, isn't it? The question always pops up: *do I really need this thing?* The goal seems simple enough: copy a string, but only up to a specified length. Sounds useful. But... the baggage.

The *gotcha* is always in the details. You've got the null termination (or lack thereof) to worry about. You've got the padding to contend with if the source string is shorter than the specified length. The potential for buffer overruns is drastically reduced with `strncpy` compared to `strcpy`, yes, but it doesn't solve it completely and if the `size` argument is wrong you can get unexpected results.

Then there's the performance consideration. In many cases, I'm probably better off calculating the length and using `memcpy` or a loop. It often comes down to this: am I better off managing the null termination and performance implications myself, or am I willing to trust this somewhat quirky function? There are corner cases where it's the right choice, but the default should probably be to avoid `strncpy` unless you are dealing with very strict memory sizes and do not mind the possibility of a non-null terminated string being created.

Ultimately, the thought process boils down to risk assessment. Is the code robust enough to handle the subtleties? Or am I going to introduce a subtle bug that's going to haunt me in production? It's always a judgement call.

map[IncludeSnippetLines:1 Name:strncpy SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 146170
							output: 42
							thoughts: 6
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Memory Corruption Potential – `strscpy`**

Alright, `strscpy`... just the mention of that function sends a chill down my spine. The very name evokes memories of countless debugging sessions and security audits. My first thought is always, "Potential for buffer overflows, absolutely." I immediately start mentally assessing the contexts where I've seen it used, or where I *expect* to see it used, and I'm practically running a mental static analysis. I'm already envisioning the possible source and destination buffer sizes and how I'd verify that the length of the string to be copied is accounted for, and whether the null terminator is handled safely. Am I looking at a fixed-size buffer, a dynamically allocated buffer, or something in between? What if the destination buffer isn't large enough to accommodate the source string, especially with that critical null terminator? Is there any bounds checking in place? If not, that's almost a guaranteed vulnerability waiting to happen. I'm already formulating questions: Is this code in a sensitive area (kernel, user mode, network stack)? What is the target architecture, and do I have to take into consideration the compiler and linker settings? `strscpy`… it’s a red flag.

log-in to see details

map[IncludeSnippetLines:1 Name:strscpy SourceTreePrefix:kernel/bpf/helpers.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 146525
							output: 41
							thoughts: 291
						

**BPF String Function Safety Check**

Okay, first things first, I saw `strscpy_pad` used within `bpf_get_current_comm`, specifically in that BPF helper. Given the context, that function should be safe; the verifier provides guarantees on the `size` parameter. That's a good starting point.

Now, I need to expand my search. I should really check for other string functions used in the BPF context. Let's see... looking at the code, I see `strnchr`, `isascii`, `isprint`, `isspace`, and `ispunct` are used in `bpf_bprintf_prepare`. 

Alright, so the user might have something more subtle in mind. They specifically mentioned `kernel/bpf/helpers.c`, but they're hinting at the possibility of other functions acting as helpers being outside of that file. Okay, let me think... could they be alluding to something like `bpf_snprintf_btf`? It's used to format strings, but it's not in the main helpers file.

Time to confirm my suspicions and find out where `bpf_snprintf_btf` is implemented. I'll search the code for `BPF_CALL.*snprintf_btf` and see what comes up. That should give me the implementation location to assess its usage and safety.

log-in to see details

map[IncludeSnippetLines:1 Name:snprintf_btf SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 147177
							output: 44
							thoughts: 22
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Investigating a BPF Snprintf Vulnerability**

Right, let's dive in. My immediate thought is to track down the function definition `BPF_CALL_5(bpf_snprintf_btf)`. This strongly suggests we're dealing with a BPF (Berkeley Packet Filter) context, and the presence of `snprintf` immediately raises a red flag regarding potential format string vulnerabilities or buffer overflows. The "BTF" suffix likely indicates that we're dealing with debugging information.

My approach is going to focus on understanding how this particular BPF helper function is used, what arguments it takes, and how those arguments are validated (or *aren't* validated). I'll want to trace its call sites to determine the context in which `bpf_snprintf_btf` is being invoked – is it in a privileged environment? What kind of data is being passed to it? The goal is to identify a potential path for crafting malicious input that could lead to a crash, information leak, or even code execution within the kernel. I'll need to scrutinize how format specifiers are handled and whether any bounds checks are implemented. I'm going to start with the kernel source code, but I'll also check any relevant documentation or recent security advisories related to BPF and format string bugs. My understanding of the BPF verifier is going to be key here.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf SourceTreePrefix:kernel/bpf/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 147576
							output: 48
							thoughts: 27
						

Okay, here's my summary, taking on the persona you requested:

**Investigating `bpf_snprintf_btf`**

Alright, let's dive in. I need to figure out how `bpf_snprintf_btf` works. Given its name, it's obviously related to the BTF (BPF Type Format) data. I'm guessing it's responsible for, likely, string formatting when dealing with BTF information within the kernel. My first instinct, and the most logical starting point given the context, is to jump directly into the source code. I'll search for the function definition within `kernel/bpf/btf.c`. That's where I expect to find the implementation and any related function calls and structures. Hopefully, I can understand the formatting logic and where it's used within the broader BPF ecosystem from there. Let's see what we find.

log-in to see details

map[IncludeSnippetLines:1 Name:bpf_snprintf_btf SourceTreePrefix:kernel/bpf/btf.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 147867
							output: 45
							thoughts: 24
						

Okay, here's my take on those thoughts, tailored for an expert audience and presented in the first person:

**Navigating the BTF Landscape**

Right, so I need to find the definition of `snprintf_btf`. My initial instinct, given its naming convention, is that it's probably tucked away in the BPF subsystem, specifically within the BTF (BPF Type Format) implementation. Therefore, I’ll start digging in the `kernel/bpf/` directory, and the filename most likely is `btf.c`. That seems like the logical place to start my search. It's a bit of an educated guess, but usually naming conventions are pretty consistent within the kernel. Let's fire up the search tools and see what we can find. I’m hoping it’s clearly defined there, as any interactions with a formatted string would indicate.

log-in to see details

map[IncludeSnippetLines:1 Name:snprintf_btf SourceTreePrefix:kernel/bpf/btf.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 148142
							output: 29
							thoughts: 17
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Debugging Strategy: `snprintf_btf` Search**

Alright, so I'm diving into this issue, and the first thing that pops into my head is to track down the source of this particular function, `snprintf_btf`. Given the context, I'm going to start by running a comprehensive search across the entire project codebase. I'm going to leverage my existing knowledge of the tooling to expedite this process - likely a global search through my IDE or the command line. This comprehensive search should allow me to identify not only the definition of `snprintf_btf` but also all its potential call sites, which I can then leverage to understand the functionality and usage more broadly. Understanding where it is used is vital, so as to understand the context of any problems encountered. This is always my first step when chasing a function I'm unfamiliar with.

log-in to see details