| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/02 18:10 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"EXT4_FS"
],
"FocusSymbols": [
"ext4_xattr_delete_inode",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_put_ea_inode",
"ext4_ea_inode_work",
"ext4_xattr_release_block",
"ext4_xattr_inode_dec_ref_all"
],
"Reasoning": "The patch modifies ext4's handling of Extended Attribute (EA) inodes by introducing a deferred iput mechanism to avoid lock ordering issues. It replaces the `ext4_xattr_inode_array` with a lockless list and a delayed workqueue (`ext4_ea_inode_work`). This is a functional change in core ext4 logic and should be fuzzed to ensure no use-after-free, memory leaks, or deadlocks occur during EA inode eviction.",
"WorthFuzzing": true
} |
| 1/1 | 2026/07/02 18:10 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit dae762b2ac3937346719ff2fe93dbd8ac62db185\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jul 2 18:10:38 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h\nindex b37c136ea3ab33..b9b0ada7774bb4 100644\n--- a/fs/ext4/ext4.h\n+++ b/fs/ext4/ext4.h\n@@ -1070,8 +1070,14 @@ struct ext4_inode_info {\n \t * between readers of EAs and writers of regular file data, so\n \t * instead we synchronize on xattr_sem when reading or changing\n \t * EAs.\n+\t *\n+\t * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse\n+\t * the space for deferred iput linkage.\n \t */\n-\tstruct rw_semaphore xattr_sem;\n+\tunion {\n+\t\tstruct rw_semaphore xattr_sem;\n+\t\tstruct llist_node i_ea_iput_node;\n+\t};\n \n \t/*\n \t * Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise\n@@ -1770,6 +1776,11 @@ struct ext4_sb_info {\n \tstruct ext4_es_stats s_es_stats;\n \tstruct mb_cache *s_ea_block_cache;\n \tstruct mb_cache *s_ea_inode_cache;\n+\n+\t/* Deferred iput for EA inodes to avoid lock ordering issues */\n+\tstruct llist_head s_ea_inode_to_free;\n+\tstruct delayed_work s_ea_inode_work;\n+\n \tspinlock_t s_es_lock ____cacheline_aligned_in_smp;\n \n \t/* Journal triggers for checksum computation */\ndiff --git a/fs/ext4/inode.c b/fs/ext4/inode.c\nindex ce99807c5f5b2c..747c52c232cc03 100644\n--- a/fs/ext4/inode.c\n+++ b/fs/ext4/inode.c\n@@ -176,7 +176,6 @@ void ext4_evict_inode(struct inode *inode)\n \t * (xattr block freeing), bitmap, group descriptor (inode freeing)\n \t */\n \tint extra_credits = 6;\n-\tstruct ext4_xattr_inode_array *ea_inode_array = NULL;\n \tbool freeze_protected = false;\n \n \ttrace_ext4_evict_inode(inode);\n@@ -281,8 +280,7 @@ void ext4_evict_inode(struct inode *inode)\n \t}\n \n \t/* Remove xattr references. */\n-\terr = ext4_xattr_delete_inode(handle, inode, \u0026ea_inode_array,\n-\t\t\t\t extra_credits);\n+\terr = ext4_xattr_delete_inode(handle, inode, extra_credits);\n \tif (err) {\n \t\text4_warning(inode-\u003ei_sb, \"xattr delete (err %d)\", err);\n stop_handle:\n@@ -290,7 +288,6 @@ void ext4_evict_inode(struct inode *inode)\n \t\text4_orphan_del(NULL, inode);\n \t\tif (freeze_protected)\n \t\t\tsb_end_intwrite(inode-\u003ei_sb);\n-\t\text4_xattr_inode_array_free(ea_inode_array);\n \t\tgoto no_delete;\n \t}\n \n@@ -320,7 +317,6 @@ void ext4_evict_inode(struct inode *inode)\n \text4_journal_stop(handle);\n \tif (freeze_protected)\n \t\tsb_end_intwrite(inode-\u003ei_sb);\n-\text4_xattr_inode_array_free(ea_inode_array);\n \treturn;\n no_delete:\n \t/*\ndiff --git a/fs/ext4/super.c b/fs/ext4/super.c\nindex 245f67d10ded34..3efa5a817bef4f 100644\n--- a/fs/ext4/super.c\n+++ b/fs/ext4/super.c\n@@ -1303,6 +1303,8 @@ static void ext4_put_super(struct super_block *sb)\n \t\t\t \u0026sb-\u003es_uuid);\n \n \text4_unregister_li_request(sb);\n+\t/* Drain deferred EA inode iputs while quota is still active. */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_quotas_off(sb, EXT4_MAXQUOTAS);\n \n \tdestroy_workqueue(sbi-\u003ersv_conversion_wq);\n@@ -1423,6 +1425,13 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)\n \tmemset(\u0026ei-\u003ei_dquot, 0, sizeof(ei-\u003ei_dquot));\n #endif\n \tei-\u003ejinode = NULL;\n+\t/*\n+\t * Reinitialize xattr_sem every allocation because EA inodes\n+\t * share this space with i_ea_iput_node (via union) which may\n+\t * have overwritten the semaphore when the slab object was\n+\t * previously used as an EA inode.\n+\t */\n+\tinit_rwsem(\u0026ei-\u003exattr_sem);\n \tINIT_LIST_HEAD(\u0026ei-\u003ei_rsv_conversion_list);\n \tspin_lock_init(\u0026ei-\u003ei_completed_io_lock);\n \tei-\u003ei_sync_tid = 0;\n@@ -1488,7 +1497,6 @@ static void init_once(void *foo)\n \tstruct ext4_inode_info *ei = foo;\n \n \tINIT_LIST_HEAD(\u0026ei-\u003ei_orphan);\n-\tinit_rwsem(\u0026ei-\u003exattr_sem);\n \tinit_rwsem(\u0026ei-\u003ei_data_sem);\n \tinode_init_once(\u0026ei-\u003evfs_inode);\n \text4_fc_init_inode(\u0026ei-\u003evfs_inode);\n@@ -5497,6 +5505,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)\n \t\t\t ext4_has_feature_orphan_present(sb) ||\n \t\t\t ext4_has_feature_journal_needs_recovery(sb));\n \n+\text4_init_ea_inode_work(sbi);\n+\n \tif (ext4_has_feature_mmp(sb) \u0026\u0026 !sb_rdonly(sb)) {\n \t\terr = ext4_multi_mount_protect(sb, le64_to_cpu(es-\u003es_mmp_block));\n \t\tif (err)\n@@ -5747,6 +5757,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)\n \treturn 0;\n \n failed_mount9:\n+\t/* Drain deferred EA inode iputs before quota shutdown */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_quotas_off(sb, EXT4_MAXQUOTAS);\n failed_mount8: __maybe_unused\n \text4_release_orphan_info(sb);\n@@ -5767,6 +5779,8 @@ failed_mount8: __maybe_unused\n \tif (EXT4_SB(sb)-\u003ersv_conversion_wq)\n \t\tdestroy_workqueue(EXT4_SB(sb)-\u003ersv_conversion_wq);\n failed_mount_wq:\n+\t/* Drain deferred EA inode iputs before freeing structures */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_xattr_destroy_cache(sbi-\u003es_ea_inode_cache);\n \tsbi-\u003es_ea_inode_cache = NULL;\n \n@@ -5777,6 +5791,8 @@ failed_mount8: __maybe_unused\n \t\text4_journal_destroy(sbi, sbi-\u003es_journal);\n \t}\n failed_mount3a:\n+\t/* Drain deferred EA inode iputs from journal replay */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_es_unregister_shrinker(sbi);\n failed_mount3:\n \t/* flush s_sb_upd_work before sbi destroy */\ndiff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c\nindex 982a1f831e2282..4ae6ce1115660e 100644\n--- a/fs/ext4/xattr.c\n+++ b/fs/ext4/xattr.c\n@@ -114,10 +114,6 @@ const struct xattr_handler * const ext4_xattr_handlers[] = {\n #define EA_INODE_CACHE(inode)\t(((struct ext4_sb_info *) \\\n \t\t\t\tinode-\u003ei_sb-\u003es_fs_info)-\u003es_ea_inode_cache)\n \n-static int\n-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n-\t\t\tstruct inode *inode);\n-\n #ifdef CONFIG_LOCKDEP\n void ext4_xattr_inode_set_class(struct inode *ea_inode)\n {\n@@ -567,7 +563,7 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,\n \t\t\t\t\tea_inode-\u003ei_ino, true /* reusable */);\n \t}\n out:\n-\tiput(ea_inode);\n+\text4_put_ea_inode(ea_inode);\n \treturn err;\n }\n \n@@ -1104,10 +1100,10 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,\n \t\terr = ext4_xattr_inode_inc_ref(handle, ea_inode);\n \t\tif (err) {\n \t\t\text4_warning_inode(ea_inode, \"inc ref error %d\", err);\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\tgoto cleanup;\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \t}\n \treturn 0;\n \n@@ -1133,7 +1129,7 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err)\n \t\t\text4_warning_inode(ea_inode, \"cleanup dec ref error %d\",\n \t\t\t\t\t err);\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \t}\n \treturn saved_err;\n }\n@@ -1160,7 +1156,6 @@ static void\n ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\t\t struct buffer_head *bh,\n \t\t\t struct ext4_xattr_entry *first, bool block_csum,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits, bool skip_quota)\n {\n \tstruct inode *ea_inode;\n@@ -1197,14 +1192,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err)\n \t\t\tcontinue;\n \n-\t\terr = ext4_expand_inode_array(ea_inode_array, ea_inode);\n-\t\tif (err) {\n-\t\t\text4_warning_inode(ea_inode,\n-\t\t\t\t\t \"Expand inode array err=%d\", err);\n-\t\t\tiput(ea_inode);\n-\t\t\tcontinue;\n-\t\t}\n-\n \t\terr = ext4_journal_ensure_credits_fn(handle, credits, credits,\n \t\t\text4_free_metadata_revoke_credits(parent-\u003ei_sb, 1),\n \t\t\text4_xattr_restart_fn(handle, parent, bh, block_csum,\n@@ -1212,6 +1199,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err \u003c 0) {\n \t\t\text4_warning_inode(ea_inode, \"Ensure credits err=%d\",\n \t\t\t\t\t err);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\tcontinue;\n \t\t}\n \t\tif (err \u003e 0) {\n@@ -1221,6 +1209,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\t\"Re-get write access err=%d\",\n \t\t\t\t\t\terr);\n+\t\t\t\text4_put_ea_inode(ea_inode);\n \t\t\t\tcontinue;\n \t\t\t}\n \t\t}\n@@ -1229,6 +1218,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err) {\n \t\t\text4_warning_inode(ea_inode, \"ea_inode dec ref err=%d\",\n \t\t\t\t\t err);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\tcontinue;\n \t\t}\n \n@@ -1245,6 +1235,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tentry-\u003ee_value_inum = 0;\n \t\tentry-\u003ee_value_size = 0;\n \n+\t\text4_put_ea_inode(ea_inode);\n \t\tdirty = true;\n \t}\n \n@@ -1271,7 +1262,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n static void\n ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n \t\t\t struct buffer_head *bh,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits)\n {\n \tstruct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);\n@@ -1313,7 +1303,6 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_dec_ref_all(handle, inode, bh,\n \t\t\t\t\t\t BFIRST(bh),\n \t\t\t\t\t\t true /* block_csum */,\n-\t\t\t\t\t\t ea_inode_array,\n \t\t\t\t\t\t extra_credits,\n \t\t\t\t\t\t true /* skip_quota */);\n \t\text4_free_blocks(handle, inode, bh, 0, 1,\n@@ -1505,7 +1494,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,\n \t\t\tif (ext4_xattr_inode_dec_ref(handle, ea_inode))\n \t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\"cleanup dec ref error %d\", err);\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\treturn ERR_PTR(err);\n \t\t}\n \n@@ -1564,7 +1553,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,\n \t\t\tkvfree(ea_data);\n \t\t\treturn ea_inode;\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \tnext_entry:\n \t\tce = mb_cache_entry_find_next(ea_inode_cache, ce);\n \t}\n@@ -1615,7 +1604,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,\n \t\t\t\t ea_inode-\u003ei_ino, true /* reusable */);\n \treturn ea_inode;\n out_err:\n-\tiput(ea_inode);\n+\text4_put_ea_inode(ea_inode);\n \text4_xattr_inode_free_quota(inode, NULL, value_len);\n \treturn ERR_PTR(err);\n }\n@@ -1848,7 +1837,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,\n \n \tret = 0;\n out:\n-\tiput(old_ea_inode);\n+\text4_put_ea_inode(old_ea_inode);\n \treturn ret;\n }\n \n@@ -2010,7 +1999,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\t\told_ea_inode_quota = le32_to_cpu(\n \t\t\t\t\t\ts-\u003ehere-\u003ee_value_size);\n \t\t\t}\n-\t\t\tiput(tmp_inode);\n+\t\t\text4_put_ea_inode(tmp_inode);\n \n \t\t\ts-\u003ehere-\u003ee_value_inum = 0;\n \t\t\ts-\u003ehere-\u003ee_value_size = 0;\n@@ -2150,7 +2139,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\t\t \"dec ref error=%d\",\n \t\t\t\t\t\t\t error);\n-\t\t\t\tiput(ea_inode);\n+\t\t\t\text4_put_ea_inode(ea_inode);\n \t\t\t\tea_inode = NULL;\n \t\t\t}\n \n@@ -2182,12 +2171,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \n \t/* Drop the previous xattr block. */\n \tif (bs-\u003ebh \u0026\u0026 bs-\u003ebh != new_bh) {\n-\t\tstruct ext4_xattr_inode_array *ea_inode_array = NULL;\n-\n \t\text4_xattr_release_block(handle, inode, bs-\u003ebh,\n-\t\t\t\t\t \u0026ea_inode_array,\n \t\t\t\t\t 0 /* extra_credits */);\n-\t\text4_xattr_inode_array_free(ea_inode_array);\n \t}\n \terror = 0;\n \n@@ -2203,7 +2188,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t\t i_size_read(ea_inode));\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \t}\n \tif (ce)\n \t\tmb_cache_entry_put(ea_block_cache, ce);\n@@ -2285,7 +2270,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,\n \n \t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t\t i_size_read(ea_inode));\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t}\n \t\treturn error;\n \t}\n@@ -2297,7 +2282,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,\n \t\theader-\u003eh_magic = cpu_to_le32(0);\n \t\text4_clear_inode_state(inode, EXT4_STATE_XATTR);\n \t}\n-\tiput(ea_inode);\n+\text4_put_ea_inode(ea_inode);\n \treturn 0;\n }\n \n@@ -2863,46 +2848,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n \treturn error;\n }\n \n-#define EIA_INCR 16 /* must be 2^n */\n-#define EIA_MASK (EIA_INCR - 1)\n-\n-/* Add the large xattr @inode into @ea_inode_array for deferred iput().\n- * If @ea_inode_array is new or full it will be grown and the old\n- * contents copied over.\n- */\n-static int\n-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n-\t\t\tstruct inode *inode)\n-{\n-\tif (*ea_inode_array == NULL) {\n-\t\t/*\n-\t\t * Start with 15 inodes, so it fits into a power-of-two size.\n-\t\t */\n-\t\t(*ea_inode_array) = kmalloc_flex(**ea_inode_array, inodes,\n-\t\t\t\t\t\t EIA_MASK, GFP_NOFS);\n-\t\tif (*ea_inode_array == NULL)\n-\t\t\treturn -ENOMEM;\n-\t\t(*ea_inode_array)-\u003ecount = 0;\n-\t} else if (((*ea_inode_array)-\u003ecount \u0026 EIA_MASK) == EIA_MASK) {\n-\t\t/* expand the array once all 15 + n * 16 slots are full */\n-\t\tstruct ext4_xattr_inode_array *new_array = NULL;\n-\n-\t\tnew_array = kmalloc_flex(**ea_inode_array, inodes,\n-\t\t\t\t\t (*ea_inode_array)-\u003ecount + EIA_INCR,\n-\t\t\t\t\t GFP_NOFS);\n-\t\tif (new_array == NULL)\n-\t\t\treturn -ENOMEM;\n-\t\tmemcpy(new_array, *ea_inode_array,\n-\t\t struct_size(*ea_inode_array, inodes,\n-\t\t\t\t (*ea_inode_array)-\u003ecount));\n-\t\tkfree(*ea_inode_array);\n-\t\t*ea_inode_array = new_array;\n-\t}\n-\t(*ea_inode_array)-\u003ecount++;\n-\t(*ea_inode_array)-\u003einodes[(*ea_inode_array)-\u003ecount - 1] = inode;\n-\treturn 0;\n-}\n-\n /*\n * ext4_xattr_delete_inode()\n *\n@@ -2913,7 +2858,6 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n * references on xattr block and xattr inodes.\n */\n int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits)\n {\n \tstruct buffer_head *bh = NULL;\n@@ -2952,7 +2896,6 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,\n \t\t\t\t\t\t IFIRST(header),\n \t\t\t\t\t\t false /* block_csum */,\n-\t\t\t\t\t\t ea_inode_array,\n \t\t\t\t\t\t extra_credits,\n \t\t\t\t\t\t false /* skip_quota */);\n \t}\n@@ -2986,12 +2929,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \t\t\t\t\tcontinue;\n \t\t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t le32_to_cpu(entry-\u003ee_value_size));\n-\t\t\t\tiput(ea_inode);\n+\t\t\t\text4_put_ea_inode(ea_inode);\n \t\t\t}\n \n \t\t}\n \n-\t\text4_xattr_release_block(handle, inode, bh, ea_inode_array,\n+\t\text4_xattr_release_block(handle, inode, bh,\n \t\t\t\t\t extra_credits);\n \t\t/*\n \t\t * Update i_file_acl value in the same transaction that releases\n@@ -3013,16 +2956,63 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \treturn error;\n }\n \n-void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *ea_inode_array)\n+/*\n+ * Worker function for deferred EA inode iput. Processes all inodes queued\n+ * on s_ea_inode_to_free in a context free of xattr_sem/jbd2 handle locks.\n+ */\n+static void ext4_ea_inode_work(struct work_struct *work)\n {\n-\tint idx;\n+\tstruct ext4_sb_info *sbi = container_of(to_delayed_work(work),\n+\t\t\t\t\t\tstruct ext4_sb_info,\n+\t\t\t\t\t\ts_ea_inode_work);\n+\tstruct llist_node *node = llist_del_all(\u0026sbi-\u003es_ea_inode_to_free);\n \n-\tif (ea_inode_array == NULL)\n+\twhile (node) {\n+\t\tstruct ext4_inode_info *ei = container_of(node,\n+\t\t\t\t\tstruct ext4_inode_info, i_ea_iput_node);\n+\t\tnode = node-\u003enext;\n+\t\tiput(\u0026ei-\u003evfs_inode);\n+\t}\n+}\n+\n+/*\n+ * Release a VFS reference on an EA inode. Must be used instead of iput()\n+ * in any context where xattr_sem or a jbd2 handle is held.\n+ *\n+ * If this is not the last reference, drops it immediately via\n+ * iput_if_not_last() with no further action needed.\n+ *\n+ * If this is the last reference, the inode is linked onto a per-sb\n+ * llist via i_ea_iput_node (embedded in ext4_inode_info, sharing space\n+ * with the unused xattr_sem) and a delayed worker performs the final\n+ * iput() in a clean context.\n+ *\n+ * Note: while an inode is on s_ea_inode_to_free, the unconsumed i_count\n+ * reference (still 1) keeps it in the inode cache, so any concurrent\n+ * iget() bumps i_count to \u003e= 2 and iput_if_not_last() will succeed.\n+ * Nobody will add the inode a second time until ext4_ea_inode_work()\n+ * drops that reference via iput().\n+ */\n+void ext4_put_ea_inode(struct inode *inode)\n+{\n+\tif (!inode)\n+\t\treturn;\n+\tWARN_ON_ONCE(!(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL));\n+\tif (iput_if_not_last(inode))\n \t\treturn;\n+\tllist_add(\u0026EXT4_I(inode)-\u003ei_ea_iput_node,\n+\t\t \u0026EXT4_SB(inode-\u003ei_sb)-\u003es_ea_inode_to_free);\n+\t/*\n+\t * Use a short delay to allow multiple EA inodes to accumulate,\n+\t * reducing workqueue wakeups when several are released together.\n+\t */\n+\tschedule_delayed_work(\u0026EXT4_SB(inode-\u003ei_sb)-\u003es_ea_inode_work, 1);\n+}\n \n-\tfor (idx = 0; idx \u003c ea_inode_array-\u003ecount; ++idx)\n-\t\tiput(ea_inode_array-\u003einodes[idx]);\n-\tkfree(ea_inode_array);\n+void ext4_init_ea_inode_work(struct ext4_sb_info *sbi)\n+{\n+\tinit_llist_head(\u0026sbi-\u003es_ea_inode_to_free);\n+\tINIT_DELAYED_WORK(\u0026sbi-\u003es_ea_inode_work, ext4_ea_inode_work);\n }\n \n /*\ndiff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h\nindex 1fedf44d4fb65e..821dc6a50e51e7 100644\n--- a/fs/ext4/xattr.h\n+++ b/fs/ext4/xattr.h\n@@ -131,11 +131,6 @@ struct ext4_xattr_ibody_find {\n \tstruct ext4_iloc iloc;\n };\n \n-struct ext4_xattr_inode_array {\n-\tunsigned int count;\n-\tstruct inode *inodes[] __counted_by(count);\n-};\n-\n extern const struct xattr_handler ext4_xattr_user_handler;\n extern const struct xattr_handler ext4_xattr_trusted_handler;\n extern const struct xattr_handler ext4_xattr_security_handler;\n@@ -187,9 +182,9 @@ extern int __ext4_xattr_set_credits(struct super_block *sb, struct inode *inode,\n \t\t\t\tbool is_create);\n \n extern int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n-\t\t\t\t struct ext4_xattr_inode_array **array,\n \t\t\t\t int extra_credits);\n-extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);\n+extern void ext4_init_ea_inode_work(struct ext4_sb_info *sbi);\n+extern void ext4_put_ea_inode(struct inode *inode);\n \n extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n \t\t\t struct ext4_inode *raw_inode, handle_t *handle);\ndiff --git a/include/linux/fs.h b/include/linux/fs.h\nindex d10897b3a1e350..709519617c7a38 100644\n--- a/include/linux/fs.h\n+++ b/include/linux/fs.h\n@@ -2413,6 +2413,21 @@ static inline void super_set_sysfs_name_generic(struct super_block *sb, const ch\n extern void ihold(struct inode * inode);\n extern void iput(struct inode *);\n void iput_not_last(struct inode *);\n+\n+/**\n+ * iput_if_not_last - drop an inode reference only if it is not the last one\n+ * @inode: inode to put\n+ *\n+ * Returns true if the reference was dropped, false if this was the last\n+ * reference and the caller must arrange for final iput() in a safe context.\n+ */\n+static inline bool __must_check iput_if_not_last(struct inode *inode)\n+{\n+\tVFS_BUG_ON_INODE(inode_state_read_once(inode) \u0026 (I_FREEING | I_CLEAR), inode);\n+\tVFS_BUG_ON_INODE(icount_read_once(inode) \u003c 1, inode);\n+\treturn atomic_add_unless(\u0026inode-\u003ei_count, -1, 1);\n+}\n+\n int inode_update_time(struct inode *inode, enum fs_update_time type,\n \t\tunsigned int flags);\n int generic_update_time(struct inode *inode, enum fs_update_time type,\n"
} |
| 2/1 | 2026/07/02 18:10 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"EXT4_FS"
],
"FocusSymbols": [
"ext4_xattr_delete_inode",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_put_ea_inode",
"ext4_ea_inode_work",
"ext4_xattr_release_block",
"ext4_xattr_inode_dec_ref_all"
],
"Reasoning": "The patch modifies ext4's handling of Extended Attribute (EA) inodes by introducing a deferred iput mechanism to avoid lock ordering issues. It replaces the `ext4_xattr_inode_array` with a lockless list and a delayed workqueue (`ext4_ea_inode_work`). This is a functional change in core ext4 logic and should be fuzzed to ensure no use-after-free, memory leaks, or deadlocks occur during EA inode eviction.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit dae762b2ac3937346719ff2fe93dbd8ac62db185
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Jul 2 18:10:38 2026 +0000
syz-cluster: applied patch under review
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index b37c136ea3ab33..b9b0ada7774bb4 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1070,8 +1070,14 @@ struct ext4_inode_info {
* between readers of EAs and writers of regular file data, so
* instead we synchronize on xattr_sem when reading or changing
* EAs.
+ *
+ * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse
+ * the space for deferred iput linkage.
*/
- struct rw_semaphore xattr_sem;
+ union {
+ struct rw_semaphore xattr_sem;
+ struct llist_node i_ea_iput_node;
+ };
/*
* Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise
@@ -1770,6 +1776,11 @@ struct ext4_sb_info {
struct ext4_es_stats s_es_stats;
struct mb_cache *s_ea_block_cache;
struct mb_cache *s_ea_inode_cache;
+
+ /* Deferred iput for EA inodes to avoid lock ordering issues */
+ struct llist_head s_ea_inode_to_free;
+ struct delayed_work s_ea_inode_work;
+
spinlock_t s_es_lock ____cacheline_aligned_in_smp;
/* Journal triggers for checksum computation */
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ce99807c5f5b2c..747c52c232cc03 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -176,7 +176,6 @@ void ext4_evict_inode(struct inode *inode)
* (xattr block freeing), bitmap, group descriptor (inode freeing)
*/
int extra_credits = 6;
- struct ext4_xattr_inode_array *ea_inode_array = NULL;
bool freeze_protected = false;
trace_ext4_evict_inode(inode);
@@ -281,8 +280,7 @@ void ext4_evict_inode(struct inode *inode)
}
/* Remove xattr references. */
- err = ext4_xattr_delete_inode(handle, inode, &ea_inode_array,
- extra_credits);
+ err = ext4_xattr_delete_inode(handle, inode, extra_credits);
if (err) {
ext4_warning(inode->i_sb, "xattr delete (err %d)", err);
stop_handle:
@@ -290,7 +288,6 @@ void ext4_evict_inode(struct inode *inode)
ext4_orphan_del(NULL, inode);
if (freeze_protected)
sb_end_intwrite(inode->i_sb);
- ext4_xattr_inode_array_free(ea_inode_array);
goto no_delete;
}
@@ -320,7 +317,6 @@ void ext4_evict_inode(struct inode *inode)
ext4_journal_stop(handle);
if (freeze_protected)
sb_end_intwrite(inode->i_sb);
- ext4_xattr_inode_array_free(ea_inode_array);
return;
no_delete:
/*
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 245f67d10ded34..3efa5a817bef4f 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1303,6 +1303,8 @@ static void ext4_put_super(struct super_block *sb)
&sb->s_uuid);
ext4_unregister_li_request(sb);
+ /* Drain deferred EA inode iputs while quota is still active. */
+ flush_delayed_work(&sbi->s_ea_inode_work);
ext4_quotas_off(sb, EXT4_MAXQUOTAS);
destroy_workqueue(sbi->rsv_conversion_wq);
@@ -1423,6 +1425,13 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
memset(&ei->i_dquot, 0, sizeof(ei->i_dquot));
#endif
ei->jinode = NULL;
+ /*
+ * Reinitialize xattr_sem every allocation because EA inodes
+ * share this space with i_ea_iput_node (via union) which may
+ * have overwritten the semaphore when the slab object was
+ * previously used as an EA inode.
+ */
+ init_rwsem(&ei->xattr_sem);
INIT_LIST_HEAD(&ei->i_rsv_conversion_list);
spin_lock_init(&ei->i_completed_io_lock);
ei->i_sync_tid = 0;
@@ -1488,7 +1497,6 @@ static void init_once(void *foo)
struct ext4_inode_info *ei = foo;
INIT_LIST_HEAD(&ei->i_orphan);
- init_rwsem(&ei->xattr_sem);
init_rwsem(&ei->i_data_sem);
inode_init_once(&ei->vfs_inode);
ext4_fc_init_inode(&ei->vfs_inode);
@@ -5497,6 +5505,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
ext4_has_feature_orphan_present(sb) ||
ext4_has_feature_journal_needs_recovery(sb));
+ ext4_init_ea_inode_work(sbi);
+
if (ext4_has_feature_mmp(sb) && !sb_rdonly(sb)) {
err = ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block));
if (err)
@@ -5747,6 +5757,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
return 0;
failed_mount9:
+ /* Drain deferred EA inode iputs before quota shutdown */
+ flush_delayed_work(&sbi->s_ea_inode_work);
ext4_quotas_off(sb, EXT4_MAXQUOTAS);
failed_mount8: __maybe_unused
ext4_release_orphan_info(sb);
@@ -5767,6 +5779,8 @@ failed_mount8: __maybe_unused
if (EXT4_SB(sb)->rsv_conversion_wq)
destroy_workqueue(EXT4_SB(sb)->rsv_conversion_wq);
failed_mount_wq:
+ /* Drain deferred EA inode iputs before freeing structures */
+ flush_delayed_work(&sbi->s_ea_inode_work);
ext4_xattr_destroy_cache(sbi->s_ea_inode_cache);
sbi->s_ea_inode_cache = NULL;
@@ -5777,6 +5791,8 @@ failed_mount8: __maybe_unused
ext4_journal_destroy(sbi, sbi->s_journal);
}
failed_mount3a:
+ /* Drain deferred EA inode iputs from journal replay */
+ flush_delayed_work(&sbi->s_ea_inode_work);
ext4_es_unregister_shrinker(sbi);
failed_mount3:
/* flush s_sb_upd_work before sbi destroy */
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 982a1f831e2282..4ae6ce1115660e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -114,10 +114,6 @@ const struct xattr_handler * const ext4_xattr_handlers[] = {
#define EA_INODE_CACHE(inode) (((struct ext4_sb_info *) \
inode->i_sb->s_fs_info)->s_ea_inode_cache)
-static int
-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
- struct inode *inode);
-
#ifdef CONFIG_LOCKDEP
void ext4_xattr_inode_set_class(struct inode *ea_inode)
{
@@ -567,7 +563,7 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,
ea_inode->i_ino, true /* reusable */);
}
out:
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
return err;
}
@@ -1104,10 +1100,10 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,
err = ext4_xattr_inode_inc_ref(handle, ea_inode);
if (err) {
ext4_warning_inode(ea_inode, "inc ref error %d", err);
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
goto cleanup;
}
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
}
return 0;
@@ -1133,7 +1129,7 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,
if (err)
ext4_warning_inode(ea_inode, "cleanup dec ref error %d",
err);
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
}
return saved_err;
}
@@ -1160,7 +1156,6 @@ static void
ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
struct buffer_head *bh,
struct ext4_xattr_entry *first, bool block_csum,
- struct ext4_xattr_inode_array **ea_inode_array,
int extra_credits, bool skip_quota)
{
struct inode *ea_inode;
@@ -1197,14 +1192,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
if (err)
continue;
- err = ext4_expand_inode_array(ea_inode_array, ea_inode);
- if (err) {
- ext4_warning_inode(ea_inode,
- "Expand inode array err=%d", err);
- iput(ea_inode);
- continue;
- }
-
err = ext4_journal_ensure_credits_fn(handle, credits, credits,
ext4_free_metadata_revoke_credits(parent->i_sb, 1),
ext4_xattr_restart_fn(handle, parent, bh, block_csum,
@@ -1212,6 +1199,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
if (err < 0) {
ext4_warning_inode(ea_inode, "Ensure credits err=%d",
err);
+ ext4_put_ea_inode(ea_inode);
continue;
}
if (err > 0) {
@@ -1221,6 +1209,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
ext4_warning_inode(ea_inode,
"Re-get write access err=%d",
err);
+ ext4_put_ea_inode(ea_inode);
continue;
}
}
@@ -1229,6 +1218,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
if (err) {
ext4_warning_inode(ea_inode, "ea_inode dec ref err=%d",
err);
+ ext4_put_ea_inode(ea_inode);
continue;
}
@@ -1245,6 +1235,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
entry->e_value_inum = 0;
entry->e_value_size = 0;
+ ext4_put_ea_inode(ea_inode);
dirty = true;
}
@@ -1271,7 +1262,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
static void
ext4_xattr_release_block(handle_t *handle, struct inode *inode,
struct buffer_head *bh,
- struct ext4_xattr_inode_array **ea_inode_array,
int extra_credits)
{
struct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);
@@ -1313,7 +1303,6 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
ext4_xattr_inode_dec_ref_all(handle, inode, bh,
BFIRST(bh),
true /* block_csum */,
- ea_inode_array,
extra_credits,
true /* skip_quota */);
ext4_free_blocks(handle, inode, bh, 0, 1,
@@ -1505,7 +1494,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
if (ext4_xattr_inode_dec_ref(handle, ea_inode))
ext4_warning_inode(ea_inode,
"cleanup dec ref error %d", err);
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
return ERR_PTR(err);
}
@@ -1564,7 +1553,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
kvfree(ea_data);
return ea_inode;
}
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
next_entry:
ce = mb_cache_entry_find_next(ea_inode_cache, ce);
}
@@ -1615,7 +1604,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,
ea_inode->i_ino, true /* reusable */);
return ea_inode;
out_err:
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
ext4_xattr_inode_free_quota(inode, NULL, value_len);
return ERR_PTR(err);
}
@@ -1848,7 +1837,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
ret = 0;
out:
- iput(old_ea_inode);
+ ext4_put_ea_inode(old_ea_inode);
return ret;
}
@@ -2010,7 +1999,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
old_ea_inode_quota = le32_to_cpu(
s->here->e_value_size);
}
- iput(tmp_inode);
+ ext4_put_ea_inode(tmp_inode);
s->here->e_value_inum = 0;
s->here->e_value_size = 0;
@@ -2150,7 +2139,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
ext4_warning_inode(ea_inode,
"dec ref error=%d",
error);
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
ea_inode = NULL;
}
@@ -2182,12 +2171,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
/* Drop the previous xattr block. */
if (bs->bh && bs->bh != new_bh) {
- struct ext4_xattr_inode_array *ea_inode_array = NULL;
-
ext4_xattr_release_block(handle, inode, bs->bh,
- &ea_inode_array,
0 /* extra_credits */);
- ext4_xattr_inode_array_free(ea_inode_array);
}
error = 0;
@@ -2203,7 +2188,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
ext4_xattr_inode_free_quota(inode, ea_inode,
i_size_read(ea_inode));
}
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
}
if (ce)
mb_cache_entry_put(ea_block_cache, ce);
@@ -2285,7 +2270,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
ext4_xattr_inode_free_quota(inode, ea_inode,
i_size_read(ea_inode));
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
}
return error;
}
@@ -2297,7 +2282,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
header->h_magic = cpu_to_le32(0);
ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
}
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
return 0;
}
@@ -2863,46 +2848,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
return error;
}
-#define EIA_INCR 16 /* must be 2^n */
-#define EIA_MASK (EIA_INCR - 1)
-
-/* Add the large xattr @inode into @ea_inode_array for deferred iput().
- * If @ea_inode_array is new or full it will be grown and the old
- * contents copied over.
- */
-static int
-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
- struct inode *inode)
-{
- if (*ea_inode_array == NULL) {
- /*
- * Start with 15 inodes, so it fits into a power-of-two size.
- */
- (*ea_inode_array) = kmalloc_flex(**ea_inode_array, inodes,
- EIA_MASK, GFP_NOFS);
- if (*ea_inode_array == NULL)
- return -ENOMEM;
- (*ea_inode_array)->count = 0;
- } else if (((*ea_inode_array)->count & EIA_MASK) == EIA_MASK) {
- /* expand the array once all 15 + n * 16 slots are full */
- struct ext4_xattr_inode_array *new_array = NULL;
-
- new_array = kmalloc_flex(**ea_inode_array, inodes,
- (*ea_inode_array)->count + EIA_INCR,
- GFP_NOFS);
- if (new_array == NULL)
- return -ENOMEM;
- memcpy(new_array, *ea_inode_array,
- struct_size(*ea_inode_array, inodes,
- (*ea_inode_array)->count));
- kfree(*ea_inode_array);
- *ea_inode_array = new_array;
- }
- (*ea_inode_array)->count++;
- (*ea_inode_array)->inodes[(*ea_inode_array)->count - 1] = inode;
- return 0;
-}
-
/*
* ext4_xattr_delete_inode()
*
@@ -2913,7 +2858,6 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
* references on xattr block and xattr inodes.
*/
int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
- struct ext4_xattr_inode_array **ea_inode_array,
int extra_credits)
{
struct buffer_head *bh = NULL;
@@ -2952,7 +2896,6 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
ext4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,
IFIRST(header),
false /* block_csum */,
- ea_inode_array,
extra_credits,
false /* skip_quota */);
}
@@ -2986,12 +2929,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
continue;
ext4_xattr_inode_free_quota(inode, ea_inode,
le32_to_cpu(entry->e_value_size));
- iput(ea_inode);
+ ext4_put_ea_inode(ea_inode);
}
}
- ext4_xattr_release_block(handle, inode, bh, ea_inode_array,
+ ext4_xattr_release_block(handle, inode, bh,
extra_credits);
/*
* Update i_file_acl value in the same transaction that releases
@@ -3013,16 +2956,63 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
return error;
}
-void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *ea_inode_array)
+/*
+ * Worker function for deferred EA inode iput. Processes all inodes queued
+ * on s_ea_inode_to_free in a context free of xattr_sem/jbd2 handle locks.
+ */
+static void ext4_ea_inode_work(struct work_struct *work)
{
- int idx;
+ struct ext4_sb_info *sbi = container_of(to_delayed_work(work),
+ struct ext4_sb_info,
+ s_ea_inode_work);
+ struct llist_node *node = llist_del_all(&sbi->s_ea_inode_to_free);
- if (ea_inode_array == NULL)
+ while (node) {
+ struct ext4_inode_info *ei = container_of(node,
+ struct ext4_inode_info, i_ea_iput_node);
+ node = node->next;
+ iput(&ei->vfs_inode);
+ }
+}
+
+/*
+ * Release a VFS reference on an EA inode. Must be used instead of iput()
+ * in any context where xattr_sem or a jbd2 handle is held.
+ *
+ * If this is not the last reference, drops it immediately via
+ * iput_if_not_last() with no further action needed.
+ *
+ * If this is the last reference, the inode is linked onto a per-sb
+ * llist via i_ea_iput_node (embedded in ext4_inode_info, sharing space
+ * with the unused xattr_sem) and a delayed worker performs the final
+ * iput() in a clean context.
+ *
+ * Note: while an inode is on s_ea_inode_to_free, the unconsumed i_count
+ * reference (still 1) keeps it in the inode cache, so any concurrent
+ * iget() bumps i_count to >= 2 and iput_if_not_last() will succeed.
+ * Nobody will add the inode a second time until ext4_ea_inode_work()
+ * drops that reference via iput().
+ */
+void ext4_put_ea_inode(struct inode *inode)
+{
+ if (!inode)
+ return;
+ WARN_ON_ONCE(!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL));
+ if (iput_if_not_last(inode))
return;
+ llist_add(&EXT4_I(inode)->i_ea_iput_node,
+ &EXT4_SB(inode->i_sb)->s_ea_inode_to_free);
+ /*
+ * Use a short delay to allow multiple EA inodes to accumulate,
+ * reducing workqueue wakeups when several are released together.
+ */
+ schedule_delayed_work(&EXT4_SB(inode->i_sb)->s_ea_inode_work, 1);
+}
- for (idx = 0; idx < ea_inode_array->count; ++idx)
- iput(ea_inode_array->inodes[idx]);
- kfree(ea_inode_array);
+void ext4_init_ea_inode_work(struct ext4_sb_info *sbi)
+{
+ init_llist_head(&sbi->s_ea_inode_to_free);
+ INIT_DELAYED_WORK(&sbi->s_ea_inode_work, ext4_ea_inode_work);
}
/*
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 1fedf44d4fb65e..821dc6a50e51e7 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -131,11 +131,6 @@ struct ext4_xattr_ibody_find {
struct ext4_iloc iloc;
};
-struct ext4_xattr_inode_array {
- unsigned int count;
- struct inode *inodes[] __counted_by(count);
-};
-
extern const struct xattr_handler ext4_xattr_user_handler;
extern const struct xattr_handler ext4_xattr_trusted_handler;
extern const struct xattr_handler ext4_xattr_security_handler;
@@ -187,9 +182,9 @@ extern int __ext4_xattr_set_credits(struct super_block *sb, struct inode *inode,
bool is_create);
extern int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
- struct ext4_xattr_inode_array **array,
int extra_credits);
-extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);
+extern void ext4_init_ea_inode_work(struct ext4_sb_info *sbi);
+extern void ext4_put_ea_inode(struct inode *inode);
extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
struct ext4_inode *raw_inode, handle_t *handle);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index d10897b3a1e350..709519617c7a38 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2413,6 +2413,21 @@ static inline void super_set_sysfs_name_generic(struct super_block *sb, const ch
extern void ihold(struct inode * inode);
extern void iput(struct inode *);
void iput_not_last(struct inode *);
+
+/**
+ * iput_if_not_last - drop an inode reference only if it is not the last one
+ * @inode: inode to put
+ *
+ * Returns true if the reference was dropped, false if this was the last
+ * reference and the caller must arrange for final iput() in a safe context.
+ */
+static inline bool __must_check iput_if_not_last(struct inode *inode)
+{
+ VFS_BUG_ON_INODE(inode_state_read_once(inode) & (I_FREEING | I_CLEAR), inode);
+ VFS_BUG_ON_INODE(icount_read_once(inode) < 1, inode);
+ return atomic_add_unless(&inode->i_count, -1, 1);
+}
+
int inode_update_time(struct inode *inode, enum fs_update_time type,
unsigned int flags);
int generic_update_time(struct inode *inode, enum fs_update_time type,
|
| 3/2 | 2026/07/02 18:10 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9465 output: 29 thoughts: 651 Thoughts: **Analyzing a Patch: Extended Attribute (EA) Inode Deferral in ext4** Okay, so I'm looking at this patch that's fundamentally changing how ext4 handles Extended Attribute (EA) inodes, specifically focusing on the freeing process. The aim seems to be addressing lock ordering issues, which is always a good thing. They're implementing a deferred `iput` mechanism for EA inodes. Smart, using `s_ea_inode_to_free` and `s_ea_inode_work` within the `ext4_sb_info` structure is a solid approach for this kind of delayed operation. The addition of `iput_if_not_last` is also expected. The shift from `ext4_xattr_inode_array` to a lockless list (`llist_node i_ea_iput_node` in `struct ext4_inode_info`) is a notable architectural change, and potentially a performance improvement. This definitely warrants close scrutiny. This is a core functional change, no doubt about it. We should definitely include this in the fuzzing process – `WorthFuzzing=true` is spot on. Now, let's identify the specific functions that are being modified or added. The code touches a significant number of functions related to EA inode management: `ext4_ea_inode_work`, `ext4_put_ea_inode`, `ext4_init_ea_inode_work`, and core xattr functions like `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, `ext4_xattr_inode_dec_ref_all`, `ext4_xattr_inode_inc_ref_all`, and so on. However, I'm focusing my attention primarily on the following for this initial analysis: `ext4_ea_inode_work`, which is the core deferred work, `ext4_put_ea_inode`, `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, `ext4_xattr_inode_dec_ref_all`, `ext4_xattr_block_set`, and `ext4_xattr_ibody_set` as they are the most critical for potential regressions. Given that this affects core ext4 EA handling, configuration is important. The code resides within `fs/ext4/`, and the relevant config is `EXT4_FS`. But, I need to check for any specific configs related to EA inodes. Let's delve into the `fs/ext4/Kconfig` file or perform a quick grep for "EA_INODE". Related configs like `EXT4_FS_POSIX_ACL` and `EXT4_FS_SECURITY` are related to xattrs but EA inodes are fundamental and I suspect EA inodes are a feature of ext4, which makes me suspect it depends on `EXT4_FEATURE_INCOMPAT_EA_INODE`. Need to verify this quickly. |
| 4/2 | 2026/07/02 18:10 | tool | grepper |
0mArgs:{
"Expression": "EA_INODE",
"PathPrefix": "fs/ext4/"
}Results: {
"Output": "fs/ext4/ext4.h=440=struct flex_groups {\n--\nfs/ext4/ext4.h-504-#define EXT4_VERITY_FL\t\t\t0x00100000 /* Verity protected inode */\nfs/ext4/ext4.h:505:#define EXT4_EA_INODE_FL\t 0x00200000 /* Inode used for large EA */\nfs/ext4/ext4.h-506-/* 0x00400000 was formerly EXT4_EOFBLOCKS_FL */\n--\nfs/ext4/ext4.h=580=enum {\n--\nfs/ext4/ext4.h-603-\tEXT4_INODE_VERITY\t= 20,\t/* Verity protected inode */\nfs/ext4/ext4.h:604:\tEXT4_INODE_EA_INODE\t= 21,\t/* Inode used for large EA */\nfs/ext4/ext4.h-605-/* 22 was formerly EXT4_INODE_EOFBLOCKS */\n--\nfs/ext4/ext4.h=629=static inline void ext4_check_flag_values(void)\n--\nfs/ext4/ext4.h-651-\tCHECK_FLAG_VALUE(VERITY);\nfs/ext4/ext4.h:652:\tCHECK_FLAG_VALUE(EA_INODE);\nfs/ext4/ext4.h-653-\tCHECK_FLAG_VALUE(INLINE_DATA);\n--\nfs/ext4/ext4.h=1048=struct ext4_inode_info {\n--\nfs/ext4/ext4.h-1073-\t *\nfs/ext4/ext4.h:1074:\t * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse\nfs/ext4/ext4.h-1075-\t * the space for deferred iput linkage.\n--\nfs/ext4/ext4.h=2037=enum {\n--\nfs/ext4/ext4.h-2045-\tEXT4_STATE_EXT_PRECACHED,\t/* extents have been precached */\nfs/ext4/ext4.h:2046:\tEXT4_STATE_LUSTRE_EA_INODE,\t/* Lustre-style ea_inode */\nfs/ext4/ext4.h-2047-\tEXT4_STATE_VERITY_IN_PROGRESS,\t/* building fs-verity Merkle tree */\n--\nfs/ext4/ext4.h=2134=static inline bool ext4_inode_orphan_tracked(struct inode *inode)\n--\nfs/ext4/ext4.h-2215-#define EXT4_FEATURE_INCOMPAT_FLEX_BG\t\t0x0200\nfs/ext4/ext4.h:2216:#define EXT4_FEATURE_INCOMPAT_EA_INODE\t\t0x0400 /* EA in inode */\nfs/ext4/ext4.h-2217-#define EXT4_FEATURE_INCOMPAT_DIRDATA\t\t0x1000 /* data in dirent */\n--\nfs/ext4/ext4.h=2314=EXT4_FEATURE_INCOMPAT_FUNCS(flex_bg,\t\tFLEX_BG)\nfs/ext4/ext4.h:2315:EXT4_FEATURE_INCOMPAT_FUNCS(ea_inode,\t\tEA_INODE)\nfs/ext4/ext4.h-2316-EXT4_FEATURE_INCOMPAT_FUNCS(dirdata,\t\tDIRDATA)\n--\nfs/ext4/ext4.h=2321=EXT4_FEATURE_INCOMPAT_FUNCS(casefold,\t\tCASEFOLD)\n--\nfs/ext4/ext4.h-2345-\t\t\t\t\t EXT4_FEATURE_INCOMPAT_FLEX_BG| \\\nfs/ext4/ext4.h:2346:\t\t\t\t\t EXT4_FEATURE_INCOMPAT_EA_INODE| \\\nfs/ext4/ext4.h-2347-\t\t\t\t\t EXT4_FEATURE_INCOMPAT_MMP | \\\n--\nfs/ext4/ext4.h=2702=static inline bool ext4_is_quota_file(struct inode *inode)\n--\nfs/ext4/ext4.h-2704-\treturn IS_NOQUOTA(inode) \u0026\u0026\nfs/ext4/ext4.h:2705:\t !(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL);\nfs/ext4/ext4.h-2706-}\n--\nfs/ext4/ext4.h=3153=typedef enum {\n--\nfs/ext4/ext4.h-3157-\tEXT4_IGET_BAD =\t\t0x0004, /* Allow to iget a bad inode */\nfs/ext4/ext4.h:3158:\tEXT4_IGET_EA_INODE =\t0x0008\t/* Inode should contain an EA value */\nfs/ext4/ext4.h-3159-} ext4_iget_flags;\n--\nfs/ext4/ext4_jbd2.c=10=int ext4_inode_journal_mode(struct inode *inode)\n--\nfs/ext4/ext4_jbd2.c-15-\tif (!S_ISREG(inode-\u003ei_mode) ||\nfs/ext4/ext4_jbd2.c:16:\t ext4_test_inode_flag(inode, EXT4_INODE_EA_INODE) ||\nfs/ext4/ext4_jbd2.c-17-\t test_opt(inode-\u003ei_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA ||\n--\nfs/ext4/extents.c=2437=static inline int get_default_free_blocks_flags(struct inode *inode)\n--\nfs/ext4/extents.c-2439-\tif (S_ISDIR(inode-\u003ei_mode) || S_ISLNK(inode-\u003ei_mode) ||\nfs/ext4/extents.c:2440:\t ext4_test_inode_flag(inode, EXT4_INODE_EA_INODE))\nfs/ext4/extents.c-2441-\t\treturn EXT4_FREE_BLOCKS_METADATA | EXT4_FREE_BLOCKS_FORGET;\n--\nfs/ext4/ialloc.c=933=struct inode *__ext4_new_inode(struct mnt_idmap *idmap,\n--\nfs/ext4/ialloc.c-995-\nfs/ext4/ialloc.c:996:\tif (!(i_flags \u0026 EXT4_EA_INODE_FL)) {\nfs/ext4/ialloc.c-997-\t\terr = fscrypt_prepare_new_inode(dir, inode, \u0026encrypt);\n--\nfs/ext4/ialloc.c-1005-\nfs/ext4/ialloc.c:1006:\tif (!handle \u0026\u0026 sbi-\u003es_journal \u0026\u0026 !(i_flags \u0026 EXT4_EA_INODE_FL)) {\nfs/ext4/ialloc.c-1007-\t\tret2 = ext4_xattr_credits_for_new_inode(dir, mode, encrypt);\n--\nfs/ext4/ialloc.c-1308-\tif (ext4_has_feature_inline_data(sb) \u0026\u0026\nfs/ext4/ialloc.c:1309:\t (!(ei-\u003ei_flags \u0026 (EXT4_DAX_FL|EXT4_EA_INODE_FL)) || S_ISDIR(mode)))\nfs/ext4/ialloc.c-1310-\t\text4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);\n--\nfs/ext4/ialloc.c-1326-\nfs/ext4/ialloc.c:1327:\tif (!(ei-\u003ei_flags \u0026 EXT4_EA_INODE_FL)) {\nfs/ext4/ialloc.c-1328-\t\terr = ext4_init_acl(handle, inode, dir);\n--\nfs/ext4/indirect.c=857=static int ext4_clear_blocks(handle_t *handle, struct inode *inode,\n--\nfs/ext4/indirect.c-867-\tif (S_ISDIR(inode-\u003ei_mode) || S_ISLNK(inode-\u003ei_mode) ||\nfs/ext4/indirect.c:868:\t ext4_test_inode_flag(inode, EXT4_INODE_EA_INODE))\nfs/ext4/indirect.c-869-\t\tflags |= EXT4_FREE_BLOCKS_FORGET | EXT4_FREE_BLOCKS_METADATA;\n--\nfs/ext4/inode.c=169=void ext4_evict_inode(struct inode *inode)\n--\nfs/ext4/inode.c-184-\nfs/ext4/inode.c:185:\tif (EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL)\nfs/ext4/inode.c-186-\t\text4_evict_ea_inode(inode);\n--\nfs/ext4/inode.c=434=void ext4_check_map_extents_env(struct inode *inode)\n--\nfs/ext4/inode.c-442-\t (inode_state_read_once(inode) \u0026 (I_FREEING | I_WILL_FREE | I_NEW)) ||\nfs/ext4/inode.c:443:\t ext4_test_inode_flag(inode, EXT4_INODE_EA_INODE) ||\nfs/ext4/inode.c-444-\t ext4_verity_in_progress(inode))\n--\nfs/ext4/inode.c=4697=static inline u64 ext4_inode_peek_iversion(const struct inode *inode)\nfs/ext4/inode.c-4698-{\nfs/ext4/inode.c:4699:\tif (unlikely(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL))\nfs/ext4/inode.c-4700-\t\treturn inode_peek_iversion_raw(inode);\n--\nfs/ext4/inode.c=5190=int ext4_get_projid(struct inode *inode, kprojid_t *projid)\n--\nfs/ext4/inode.c-5199- * ext4 has self-managed i_version for ea inodes, it stores the lower 32bit of\nfs/ext4/inode.c:5200: * refcount in i_version, so use raw values if inode has EXT4_EA_INODE_FL flag\nfs/ext4/inode.c-5201- * set.\n--\nfs/ext4/inode.c=5203=static inline void ext4_inode_set_iversion_queried(struct inode *inode, u64 val)\nfs/ext4/inode.c-5204-{\nfs/ext4/inode.c:5205:\tif (unlikely(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL))\nfs/ext4/inode.c-5206-\t\tinode_set_iversion_raw(inode, val);\n--\nfs/ext4/inode.c=5211=static int check_igot_inode(struct inode *inode, ext4_iget_flags flags,\n--\nfs/ext4/inode.c-5215-\nfs/ext4/inode.c:5216:\tif (flags \u0026 EXT4_IGET_EA_INODE) {\nfs/ext4/inode.c:5217:\t\tif (!(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL)) {\nfs/ext4/inode.c:5218:\t\t\terr_str = \"missing EA_INODE flag\";\nfs/ext4/inode.c-5219-\t\t\tgoto error;\n--\nfs/ext4/inode.c-5226-\t} else {\nfs/ext4/inode.c:5227:\t\tif ((EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL)) {\nfs/ext4/inode.c-5228-\t\t\t/*\n--\nfs/ext4/inode.c-5234-\t\t\t\treturn -ESTALE;\nfs/ext4/inode.c:5235:\t\t\terr_str = \"unexpected EA_INODE flag\";\nfs/ext4/inode.c-5236-\t\t\tgoto error;\n--\nfs/ext4/ioctl.c=1205=static int ext4_ioctl_setuuid(struct file *filp,\n--\nfs/ext4/ioctl.c-1261-\t\t(EXT4_FEATURE_INCOMPAT_EXTENTS |\t\\\nfs/ext4/ioctl.c:1262:\t\t EXT4_FEATURE_INCOMPAT_EA_INODE |\t\\\nfs/ext4/ioctl.c-1263-\t\t EXT4_FEATURE_INCOMPAT_ENCRYPT |\t\\\n--\nfs/ext4/verity.c-15- * by ext4 with only some relatively small changes to ext4. This approach\nfs/ext4/verity.c:16: * avoids having to depend on the EA_INODE feature and on rearchitecturing\nfs/ext4/verity.c-17- * ext4's xattr support to support paging multi-gigabyte xattrs into memory, and\n--\nfs/ext4/verity.c=102=static int ext4_begin_enable_verity(struct file *filp)\n--\nfs/ext4/verity.c-168- * xattrs. Also, if the descriptor includes a large signature blob it may be\nfs/ext4/verity.c:169: * too large to store in an xattr without the EA_INODE feature.\nfs/ext4/verity.c-170- */\n--\nfs/ext4/xattr.c=101=const struct xattr_handler * const ext4_xattr_handlers[] = {\n--\nfs/ext4/xattr.c-113-\nfs/ext4/xattr.c:114:#define EA_INODE_CACHE(inode)\t(((struct ext4_sb_info *) \\\nfs/ext4/xattr.c-115-\t\t\t\tinode-\u003ei_sb-\u003es_fs_info)-\u003es_ea_inode_cache)\n--\nfs/ext4/xattr.c=420=static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,\n--\nfs/ext4/xattr.c-436-\nfs/ext4/xattr.c:437:\tinode = ext4_iget(parent-\u003ei_sb, ea_ino, EXT4_IGET_EA_INODE);\nfs/ext4/xattr.c-438-\tif (IS_ERR(inode)) {\n--\nfs/ext4/xattr.c-454-\t inode-\u003ei_generation == parent-\u003ei_generation) {\nfs/ext4/xattr.c:455:\t\text4_set_inode_state(inode, EXT4_STATE_LUSTRE_EA_INODE);\nfs/ext4/xattr.c-456-\t\text4_xattr_inode_set_ref(inode, 1);\n--\nfs/ext4/xattr.c=468=void ext4_evict_ea_inode(struct inode *inode)\n--\nfs/ext4/xattr.c-471-\nfs/ext4/xattr.c:472:\tif (!EA_INODE_CACHE(inode))\nfs/ext4/xattr.c-473-\t\treturn;\nfs/ext4/xattr.c-474-\t/* Wait for entry to get unused so that we can remove it */\nfs/ext4/xattr.c:475:\twhile ((oe = mb_cache_entry_delete_or_get(EA_INODE_CACHE(inode),\nfs/ext4/xattr.c-476-\t\t\text4_xattr_inode_get_hash(inode), inode-\u003ei_ino))) {\nfs/ext4/xattr.c-477-\t\tmb_cache_entry_wait_unused(oe);\nfs/ext4/xattr.c:478:\t\tmb_cache_entry_put(EA_INODE_CACHE(inode), oe);\nfs/ext4/xattr.c-479-\t}\n--\nfs/ext4/xattr.c=525=ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,\n--\nfs/ext4/xattr.c-527-{\nfs/ext4/xattr.c:528:\tstruct mb_cache *ea_inode_cache = EA_INODE_CACHE(inode);\nfs/ext4/xattr.c-529-\tstruct inode *ea_inode;\n--\nfs/ext4/xattr.c-550-\nfs/ext4/xattr.c:551:\tif (!ext4_test_inode_state(ea_inode, EXT4_STATE_LUSTRE_EA_INODE)) {\nfs/ext4/xattr.c-552-\t\terr = ext4_xattr_inode_verify_hashes(ea_inode, entry, buffer,\n--\nfs/ext4/xattr.c=924=static void ext4_xattr_inode_free_quota(struct inode *parent,\n--\nfs/ext4/xattr.c-928-\tif (ea_inode \u0026\u0026\nfs/ext4/xattr.c:929:\t ext4_test_inode_state(ea_inode, EXT4_STATE_LUSTRE_EA_INODE))\nfs/ext4/xattr.c-930-\t\treturn;\n--\nfs/ext4/xattr.c=1461=static struct inode *ext4_xattr_inode_create(handle_t *handle,\n--\nfs/ext4/xattr.c-1480-\t\t\t\t S_IFREG | 0600, NULL, inode-\u003ei_ino + 1, owner,\nfs/ext4/xattr.c:1481:\t\t\t\t EXT4_EA_INODE_FL);\nfs/ext4/xattr.c-1482-\tif (!IS_ERR(ea_inode)) {\n--\nfs/ext4/xattr.c=1516=ext4_xattr_inode_cache_find(struct inode *inode, const void *value,\n--\nfs/ext4/xattr.c-1520-\tstruct mb_cache_entry *ce;\nfs/ext4/xattr.c:1521:\tstruct mb_cache *ea_inode_cache = EA_INODE_CACHE(inode);\nfs/ext4/xattr.c-1522-\tvoid *ea_data;\n--\nfs/ext4/xattr.c-1541-\t\tea_inode = ext4_iget(inode-\u003ei_sb, ce-\u003ee_value,\nfs/ext4/xattr.c:1542:\t\t\t\t EXT4_IGET_EA_INODE);\nfs/ext4/xattr.c-1543-\t\tif (IS_ERR(ea_inode))\n--\nfs/ext4/xattr.c=1567=static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,\n--\nfs/ext4/xattr.c-1601-\nfs/ext4/xattr.c:1602:\tif (EA_INODE_CACHE(inode))\nfs/ext4/xattr.c:1603:\t\tmb_cache_entry_create(EA_INODE_CACHE(inode), GFP_NOFS, hash,\nfs/ext4/xattr.c-1604-\t\t\t\t ea_inode-\u003ei_ino, true /* reusable */);\n--\nfs/ext4/xattr.c=1888=ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-1993-\t\t\tif (!ext4_test_inode_state(tmp_inode,\nfs/ext4/xattr.c:1994:\t\t\t\t\tEXT4_STATE_LUSTRE_EA_INODE)) {\nfs/ext4/xattr.c-1995-\t\t\t\t/*\n--\nfs/ext4/xattr.c=2996=void ext4_put_ea_inode(struct inode *inode)\n--\nfs/ext4/xattr.c-2999-\t\treturn;\nfs/ext4/xattr.c:3000:\tWARN_ON_ONCE(!(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL));\nfs/ext4/xattr.c-3001-\tif (iput_if_not_last(inode))\n"
} |
| 5/2 | 2026/07/02 18:10 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16080 output: 30 thoughts: 121 Thoughts: **Checking the EXT4_FEATURE_INCOMPAT_EA_INODE Feature and Dependencies** Okay, so I'm looking at this `EXT4_FEATURE_INCOMPAT_EA_INODE` feature. It's not a standalone Kconfig option, it just comes along with ext4. Right, so to actually *test* this feature, I need to verify that ext4 itself is enabled, which means `EXT4_FS` needs to be set. Makes sense. And, of course, extended attributes have to be enabled. That should be `EXT4_FS_XATTR`. But wait, I'm pretty sure that's usually on by default, or at least easy to explicitly set. Hold on...does `EXT4_FS_XATTR` actually exist? I better double-check that; I don't want to make assumptions. |
| 6/2 | 2026/07/02 18:10 | tool | grepper |
0mArgs:{
"Expression": "config EXT4_FS",
"PathPrefix": "fs/ext4/"
}Results: {
"Output": "fs/ext4/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/ext4/Kconfig:2:config EXT4_FS\nfs/ext4/Kconfig-3-\ttristate \"The Extended 4 (ext4) filesystem\"\n--\nfs/ext4/Kconfig=35=config EXT4_USE_FOR_EXT2\n--\nfs/ext4/Kconfig-45-\nfs/ext4/Kconfig:46:config EXT4_FS_POSIX_ACL\nfs/ext4/Kconfig-47-\tbool \"Ext4 POSIX Access Control Lists\"\n--\nfs/ext4/Kconfig-55-\nfs/ext4/Kconfig:56:config EXT4_FS_SECURITY\nfs/ext4/Kconfig-57-\tbool \"Ext4 Security Labels\"\n"
} |
| 7/2 | 2026/07/02 18:10 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16629 output: 34 thoughts: 744 Thoughts: **Focusing on EXT4 Extended Attributes (xattrs)** Okay, so I'm honing in on the EXT4 file system, specifically xattrs. `EXT4_FS` is the core, and I'm noting that while `EXT4_FS_POSIX_ACL` and `EXT4_FS_SECURITY` might be relevant for xattrs too, the EA inodes are the important part for larger attributes. So, for now, let's just stick with `EXT4_FS`. I need to nail down the functions that are going to be critical for the fuzzing campaign. I'm seeing a list of functions that seem promising, but I need to make some decisions. Initially, I had a focus list of the following functions: * `ext4_ea_inode_work` (statically defined, it might not be directly fuzzable, but it is called from a workqueue, so there may be a way) * `ext4_put_ea_inode` (called from various locations) * `ext4_xattr_delete_inode` * `ext4_xattr_release_block` * `ext4_xattr_inode_dec_ref_all` * `ext4_xattr_block_set` * `ext4_xattr_ibody_set` * `ext4_xattr_set_entry` * `ext4_xattr_inode_lookup_create` * `ext4_xattr_inode_create` * `ext4_xattr_inode_get` But now that I've reviewed the patch, it seems like several of these functions are modified. Basically, anything that used `iput(ea_inode)` is now using `ext4_put_ea_inode(ea_inode)`. Also, `ext4_xattr_delete_inode` no longer uses `ea_inode_array`. So, the focus really narrows to the following key functions: * `ext4_xattr_delete_inode` * `ext4_xattr_release_block` * `ext4_xattr_inode_dec_ref_all` * `ext4_xattr_block_set` * `ext4_xattr_ibody_set` * `ext4_put_ea_inode` I'm thinking, is `ext4_ea_inode_work` reachable, despite being static? Yes, it's triggered via delayed work. And `ext4_put_ea_inode`? Yep, involved in setting, getting, and deleting large xattrs. And what about `iput_if_not_last`? That's inline in `fs.h`, so accessible. So, going back to the first point; is `EXT4_FS` the right scope? Yes, it seems like it will provide enough coverage. Let's refine those "FocusSymbols": * `ext4_xattr_delete_inode` * `ext4_xattr_release_block` * `ext4_xattr_inode_dec_ref_all` * `ext4_xattr_block_set` * `ext4_xattr_ibody_set` * `ext4_put_ea_inode` * `ext4_ea_inode_work` I need to double-check if `ext4_xattr_release_block` is static, just to be sure. |
| 8/2 | 2026/07/02 18:11 | tool | grepper |
0mArgs:{
"Expression": "ext4_xattr_release_block",
"PathPrefix": "fs/ext4/"
}Results: {
"Output": "fs/ext4/xattr.c=1262=static void\nfs/ext4/xattr.c:1263:ext4_xattr_release_block(handle_t *handle, struct inode *inode,\nfs/ext4/xattr.c-1264-\t\t\t struct buffer_head *bh,\n--\nfs/ext4/xattr.c=1888=ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-2173-\tif (bs-\u003ebh \u0026\u0026 bs-\u003ebh != new_bh) {\nfs/ext4/xattr.c:2174:\t\text4_xattr_release_block(handle, inode, bs-\u003ebh,\nfs/ext4/xattr.c-2175-\t\t\t\t\t 0 /* extra_credits */);\n--\nfs/ext4/xattr.c=2860=int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-2936-\nfs/ext4/xattr.c:2937:\t\text4_xattr_release_block(handle, inode, bh,\nfs/ext4/xattr.c-2938-\t\t\t\t\t extra_credits);\n"
} |
| 9/2 | 2026/07/02 18:11 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18527 output: 38 thoughts: 202 Thoughts: Here's my thought process, summarized as you requested: **XFS Extended Attribute Function Inclusion** Okay, so I'm looking at these XFS extended attribute functions and figuring out what's relevant to include. Right off the bat, I see that this is a static context, which is important to keep in mind. I need to make sure I get the right ones. It looks like `ext4_xattr_delete_inode` is global, so that's definitely in. Then there's `ext4_xattr_block_set`, which is also global – include it. Same goes for `ext4_xattr_ibody_set` and `ext4_put_ea_inode` – those are global too, so I'll be sure to include them. Now, there's `ext4_ea_inode_work` - it's static, but seems related, so I'll include it in this pass. Let's quickly create the list. I'll include: - `ext4_xattr_delete_inode` - `ext4_xattr_block_set` - `ext4_xattr_ibody_set` - `ext4_put_ea_inode` - `ext4_ea_inode_work` - `ext4_xattr_release_block` - `ext4_xattr_inode_dec_ref_all` Wait a second...I just caught that `ext4_xattr_inode_dec_ref_all` is static as well... |
| 10/2 | 2026/07/02 18:11 | tool | grepper |
0mArgs:{
"Expression": "ext4_xattr_inode_dec_ref_all",
"PathPrefix": "fs/ext4/"
}Results: {
"Output": "fs/ext4/xattr.c=1155=static void\nfs/ext4/xattr.c:1156:ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\nfs/ext4/xattr.c-1157-\t\t\t struct buffer_head *bh,\n--\nfs/ext4/xattr.c=1263=ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-1302-\t\tif (ext4_has_feature_ea_inode(inode-\u003ei_sb))\nfs/ext4/xattr.c:1303:\t\t\text4_xattr_inode_dec_ref_all(handle, inode, bh,\nfs/ext4/xattr.c-1304-\t\t\t\t\t\t BFIRST(bh),\n--\nfs/ext4/xattr.c=2860=int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-2895-\t\tif (header-\u003eh_magic == cpu_to_le32(EXT4_XATTR_MAGIC))\nfs/ext4/xattr.c:2896:\t\t\text4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,\nfs/ext4/xattr.c-2897-\t\t\t\t\t\t IFIRST(header),\n"
} |
| 11/2 | 2026/07/02 18:11 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19487 output: 35 thoughts: 34 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: **Focus Symbol Management and a Quick Check** Right, these new items need to be integrated into the `FocusSymbols` structure. That's the immediate action. Before I fully commit, though, let's just do a quick sanity check. I'll need to confirm that `iput_if_not_last` is behaving as I expect, and that means a peek at `include/linux/fs.h`. It's likely that a subtle edge case has been uncovered by this. This function handles the release of an inode. I need to make certain that the implementation and usage align with my current understanding of the focus symbol strategy, specifically regarding finalization and any associated race conditions with memory management. This quick cross-reference will ensure there are no surprises with how this interacts with the new entries. |
| 12/2 | 2026/07/02 18:11 | tool | grepper |
0mArgs:{
"Expression": "iput_if_not_last",
"PathPrefix": "include/linux/fs.h"
}Results: {
"Output": "include/linux/fs.h=2415=void iput_not_last(struct inode *);\n--\ninclude/linux/fs.h-2417-/**\ninclude/linux/fs.h:2418: * iput_if_not_last - drop an inode reference only if it is not the last one\ninclude/linux/fs.h-2419- * @inode: inode to put\n--\ninclude/linux/fs.h-2423- */\ninclude/linux/fs.h:2424:static inline bool __must_check iput_if_not_last(struct inode *inode)\ninclude/linux/fs.h-2425-{\n"
} |
| 13/2 | 2026/07/02 18:11 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19922 output: 222 thoughts: 261 Thoughts: **Fuzzing Strategy for Extended Attribute (EA) Inode Handling in ext4** Okay, so I'm looking at this patch and my initial thought is that we need to fuzz the changes to ext4's EA inode handling. It looks like the main goal here is to avoid lock ordering issues when dealing with EA inodes, which is crucial for overall filesystem stability. Specifically, they've introduced a deferred `iput` mechanism using a lockless list and a delayed workqueue called `ext4_ea_inode_work`. This is a pretty significant architectural shift and I need to ensure it's robust. While the primary function of interest, `ext4_put_ea_inode`, might not be directly fuzzable as a symbol because it's inlined, it's still at the heart of the changes and therefore a key consideration. The core functions I'll need to focus on are: `ext4_xattr_delete_inode`, `ext4_xattr_block_set`, `ext4_xattr_ibody_set`, `ext4_put_ea_inode` (even if inlined, I'll need to consider how it's used), `ext4_ea_inode_work`, `ext4_xattr_release_block`, and `ext4_xattr_inode_dec_ref_all`. These are the building blocks involved in EA inode eviction, and need to be examined carefully. The configurations I'll need to remember to enable for the fuzzing runs would be `EXT4_FS`. I'm concerned about the usual suspects: use-after-free conditions, memory leaks, and potential deadlocks that might arise due to this new delayed workqueue and lockless list. I need to design fuzzing campaigns that specifically target those areas and test thoroughly. I'll need to pay close attention to the interaction between the lockless list and the workqueue and ensure that the eviction process is clean and consistent under various load conditions. Right, I'm ready to call `set-results` now. |
| 14/2 | 2026/07/02 18:11 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"EXT4_FS"
],
"FocusSymbols": [
"ext4_xattr_delete_inode",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_put_ea_inode",
"ext4_ea_inode_work",
"ext4_xattr_release_block",
"ext4_xattr_inode_dec_ref_all"
],
"Reasoning": "The patch modifies ext4's handling of Extended Attribute (EA) inodes by introducing a deferred iput mechanism to avoid lock ordering issues. It replaces the `ext4_xattr_inode_array` with a lockless list and a delayed workqueue (`ext4_ea_inode_work`). This is a functional change in core ext4 logic and should be fuzzed to ensure no use-after-free, memory leaks, or deadlocks occur during EA inode eviction.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"EXT4_FS"
],
"FocusSymbols": [
"ext4_xattr_delete_inode",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_put_ea_inode",
"ext4_ea_inode_work",
"ext4_xattr_release_block",
"ext4_xattr_inode_dec_ref_all"
],
"Reasoning": "The patch modifies ext4's handling of Extended Attribute (EA) inodes by introducing a deferred iput mechanism to avoid lock ordering issues. It replaces the `ext4_xattr_inode_array` with a lockless list and a delayed workqueue (`ext4_ea_inode_work`). This is a functional change in core ext4 logic and should be fuzzed to ensure no use-after-free, memory leaks, or deadlocks occur during EA inode eviction.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|