AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` and uses it exclusively in `thp_shrinker_init`, which is an `__init` function executed only once during kernel boot. It does not introduce any new reachable logic or system calls that can be triggered or explored by a fuzzer from userspace.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 9ddc4e24895da0a468873efa54f713f85d06281b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Jul 18 10:33:15 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/arm64/include/asm/set_memory.h b/arch/arm64/include/asm/set_memory.h\nindex 90f61b17275e1b..7083260303c3cd 100644\n--- a/arch/arm64/include/asm/set_memory.h\n+++ b/arch/arm64/include/asm/set_memory.h\n@@ -14,6 +14,8 @@ int set_memory_valid(unsigned long addr, int numpages, int enable);\n int set_direct_map_invalid_noflush(struct page *page);\n int set_direct_map_default_noflush(struct page *page);\n int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\n+#define set_direct_map_ro_noflush set_direct_map_ro_noflush\n bool kernel_page_present(struct page *page);\n \n int set_memory_encrypted(unsigned long addr, int numpages);\ndiff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c\nindex ce035e1b4eaf66..c51236b6165199 100644\n--- a/arch/arm64/mm/pageattr.c\n+++ b/arch/arm64/mm/pageattr.c\n@@ -365,6 +365,16 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n \treturn set_memory_valid(addr, nr, valid);\n }\n \n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\n+{\n+\tif (!can_set_direct_map())\n+\t\treturn 0;\n+\n+\treturn update_range_prot((unsigned long)addr, PAGE_SIZE * nr_pages,\n+\t\t\t\t __pgprot(PTE_RDONLY),\n+\t\t\t\t __pgprot(PTE_WRITE));\n+}\n+\n #ifdef CONFIG_DEBUG_PAGEALLOC\n /*\n  * This is - apart from the return value - doing the same\ndiff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h\nindex 4362c26aa992db..bd3817e06052c0 100644\n--- a/arch/x86/include/asm/set_memory.h\n+++ b/arch/x86/include/asm/set_memory.h\n@@ -89,6 +89,8 @@ int set_pages_rw(struct page *page, int numpages);\n int set_direct_map_invalid_noflush(struct page *page);\n int set_direct_map_default_noflush(struct page *page);\n int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\n+#define set_direct_map_ro_noflush set_direct_map_ro_noflush\n bool kernel_page_present(struct page *page);\n \n extern int kernel_set_to_readonly;\ndiff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c\nindex d023a40a1e0345..5987f4c84f6fe9 100644\n--- a/arch/x86/mm/pat/set_memory.c\n+++ b/arch/x86/mm/pat/set_memory.c\n@@ -2662,6 +2662,21 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n \treturn __set_pages_np(page, nr);\n }\n \n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\n+{\n+\tunsigned long tempaddr = (unsigned long)addr;\n+\tstruct cpa_data cpa = {\n+\t\t.vaddr = \u0026tempaddr,\n+\t\t.pgd = NULL,\n+\t\t.numpages = nr_pages,\n+\t\t.mask_set = __pgprot(0),\n+\t\t.mask_clr = __pgprot(_PAGE_RW | _PAGE_DIRTY),\n+\t\t.flags = CPA_NO_CHECK_ALIAS,\n+\t};\n+\n+\treturn __change_page_attr_set_clr(\u0026cpa, 1);\n+}\n+\n #ifdef CONFIG_DEBUG_PAGEALLOC\n void __kernel_map_pages(struct page *page, int numpages, int enable)\n {\ndiff --git a/include/linux/set_memory.h b/include/linux/set_memory.h\nindex 3030d9245f5ac8..e83ced6a382777 100644\n--- a/include/linux/set_memory.h\n+++ b/include/linux/set_memory.h\n@@ -40,6 +40,24 @@ static inline int set_direct_map_valid_noflush(struct page *page,\n \treturn 0;\n }\n \n+/**\n+ * set_direct_map_ro_noflush - make a direct-map range read-only\n+ * @addr: start address in the direct map\n+ * @nr_pages: number of pages starting at @addr\n+ *\n+ * Make the direct-map range starting at @addr read-only without invalidating\n+ * TLBs. Callers must either ensure that no stale writable translations can\n+ * be used, or treat the permission change as a best-effort hardening step.\n+ *\n+ * Return: 0 on success or when direct-map permission changes are unsupported,\n+ * or a negative errno on failure.\n+ */\n+static inline int set_direct_map_ro_noflush(const void *addr,\n+\t\t\t\t\t    unsigned long nr_pages)\n+{\n+\treturn 0;\n+}\n+\n static inline bool kernel_page_present(struct page *page)\n {\n \treturn true;\n@@ -56,6 +74,17 @@ static inline bool can_set_direct_map(void)\n }\n #define can_set_direct_map can_set_direct_map\n #endif\n+\n+#ifndef set_direct_map_ro_noflush\n+/* See the comment above the generic fallback for the _noflush contract. */\n+static inline int set_direct_map_ro_noflush(const void *addr,\n+\t\t\t\t\t    unsigned long nr_pages)\n+{\n+\treturn 0;\n+}\n+\n+#define set_direct_map_ro_noflush set_direct_map_ro_noflush\n+#endif\n #endif /* CONFIG_ARCH_HAS_SET_DIRECT_MAP */\n \n #ifdef CONFIG_X86_64\ndiff --git a/mm/huge_memory.c b/mm/huge_memory.c\nindex 970e077019b75a..4425ae5560cbd7 100644\n--- a/mm/huge_memory.c\n+++ b/mm/huge_memory.c\n@@ -40,8 +40,10 @@\n #include \u003clinux/pgalloc.h\u003e\n #include \u003clinux/pgalloc_tag.h\u003e\n #include \u003clinux/pagewalk.h\u003e\n+#include \u003clinux/set_memory.h\u003e\n \n #include \u003casm/tlb.h\u003e\n+#include \u003casm/tlbflush.h\u003e\n #include \"internal.h\"\n #include \"swap.h\"\n \n@@ -932,6 +934,8 @@ static int __init thp_shrinker_init(void)\n \tshrinker_register(deferred_split_shrinker);\n \n \tif (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO)) {\n+\t\tunsigned long addr;\n+\n \t\t/*\n \t\t * Bump the reference of the huge_zero_folio and do not\n \t\t * initialize the shrinker.\n@@ -940,8 +944,18 @@ static int __init thp_shrinker_init(void)\n \t\t * that get_huge_zero_folio() will most likely not fail as\n \t\t * thp_shrinker_init() is invoked early on during boot.\n \t\t */\n-\t\tif (!get_huge_zero_folio())\n+\t\tif (!get_huge_zero_folio()) {\n \t\t\tpr_warn(\"Allocating persistent huge zero folio failed\\n\");\n+\t\t\treturn 0;\n+\t\t}\n+\n+\t\taddr = (unsigned long)folio_address(huge_zero_folio);\n+\t\t/*\n+\t\t * The folio was zeroed through the writable direct map. Flush\n+\t\t * after the page-table update to invalidate stale translations.\n+\t\t */\n+\t\tset_direct_map_ro_noflush((void *)addr, HPAGE_PMD_NR);\n+\t\tflush_tlb_kernel_range(addr, addr + HPAGE_PMD_SIZE);\n \t\treturn 0;\n \t}\n \n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` and uses it exclusively in `thp_shrinker_init`, which is an `__init` function executed only once during kernel boot. It does not introduce any new reachable logic or system calls that can be triggered or explored by a fuzzer from userspace.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 9ddc4e24895da0a468873efa54f713f85d06281b
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Jul 18 10:33:15 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/arm64/include/asm/set_memory.h b/arch/arm64/include/asm/set_memory.h
index 90f61b17275e1b..7083260303c3cd 100644
--- a/arch/arm64/include/asm/set_memory.h
+++ b/arch/arm64/include/asm/set_memory.h
@@ -14,6 +14,8 @@ int set_memory_valid(unsigned long addr, int numpages, int enable);
 int set_direct_map_invalid_noflush(struct page *page);
 int set_direct_map_default_noflush(struct page *page);
 int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);
+#define set_direct_map_ro_noflush set_direct_map_ro_noflush
 bool kernel_page_present(struct page *page);
 
 int set_memory_encrypted(unsigned long addr, int numpages);
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index ce035e1b4eaf66..c51236b6165199 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -365,6 +365,16 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)
 	return set_memory_valid(addr, nr, valid);
 }
 
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)
+{
+	if (!can_set_direct_map())
+		return 0;
+
+	return update_range_prot((unsigned long)addr, PAGE_SIZE * nr_pages,
+				 __pgprot(PTE_RDONLY),
+				 __pgprot(PTE_WRITE));
+}
+
 #ifdef CONFIG_DEBUG_PAGEALLOC
 /*
  * This is - apart from the return value - doing the same
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index 4362c26aa992db..bd3817e06052c0 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -89,6 +89,8 @@ int set_pages_rw(struct page *page, int numpages);
 int set_direct_map_invalid_noflush(struct page *page);
 int set_direct_map_default_noflush(struct page *page);
 int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);
+#define set_direct_map_ro_noflush set_direct_map_ro_noflush
 bool kernel_page_present(struct page *page);
 
 extern int kernel_set_to_readonly;
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d023a40a1e0345..5987f4c84f6fe9 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -2662,6 +2662,21 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)
 	return __set_pages_np(page, nr);
 }
 
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)
+{
+	unsigned long tempaddr = (unsigned long)addr;
+	struct cpa_data cpa = {
+		.vaddr = &tempaddr,
+		.pgd = NULL,
+		.numpages = nr_pages,
+		.mask_set = __pgprot(0),
+		.mask_clr = __pgprot(_PAGE_RW | _PAGE_DIRTY),
+		.flags = CPA_NO_CHECK_ALIAS,
+	};
+
+	return __change_page_attr_set_clr(&cpa, 1);
+}
+
 #ifdef CONFIG_DEBUG_PAGEALLOC
 void __kernel_map_pages(struct page *page, int numpages, int enable)
 {
diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h
index 3030d9245f5ac8..e83ced6a382777 100644
--- a/include/linux/set_memory.h
+++ b/include/linux/set_memory.h
@@ -40,6 +40,24 @@ static inline int set_direct_map_valid_noflush(struct page *page,
 	return 0;
 }
 
+/**
+ * set_direct_map_ro_noflush - make a direct-map range read-only
+ * @addr: start address in the direct map
+ * @nr_pages: number of pages starting at @addr
+ *
+ * Make the direct-map range starting at @addr read-only without invalidating
+ * TLBs. Callers must either ensure that no stale writable translations can
+ * be used, or treat the permission change as a best-effort hardening step.
+ *
+ * Return: 0 on success or when direct-map permission changes are unsupported,
+ * or a negative errno on failure.
+ */
+static inline int set_direct_map_ro_noflush(const void *addr,
+					    unsigned long nr_pages)
+{
+	return 0;
+}
+
 static inline bool kernel_page_present(struct page *page)
 {
 	return true;
@@ -56,6 +74,17 @@ static inline bool can_set_direct_map(void)
 }
 #define can_set_direct_map can_set_direct_map
 #endif
+
+#ifndef set_direct_map_ro_noflush
+/* See the comment above the generic fallback for the _noflush contract. */
+static inline int set_direct_map_ro_noflush(const void *addr,
+					    unsigned long nr_pages)
+{
+	return 0;
+}
+
+#define set_direct_map_ro_noflush set_direct_map_ro_noflush
+#endif
 #endif /* CONFIG_ARCH_HAS_SET_DIRECT_MAP */
 
 #ifdef CONFIG_X86_64
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 970e077019b75a..4425ae5560cbd7 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -40,8 +40,10 @@
 #include <linux/pgalloc.h>
 #include <linux/pgalloc_tag.h>
 #include <linux/pagewalk.h>
+#include <linux/set_memory.h>
 
 #include <asm/tlb.h>
+#include <asm/tlbflush.h>
 #include "internal.h"
 #include "swap.h"
 
@@ -932,6 +934,8 @@ static int __init thp_shrinker_init(void)
 	shrinker_register(deferred_split_shrinker);
 
 	if (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO)) {
+		unsigned long addr;
+
 		/*
 		 * Bump the reference of the huge_zero_folio and do not
 		 * initialize the shrinker.
@@ -940,8 +944,18 @@ static int __init thp_shrinker_init(void)
 		 * that get_huge_zero_folio() will most likely not fail as
 		 * thp_shrinker_init() is invoked early on during boot.
 		 */
-		if (!get_huge_zero_folio())
+		if (!get_huge_zero_folio()) {
 			pr_warn("Allocating persistent huge zero folio failed\n");
+			return 0;
+		}
+
+		addr = (unsigned long)folio_address(huge_zero_folio);
+		/*
+		 * The folio was zeroed through the writable direct map. Flush
+		 * after the page-table update to invalidate stale translations.
+		 */
+		set_direct_map_ro_noflush((void *)addr, HPAGE_PMD_NR);
+		flush_tlb_kernel_range(addr, addr + HPAGE_PMD_SIZE);
 		return 0;
 	}
 

gemini-3.1-pro-preview

null

null

							input: 3909
							output: 25
							thoughts: 217
						

**Analyzing the Proposed Patch: `set_direct_map_ro_noflush`**

Okay, so I'm looking at this patch and it's introducing this `set_direct_map_ro_noflush` function. It seems to be touching several key areas: `arch/arm64` and `arch/x86` assembly includes and implementation, the generic `include/linux/set_memory.h`, and, interestingly, `mm/huge_memory.c`. The fact that it's in both architecture-specific and more generic areas suggests this is an important low-level optimization.

My immediate thought is, what's the purpose of this function? The name suggests it's related to setting memory read-only without flushing the cache. That implies a specific use case where we can guarantee a read-only state without invalidating cached data, potentially for performance gains.

The modification to `mm/huge_memory.c` is particularly intriguing. It's using this new function on `huge_zero_folio`, specifically when `CONFIG_PERSISTENT_HUGE_ZERO_FOLIO` is enabled. Ah, right. It seems this is for persistent zero folios, which means we are dealing with memory that persists across some action. This is interesting.

My next step is clear: I need to quickly determine what `CONFIG_PERSISTENT_HUGE_ZERO_FOLIO` *actually* does. I'll need to use `grepper` or a similar tool to find the definition and any relevant code using it to understand the context and implications of this change.

{
  "Expression": "PERSISTENT_HUGE_ZERO_FOLIO"
}

{
  "Output": "arch/s390/configs/debug_defconfig=103=CONFIG_KSM=y\narch/s390/configs/debug_defconfig:104:CONFIG_PERSISTENT_HUGE_ZERO_FOLIO=y\narch/s390/configs/debug_defconfig-105-CONFIG_TRANSPARENT_HUGEPAGE=y\n--\narch/s390/configs/defconfig=96=CONFIG_KSM=y\narch/s390/configs/defconfig:97:CONFIG_PERSISTENT_HUGE_ZERO_FOLIO=y\narch/s390/configs/defconfig-98-CONFIG_TRANSPARENT_HUGEPAGE=y\n--\ninclude/linux/huge_mm.h=548=static inline struct folio *get_persistent_huge_zero_folio(void)\ninclude/linux/huge_mm.h-549-{\ninclude/linux/huge_mm.h:550:\tif (!IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO))\ninclude/linux/huge_mm.h-551-\t\treturn NULL;\n--\ninclude/linux/huge_mm.h=785=static inline int split_folio_to_order(struct folio *folio, int new_order)\n--\ninclude/linux/huge_mm.h-799- *\ninclude/linux/huge_mm.h:800: * Return: pointer to PMD sized zero folio if CONFIG_PERSISTENT_HUGE_ZERO_FOLIO\ninclude/linux/huge_mm.h-801- * is enabled or a single page sized zero folio\n--\nmm/Kconfig=771=config ARCH_WANTS_THP_SWAP\n--\nmm/Kconfig-773-\nmm/Kconfig:774:config PERSISTENT_HUGE_ZERO_FOLIO\nmm/Kconfig-775-\tbool \"Allocate a PMD sized folio for zeroing\"\n--\nmm/huge_memory.c=263=struct folio *mm_get_huge_zero_folio(struct mm_struct *mm)\nmm/huge_memory.c-264-{\nmm/huge_memory.c:265:\tif (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO))\nmm/huge_memory.c-266-\t\treturn huge_zero_folio;\n--\nmm/huge_memory.c=280=void mm_put_huge_zero_folio(struct mm_struct *mm)\nmm/huge_memory.c-281-{\nmm/huge_memory.c:282:\tif (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO))\nmm/huge_memory.c-283-\t\treturn;\n--\nmm/huge_memory.c=923=static int __init thp_shrinker_init(void)\n--\nmm/huge_memory.c-935-\nmm/huge_memory.c:936:\tif (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO)) {\nmm/huge_memory.c-937-\t\tunsigned long addr;\n"
}

gemini-3.1-pro-preview

null

null

							input: 5276
							output: 24
							thoughts: 475
						

**Analyzing the Patch for Fuzzing Potential**

Okay, so I'm looking at this patch and my initial thought is, "Hmm, this adds a call to `set_direct_map_ro_noflush` within `thp_shrinker_init` when `CONFIG_PERSISTENT_HUGE_ZERO_FOLIO` is enabled."  `thp_shrinker_init` is an `__init` function, which means it runs *once* at boot. My gut reaction is that this isn't something syzkaller, or other fuzzers, would normally target directly because it's boot-time initialization.  Fuzzers focus on runtime behavior and things like system calls, so this seems immediately unlikely to be fuzzer-friendly.

I need to confirm if there are any other functional changes here.  The code itself, `set_direct_map_ro_noflush`, is being applied on arm64 and x86, with a fallback defined in `include/linux/set_memory.h`. The critical point here is that this new function is *only* called within `thp_shrinker_init`. That's a huge red flag because that means it's solely executed at kernel boot.  Since it's in an `__init` function, this isn't code syzkaller can readily reach.

Wait a minute...what about the *effect* of this change? It changes the huge zero folio's behavior by making the direct map of the huge zero folio read-only. Ah, now I see: this is a hardening feature, a security improvement. If someone tries to write to the huge zero folio via the direct map, it'll result in a fault. That's good, but from a fuzzing perspective, this change doesn't introduce *new* reachable logic that can be systematically exploited. It's a protection mechanism, not a new attack surface.

Furthermore, `set_direct_map_ro_noflush` is just a simple wrapper around `update_range_prot` on arm64 or `__change_page_attr_set_clr` on x86, so the complexity is minimal. The important thing is that it is only called in `thp_shrinker_init`. Since `thp_shrinker_init` is an `__init` function, which is only executed once at boot, the code path is not able to be triggered more than once per boot. This is definitely a boot-time initialization. Therefore, WorthFuzzing=false.

I'll quickly double-check to make sure there are *no* other callers of `set_direct_map_ro_noflush`, but I'm pretty confident in my initial assessment.

{
  "Expression": "set_direct_map_ro_noflush"
}

{
  "Output": "arch/arm64/include/asm/set_memory.h=16=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\narch/arm64/include/asm/set_memory.h:17:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\narch/arm64/include/asm/set_memory.h:18:#define set_direct_map_ro_noflush set_direct_map_ro_noflush\narch/arm64/include/asm/set_memory.h-19-bool kernel_page_present(struct page *page);\n--\narch/arm64/mm/pageattr.c=358=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n--\narch/arm64/mm/pageattr.c-367-\narch/arm64/mm/pageattr.c:368:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\narch/arm64/mm/pageattr.c-369-{\n--\narch/x86/include/asm/set_memory.h=91=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\narch/x86/include/asm/set_memory.h:92:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\narch/x86/include/asm/set_memory.h:93:#define set_direct_map_ro_noflush set_direct_map_ro_noflush\narch/x86/include/asm/set_memory.h-94-bool kernel_page_present(struct page *page);\n--\narch/x86/mm/pat/set_memory.c=2657=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n--\narch/x86/mm/pat/set_memory.c-2664-\narch/x86/mm/pat/set_memory.c:2665:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\narch/x86/mm/pat/set_memory.c-2666-{\n--\ninclude/linux/set_memory.h=37=static inline int set_direct_map_valid_noflush(struct page *page,\n--\ninclude/linux/set_memory.h-43-/**\ninclude/linux/set_memory.h:44: * set_direct_map_ro_noflush - make a direct-map range read-only\ninclude/linux/set_memory.h-45- * @addr: start address in the direct map\n--\ninclude/linux/set_memory.h-54- */\ninclude/linux/set_memory.h:55:static inline int set_direct_map_ro_noflush(const void *addr,\ninclude/linux/set_memory.h-56-\t\t\t\t\t    unsigned long nr_pages)\n--\ninclude/linux/set_memory.h=71=static inline bool can_set_direct_map(void)\n--\ninclude/linux/set_memory.h-77-\ninclude/linux/set_memory.h:78:#ifndef set_direct_map_ro_noflush\ninclude/linux/set_memory.h-79-/* See the comment above the generic fallback for the _noflush contract. */\ninclude/linux/set_memory.h:80:static inline int set_direct_map_ro_noflush(const void *addr,\ninclude/linux/set_memory.h-81-\t\t\t\t\t    unsigned long nr_pages)\n--\ninclude/linux/set_memory.h-85-\ninclude/linux/set_memory.h:86:#define set_direct_map_ro_noflush set_direct_map_ro_noflush\ninclude/linux/set_memory.h-87-#endif\n--\nmm/huge_memory.c=923=static int __init thp_shrinker_init(void)\n--\nmm/huge_memory.c-956-\t\t */\nmm/huge_memory.c:957:\t\tset_direct_map_ro_noflush((void *)addr, HPAGE_PMD_NR);\nmm/huge_memory.c-958-\t\tflush_tlb_kernel_range(addr, addr + HPAGE_PMD_SIZE);\n"
}

gemini-3.1-pro-preview

null

null

							input: 7475
							output: 104
							thoughts: 165
						

**My Assessment of the Fuzzing Suitability**

Okay, let me break this down. The sole entry point for this new code is `thp_shrinker_init`. Right, that's an `__init` function, which means it runs only once, during the kernel's initial boot sequence. It's essentially a setup routine. Thinking about it, this function doesn't add any new functionality that userspace can directly access. No new system calls are exposed, no new ioctls, nothing that a user could trigger through regular operations. And critically, this `set_direct_map_ro_noflush` function is *only* called within that initialization context.

Therefore, since the code path introduced by the patch is inherently limited in scope and execution and there are no new attack surfaces, fuzzing this part of the kernel seems utterly pointless. It's a dead end, and a waste of cycles. The answer is clear: WorthFuzzing: false. I'll make sure to reflect this concisely in my response.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` and uses it exclusively in `thp_shrinker_init`, which is an `__init` function executed only once during kernel boot. It does not introduce any new reachable logic or system calls that can be triggered or explored by a fuzzer from userspace.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` and uses it exclusively in `thp_shrinker_init`, which is an `__init` function executed only once during kernel boot. It does not introduce any new reachable logic or system calls that can be triggered or explored by a fuzzer from userspace.",
  "WorthFuzzing": false
}