AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/20 21:53	flow	patch-triage	1m Args: null Results: { "EnableConfigs": [ "PROC_FS", "PROC_PAGE_MONITOR" ], "FocusSymbols": [ "show_smaps_rollup", "smap_gather_stats_range", "smap_gather_stats", "proc_get_vma", "m_start", "m_next", "do_procmap_query" ], "KMSANReasoning": "The patch modifies `fs/proc/task_mmu.c` to allow `show_smaps_rollup` to utilize per-VMA locks with RCU and fall back to `mmap_lock` under contention, refactors gate VMA handling across `m_start`/`m_next`, inlines/reorders locking helpers, and extends selftests for `smaps_rollup` racing with VMA operations.\n\nPotential bugs introduced by these concurrency and iteration changes include locking issues (deadlocks, unbalanced lock/unlock), race conditions, and use-after-free or invalid pointer dereferences of `vm_area_struct` instances when dropping and retaking locks. All of these classes of bugs are thoroughly covered by standard KASAN, LOCKDEP, and kernel debug asserts.\n\nThere are no uninitialized memory risks:\n1. All local stack variables and structures (e.g. `struct mem_size_stats mss = {}`, `struct proc_maps_locking_ctx lock_ctx`) are explicitly zero-initialized.\n2. Data exposed to userspace is emitted as formatted ASCII text through `seq_file` helpers rather than binary structure copying.\n3. No struct padding, uninitialized buffers, or conditional branching based on uninitialized values are introduced.\n\nTherefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false, "Reasoning": "The patch modifies memory management and procfs iteration and locking logic in fs/proc/task_mmu.c. In particular, it transitions show_smaps_rollup() from holding mmap_read_lock throughout the walk to utilizing per-VMA locking and RCU iteration via proc_get_vma() with dynamic fallback on contention, adds smap_gather_stats_range() to handle concurrent VMA resizing/merges, and refactors gate VMA and lock state handling. These concurrency-sensitive paths in core memory management / procfs are fully reachable and warrant fuzzing.", "WorthFuzzing": true }
1/1	2026/09/20 21:53	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 65b8cf9238da96ba78f442644c1d90d5a151280b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Sep 20 21:52:59 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c\nindex 052e8dc796bcf..c0d228036b8a6 100644\n--- a/fs/proc/task_mmu.c\n+++ b/fs/proc/task_mmu.c\n@@ -130,28 +130,12 @@ static void release_task_mempolicy(struct proc_maps_private priv)\n }\n #endif\n \n-static inline int lock_ctx_mm(struct proc_maps_locking_ctx lock_ctx)\n-{\n-\tint ret = mmap_read_lock_killable(lock_ctx-\u003emm);\n-\n-\tif (!ret)\n-\t\tlock_ctx-\u003emmap_locked = true;\n-\n-\treturn ret;\n-}\n-\n-static inline void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx)\n+static void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx)\n {\n \tmmap_read_unlock(lock_ctx-\u003emm);\n \tlock_ctx-\u003emmap_locked = false;\n }\n \n-static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx)\n-{\n-\tlock_ctx-\u003elocked_vma = NULL;\n-\tlock_ctx-\u003emmap_locked = false;\n-}\n-\n static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx)\n {\n \tif (lock_ctx-\u003elocked_vma) {\n@@ -160,23 +144,10 @@ static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx)\n \t}\n }\n \n-static inline bool lock_vma_range(struct seq_file m,\n-\t\t\t\t struct proc_maps_locking_ctx lock_ctx)\n-{\n-\trcu_read_lock();\n-\treset_lock_ctx(lock_ctx);\n-\n-\treturn true;\n-}\n-\n-static inline void unlock_vma_range(struct proc_maps_locking_ctx lock_ctx)\n+static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx)\n {\n-\tif (lock_ctx-\u003emmap_locked) {\n-\t\tunlock_ctx_mm(lock_ctx);\n-\t} else {\n-\t\tunlock_ctx_vma(lock_ctx);\n-\t\trcu_read_unlock();\n-\t}\n+\tlock_ctx-\u003elocked_vma = NULL;\n+\tlock_ctx-\u003emmap_locked = false;\n }\n \n static struct vm_area_struct get_next_vma(struct proc_maps_private priv,\n@@ -196,8 +167,8 @@ static struct vm_area_struct get_next_vma(struct proc_maps_private priv,\n \treturn vma;\n }\n \n-static inline bool fallback_to_mmap_lock(struct proc_maps_private priv,\n-\t\t\t\t\t loff_t pos)\n+static bool fallback_to_mmap_lock(struct proc_maps_private priv,\n+\t\tloff_t pos)\n {\n \tstruct proc_maps_locking_ctx lock_ctx = \u0026priv-\u003elock_ctx;\n \n@@ -213,7 +184,8 @@ static inline bool fallback_to_mmap_lock(struct proc_maps_private priv,\n \treturn true;\n }\n \n-static inline void drop_rcu(struct proc_maps_private priv)\n+#ifdef CONFIG_PROC_PAGE_MONITOR\n+static void drop_rcu(struct proc_maps_private priv)\n {\n \tif (priv-\u003elock_ctx.mmap_locked)\n \t\treturn;\n@@ -221,7 +193,7 @@ static inline void drop_rcu(struct proc_maps_private priv)\n \trcu_read_unlock();\n }\n \n-static inline void reacquire_rcu(struct proc_maps_private priv)\n+static void reacquire_rcu(struct proc_maps_private priv)\n {\n \tif (priv-\u003elock_ctx.mmap_locked)\n \t\treturn;\n@@ -230,6 +202,7 @@ static inline void reacquire_rcu(struct proc_maps_private priv)\n \t/ Reinitialize the iterator. /\n \tvma_iter_set(\u0026priv-\u003eiter, priv-\u003elock_ctx.locked_vma-\u003evm_end);\n }\n+#endif\n \n static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos)\n {\n@@ -255,9 +228,6 @@ static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos)\n \t\t found the extended vma with the same vm_start.\n \t\t /\n \t\tppos = vma-\u003evm_end;\n-\t} else {\n-\t\tppos = SENTINEL_VMA_GATE;\n-\t\tvma = get_gate_vma(priv-\u003elock_ctx.mm);\n \t}\n \n \treturn vma;\n@@ -267,6 +237,7 @@ static void m_start(struct seq_file m, loff_t ppos)\n {\n \tstruct proc_maps_private priv = m-\u003eprivate;\n \tstruct proc_maps_locking_ctx lock_ctx;\n+\tstruct vm_area_struct vma;\n \tloff_t last_addr = ppos;\n \tstruct mm_struct mm;\n \n@@ -286,13 +257,8 @@ static void m_start(struct seq_file m, loff_t ppos)\n \t\treturn NULL;\n \t}\n \n-\tif (!lock_vma_range(m, lock_ctx)) {\n-\t\tmmput(mm);\n-\t\tput_task_struct(priv-\u003etask);\n-\t\tpriv-\u003etask = NULL;\n-\t\treturn ERR_PTR(-EINTR);\n-\t}\n-\n+\trcu_read_lock();\n+\treset_lock_ctx(lock_ctx);\n \t/\n \t Reset current position if last_addr was set before\n \t * and it's not a sentinel.\n@@ -301,19 +267,39 @@ static void m_start(struct seq_file m, loff_t ppos)\n \t\tppos = last_addr = priv-\u003elast_pos;\n \tvma_iter_init(\u0026priv-\u003eiter, mm, (unsigned long)last_addr);\n \thold_task_mempolicy(priv);\n+\t/\n+\t If seq_file had to flush its collected data right after m_next() set\n+\t * position to SENTINEL_VMA_GATE, m_start() will get that sentinel and\n+\t * should return gate_vma without calling proc_get_vma().\n+\t /\n \tif (last_addr == SENTINEL_VMA_GATE)\n \t\treturn get_gate_vma(mm);\n \n-\treturn proc_get_vma(m, ppos);\n+\tvma = proc_get_vma(m, ppos);\n+\tif (vma)\n+\t\treturn vma;\n+\n+\t/ Return gate VMA at the end /\n+\tppos = SENTINEL_VMA_GATE;\n+\treturn get_gate_vma(mm);\n }\n \n static void m_next(struct seq_file m, void v, loff_t ppos)\n {\n+\tstruct proc_maps_private priv = m-\u003eprivate;\n+\tstruct vm_area_struct vma;\n+\n \tif (ppos == SENTINEL_VMA_GATE) {\n \t\tppos = SENTINEL_VMA_END;\n \t\treturn NULL;\n \t}\n-\treturn proc_get_vma(m, ppos);\n+\tvma = proc_get_vma(m, ppos);\n+\tif (vma)\n+\t\treturn vma;\n+\n+\t/* Return gate VMA at the end /\n+\tppos = SENTINEL_VMA_GATE;\n+\treturn get_gate_vma(priv-\u003elock_ctx.mm);\n }\n \n static void m_stop(struct seq_file m, void v)\n@@ -325,7 +311,12 @@ static void m_stop(struct seq_file m, void v)\n \t\treturn;\n \n \trelease_task_mempolicy(priv);\n-\tunlock_vma_range(\u0026priv-\u003elock_ctx);\n+\tif (priv-\u003elock_ctx.mmap_locked) {\n+\t\tunlock_ctx_mm(\u0026priv-\u003elock_ctx);\n+\t} else {\n+\t\tunlock_ctx_vma(\u0026priv-\u003elock_ctx);\n+\t\trcu_read_unlock();\n+\t}\n \tmmput(mm);\n \tput_task_struct(priv-\u003etask);\n \tpriv-\u003etask = NULL;\n@@ -518,21 +509,6 @@ static int pid_maps_open(struct inode inode, struct file file)\n \t\tPROCMAP_QUERY_VMA_FLAGS\t\t\t\t\\\n )\n \n-static int query_vma_setup(struct proc_maps_locking_ctx lock_ctx)\n-{\n-\treset_lock_ctx(lock_ctx);\n-\n-\treturn 0;\n-}\n-\n-static void query_vma_teardown(struct proc_maps_locking_ctx lock_ctx)\n-{\n-\tif (lock_ctx-\u003emmap_locked)\n-\t\tunlock_ctx_mm(lock_ctx);\n-\telse\n-\t\tunlock_ctx_vma(lock_ctx);\n-}\n-\n static struct vm_area_struct query_vma_find_by_addr(struct proc_maps_locking_ctx lock_ctx,\n \t\t\t\t\t\t unsigned long addr)\n {\n@@ -653,12 +629,7 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg)\n \tif (!mm \|\| !mmget_not_zero(mm))\n \t\treturn -ESRCH;\n \n-\terr = query_vma_setup(\u0026lock_ctx);\n-\tif (err) {\n-\t\tmmput(mm);\n-\t\treturn err;\n-\t}\n-\n+\treset_lock_ctx(\u0026lock_ctx);\n \tvma = query_matching_vma(\u0026lock_ctx, karg.query_addr, karg.query_flags);\n \tif (IS_ERR(vma)) {\n \t\terr = PTR_ERR(vma);\n@@ -732,7 +703,10 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg)\n \t\tvm_file = get_file(vma-\u003evm_file);\n \n \t/* unlock vma or mmap_lock, and put mm_struct before copying data to user /\n-\tquery_vma_teardown(\u0026lock_ctx);\n+\tif (lock_ctx.mmap_locked)\n+\t\tunlock_ctx_mm(\u0026lock_ctx);\n+\telse\n+\t\tunlock_ctx_vma(\u0026lock_ctx);\n \tmmput(mm);\n \n \tif (karg.build_id_size) {\n@@ -773,7 +747,10 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg)\n \treturn 0;\n \n out:\n-\tquery_vma_teardown(\u0026lock_ctx);\n+\tif (lock_ctx.mmap_locked)\n+\t\tunlock_ctx_mm(\u0026lock_ctx);\n+\telse\n+\t\tunlock_ctx_vma(\u0026lock_ctx);\n \tmmput(mm);\n out_file:\n \tif (vm_file)\n@@ -1263,7 +1240,7 @@ static const struct mm_walk_ops smaps_shmem_walk_vma_lock_ops = {\n \t.walk_lock\t\t= PGWALK_VMA_RDLOCK_VERIFY,\n };\n \n-static inline const struct mm_walk_ops \n+static const struct mm_walk_ops \n get_smaps_walk_ops(struct proc_maps_private priv)\n {\n \tif (priv-\u003elock_ctx.mmap_locked)\n@@ -1271,7 +1248,7 @@ get_smaps_walk_ops(struct proc_maps_private priv)\n \treturn \u0026smaps_walk_vma_lock_ops;\n }\n \n-static inline const struct mm_walk_ops \n+static const struct mm_walk_ops \n get_smaps_shmem_walk_ops(struct proc_maps_private priv)\n {\n \tif (priv-\u003elock_ctx.mmap_locked)\n@@ -1279,20 +1256,26 @@ get_smaps_shmem_walk_ops(struct proc_maps_private priv)\n \treturn \u0026smaps_shmem_walk_vma_lock_ops;\n }\n \n-/\n- * Gather mem stats from @vma with the indicated beginning\n- * address @start, and keep them in @mss.\n+/*\n+ smap_gather_stats_range() - Gather mem stats from a portion of the @vma.\n+ * @priv: proc maps private state.\n+ * @vma: The VMA to gather stats for.\n+ * @mss: The accumulated stats.\n+ * @start: The address from which to start.\n \n- Use vm_start of @vma as the beginning address if @start is 0.\n+ * This gathers stats for the portion of the VMA starting at the @start\n+ * address.\n /\n-static void smap_gather_stats(struct proc_maps_private priv,\n-\t\t\t struct vm_area_struct vma,\n-\t\t\t struct mem_size_stats mss, unsigned long start)\n+static void smap_gather_stats_range(struct proc_maps_private priv,\n+\t\tstruct vm_area_struct vma,\n+\t\tstruct mem_size_stats mss,\n+\t\tunsigned long start)\n {\n \tconst struct mm_walk_ops ops = get_smaps_walk_ops(priv);\n+\tconst bool is_partial = start \u003e vma-\u003evm_start;\n \n \t/* Invalid start /\n-\tif (start \u003e= vma-\u003evm_end)\n+\tif (start \u003c vma-\u003evm_start \|\| start \u003e= vma-\u003evm_end)\n \t\treturn;\n \n \tif (vma == get_gate_vma(priv-\u003elock_ctx.mm))\n@@ -1303,33 +1286,39 @@ static void smap_gather_stats(struct proc_maps_private priv,\n \n \tif (vma-\u003evm_file \u0026\u0026 shmem_mapping(vma-\u003evm_file-\u003ef_mapping)) {\n \t\t/\n-\t\t For shared or readonly shmem mappings we know that all\n-\t\t * swapped out pages belong to the shmem object, and we can\n-\t\t * obtain the swap value much more efficiently. For private\n-\t\t * writable mappings, we might have COW pages that are\n-\t\t * not affected by the parent swapped out pages of the shmem\n-\t\t * object, so we have to distinguish them during the page walk.\n-\t\t * Unless we know that the shmem object (or the part mapped by\n-\t\t * our VMA) has no swapped out pages at all.\n+\t\t * CoW mappings might map anon folios that do not belong to\n+\t\t * shmem. Perform a less efficient page table walk in this\n+\t\t * situation, unless we know that the shmem object (or the\n+\t\t * part mapped by our VMA) has no swapped out pages at all.\n \t\t /\n-\t\tunsigned long shmem_swapped = shmem_swap_usage(vma);\n+\t\tconst unsigned long shmem_swapped = shmem_swap_usage(vma);\n+\t\tconst bool is_cow = vma_is_cow_mapping(vma);\n \n-\t\tif (!start \u0026\u0026 (!shmem_swapped \|\| (vma-\u003evm_flags \u0026 VM_SHARED) \|\|\n-\t\t\t\t\t!(vma-\u003evm_flags \u0026 VM_WRITE))) {\n-\t\t\tmss-\u003eswap += shmem_swapped;\n-\t\t} else {\n+\t\tif (is_partial \|\| (shmem_swapped \u0026\u0026 is_cow))\n \t\t\tops = get_smaps_shmem_walk_ops(priv);\n-\t\t}\n+\t\telse\n+\t\t\tmss-\u003eswap += shmem_swapped;\n \t}\n \n-\tif (!start)\n-\t\twalk_page_vma(vma, ops, mss);\n-\telse\n-\t\twalk_page_range(vma-\u003evm_mm, start, vma-\u003evm_end, ops, mss);\n+\twalk_page_range_vma(vma, start, vma-\u003evm_end, ops, mss);\n \n \treacquire_rcu(priv);\n }\n \n+/\n+ smap_gather_stats() - Gather mem stats from the entire @vma.\n+ * @priv: proc maps private state.\n+ * @vma: The VMA to gather stats for.\n+ * @mss: The accumulated stats.\n+ \n+ This gathers stats for the whole of the VMA.\n+ /\n+static void smap_gather_stats(struct proc_maps_private priv,\n+\t\tstruct vm_area_struct vma, struct mem_size_stats mss)\n+{\n+\tsmap_gather_stats_range(priv, vma, mss, vma-\u003evm_start);\n+}\n+\n #define SEQ_PUT_DEC(str, val) \\\n \t\tseq_put_decimal_ull_width(m, str, (val) \u003e\u003e 10, 8)\n \n@@ -1380,7 +1369,7 @@ static int show_smap(struct seq_file m, void v)\n \tstruct vm_area_struct vma = v;\n \tstruct mem_size_stats mss = {};\n \n-\tsmap_gather_stats(priv, vma, \u0026mss, 0);\n+\tsmap_gather_stats(priv, vma, \u0026mss);\n \n \tshow_map_vma(m, vma);\n \n@@ -1405,12 +1394,14 @@ static int show_smap(struct seq_file m, void v)\n static int show_smaps_rollup(struct seq_file m, void v)\n {\n \tstruct proc_maps_private priv = m-\u003eprivate;\n+\tstruct proc_maps_locking_ctx lock_ctx = \u0026priv-\u003elock_ctx;\n+\tstruct mm_struct mm = lock_ctx-\u003emm;\n \tstruct mem_size_stats mss = {};\n-\tstruct mm_struct mm = priv-\u003elock_ctx.mm;\n+\tunsigned long last_vma_end = 0;\n+\tunsigned long vma_start = 0;\n \tstruct vm_area_struct vma;\n-\tunsigned long vma_start = 0, last_vma_end = 0;\n+\tloff_t pos = 0;\n \tint ret = 0;\n-\tVMA_ITERATOR(vmi, mm, 0);\n \n \tpriv-\u003etask = get_proc_task(priv-\u003einode);\n \tif (!priv-\u003etask)\n@@ -1421,89 +1412,63 @@ static int show_smaps_rollup(struct seq_file m, void v)\n \t\tgoto out_put_task;\n \t}\n \n-\tret = lock_ctx_mm(\u0026priv-\u003elock_ctx);\n-\tif (ret)\n-\t\tgoto out_put_mm;\n-\n \thold_task_mempolicy(priv);\n-\tvma = vma_next(\u0026vmi);\n+\trcu_read_lock();\n+\treset_lock_ctx(lock_ctx);\n \n+\tvma_iter_init(\u0026priv-\u003eiter, mm, 0);\n+\tvma = proc_get_vma(m, \u0026pos);\n \tif (unlikely(!vma))\n \t\tgoto empty_set;\n \n-\tvma_start = vma-\u003evm_start;\n-\tdo {\n-\t\tsmap_gather_stats(priv, vma, \u0026mss, 0);\n+\tif (!IS_ERR(vma))\n+\t\tvma_start = vma-\u003evm_start;\n+\n+\twhile (vma) {\n+\t\tif (IS_ERR(vma)) {\n+\t\t\tret = PTR_ERR(vma);\n+\t\t\tgoto out_unlock;\n+\t\t}\n+\n+\t\tif (vma-\u003evm_start \u003c last_vma_end) {\n+\t\t\t/\n+\t\t\t After retaking the lock, already reported VMA grew\n+\t\t\t * or got merged with the next one and we found it\n+\t\t\t * again. Gather stats for the remaining portion by\n+\t\t\t * starting at last_vma_end.\n+\t\t\t /\n+\t\t\tsmap_gather_stats_range(priv, vma, \u0026mss, last_vma_end);\n+\t\t} else {\n+\t\t\t/ Found next unreported VMA, start from its beginning /\n+\t\t\tsmap_gather_stats(priv, vma, \u0026mss);\n+\t\t}\n \t\tlast_vma_end = vma-\u003evm_end;\n \n \t\t/\n-\t\t * Release mmap_lock temporarily if someone wants to\n-\t\t * access it for write request.\n+\t\t * If the VMA lock is not taken, we hold the often contended\n+\t\t * mmap lock. This can happen if we had to fall back to the\n+\t\t * mmap lock.\n+\t\t \n+\t\t To relieve pressure, check if it is indeed contended, then\n+\t\t * temporarily release it.\n \t\t /\n-\t\tif (mmap_lock_is_contended(mm)) {\n-\t\t\tvma_iter_invalidate(\u0026vmi);\n-\t\t\tunlock_ctx_mm(\u0026priv-\u003elock_ctx);\n-\t\t\tret = lock_ctx_mm(\u0026priv-\u003elock_ctx);\n-\t\t\tif (ret) {\n-\t\t\t\trelease_task_mempolicy(priv);\n-\t\t\t\tgoto out_put_mm;\n-\t\t\t}\n-\n+\t\tif (lock_ctx-\u003emmap_locked \u0026\u0026\n+\t\t mmap_lock_is_contended(lock_ctx-\u003emm)) {\n+\t\t\tunlock_ctx_mm(lock_ctx);\n \t\t\t/\n-\t\t\t * After dropping the lock, there are four cases to\n-\t\t\t * consider. See the following example for explanation.\n-\t\t\t \n-\t\t\t +------+------+-----------+\n-\t\t\t * \| VMA1 \| VMA2 \| VMA3 \|\n-\t\t\t * +------+------+-----------+\n-\t\t\t * \| \| \| \|\n-\t\t\t * 4k 8k 16k 400k\n-\t\t\t \n-\t\t\t Suppose we drop the lock after reading VMA2 due to\n-\t\t\t * contention, then we get:\n-\t\t\t \n-\t\t\t \tlast_vma_end = 16k\n-\t\t\t \n-\t\t\t 1) VMA2 is freed, but VMA3 exists:\n-\t\t\t \n-\t\t\t vma_next(vmi) will return VMA3.\n-\t\t\t * In this case, just continue from VMA3.\n-\t\t\t \n-\t\t\t 2) VMA2 still exists:\n-\t\t\t \n-\t\t\t vma_next(vmi) will return VMA3.\n-\t\t\t * In this case, just continue from VMA3.\n-\t\t\t \n-\t\t\t 3) No more VMAs can be found:\n-\t\t\t \n-\t\t\t vma_next(vmi) will return NULL.\n-\t\t\t * No more things to do, just break.\n-\t\t\t \n-\t\t\t 4) (last_vma_end - 1) is the middle of a vma (VMA'):\n-\t\t\t \n-\t\t\t vma_next(vmi) will return VMA' whose range\n-\t\t\t * contains last_vma_end.\n-\t\t\t * Iterate VMA' from last_vma_end.\n+\t\t\t * Even though we previously fell back to mmap lock,\n+\t\t\t * we try taking VMA lock for the next VMA, since it\n+\t\t\t * might not be under modification. In the worst case\n+\t\t\t * we will fall back to mmap lock again.\n \t\t\t /\n-\t\t\tvma = vma_next(\u0026vmi);\n-\t\t\t/ Case 3 above /\n-\t\t\tif (!vma)\n-\t\t\t\tbreak;\n-\n-\t\t\t/ Case 1 and 2 above /\n-\t\t\tif (vma-\u003evm_start \u003e= last_vma_end) {\n-\t\t\t\tsmap_gather_stats(priv, vma, \u0026mss, 0);\n-\t\t\t\tlast_vma_end = vma-\u003evm_end;\n-\t\t\t\tcontinue;\n-\t\t\t}\n-\n-\t\t\t/ Case 4 above /\n-\t\t\tif (vma-\u003evm_end \u003e last_vma_end) {\n-\t\t\t\tsmap_gather_stats(priv, vma, \u0026mss, last_vma_end);\n-\t\t\t\tlast_vma_end = vma-\u003evm_end;\n-\t\t\t}\n+\t\t\trcu_read_lock();\n+\t\t\treset_lock_ctx(lock_ctx);\n+\t\t\t/ Resume from the last position. /\n+\t\t\tpos = last_vma_end;\n+\t\t\tvma_iter_init(\u0026priv-\u003eiter, mm, pos);\n \t\t}\n-\t} for_each_vma(vmi, vma);\n+\t\tvma = proc_get_vma(m, \u0026pos);\n+\t}\n \n empty_set:\n \tshow_vma_header_prefix(m, vma_start, last_vma_end, 0, 0, 0, 0);\n@@ -1512,10 +1477,14 @@ static int show_smaps_rollup(struct seq_file m, void v)\n \n \t__show_smap(m, \u0026mss, true);\n \n+out_unlock:\n+\tif (lock_ctx-\u003emmap_locked) {\n+\t\tunlock_ctx_mm(lock_ctx);\n+\t} else {\n+\t\tunlock_ctx_vma(lock_ctx);\n+\t\trcu_read_unlock();\n+\t}\n \trelease_task_mempolicy(priv);\n-\tunlock_ctx_mm(\u0026priv-\u003elock_ctx);\n-\n-out_put_mm:\n \tmmput(mm);\n out_put_task:\n \tput_task_struct(priv-\u003etask);\n@@ -1605,7 +1574,7 @@ struct clear_refs_private {\n \tenum clear_refs_types type;\n };\n \n-static inline bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, pte_t pte)\n+static bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, pte_t pte)\n {\n \tstruct folio folio;\n \n@@ -1621,8 +1590,8 @@ static inline bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr,\n \treturn folio_maybe_dma_pinned(folio);\n }\n \n-static inline void clear_soft_dirty(struct vm_area_struct vma,\n-\t\tunsigned long addr, pte_t pte)\n+static void clear_soft_dirty(struct vm_area_struct vma, unsigned long addr,\n+\t\tpte_t pte)\n {\n \tif (!pgtable_supports_soft_dirty())\n \t\treturn;\n@@ -1653,7 +1622,7 @@ static inline void clear_soft_dirty(struct vm_area_struct vma,\n }\n \n #if defined(CONFIG_TRANSPARENT_HUGEPAGE)\n-static inline void clear_soft_dirty_pmd(struct vm_area_struct vma,\n+static void clear_soft_dirty_pmd(struct vm_area_struct vma,\n \t\tunsigned long addr, pmd_t pmdp)\n {\n \tpmd_t old, pmd = pmdp;\n@@ -1679,7 +1648,7 @@ static inline void clear_soft_dirty_pmd(struct vm_area_struct vma,\n \t}\n }\n #else\n-static inline void clear_soft_dirty_pmd(struct vm_area_struct vma,\n+static void clear_soft_dirty_pmd(struct vm_area_struct vma,\n \t\tunsigned long addr, pmd_t pmdp)\n {\n }\n@@ -1881,7 +1850,7 @@ struct pagemapread {\n \n #define PM_END_OF_BUFFER 1\n \n-static inline pagemap_entry_t make_pme(u64 frame, u64 flags)\n+static pagemap_entry_t make_pme(u64 frame, u64 flags)\n {\n \treturn (pagemap_entry_t) { .pme = (frame \u0026 PM_PFRAME_MASK) \| flags };\n }\n@@ -3423,7 +3392,7 @@ static const struct mm_walk_ops show_numa_vma_lock_ops = {\n \t.walk_lock = PGWALK_VMA_RDLOCK_VERIFY,\n };\n \n-static inline const struct mm_walk_ops \n+static const struct mm_walk_ops \n get_show_numa_ops(struct proc_maps_private priv)\n {\n \tif (priv-\u003elock_ctx.mmap_locked)\ndiff --git a/tools/testing/selftests/proc/proc-maps-race.c b/tools/testing/selftests/proc/proc-maps-race.c\nindex 415eccb704684..bf4c5073f6fc8 100644\n--- a/tools/testing/selftests/proc/proc-maps-race.c\n+++ b/tools/testing/selftests/proc/proc-maps-race.c\n@@ -80,6 +80,61 @@ enum maps_file {\n \n struct vma_modifier_info;\n \n+enum smaps_rollup_stat {\n+\tRss,\n+\tPss,\n+\tPss_Dirty,\n+\tPss_Anon,\n+\tPss_File,\n+\tPss_Shmem,\n+\tShared_Clean,\n+\tShared_Dirty,\n+\tPrivate_Clean,\n+\tPrivate_Dirty,\n+\tReferenced,\n+\tAnonymous,\n+\tKSM,\n+\tLazyFree,\n+\tAnonHugePages,\n+\tShmemPmdMapped,\n+\tFilePmdMapped,\n+\tShared_Hugetlb,\n+\tPrivate_Hugetlb,\n+\tSwap,\n+\tSwapPss,\n+\tLocked,\n+\tRollupFieldCount\n+};\n+\n+static const char smaps_rollup_stat_names[RollupFieldCount] = {\n+\t\"Rss\",\n+\t\"Pss\",\n+\t\"Pss_Dirty\",\n+\t\"Pss_Anon\",\n+\t\"Pss_File\",\n+\t\"Pss_Shmem\",\n+\t\"Shared_Clean\",\n+\t\"Shared_Dirty\",\n+\t\"Private_Clean\",\n+\t\"Private_Dirty\",\n+\t\"Referenced\",\n+\t\"Anonymous\",\n+\t\"KSM\",\n+\t\"LazyFree\",\n+\t\"AnonHugePages\",\n+\t\"ShmemPmdMapped\",\n+\t\"FilePmdMapped\",\n+\t\"Shared_Hugetlb\",\n+\t\"Private_Hugetlb\",\n+\t\"Swap\",\n+\t\"SwapPss\",\n+\t\"Locked\",\n+};\n+\n+struct smaps_rollup_stats {\n+\tunsigned long values[RollupFieldCount];\n+};\n+\n FIXTURE(proc_maps_race)\n {\n \tstruct vma_modifier_info mod_info;\n@@ -91,6 +146,7 @@ FIXTURE(proc_maps_race)\n \tenum maps_file maps_file;\n \tint shared_mem_size;\n \tint skip_pages;\n+\tint rollup_fd;\n \tint page_size;\n \tint vma_count;\n \tbool verbose;\n@@ -132,12 +188,12 @@ struct vma_modifier_info {\n \tvoid child_mapped_addr[];\n };\n \n-static bool read_page(FIXTURE_DATA(proc_maps_race) self,\n+static bool read_page(FIXTURE_DATA(proc_maps_race) self, int fd,\n \t\t struct page_content page)\n {\n \tssize_t bytes_read;\n \n-\tbytes_read = read(self-\u003emaps_fd, page-\u003edata, self-\u003epage_size);\n+\tbytes_read = read(fd, page-\u003edata, self-\u003epage_size);\n \tif (bytes_read \u003c= 0)\n \t\treturn false;\n \n@@ -175,7 +231,7 @@ static int locate_containing_page(FIXTURE_DATA(proc_maps_race) self,\n \t\tchar curr_pos;\n \t\tchar end_pos;\n \n-\t\tif (!read_page(self, \u0026self-\u003epage1))\n+\t\tif (!read_page(self, self-\u003emaps_fd, \u0026self-\u003epage1))\n \t\t\treturn -1;\n \n \t\tcurr_pos = self-\u003epage1.data;\n@@ -205,10 +261,11 @@ static bool read_two_pages(FIXTURE_DATA(proc_maps_race) self)\n \t\treturn false;\n \n \tfor (int i = 0; i \u003c self-\u003eskip_pages; i++)\n-\t\tif (!read_page(self, \u0026self-\u003epage1))\n+\t\tif (!read_page(self, self-\u003emaps_fd, \u0026self-\u003epage1))\n \t\t\treturn false;\n \n-\treturn read_page(self, \u0026self-\u003epage1) \u0026\u0026 read_page(self, \u0026self-\u003epage2);\n+\treturn read_page(self, self-\u003emaps_fd, \u0026self-\u003epage1) \u0026\u0026\n+\t read_page(self, self-\u003emaps_fd, \u0026self-\u003epage2);\n }\n \n static void copy_line(const char line_start, const char line_end,\n@@ -317,6 +374,61 @@ static bool read_boundary_lines(FIXTURE_DATA(proc_maps_race) self,\n \t\t \u0026first_line-\u003eend_addr) == 2;\n }\n \n+static bool parse_smaps_rollup(FIXTURE_DATA(proc_maps_race) self,\n+\t\tstruct smaps_rollup_stats stats)\n+{\n+\tunsigned int dev_maj, dev_min, inode;\n+\tunsigned long start, end, offs;\n+\tunsigned long value;\n+\tchar name[32], perm[5];\n+\tchar curr_pos;\n+\tchar end_pos;\n+\tchar line_end;\n+\n+\tif (lseek(self-\u003erollup_fd, 0, SEEK_SET) \u003c 0)\n+\t\treturn false;\n+\n+\tif (!read_page(self, self-\u003erollup_fd, \u0026self-\u003epage1))\n+\t\treturn false;\n+\n+\tcurr_pos = self-\u003epage1.data;\n+\tend_pos = self-\u003epage1.data + self-\u003epage1.size;\n+\n+\tline_end = strchr(curr_pos, '\\n');\n+\tif (!line_end)\n+\t\treturn false;\n+\n+\tif (sscanf(curr_pos, \"%lx-%lx %4s %lx %u:%u %u %31s\",\n+\t\t\u0026start, \u0026end, perm, \u0026offs, \u0026dev_maj, \u0026dev_min, \u0026inode, name) != 8)\n+\t\treturn false;\n+\n+\tif (strcmp(name, \"[rollup]\"))\n+\t\treturn false;\n+\n+\tfor (int stat = 0; stat \u003c ARRAY_SIZE(smaps_rollup_stat_names); stat++) {\n+\t\tint len;\n+\n+\t\tcurr_pos = line_end + 1;\n+\t\tif (curr_pos \u003e= end_pos)\n+\t\t\treturn false;\n+\n+\t\tline_end = strchr(curr_pos, '\\n');\n+\t\tif (!line_end)\n+\t\t\treturn false;\n+\n+\t\tif (sscanf(curr_pos, \"%31s %lu kB\", name, \u0026value) != 2)\n+\t\t\treturn false;\n+\n+\t\tlen = strlen(name);\n+\t\tif (name[len - 1] != ':' \|\| strncmp(name, smaps_rollup_stat_names[stat], len - 1))\n+\t\t\treturn false;\n+\n+\t\tstats-\u003evalues[stat] = value;\n+\t}\n+\n+\treturn true;\n+}\n+\n / Thread synchronization routines /\n static void wait_for_state(struct vma_modifier_info mod_info, enum test_state state)\n {\n@@ -397,6 +509,40 @@ static bool print_boundaries_on(bool condition, const char title,\n \treturn condition;\n }\n \n+static void print_smaps_rollup_stats(const char title, FIXTURE_DATA(proc_maps_race) self,\n+\t\tstruct smaps_rollup_stats stats)\n+{\n+\tprintf(\"%s\", title);\n+\tfor (int stat = 0; stat \u003c ARRAY_SIZE(smaps_rollup_stat_names); stat++)\n+\t\tprintf(\"%64s %lu kB\\n\", smaps_rollup_stat_names[stat], stats-\u003evalues[stat]);\n+}\n+\n+static bool cmp_smaps_rollup_stat(struct smaps_rollup_stats s1,\n+\t\tstruct smaps_rollup_stats s2, enum smaps_rollup_stat stat)\n+{\n+\treturn s1-\u003evalues[stat] == s2-\u003evalues[stat];\n+}\n+\n+static bool compare_smaps_rollup(FIXTURE_DATA(proc_maps_race) self,\n+\t\tstruct smaps_rollup_stats expected,\n+\t\tstruct smaps_rollup_stats actual)\n+{\n+\t/\n+\t * Clean/dirty metrics might change but Pss-related ones\n+\t * should stay constant.\n+\t /\n+\tif (cmp_smaps_rollup_stat(expected, actual, Pss) \u0026\u0026\n+\t cmp_smaps_rollup_stat(expected, actual, Pss_Anon) \u0026\u0026\n+\t cmp_smaps_rollup_stat(expected, actual, Pss_File) \u0026\u0026\n+\t cmp_smaps_rollup_stat(expected, actual, Pss_Shmem))\n+\t\treturn true;\n+\n+\tprint_smaps_rollup_stats(\"Expected stats:\", self, expected);\n+\tprint_smaps_rollup_stats(\"Actual stats:\", self, actual);\n+\n+\treturn false;\n+}\n+\n static void report_test_start(const char name, bool verbose)\n {\n \tif (verbose)\n@@ -572,6 +718,7 @@ FIXTURE_SETUP(proc_maps_race)\n \tunsigned long first_map_addr;\n \tunsigned long last_map_addr;\n \tunsigned long duration_sec;\n+\tchar rollup_fname[32];\n \tchar fname[32];\n \n \tself-\u003epage_size = (unsigned long)sysconf(_SC_PAGESIZE);\n@@ -649,6 +796,9 @@ FIXTURE_SETUP(proc_maps_race)\n \t\tbreak;\n \tcase SMAPS:\n \t\tsprintf(fname, \"/proc/%d/smaps\", self-\u003epid);\n+\t\tsprintf(rollup_fname, \"/proc/%d/smaps_rollup\", self-\u003epid);\n+\t\tself-\u003erollup_fd = open(rollup_fname, O_RDONLY);\n+\t\tASSERT_NE(self-\u003erollup_fd, -1);\n \t\tbreak;\n \tdefault:\n \t\tksft_exit_fail();\n@@ -711,6 +861,8 @@ FIXTURE_TEARDOWN(proc_maps_race)\n \tfor (int i = 0; i \u003c self-\u003evma_count; i++)\n \t\tmunmap(self-\u003emod_info-\u003echild_mapped_addr[i], self-\u003epage_size);\n \tclose(self-\u003emaps_fd);\n+\tif (self-\u003emaps_file == SMAPS)\n+\t\tclose(self-\u003erollup_fd);\n \twaitpid(self-\u003epid, \u0026status, 0);\n \tmunmap(self-\u003emod_info, self-\u003eshared_mem_size);\n }\n@@ -723,6 +875,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split)\n \tstruct line_content split_first_line;\n \tstruct line_content restored_last_line;\n \tstruct line_content restored_first_line;\n+\tstruct smaps_rollup_stats orig_stats;\n \n \twait_for_state(mod_info, SETUP_READY);\n \n@@ -736,6 +889,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split)\n \treport_test_start(\"Tearing from split\", self-\u003everbose);\n \tASSERT_TRUE(capture_mod_pattern(self, \u0026split_last_line, \u0026split_first_line,\n \t\t\t\t\t\u0026restored_last_line, \u0026restored_first_line));\n+\tif (self-\u003emaps_file == SMAPS)\n+\t\tASSERT_TRUE(parse_smaps_rollup(self, \u0026orig_stats));\n \n \t/* Now start concurrent modifications for self-\u003eduration_sec /\n \tsignal_state(mod_info, TEST_READY);\n@@ -799,6 +954,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split)\n \t\t\t\t vma_end == self-\u003elast_line.end_addr) \|\|\n \t\t\t\t (vma_start == split_first_line.start_addr \u0026\u0026\n \t\t\t\t vma_end == split_first_line.end_addr));\n+\t\t} else {\n+\t\t\tstruct smaps_rollup_stats stats;\n+\n+\t\t\tASSERT_TRUE(parse_smaps_rollup(self, \u0026stats));\n+\t\t\tASSERT_TRUE(compare_smaps_rollup(self, \u0026orig_stats, \u0026stats));\n \t\t}\n \t\tclock_gettime(CLOCK_MONOTONIC_COARSE, \u0026end_ts);\n \t\tend_test_iteration(\u0026end_ts, self-\u003everbose);\n@@ -817,6 +977,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize)\n \tstruct line_content shrunk_first_line;\n \tstruct line_content restored_last_line;\n \tstruct line_content restored_first_line;\n+\tstruct smaps_rollup_stats orig_stats;\n \n \twait_for_state(mod_info, SETUP_READY);\n \n@@ -830,6 +991,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize)\n \treport_test_start(\"Tearing from resize\", self-\u003everbose);\n \tASSERT_TRUE(capture_mod_pattern(self, \u0026shrunk_last_line, \u0026shrunk_first_line,\n \t\t\t\t\t\u0026restored_last_line, \u0026restored_first_line));\n+\tif (self-\u003emaps_file == SMAPS)\n+\t\tASSERT_TRUE(parse_smaps_rollup(self, \u0026orig_stats));\n \n \t/ Now start concurrent modifications for self-\u003eduration_sec /\n \tsignal_state(mod_info, TEST_READY);\n@@ -880,6 +1043,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize)\n \t\t\tASSERT_TRUE(vma_start == self-\u003elast_line.start_addr \u0026\u0026\n \t\t\t\t (vma_end - vma_start == self-\u003epage_size 3 \|\|\n \t\t\t\t vma_end - vma_start == self-\u003epage_size));\n+\t\t} else {\n+\t\t\tstruct smaps_rollup_stats stats;\n+\n+\t\t\tASSERT_TRUE(parse_smaps_rollup(self, \u0026stats));\n+\t\t\tASSERT_TRUE(compare_smaps_rollup(self, \u0026orig_stats, \u0026stats));\n \t\t}\n \t\tclock_gettime(CLOCK_MONOTONIC_COARSE, \u0026end_ts);\n \t\tend_test_iteration(\u0026end_ts, self-\u003everbose);\n@@ -898,6 +1066,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap)\n \tstruct line_content remapped_first_line;\n \tstruct line_content restored_last_line;\n \tstruct line_content restored_first_line;\n+\tstruct smaps_rollup_stats orig_stats;\n \n \twait_for_state(mod_info, SETUP_READY);\n \n@@ -911,6 +1080,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap)\n \treport_test_start(\"Tearing from remap\", self-\u003everbose);\n \tASSERT_TRUE(capture_mod_pattern(self, \u0026remapped_last_line, \u0026remapped_first_line,\n \t\t\t\t\t\u0026restored_last_line, \u0026restored_first_line));\n+\tif (self-\u003emaps_file == SMAPS)\n+\t\tASSERT_TRUE(parse_smaps_rollup(self, \u0026orig_stats));\n \n \t/* Now start concurrent modifications for self-\u003eduration_sec /\n \tsignal_state(mod_info, TEST_READY);\n@@ -963,6 +1134,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap)\n \t\t\t\t vma_end - vma_start == self-\u003epage_size 3) \|\|\n \t\t\t\t (vma_start == self-\u003elast_line.start_addr + self-\u003epage_size \u0026\u0026\n \t\t\t\t vma_end - vma_start == self-\u003epage_size));\n+\t\t} else {\n+\t\t\tstruct smaps_rollup_stats stats;\n+\n+\t\t\tASSERT_TRUE(parse_smaps_rollup(self, \u0026stats));\n+\t\t\tASSERT_TRUE(compare_smaps_rollup(self, \u0026orig_stats, \u0026stats));\n \t\t}\n \t\tclock_gettime(CLOCK_MONOTONIC_COARSE, \u0026end_ts);\n \t\tend_test_iteration(\u0026end_ts, self-\u003everbose);\n" }
2/1	2026/09/20 21:53	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": [ "PROC_FS", "PROC_PAGE_MONITOR" ], "FocusSymbols": [ "show_smaps_rollup", "smap_gather_stats_range", "smap_gather_stats", "proc_get_vma", "m_start", "m_next", "do_procmap_query" ], "Reasoning": "The patch modifies memory management and procfs iteration and locking logic in fs/proc/task_mmu.c. In particular, it transitions show_smaps_rollup() from holding mmap_read_lock throughout the walk to utilizing per-VMA locking and RCU iteration via proc_get_vma() with dynamic fallback on contention, adds smap_gather_stats_range() to handle concurrent VMA resizing/merges, and refactors gate VMA and lock state handling. These concurrency-sensitive paths in core memory management / procfs are fully reachable and warrant fuzzing.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 65b8cf9238da96ba78f442644c1d90d5a151280b Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 20 21:52:59 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 052e8dc796bcf..c0d228036b8a6 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -130,28 +130,12 @@ static void release_task_mempolicy(struct proc_maps_private priv) } #endif -static inline int lock_ctx_mm(struct proc_maps_locking_ctx lock_ctx) -{ - int ret = mmap_read_lock_killable(lock_ctx->mm); - - if (!ret) - lock_ctx->mmap_locked = true; - - return ret; -} - -static inline void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx) +static void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx) { mmap_read_unlock(lock_ctx->mm); lock_ctx->mmap_locked = false; } -static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx) -{ - lock_ctx->locked_vma = NULL; - lock_ctx->mmap_locked = false; -} - static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx) { if (lock_ctx->locked_vma) { @@ -160,23 +144,10 @@ static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx) } } -static inline bool lock_vma_range(struct seq_file m, - struct proc_maps_locking_ctx lock_ctx) -{ - rcu_read_lock(); - reset_lock_ctx(lock_ctx); - - return true; -} - -static inline void unlock_vma_range(struct proc_maps_locking_ctx lock_ctx) +static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx) { - if (lock_ctx->mmap_locked) { - unlock_ctx_mm(lock_ctx); - } else { - unlock_ctx_vma(lock_ctx); - rcu_read_unlock(); - } + lock_ctx->locked_vma = NULL; + lock_ctx->mmap_locked = false; } static struct vm_area_struct get_next_vma(struct proc_maps_private priv, @@ -196,8 +167,8 @@ static struct vm_area_struct get_next_vma(struct proc_maps_private priv, return vma; } -static inline bool fallback_to_mmap_lock(struct proc_maps_private priv, - loff_t pos) +static bool fallback_to_mmap_lock(struct proc_maps_private priv, + loff_t pos) { struct proc_maps_locking_ctx lock_ctx = &priv->lock_ctx; @@ -213,7 +184,8 @@ static inline bool fallback_to_mmap_lock(struct proc_maps_private priv, return true; } -static inline void drop_rcu(struct proc_maps_private priv) +#ifdef CONFIG_PROC_PAGE_MONITOR +static void drop_rcu(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) return; @@ -221,7 +193,7 @@ static inline void drop_rcu(struct proc_maps_private priv) rcu_read_unlock(); } -static inline void reacquire_rcu(struct proc_maps_private priv) +static void reacquire_rcu(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) return; @@ -230,6 +202,7 @@ static inline void reacquire_rcu(struct proc_maps_private priv) / Reinitialize the iterator. / vma_iter_set(&priv->iter, priv->lock_ctx.locked_vma->vm_end); } +#endif static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos) { @@ -255,9 +228,6 @@ static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos) found the extended vma with the same vm_start. / ppos = vma->vm_end; - } else { - ppos = SENTINEL_VMA_GATE; - vma = get_gate_vma(priv->lock_ctx.mm); } return vma; @@ -267,6 +237,7 @@ static void m_start(struct seq_file m, loff_t ppos) { struct proc_maps_private priv = m->private; struct proc_maps_locking_ctx lock_ctx; + struct vm_area_struct vma; loff_t last_addr = ppos; struct mm_struct mm; @@ -286,13 +257,8 @@ static void m_start(struct seq_file m, loff_t ppos) return NULL; } - if (!lock_vma_range(m, lock_ctx)) { - mmput(mm); - put_task_struct(priv->task); - priv->task = NULL; - return ERR_PTR(-EINTR); - } - + rcu_read_lock(); + reset_lock_ctx(lock_ctx); /* * Reset current position if last_addr was set before * and it's not a sentinel. @@ -301,19 +267,39 @@ static void m_start(struct seq_file m, loff_t ppos) ppos = last_addr = priv->last_pos; vma_iter_init(&priv->iter, mm, (unsigned long)last_addr); hold_task_mempolicy(priv); + /* + * If seq_file had to flush its collected data right after m_next() set + * position to SENTINEL_VMA_GATE, m_start() will get that sentinel and + * should return gate_vma without calling proc_get_vma(). + / if (last_addr == SENTINEL_VMA_GATE) return get_gate_vma(mm); - return proc_get_vma(m, ppos); + vma = proc_get_vma(m, ppos); + if (vma) + return vma; + + / Return gate VMA at the end / + ppos = SENTINEL_VMA_GATE; + return get_gate_vma(mm); } static void m_next(struct seq_file m, void v, loff_t ppos) { + struct proc_maps_private priv = m->private; + struct vm_area_struct vma; + if (ppos == SENTINEL_VMA_GATE) { ppos = SENTINEL_VMA_END; return NULL; } - return proc_get_vma(m, ppos); + vma = proc_get_vma(m, ppos); + if (vma) + return vma; + + /* Return gate VMA at the end / + ppos = SENTINEL_VMA_GATE; + return get_gate_vma(priv->lock_ctx.mm); } static void m_stop(struct seq_file m, void v) @@ -325,7 +311,12 @@ static void m_stop(struct seq_file m, void v) return; release_task_mempolicy(priv); - unlock_vma_range(&priv->lock_ctx); + if (priv->lock_ctx.mmap_locked) { + unlock_ctx_mm(&priv->lock_ctx); + } else { + unlock_ctx_vma(&priv->lock_ctx); + rcu_read_unlock(); + } mmput(mm); put_task_struct(priv->task); priv->task = NULL; @@ -518,21 +509,6 @@ static int pid_maps_open(struct inode inode, struct file file) PROCMAP_QUERY_VMA_FLAGS \ ) -static int query_vma_setup(struct proc_maps_locking_ctx lock_ctx) -{ - reset_lock_ctx(lock_ctx); - - return 0; -} - -static void query_vma_teardown(struct proc_maps_locking_ctx lock_ctx) -{ - if (lock_ctx->mmap_locked) - unlock_ctx_mm(lock_ctx); - else - unlock_ctx_vma(lock_ctx); -} - static struct vm_area_struct query_vma_find_by_addr(struct proc_maps_locking_ctx lock_ctx, unsigned long addr) { @@ -653,12 +629,7 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg) if (!mm \|\| !mmget_not_zero(mm)) return -ESRCH; - err = query_vma_setup(&lock_ctx); - if (err) { - mmput(mm); - return err; - } - + reset_lock_ctx(&lock_ctx); vma = query_matching_vma(&lock_ctx, karg.query_addr, karg.query_flags); if (IS_ERR(vma)) { err = PTR_ERR(vma); @@ -732,7 +703,10 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg) vm_file = get_file(vma->vm_file); /* unlock vma or mmap_lock, and put mm_struct before copying data to user / - query_vma_teardown(&lock_ctx); + if (lock_ctx.mmap_locked) + unlock_ctx_mm(&lock_ctx); + else + unlock_ctx_vma(&lock_ctx); mmput(mm); if (karg.build_id_size) { @@ -773,7 +747,10 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg) return 0; out: - query_vma_teardown(&lock_ctx); + if (lock_ctx.mmap_locked) + unlock_ctx_mm(&lock_ctx); + else + unlock_ctx_vma(&lock_ctx); mmput(mm); out_file: if (vm_file) @@ -1263,7 +1240,7 @@ static const struct mm_walk_ops smaps_shmem_walk_vma_lock_ops = { .walk_lock = PGWALK_VMA_RDLOCK_VERIFY, }; -static inline const struct mm_walk_ops +static const struct mm_walk_ops * get_smaps_walk_ops(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) @@ -1271,7 +1248,7 @@ get_smaps_walk_ops(struct proc_maps_private priv) return &smaps_walk_vma_lock_ops; } -static inline const struct mm_walk_ops * +static const struct mm_walk_ops * get_smaps_shmem_walk_ops(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) @@ -1279,20 +1256,26 @@ get_smaps_shmem_walk_ops(struct proc_maps_private priv) return &smaps_shmem_walk_vma_lock_ops; } -/* - * Gather mem stats from @vma with the indicated beginning - * address @start, and keep them in @mss. +/** + * smap_gather_stats_range() - Gather mem stats from a portion of the @vma. + * @priv: proc maps private state. + * @vma: The VMA to gather stats for. + * @mss: The accumulated stats. + * @start: The address from which to start. * - * Use vm_start of @vma as the beginning address if @start is 0. + * This gathers stats for the portion of the VMA starting at the @start + * address. / -static void smap_gather_stats(struct proc_maps_private priv, - struct vm_area_struct vma, - struct mem_size_stats mss, unsigned long start) +static void smap_gather_stats_range(struct proc_maps_private priv, + struct vm_area_struct vma, + struct mem_size_stats mss, + unsigned long start) { const struct mm_walk_ops ops = get_smaps_walk_ops(priv); + const bool is_partial = start > vma->vm_start; /* Invalid start / - if (start >= vma->vm_end) + if (start < vma->vm_start \|\| start >= vma->vm_end) return; if (vma == get_gate_vma(priv->lock_ctx.mm)) @@ -1303,33 +1286,39 @@ static void smap_gather_stats(struct proc_maps_private priv, if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) { /* - * For shared or readonly shmem mappings we know that all - * swapped out pages belong to the shmem object, and we can - * obtain the swap value much more efficiently. For private - * writable mappings, we might have COW pages that are - * not affected by the parent swapped out pages of the shmem - * object, so we have to distinguish them during the page walk. - * Unless we know that the shmem object (or the part mapped by - * our VMA) has no swapped out pages at all. + * CoW mappings might map anon folios that do not belong to + * shmem. Perform a less efficient page table walk in this + * situation, unless we know that the shmem object (or the + * part mapped by our VMA) has no swapped out pages at all. / - unsigned long shmem_swapped = shmem_swap_usage(vma); + const unsigned long shmem_swapped = shmem_swap_usage(vma); + const bool is_cow = vma_is_cow_mapping(vma); - if (!start && (!shmem_swapped \|\| (vma->vm_flags & VM_SHARED) \|\| - !(vma->vm_flags & VM_WRITE))) { - mss->swap += shmem_swapped; - } else { + if (is_partial \|\| (shmem_swapped && is_cow)) ops = get_smaps_shmem_walk_ops(priv); - } + else + mss->swap += shmem_swapped; } - if (!start) - walk_page_vma(vma, ops, mss); - else - walk_page_range(vma->vm_mm, start, vma->vm_end, ops, mss); + walk_page_range_vma(vma, start, vma->vm_end, ops, mss); reacquire_rcu(priv); } +/* + * smap_gather_stats() - Gather mem stats from the entire @vma. + * @priv: proc maps private state. + * @vma: The VMA to gather stats for. + * @mss: The accumulated stats. + * + * This gathers stats for the whole of the VMA. + / +static void smap_gather_stats(struct proc_maps_private priv, + struct vm_area_struct vma, struct mem_size_stats mss) +{ + smap_gather_stats_range(priv, vma, mss, vma->vm_start); +} + #define SEQ_PUT_DEC(str, val) \ seq_put_decimal_ull_width(m, str, (val) >> 10, 8) @@ -1380,7 +1369,7 @@ static int show_smap(struct seq_file m, void v) struct vm_area_struct vma = v; struct mem_size_stats mss = {}; - smap_gather_stats(priv, vma, &mss, 0); + smap_gather_stats(priv, vma, &mss); show_map_vma(m, vma); @@ -1405,12 +1394,14 @@ static int show_smap(struct seq_file m, void v) static int show_smaps_rollup(struct seq_file m, void v) { struct proc_maps_private priv = m->private; + struct proc_maps_locking_ctx lock_ctx = &priv->lock_ctx; + struct mm_struct mm = lock_ctx->mm; struct mem_size_stats mss = {}; - struct mm_struct mm = priv->lock_ctx.mm; + unsigned long last_vma_end = 0; + unsigned long vma_start = 0; struct vm_area_struct vma; - unsigned long vma_start = 0, last_vma_end = 0; + loff_t pos = 0; int ret = 0; - VMA_ITERATOR(vmi, mm, 0); priv->task = get_proc_task(priv->inode); if (!priv->task) @@ -1421,89 +1412,63 @@ static int show_smaps_rollup(struct seq_file m, void v) goto out_put_task; } - ret = lock_ctx_mm(&priv->lock_ctx); - if (ret) - goto out_put_mm; - hold_task_mempolicy(priv); - vma = vma_next(&vmi); + rcu_read_lock(); + reset_lock_ctx(lock_ctx); + vma_iter_init(&priv->iter, mm, 0); + vma = proc_get_vma(m, &pos); if (unlikely(!vma)) goto empty_set; - vma_start = vma->vm_start; - do { - smap_gather_stats(priv, vma, &mss, 0); + if (!IS_ERR(vma)) + vma_start = vma->vm_start; + + while (vma) { + if (IS_ERR(vma)) { + ret = PTR_ERR(vma); + goto out_unlock; + } + + if (vma->vm_start < last_vma_end) { + /* + * After retaking the lock, already reported VMA grew + * or got merged with the next one and we found it + * again. Gather stats for the remaining portion by + * starting at last_vma_end. + / + smap_gather_stats_range(priv, vma, &mss, last_vma_end); + } else { + / Found next unreported VMA, start from its beginning / + smap_gather_stats(priv, vma, &mss); + } last_vma_end = vma->vm_end; / - * Release mmap_lock temporarily if someone wants to - * access it for write request. + * If the VMA lock is not taken, we hold the often contended + * mmap lock. This can happen if we had to fall back to the + * mmap lock. + * + * To relieve pressure, check if it is indeed contended, then + * temporarily release it. / - if (mmap_lock_is_contended(mm)) { - vma_iter_invalidate(&vmi); - unlock_ctx_mm(&priv->lock_ctx); - ret = lock_ctx_mm(&priv->lock_ctx); - if (ret) { - release_task_mempolicy(priv); - goto out_put_mm; - } - + if (lock_ctx->mmap_locked && + mmap_lock_is_contended(lock_ctx->mm)) { + unlock_ctx_mm(lock_ctx); / - * After dropping the lock, there are four cases to - * consider. See the following example for explanation. - * - * +------+------+-----------+ - * \| VMA1 \| VMA2 \| VMA3 \| - * +------+------+-----------+ - * \| \| \| \| - * 4k 8k 16k 400k - * - * Suppose we drop the lock after reading VMA2 due to - * contention, then we get: - * - * last_vma_end = 16k - * - * 1) VMA2 is freed, but VMA3 exists: - * - * vma_next(vmi) will return VMA3. - * In this case, just continue from VMA3. - * - * 2) VMA2 still exists: - * - * vma_next(vmi) will return VMA3. - * In this case, just continue from VMA3. - * - * 3) No more VMAs can be found: - * - * vma_next(vmi) will return NULL. - * No more things to do, just break. - * - * 4) (last_vma_end - 1) is the middle of a vma (VMA'): - * - * vma_next(vmi) will return VMA' whose range - * contains last_vma_end. - * Iterate VMA' from last_vma_end. + * Even though we previously fell back to mmap lock, + * we try taking VMA lock for the next VMA, since it + * might not be under modification. In the worst case + * we will fall back to mmap lock again. / - vma = vma_next(&vmi); - / Case 3 above / - if (!vma) - break; - - / Case 1 and 2 above / - if (vma->vm_start >= last_vma_end) { - smap_gather_stats(priv, vma, &mss, 0); - last_vma_end = vma->vm_end; - continue; - } - - / Case 4 above / - if (vma->vm_end > last_vma_end) { - smap_gather_stats(priv, vma, &mss, last_vma_end); - last_vma_end = vma->vm_end; - } + rcu_read_lock(); + reset_lock_ctx(lock_ctx); + / Resume from the last position. / + pos = last_vma_end; + vma_iter_init(&priv->iter, mm, pos); } - } for_each_vma(vmi, vma); + vma = proc_get_vma(m, &pos); + } empty_set: show_vma_header_prefix(m, vma_start, last_vma_end, 0, 0, 0, 0); @@ -1512,10 +1477,14 @@ static int show_smaps_rollup(struct seq_file m, void v) __show_smap(m, &mss, true); +out_unlock: + if (lock_ctx->mmap_locked) { + unlock_ctx_mm(lock_ctx); + } else { + unlock_ctx_vma(lock_ctx); + rcu_read_unlock(); + } release_task_mempolicy(priv); - unlock_ctx_mm(&priv->lock_ctx); - -out_put_mm: mmput(mm); out_put_task: put_task_struct(priv->task); @@ -1605,7 +1574,7 @@ struct clear_refs_private { enum clear_refs_types type; }; -static inline bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, pte_t pte) +static bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, pte_t pte) { struct folio folio; @@ -1621,8 +1590,8 @@ static inline bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, return folio_maybe_dma_pinned(folio); } -static inline void clear_soft_dirty(struct vm_area_struct vma, - unsigned long addr, pte_t pte) +static void clear_soft_dirty(struct vm_area_struct vma, unsigned long addr, + pte_t pte) { if (!pgtable_supports_soft_dirty()) return; @@ -1653,7 +1622,7 @@ static inline void clear_soft_dirty(struct vm_area_struct vma, } #if defined(CONFIG_TRANSPARENT_HUGEPAGE) -static inline void clear_soft_dirty_pmd(struct vm_area_struct vma, +static void clear_soft_dirty_pmd(struct vm_area_struct vma, unsigned long addr, pmd_t pmdp) { pmd_t old, pmd = pmdp; @@ -1679,7 +1648,7 @@ static inline void clear_soft_dirty_pmd(struct vm_area_struct vma, } } #else -static inline void clear_soft_dirty_pmd(struct vm_area_struct vma, +static void clear_soft_dirty_pmd(struct vm_area_struct vma, unsigned long addr, pmd_t pmdp) { } @@ -1881,7 +1850,7 @@ struct pagemapread { #define PM_END_OF_BUFFER 1 -static inline pagemap_entry_t make_pme(u64 frame, u64 flags) +static pagemap_entry_t make_pme(u64 frame, u64 flags) { return (pagemap_entry_t) { .pme = (frame & PM_PFRAME_MASK) \| flags }; } @@ -3423,7 +3392,7 @@ static const struct mm_walk_ops show_numa_vma_lock_ops = { .walk_lock = PGWALK_VMA_RDLOCK_VERIFY, }; -static inline const struct mm_walk_ops * +static const struct mm_walk_ops * get_show_numa_ops(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) diff --git a/tools/testing/selftests/proc/proc-maps-race.c b/tools/testing/selftests/proc/proc-maps-race.c index 415eccb704684..bf4c5073f6fc8 100644 --- a/tools/testing/selftests/proc/proc-maps-race.c +++ b/tools/testing/selftests/proc/proc-maps-race.c @@ -80,6 +80,61 @@ enum maps_file { struct vma_modifier_info; +enum smaps_rollup_stat { + Rss, + Pss, + Pss_Dirty, + Pss_Anon, + Pss_File, + Pss_Shmem, + Shared_Clean, + Shared_Dirty, + Private_Clean, + Private_Dirty, + Referenced, + Anonymous, + KSM, + LazyFree, + AnonHugePages, + ShmemPmdMapped, + FilePmdMapped, + Shared_Hugetlb, + Private_Hugetlb, + Swap, + SwapPss, + Locked, + RollupFieldCount +}; + +static const char smaps_rollup_stat_names[RollupFieldCount] = { + "Rss", + "Pss", + "Pss_Dirty", + "Pss_Anon", + "Pss_File", + "Pss_Shmem", + "Shared_Clean", + "Shared_Dirty", + "Private_Clean", + "Private_Dirty", + "Referenced", + "Anonymous", + "KSM", + "LazyFree", + "AnonHugePages", + "ShmemPmdMapped", + "FilePmdMapped", + "Shared_Hugetlb", + "Private_Hugetlb", + "Swap", + "SwapPss", + "Locked", +}; + +struct smaps_rollup_stats { + unsigned long values[RollupFieldCount]; +}; + FIXTURE(proc_maps_race) { struct vma_modifier_info mod_info; @@ -91,6 +146,7 @@ FIXTURE(proc_maps_race) enum maps_file maps_file; int shared_mem_size; int skip_pages; + int rollup_fd; int page_size; int vma_count; bool verbose; @@ -132,12 +188,12 @@ struct vma_modifier_info { void child_mapped_addr[]; }; -static bool read_page(FIXTURE_DATA(proc_maps_race) self, +static bool read_page(FIXTURE_DATA(proc_maps_race) self, int fd, struct page_content page) { ssize_t bytes_read; - bytes_read = read(self->maps_fd, page->data, self->page_size); + bytes_read = read(fd, page->data, self->page_size); if (bytes_read <= 0) return false; @@ -175,7 +231,7 @@ static int locate_containing_page(FIXTURE_DATA(proc_maps_race) self, char curr_pos; char end_pos; - if (!read_page(self, &self->page1)) + if (!read_page(self, self->maps_fd, &self->page1)) return -1; curr_pos = self->page1.data; @@ -205,10 +261,11 @@ static bool read_two_pages(FIXTURE_DATA(proc_maps_race) self) return false; for (int i = 0; i < self->skip_pages; i++) - if (!read_page(self, &self->page1)) + if (!read_page(self, self->maps_fd, &self->page1)) return false; - return read_page(self, &self->page1) && read_page(self, &self->page2); + return read_page(self, self->maps_fd, &self->page1) && + read_page(self, self->maps_fd, &self->page2); } static void copy_line(const char line_start, const char line_end, @@ -317,6 +374,61 @@ static bool read_boundary_lines(FIXTURE_DATA(proc_maps_race) self, &first_line->end_addr) == 2; } +static bool parse_smaps_rollup(FIXTURE_DATA(proc_maps_race) self, + struct smaps_rollup_stats stats) +{ + unsigned int dev_maj, dev_min, inode; + unsigned long start, end, offs; + unsigned long value; + char name[32], perm[5]; + char curr_pos; + char end_pos; + char line_end; + + if (lseek(self->rollup_fd, 0, SEEK_SET) < 0) + return false; + + if (!read_page(self, self->rollup_fd, &self->page1)) + return false; + + curr_pos = self->page1.data; + end_pos = self->page1.data + self->page1.size; + + line_end = strchr(curr_pos, '\n'); + if (!line_end) + return false; + + if (sscanf(curr_pos, "%lx-%lx %4s %lx %u:%u %u %31s", + &start, &end, perm, &offs, &dev_maj, &dev_min, &inode, name) != 8) + return false; + + if (strcmp(name, "[rollup]")) + return false; + + for (int stat = 0; stat < ARRAY_SIZE(smaps_rollup_stat_names); stat++) { + int len; + + curr_pos = line_end + 1; + if (curr_pos >= end_pos) + return false; + + line_end = strchr(curr_pos, '\n'); + if (!line_end) + return false; + + if (sscanf(curr_pos, "%31s %lu kB", name, &value) != 2) + return false; + + len = strlen(name); + if (name[len - 1] != ':' \|\| strncmp(name, smaps_rollup_stat_names[stat], len - 1)) + return false; + + stats->values[stat] = value; + } + + return true; +} + / Thread synchronization routines / static void wait_for_state(struct vma_modifier_info mod_info, enum test_state state) { @@ -397,6 +509,40 @@ static bool print_boundaries_on(bool condition, const char title, return condition; } +static void print_smaps_rollup_stats(const char title, FIXTURE_DATA(proc_maps_race) self, + struct smaps_rollup_stats stats) +{ + printf("%s", title); + for (int stat = 0; stat < ARRAY_SIZE(smaps_rollup_stat_names); stat++) + printf("%64s %lu kB\n", smaps_rollup_stat_names[stat], stats->values[stat]); +} + +static bool cmp_smaps_rollup_stat(struct smaps_rollup_stats s1, + struct smaps_rollup_stats s2, enum smaps_rollup_stat stat) +{ + return s1->values[stat] == s2->values[stat]; +} + +static bool compare_smaps_rollup(FIXTURE_DATA(proc_maps_race) self, + struct smaps_rollup_stats expected, + struct smaps_rollup_stats actual) +{ + / + * Clean/dirty metrics might change but Pss-related ones + * should stay constant. + / + if (cmp_smaps_rollup_stat(expected, actual, Pss) && + cmp_smaps_rollup_stat(expected, actual, Pss_Anon) && + cmp_smaps_rollup_stat(expected, actual, Pss_File) && + cmp_smaps_rollup_stat(expected, actual, Pss_Shmem)) + return true; + + print_smaps_rollup_stats("Expected stats:", self, expected); + print_smaps_rollup_stats("Actual stats:", self, actual); + + return false; +} + static void report_test_start(const char name, bool verbose) { if (verbose) @@ -572,6 +718,7 @@ FIXTURE_SETUP(proc_maps_race) unsigned long first_map_addr; unsigned long last_map_addr; unsigned long duration_sec; + char rollup_fname[32]; char fname[32]; self->page_size = (unsigned long)sysconf(_SC_PAGESIZE); @@ -649,6 +796,9 @@ FIXTURE_SETUP(proc_maps_race) break; case SMAPS: sprintf(fname, "/proc/%d/smaps", self->pid); + sprintf(rollup_fname, "/proc/%d/smaps_rollup", self->pid); + self->rollup_fd = open(rollup_fname, O_RDONLY); + ASSERT_NE(self->rollup_fd, -1); break; default: ksft_exit_fail(); @@ -711,6 +861,8 @@ FIXTURE_TEARDOWN(proc_maps_race) for (int i = 0; i < self->vma_count; i++) munmap(self->mod_info->child_mapped_addr[i], self->page_size); close(self->maps_fd); + if (self->maps_file == SMAPS) + close(self->rollup_fd); waitpid(self->pid, &status, 0); munmap(self->mod_info, self->shared_mem_size); } @@ -723,6 +875,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) struct line_content split_first_line; struct line_content restored_last_line; struct line_content restored_first_line; + struct smaps_rollup_stats orig_stats; wait_for_state(mod_info, SETUP_READY); @@ -736,6 +889,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) report_test_start("Tearing from split", self->verbose); ASSERT_TRUE(capture_mod_pattern(self, &split_last_line, &split_first_line, &restored_last_line, &restored_first_line)); + if (self->maps_file == SMAPS) + ASSERT_TRUE(parse_smaps_rollup(self, &orig_stats)); /* Now start concurrent modifications for self->duration_sec / signal_state(mod_info, TEST_READY); @@ -799,6 +954,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) vma_end == self->last_line.end_addr) \|\| (vma_start == split_first_line.start_addr && vma_end == split_first_line.end_addr)); + } else { + struct smaps_rollup_stats stats; + + ASSERT_TRUE(parse_smaps_rollup(self, &stats)); + ASSERT_TRUE(compare_smaps_rollup(self, &orig_stats, &stats)); } clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); @@ -817,6 +977,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) struct line_content shrunk_first_line; struct line_content restored_last_line; struct line_content restored_first_line; + struct smaps_rollup_stats orig_stats; wait_for_state(mod_info, SETUP_READY); @@ -830,6 +991,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) report_test_start("Tearing from resize", self->verbose); ASSERT_TRUE(capture_mod_pattern(self, &shrunk_last_line, &shrunk_first_line, &restored_last_line, &restored_first_line)); + if (self->maps_file == SMAPS) + ASSERT_TRUE(parse_smaps_rollup(self, &orig_stats)); / Now start concurrent modifications for self->duration_sec / signal_state(mod_info, TEST_READY); @@ -880,6 +1043,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) ASSERT_TRUE(vma_start == self->last_line.start_addr && (vma_end - vma_start == self->page_size 3 \|\| vma_end - vma_start == self->page_size)); + } else { + struct smaps_rollup_stats stats; + + ASSERT_TRUE(parse_smaps_rollup(self, &stats)); + ASSERT_TRUE(compare_smaps_rollup(self, &orig_stats, &stats)); } clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); @@ -898,6 +1066,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) struct line_content remapped_first_line; struct line_content restored_last_line; struct line_content restored_first_line; + struct smaps_rollup_stats orig_stats; wait_for_state(mod_info, SETUP_READY); @@ -911,6 +1080,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) report_test_start("Tearing from remap", self->verbose); ASSERT_TRUE(capture_mod_pattern(self, &remapped_last_line, &remapped_first_line, &restored_last_line, &restored_first_line)); + if (self->maps_file == SMAPS) + ASSERT_TRUE(parse_smaps_rollup(self, &orig_stats)); /* Now start concurrent modifications for self->duration_sec / signal_state(mod_info, TEST_READY); @@ -963,6 +1134,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) vma_end - vma_start == self->page_size 3) \|\| (vma_start == self->last_line.start_addr + self->page_size && vma_end - vma_start == self->page_size)); + } else { + struct smaps_rollup_stats stats; + + ASSERT_TRUE(parse_smaps_rollup(self, &stats)); + ASSERT_TRUE(compare_smaps_rollup(self, &orig_stats, &stats)); } clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose);
3/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 14223 output: 39 thoughts: 1322 Thoughts: Analyzing the procfs mmu Changes Okay, let's dive into this patch. My initial thought is to understand the implications of these changes in `fs/proc/task_mmu.c`. The removal and modification of the `lock_ctx_mm`, `lock_vma_range`, and `unlock_vma_range` functions are immediately interesting. `unlock_ctx_mm` is now static, indicating it's now meant for internal use only. The movement of `reset_lock_ctx` is also something to note. The use of `#ifdef CONFIG_PROC_PAGE_MONITOR` around `drop_rcu` and `reacquire_rcu` and the change of `static inline` to `static` suggests a conditional behavior here, likely related to page monitoring, as the config suggests. Now, the `proc_get_vma` modification is crucial. They've removed the `get_gate_vma` call from within it. Looking at the surrounding code in `m_start`, `m_next`, and `m_stop`, the logic seems to be shifting. It appears the gate VMA is now returned after trying to get a valid VMA, and potentially a lock is used before to do so, via `rcu_read_lock` and the use of `reset_lock_ctx`. This pattern suggests a move towards a finer-grained locking strategy and potentially RCU to improve concurrency in procfs reads. The logic within `m_stop` has also changed, with the conditional `unlock_ctx_mm` indicating that it can use it, in case the lock is kept in `lock_ctx` when iterating. Inlining `query_vma_setup` and `query_vma_teardown` into `do_procmap_query` looks like a simple optimization to me. The change to `smap_gather_stats` to now use `smap_gather_stats_range` and `smap_gather_stats` and uses `walk_page_range_vma` is the next thing to note, also. However, the change in `show_smaps_rollup` is a significant architectural shift. Previously, it held the `mmap_read_lock` across the entire VMA walk. Now, it's using RCU and `proc_get_vma` to obtain and iterate VMA individually, with VMA locks. This is a very interesting approach to me. It's designed to reduce contention and potentially increase performance in the face of concurrent memory map modifications. The logic to handle contention, potentially falling back and reacquiring the lock, is quite clear. The changes to things like `pte_is_pinned` are probably related to the locking change. Overall, it's a careful refactoring to improve concurrency and reduce lock contention, which is good. Now, time to move on to the selftest...
4/2	2026/09/20 21:53	tool	read-file	0m Args: { "File": "fs/proc/task_mmu.c", "FirstLine": 1390, "LineCount": 80 } Results: { "Contents": "1390:\t\n1391:\t\treturn 0;\n1392:\t}\n1393:\t\n1394:\tstatic int show_smaps_rollup(struct seq_file m, void v)\n1395:\t{\n1396:\t\tstruct proc_maps_private priv = m-\u003eprivate;\n1397:\t\tstruct proc_maps_locking_ctx lock_ctx = \u0026priv-\u003elock_ctx;\n1398:\t\tstruct mm_struct mm = lock_ctx-\u003emm;\n1399:\t\tstruct mem_size_stats mss = {};\n1400:\t\tunsigned long last_vma_end = 0;\n1401:\t\tunsigned long vma_start = 0;\n1402:\t\tstruct vm_area_struct vma;\n1403:\t\tloff_t pos = 0;\n1404:\t\tint ret = 0;\n1405:\t\n1406:\t\tpriv-\u003etask = get_proc_task(priv-\u003einode);\n1407:\t\tif (!priv-\u003etask)\n1408:\t\t\treturn -ESRCH;\n1409:\t\n1410:\t\tif (!mm \|\| !mmget_not_zero(mm)) {\n1411:\t\t\tret = -ESRCH;\n1412:\t\t\tgoto out_put_task;\n1413:\t\t}\n1414:\t\n1415:\t\thold_task_mempolicy(priv);\n1416:\t\trcu_read_lock();\n1417:\t\treset_lock_ctx(lock_ctx);\n1418:\t\n1419:\t\tvma_iter_init(\u0026priv-\u003eiter, mm, 0);\n1420:\t\tvma = proc_get_vma(m, \u0026pos);\n1421:\t\tif (unlikely(!vma))\n1422:\t\t\tgoto empty_set;\n1423:\t\n1424:\t\tif (!IS_ERR(vma))\n1425:\t\t\tvma_start = vma-\u003evm_start;\n1426:\t\n1427:\t\twhile (vma) {\n1428:\t\t\tif (IS_ERR(vma)) {\n1429:\t\t\t\tret = PTR_ERR(vma);\n1430:\t\t\t\tgoto out_unlock;\n1431:\t\t\t}\n1432:\t\n1433:\t\t\tif (vma-\u003evm_start \u003c last_vma_end) {\n1434:\t\t\t\t/\n1435:\t\t\t\t After retaking the lock, already reported VMA grew\n1436:\t\t\t\t * or got merged with the next one and we found it\n1437:\t\t\t\t * again. Gather stats for the remaining portion by\n1438:\t\t\t\t * starting at last_vma_end.\n1439:\t\t\t\t /\n1440:\t\t\t\tsmap_gather_stats_range(priv, vma, \u0026mss, last_vma_end);\n1441:\t\t\t} else {\n1442:\t\t\t\t/ Found next unreported VMA, start from its beginning /\n1443:\t\t\t\tsmap_gather_stats(priv, vma, \u0026mss);\n1444:\t\t\t}\n1445:\t\t\tlast_vma_end = vma-\u003evm_end;\n1446:\t\n1447:\t\t\t/\n1448:\t\t\t * If the VMA lock is not taken, we hold the often contended\n1449:\t\t\t * mmap lock. This can happen if we had to fall back to the\n1450:\t\t\t * mmap lock.\n1451:\t\t\t \n1452:\t\t\t To relieve pressure, check if it is indeed contended, then\n1453:\t\t\t * temporarily release it.\n1454:\t\t\t /\n1455:\t\t\tif (lock_ctx-\u003emmap_locked \u0026\u0026\n1456:\t\t\t mmap_lock_is_contended(lock_ctx-\u003emm)) {\n1457:\t\t\t\tunlock_ctx_mm(lock_ctx);\n1458:\t\t\t\t/\n1459:\t\t\t\t * Even though we previously fell back to mmap lock,\n1460:\t\t\t\t * we try taking VMA lock for the next VMA, since it\n1461:\t\t\t\t * might not be under modification. In the worst case\n1462:\t\t\t\t * we will fall back to mmap lock again.\n1463:\t\t\t\t /\n1464:\t\t\t\trcu_read_lock();\n1465:\t\t\t\treset_lock_ctx(lock_ctx);\n1466:\t\t\t\t/ Resume from the last position. */\n1467:\t\t\t\tpos = last_vma_end;\n1468:\t\t\t\tvma_iter_init(\u0026priv-\u003eiter, mm, pos);\n1469:\t\t\t}\n" }
5/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 17415 output: 39 thoughts: 47 Thoughts: Here's my take on those lines of `task_mmu.c`, specifically around the `smap_gather_stats_range` and `smap_gather_stats` functions, as you requested. Diving into `task_mmu.c` for Memory Statistics Okay, let's zero in on lines 1250-1360 in `task_mmu.c`. I'm curious to see how they're handling memory statistics gathering with `smap_gather_stats_range` and `smap_gather_stats`. These functions are crucial for understanding memory utilization within the system, especially when dealing with Single-Mapping Address Spaces, right? I anticipate that `smap_gather_stats_range` will be responsible for collecting statistics within a specific virtual address range, allowing for targeted analysis of memory usage in particular regions. `smap_gather_stats`, on the other hand, likely serves as a higher-level entry point, possibly iterating over multiple ranges or utilizing `smap_gather_stats_range` to provide a complete view of the memory landscape. I'm especially interested in how they integrate with the SMAP (Supervisor Mode Access Prevention) features. Understanding how these functions interact with SMAP is key to evaluating the overall security and performance of the memory management system. It's likely we see how they're handling permissions, page faults, and other low-level memory operations. I'll be looking to see if they make intelligent decisions about how much data is moved into cache and how often they move data from registers to main memory.
6/2	2026/09/20 21:53	tool	read-file	0m Args: { "File": "fs/proc/task_mmu.c", "FirstLine": 1255, "LineCount": 80 } Results: { "Contents": "1255:\t\t\treturn \u0026smaps_shmem_walk_ops;\n1256:\t\treturn \u0026smaps_shmem_walk_vma_lock_ops;\n1257:\t}\n1258:\t\n1259:\t/*\n1260:\t smap_gather_stats_range() - Gather mem stats from a portion of the @vma.\n1261:\t * @priv: proc maps private state.\n1262:\t * @vma: The VMA to gather stats for.\n1263:\t * @mss: The accumulated stats.\n1264:\t * @start: The address from which to start.\n1265:\t \n1266:\t This gathers stats for the portion of the VMA starting at the @start\n1267:\t * address.\n1268:\t /\n1269:\tstatic void smap_gather_stats_range(struct proc_maps_private priv,\n1270:\t\t\tstruct vm_area_struct vma,\n1271:\t\t\tstruct mem_size_stats mss,\n1272:\t\t\tunsigned long start)\n1273:\t{\n1274:\t\tconst struct mm_walk_ops ops = get_smaps_walk_ops(priv);\n1275:\t\tconst bool is_partial = start \u003e vma-\u003evm_start;\n1276:\t\n1277:\t\t/ Invalid start /\n1278:\t\tif (start \u003c vma-\u003evm_start \|\| start \u003e= vma-\u003evm_end)\n1279:\t\t\treturn;\n1280:\t\n1281:\t\tif (vma == get_gate_vma(priv-\u003elock_ctx.mm))\n1282:\t\t\treturn;\n1283:\t\n1284:\t\t/ Might sleep. Drop RCU read lock but keep the VMA locked. /\n1285:\t\tdrop_rcu(priv);\n1286:\t\n1287:\t\tif (vma-\u003evm_file \u0026\u0026 shmem_mapping(vma-\u003evm_file-\u003ef_mapping)) {\n1288:\t\t\t/\n1289:\t\t\t * CoW mappings might map anon folios that do not belong to\n1290:\t\t\t * shmem. Perform a less efficient page table walk in this\n1291:\t\t\t * situation, unless we know that the shmem object (or the\n1292:\t\t\t * part mapped by our VMA) has no swapped out pages at all.\n1293:\t\t\t /\n1294:\t\t\tconst unsigned long shmem_swapped = shmem_swap_usage(vma);\n1295:\t\t\tconst bool is_cow = vma_is_cow_mapping(vma);\n1296:\t\n1297:\t\t\tif (is_partial \|\| (shmem_swapped \u0026\u0026 is_cow))\n1298:\t\t\t\tops = get_smaps_shmem_walk_ops(priv);\n1299:\t\t\telse\n1300:\t\t\t\tmss-\u003eswap += shmem_swapped;\n1301:\t\t}\n1302:\t\n1303:\t\twalk_page_range_vma(vma, start, vma-\u003evm_end, ops, mss);\n1304:\t\n1305:\t\treacquire_rcu(priv);\n1306:\t}\n1307:\t\n1308:\t/\n1309:\t smap_gather_stats() - Gather mem stats from the entire @vma.\n1310:\t * @priv: proc maps private state.\n1311:\t * @vma: The VMA to gather stats for.\n1312:\t * @mss: The accumulated stats.\n1313:\t \n1314:\t This gathers stats for the whole of the VMA.\n1315:\t /\n1316:\tstatic void smap_gather_stats(struct proc_maps_private priv,\n1317:\t\t\tstruct vm_area_struct vma, struct mem_size_stats mss)\n1318:\t{\n1319:\t\tsmap_gather_stats_range(priv, vma, mss, vma-\u003evm_start);\n1320:\t}\n1321:\t\n1322:\t#define SEQ_PUT_DEC(str, val) \\\n1323:\t\t\tseq_put_decimal_ull_width(m, str, (val) \u003e\u003e 10, 8)\n1324:\t\n1325:\t/* Show the contents common for smaps and smaps_rollup /\n1326:\tstatic void __show_smap(struct seq_file m, const struct mem_size_stats mss,\n1327:\t\tbool rollup_mode)\n1328:\t{\n1329:\t\tSEQ_PUT_DEC(\"Rss: \", mss-\u003eresident);\n1330:\t\tSEQ_PUT_DEC(\" kB\\nPss: \", mss-\u003epss \u003e\u003e PSS_SHIFT);\n1331:\t\tSEQ_PUT_DEC(\" kB\\nPss_Dirty: \", mss-\u003epss_dirty \u003e\u003e PSS_SHIFT);\n1332:\t\tif (rollup_mode) {\n1333:\t\t\t/\n1334:\t\t\t * These are meaningful only for smaps_rollup, otherwise two of\n" }
7/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 19181 output: 38 thoughts: 40 Thoughts: Here's my take on the thought process, as requested: Diving into the VMA Management Okay, so I need to get a handle on how this memory region stuff is being managed. Let's zero in on lines 220-330, and specifically, I want to see how these `m_*` variables and the `proc_get_vma` function play together. I'm assuming, given the context, that `m_start`, `m_next`, and `m_stop` are likely related to address space boundaries or perhaps iterating through VMAs (Virtual Memory Areas), while `proc_get_vma` is the core function for retrieving VMA information for a given process context. I'm expecting this section to reveal the fundamental structure used in the retrieval and manipulation of this VM data.
8/2	2026/09/20 21:53	tool	read-file	0m Args: { "File": "fs/proc/task_mmu.c", "FirstLine": 210, "LineCount": 80 } Results: { "Contents": " 210:\t\tstruct vm_area_struct vma;\n 211:\t\n 212:\tretry:\n 213:\t\tvma = get_next_vma(priv, ppos);\n 214:\t\t/* EINTR of EAGAIN is possible /\n 215:\t\tif (IS_ERR(vma)) {\n 216:\t\t\tif (PTR_ERR(vma) == -EAGAIN \u0026\u0026 fallback_to_mmap_lock(priv, ppos))\n 217:\t\t\t\tgoto retry;\n 218:\t\n 219:\t\t\treturn vma;\n 220:\t\t}\n 221:\t\n 222:\t\t/* Store previous position to be able to restart if needed /\n 223:\t\tpriv-\u003elast_pos = ppos;\n 224:\t\tif (vma) {\n 225:\t\t\t/\n 226:\t\t\t Track the end of the reported vma to ensure position changes\n 227:\t\t\t * even if previous vma was merged with the next vma and we\n 228:\t\t\t * found the extended vma with the same vm_start.\n 229:\t\t\t /\n 230:\t\t\tppos = vma-\u003evm_end;\n 231:\t\t}\n 232:\t\n 233:\t\treturn vma;\n 234:\t}\n 235:\t\n 236:\tstatic void m_start(struct seq_file m, loff_t ppos)\n 237:\t{\n 238:\t\tstruct proc_maps_private priv = m-\u003eprivate;\n 239:\t\tstruct proc_maps_locking_ctx lock_ctx;\n 240:\t\tstruct vm_area_struct vma;\n 241:\t\tloff_t last_addr = ppos;\n 242:\t\tstruct mm_struct mm;\n 243:\t\n 244:\t\t/* See m_next(). Zero at the start or after lseek. /\n 245:\t\tif (last_addr == SENTINEL_VMA_END)\n 246:\t\t\treturn NULL;\n 247:\t\n 248:\t\tpriv-\u003etask = get_proc_task(priv-\u003einode);\n 249:\t\tif (!priv-\u003etask)\n 250:\t\t\treturn ERR_PTR(-ESRCH);\n 251:\t\n 252:\t\tlock_ctx = \u0026priv-\u003elock_ctx;\n 253:\t\tmm = lock_ctx-\u003emm;\n 254:\t\tif (!mm \|\| !mmget_not_zero(mm)) {\n 255:\t\t\tput_task_struct(priv-\u003etask);\n 256:\t\t\tpriv-\u003etask = NULL;\n 257:\t\t\treturn NULL;\n 258:\t\t}\n 259:\t\n 260:\t\trcu_read_lock();\n 261:\t\treset_lock_ctx(lock_ctx);\n 262:\t\t/\n 263:\t\t * Reset current position if last_addr was set before\n 264:\t\t * and it's not a sentinel.\n 265:\t\t /\n 266:\t\tif (last_addr \u003e 0)\n 267:\t\t\tppos = last_addr = priv-\u003elast_pos;\n 268:\t\tvma_iter_init(\u0026priv-\u003eiter, mm, (unsigned long)last_addr);\n 269:\t\thold_task_mempolicy(priv);\n 270:\t\t/\n 271:\t\t If seq_file had to flush its collected data right after m_next() set\n 272:\t\t * position to SENTINEL_VMA_GATE, m_start() will get that sentinel and\n 273:\t\t * should return gate_vma without calling proc_get_vma().\n 274:\t\t /\n 275:\t\tif (last_addr == SENTINEL_VMA_GATE)\n 276:\t\t\treturn get_gate_vma(mm);\n 277:\t\n 278:\t\tvma = proc_get_vma(m, ppos);\n 279:\t\tif (vma)\n 280:\t\t\treturn vma;\n 281:\t\n 282:\t\t/ Return gate VMA at the end /\n 283:\t\tppos = SENTINEL_VMA_GATE;\n 284:\t\treturn get_gate_vma(mm);\n 285:\t}\n 286:\t\n 287:\tstatic void m_next(struct seq_file m, void v, loff_t ppos)\n 288:\t{\n 289:\t\tstruct proc_maps_private *priv = m-\u003eprivate;\n" }
9/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 20648 output: 27 thoughts: 52 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Investigating `fs/proc/task_mmu.c` Configuration Alright, this is piquing my interest. I need to understand what Kconfig options govern the behavior or inclusion of `fs/proc/task_mmu.c`. The first thing I'll do is zero in on the build system. Specifically, I need to check where this file is controlled: I'll start with `fs/proc/Makefile`, it's the obvious initial source, and look for any direct references to it or associated object files. My hunch is that it's probably governed by a Kconfig symbol. If the Makefile doesn't point directly, then I'll immediately pivot to searching the `Kconfig` files within the `fs/proc/` directory and potentially other related areas for a symbol including `task_mmu`. Hopefully, the configuration options are clearly delineated.
10/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "task_mmu", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/Makefile=6=obj-y += proc.o\nfs/proc/Makefile-7-\nfs/proc/Makefile:8:CFLAGS_task_mmu.o\t+= -Wno-override-init\nfs/proc/Makefile-9-proc-y\t\t\t:= nommu.o task_nommu.o\nfs/proc/Makefile:10:proc-$(CONFIG_MMU)\t:= task_mmu.o\nfs/proc/Makefile-11-\n" }
11/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 21054 output: 31 thoughts: 71 Thoughts: Investigating the Compilation Context of `task_mmu.c` and Page Monitoring Okay, so `fs/proc/task_mmu.c` only gets compiled into the kernel if `CONFIG_MMU` is enabled. That's good to know, sets a boundary for its relevance. Now, I'm curious about the interaction with `CONFIG_PROC_PAGE_MONITOR`. I know these memory-related procfs interfaces can be tricky. Let's do a quick check and grep through the `fs/proc/` directory, specifically `task_mmu.c` to see if there's any direct dependencies or interactions defined between `CONFIG_PROC_PAGE_MONITOR` and the code in those files. I need to understand if the page monitoring feature is directly coupled to this module or if there's more to the story. I'll get a clearer picture of their relationship that way.
12/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "CONFIG_PROC_PAGE_MONITOR", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/Makefile=36=proc-$(CONFIG_PRINTK)\t+= kmsg.o\nfs/proc/Makefile:37:proc-$(CONFIG_PROC_PAGE_MONITOR)\t+= page.o\nfs/proc/Makefile-38-proc-$(CONFIG_BOOT_CONFIG)\t+= bootconfig.o\n--\nfs/proc/base.c=3283=static const struct pid_entry tgid_base_stuff[] = {\n--\nfs/proc/base.c-3321-\tREG(\"mountstats\", S_IRUSR, proc_mountstats_operations),\nfs/proc/base.c:3322:#ifdef CONFIG_PROC_PAGE_MONITOR\nfs/proc/base.c-3323-\tREG(\"clear_refs\", S_IWUSR, proc_clear_refs_operations),\n--\nfs/proc/base.c=3642=static const struct pid_entry tid_base_stuff[] = {\n--\nfs/proc/base.c-3676-\tREG(\"mountinfo\", S_IRUGO, proc_mountinfo_operations),\nfs/proc/base.c:3677:#ifdef CONFIG_PROC_PAGE_MONITOR\nfs/proc/base.c-3678-\tREG(\"clear_refs\", S_IWUSR, proc_clear_refs_operations),\n--\nfs/proc/task_mmu.c=170=static bool fallback_to_mmap_lock(struct proc_maps_private priv,\n--\nfs/proc/task_mmu.c-186-\nfs/proc/task_mmu.c:187:#ifdef CONFIG_PROC_PAGE_MONITOR\nfs/proc/task_mmu.c-188-static void drop_rcu(struct proc_maps_private priv)\n--\nfs/proc/task_mmu.c=776=const struct file_operations proc_pid_maps_operations = {\n--\nfs/proc/task_mmu.c-803-\nfs/proc/task_mmu.c:804:#ifdef CONFIG_PROC_PAGE_MONITOR\nfs/proc/task_mmu.c-805-struct mem_size_stats {\n--\nfs/proc/task_mmu.c=3203=const struct file_operations proc_pagemap_operations = {\n--\nfs/proc/task_mmu.c-3210-};\nfs/proc/task_mmu.c:3211:#endif /* CONFIG_PROC_PAGE_MONITOR */\nfs/proc/task_mmu.c-3212-\n" }
13/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 21993 output: 29 thoughts: 106 Thoughts: Analyzing Memory Management Unit (MMU) Configuration Okay, so I'm diving into `task_mmu.c`. The first thing that jumps out is that `CONFIG_PROC_PAGE_MONITOR` is a critical guard for a whole slew of functions and data structures. It's essentially the gatekeeper for memory statistics and reporting related functions within this file. I see a lot of the familiar suspects: `drop_rcu`, `reacquire_rcu`, `struct mem_size_stats`, and then more specific routines such as `smap_gather_stats_range`, `smap_gather_stats`, `show_smap`, and the rollup function `show_smaps_rollup`. Plus, `clear_refs` and `pagemap` are also under its protection. It's quite a comprehensive set of monitoring tools, indicating a focus on detailed page-level information when enabled. Now, the next logical step is to trace the usage of `show_smaps_rollup`, to understand how this rolled up view is being used. Where exactly is this rollup data being presented?
14/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "show_smaps_rollup", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/task_mmu.c=1366=static int show_smap(struct seq_file m, void v)\n--\nfs/proc/task_mmu.c-1393-\nfs/proc/task_mmu.c:1394:static int show_smaps_rollup(struct seq_file m, void v)\nfs/proc/task_mmu.c-1395-{\n--\nfs/proc/task_mmu.c=1509=static int smaps_rollup_open(struct inode inode, struct file file)\n--\nfs/proc/task_mmu.c-1517-\nfs/proc/task_mmu.c:1518:\tret = single_open(file, show_smaps_rollup, priv);\nfs/proc/task_mmu.c-1519-\tif (ret)\n" }
15/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 22596 output: 27 thoughts: 35 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: Investigating `smaps_rollup`'s Location Alright, time to get to the bottom of this. I need to refresh my memory about where the `smaps_rollup` function lives. Is it nestled within the `fs/proc/task_mmu.c` file, or perhaps lurking in `fs/proc/base.c`? Given its name, my intuition leans towards the memory management side, which would suggest `task_mmu.c`. However, procfs is structured in a somewhat… idiosyncratic way, so it's always best to be precise. Let's fire up the code search tools. Knowing exactly where that function is defined will give me the contextual clarity I need to understand its behavior fully.
16/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "smaps_rollup", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/base.c=3283=static const struct pid_entry tgid_base_stuff[] = {\n--\nfs/proc/base.c-3324-\tREG(\"smaps\", S_IRUGO, proc_pid_smaps_operations),\nfs/proc/base.c:3325:\tREG(\"smaps_rollup\", S_IRUGO, proc_pid_smaps_rollup_operations),\nfs/proc/base.c-3326-\tREG(\"pagemap\", S_IRUSR, proc_pagemap_operations),\n--\nfs/proc/base.c=3642=static const struct pid_entry tid_base_stuff[] = {\n--\nfs/proc/base.c-3679-\tREG(\"smaps\", S_IRUGO, proc_pid_smaps_operations),\nfs/proc/base.c:3680:\tREG(\"smaps_rollup\", S_IRUGO, proc_pid_smaps_rollup_operations),\nfs/proc/base.c-3681-\tREG(\"pagemap\", S_IRUSR, proc_pagemap_operations),\n--\nfs/proc/internal.h=407=extern const struct file_operations proc_pid_smaps_operations;\nfs/proc/internal.h:408:extern const struct file_operations proc_pid_smaps_rollup_operations;\nfs/proc/internal.h-409-extern const struct file_operations proc_clear_refs_operations;\n--\nfs/proc/task_mmu.c=1316=static void smap_gather_stats(struct proc_maps_private priv,\n--\nfs/proc/task_mmu.c-1324-\nfs/proc/task_mmu.c:1325:/ Show the contents common for smaps and smaps_rollup /\nfs/proc/task_mmu.c-1326-static void __show_smap(struct seq_file m, const struct mem_size_stats mss,\n--\nfs/proc/task_mmu.c-1333-\t\t/\nfs/proc/task_mmu.c:1334:\t\t * These are meaningful only for smaps_rollup, otherwise two of\nfs/proc/task_mmu.c-1335-\t\t * them are zero, and the other one is the same as Pss.\n--\nfs/proc/task_mmu.c=1366=static int show_smap(struct seq_file m, void v)\n--\nfs/proc/task_mmu.c-1393-\nfs/proc/task_mmu.c:1394:static int show_smaps_rollup(struct seq_file m, void v)\nfs/proc/task_mmu.c-1395-{\n--\nfs/proc/task_mmu.c=1504=static int pid_smaps_open(struct inode inode, struct file file)\n--\nfs/proc/task_mmu.c-1508-\nfs/proc/task_mmu.c:1509:static int smaps_rollup_open(struct inode inode, struct file file)\nfs/proc/task_mmu.c-1510-{\n--\nfs/proc/task_mmu.c-1517-\nfs/proc/task_mmu.c:1518:\tret = single_open(file, show_smaps_rollup, priv);\nfs/proc/task_mmu.c-1519-\tif (ret)\n--\nfs/proc/task_mmu.c-1537-\nfs/proc/task_mmu.c:1538:static int smaps_rollup_release(struct inode inode, struct file file)\nfs/proc/task_mmu.c-1539-{\n--\nfs/proc/task_mmu.c=1550=const struct file_operations proc_pid_smaps_operations = {\n--\nfs/proc/task_mmu.c-1556-\nfs/proc/task_mmu.c:1557:const struct file_operations proc_pid_smaps_rollup_operations = {\nfs/proc/task_mmu.c:1558:\t.open\t\t= smaps_rollup_open,\nfs/proc/task_mmu.c-1559-\t.read\t\t= seq_read,\nfs/proc/task_mmu.c-1560-\t.llseek\t\t= seq_lseek,\nfs/proc/task_mmu.c:1561:\t.release\t= smaps_rollup_release,\nfs/proc/task_mmu.c-1562-};\n" }
17/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 24019 output: 26 thoughts: 102 Thoughts: Here's my thinking: Examining Memory Map Data in the Linux Kernel Okay, so I'm digging into how memory map data is exposed through `/proc`. Right now, I'm focusing on the `smaps_rollup` which is available under `/proc/[pid]/smaps_rollup`. My brain's also flagged that `m_start`, `m_next`, and `m_stop` – which are defined in `fs/proc/task_mmu.c` – are fundamental to several `/proc` interfaces: `/proc/[pid]/maps`, `/proc/[pid]/smaps`, and `/proc/[pid]/numa_maps`. The relationship between these is key. Now, to make sure I'm following the correct execution path, I'll trace what uses the `proc_pid_maps_operations` structure. This will help clarify where the memory information from `task_mmu.c` is actually being utilized and how `smaps_rollup` relates to the other interfaces.
18/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "m_start", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/base.c=2180=static int map_files_d_revalidate(struct inode dir, const struct qstr name,\n--\nfs/proc/base.c-2182-{\nfs/proc/base.c:2183:\tunsigned long vm_start, vm_end;\nfs/proc/base.c-2184-\tbool exact_vma_exists = false;\n--\nfs/proc/base.c-2201-\nfs/proc/base.c:2202:\tif (!dname_to_vma_addr(dentry, \u0026vm_start, \u0026vm_end)) {\nfs/proc/base.c-2203-\t\tstatus = mmap_read_lock_killable(mm);\nfs/proc/base.c-2204-\t\tif (!status) {\nfs/proc/base.c:2205:\t\t\texact_vma_exists = !!find_exact_vma(mm, vm_start,\nfs/proc/base.c-2206-\t\t\t\t\t\t\t vm_end);\n--\nfs/proc/base.c=2232=static int map_files_get_link(struct dentry dentry, struct path path,\n--\nfs/proc/base.c-2234-{\nfs/proc/base.c:2235:\tunsigned long vm_start, vm_end;\nfs/proc/base.c-2236-\tstruct vm_area_struct vma;\n--\nfs/proc/base.c-2244-\nfs/proc/base.c:2245:\trc = dname_to_vma_addr(dentry, \u0026vm_start, \u0026vm_end);\nfs/proc/base.c-2246-\tif (rc)\n--\nfs/proc/base.c-2253-\trc = -ENOENT;\nfs/proc/base.c:2254:\tvma = find_exact_vma(mm, vm_start, vm_end);\nfs/proc/base.c-2255-\tif (vma \u0026\u0026 vma-\u003evm_file) {\n--\nfs/proc/base.c=2323=static struct dentry proc_map_files_lookup(struct inode dir,\n--\nfs/proc/base.c-2325-{\nfs/proc/base.c:2326:\tunsigned long vm_start, vm_end;\nfs/proc/base.c-2327-\tstruct vm_area_struct vma;\n--\nfs/proc/base.c-2337-\tresult = ERR_PTR(-ENOENT);\nfs/proc/base.c:2338:\tif (dname_to_vma_addr(dentry, \u0026vm_start, \u0026vm_end))\nfs/proc/base.c-2339-\t\tgoto out_put_task;\n--\nfs/proc/base.c-2351-\tresult = ERR_PTR(-ENOENT);\nfs/proc/base.c:2352:\tvma = find_exact_vma(mm, vm_start, vm_end);\nfs/proc/base.c-2353-\tif (!vma)\n--\nfs/proc/base.c=2377=proc_map_files_readdir(struct file file, struct dir_context ctx)\n--\nfs/proc/base.c-2438-\nfs/proc/base.c:2439:\t\tp-\u003estart = vma-\u003evm_start;\nfs/proc/base.c-2440-\t\tp-\u003eend = vma-\u003evm_end;\n--\nfs/proc/nommu.c=31=static int nommu_region_show(struct seq_file m, struct vm_region region)\n--\nfs/proc/nommu.c-49-\t\t \"%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu \",\nfs/proc/nommu.c:50:\t\t region-\u003evm_start,\nfs/proc/nommu.c-51-\t\t region-\u003evm_end,\n--\nfs/proc/task_mmu.c=207=static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos)\n--\nfs/proc/task_mmu.c-227-\t\t even if previous vma was merged with the next vma and we\nfs/proc/task_mmu.c:228:\t\t * found the extended vma with the same vm_start.\nfs/proc/task_mmu.c-229-\t\t /\n--\nfs/proc/task_mmu.c-235-\nfs/proc/task_mmu.c:236:static void m_start(struct seq_file m, loff_t ppos)\nfs/proc/task_mmu.c-237-{\n--\nfs/proc/task_mmu.c-271-\t * If seq_file had to flush its collected data right after m_next() set\nfs/proc/task_mmu.c:272:\t * position to SENTINEL_VMA_GATE, m_start() will get that sentinel and\nfs/proc/task_mmu.c-273-\t * should return gate_vma without calling proc_get_vma().\n--\nfs/proc/task_mmu.c=445=show_map_vma(struct seq_file m, struct vm_area_struct vma)\n--\nfs/proc/task_mmu.c-462-\nfs/proc/task_mmu.c:463:\tstart = vma-\u003evm_start;\nfs/proc/task_mmu.c-464-\tend = vma-\u003evm_end;\n--\nfs/proc/task_mmu.c=487=static const struct seq_operations proc_pid_maps_op = {\nfs/proc/task_mmu.c:488:\t.start\t= m_start,\nfs/proc/task_mmu.c-489-\t.next\t= m_next,\n--\nfs/proc/task_mmu.c=547=static struct vm_area_struct query_matching_vma(struct proc_maps_locking_ctx lock_ctx,\n--\nfs/proc/task_mmu.c-581-\t/* found covering VMA or user is OK with the matching next VMA /\nfs/proc/task_mmu.c:582:\tif ((flags \u0026 PROCMAP_QUERY_COVERING_OR_NEXT_VMA) \|\| vma-\u003evm_start \u003c= addr)\nfs/proc/task_mmu.c-583-\t\treturn vma;\n--\nfs/proc/task_mmu.c=597=static int do_procmap_query(struct mm_struct mm, void __user uarg)\n--\nfs/proc/task_mmu.c-639-\nfs/proc/task_mmu.c:640:\tkarg.vma_start = vma-\u003evm_start;\nfs/proc/task_mmu.c-641-\tkarg.vma_end = vma-\u003evm_end;\n--\nfs/proc/task_mmu.c=1269=static void smap_gather_stats_range(struct proc_maps_private priv,\n--\nfs/proc/task_mmu.c-1274-\tconst struct mm_walk_ops ops = get_smaps_walk_ops(priv);\nfs/proc/task_mmu.c:1275:\tconst bool is_partial = start \u003e vma-\u003evm_start;\nfs/proc/task_mmu.c-1276-\nfs/proc/task_mmu.c-1277-\t/ Invalid start /\nfs/proc/task_mmu.c:1278:\tif (start \u003c vma-\u003evm_start \|\| start \u003e= vma-\u003evm_end)\nfs/proc/task_mmu.c-1279-\t\treturn;\n--\nfs/proc/task_mmu.c=1316=static void smap_gather_stats(struct proc_maps_private priv,\n--\nfs/proc/task_mmu.c-1318-{\nfs/proc/task_mmu.c:1319:\tsmap_gather_stats_range(priv, vma, mss, vma-\u003evm_start);\nfs/proc/task_mmu.c-1320-}\n--\nfs/proc/task_mmu.c=1366=static int show_smap(struct seq_file m, void v)\n--\nfs/proc/task_mmu.c-1375-\nfs/proc/task_mmu.c:1376:\tSEQ_PUT_DEC(\"Size: \", vma-\u003evm_end - vma-\u003evm_start);\nfs/proc/task_mmu.c-1377-\tSEQ_PUT_DEC(\" kB\\nKernelPageSize: \", vma_kernel_pagesize(vma));\n--\nfs/proc/task_mmu.c=1394=static int show_smaps_rollup(struct seq_file m, void v)\n--\nfs/proc/task_mmu.c-1424-\tif (!IS_ERR(vma))\nfs/proc/task_mmu.c:1425:\t\tvma_start = vma-\u003evm_start;\nfs/proc/task_mmu.c-1426-\n--\nfs/proc/task_mmu.c-1432-\nfs/proc/task_mmu.c:1433:\t\tif (vma-\u003evm_start \u003c last_vma_end) {\nfs/proc/task_mmu.c-1434-\t\t\t/\n--\nfs/proc/task_mmu.c=1497=static const struct seq_operations proc_pid_smaps_op = {\nfs/proc/task_mmu.c:1498:\t.start\t= m_start,\nfs/proc/task_mmu.c-1499-\t.next\t= m_next,\n--\nfs/proc/task_mmu.c=1873=static int pagemap_pte_hole(unsigned long start, unsigned long end,\n--\nfs/proc/task_mmu.c-1886-\t\tif (vma)\nfs/proc/task_mmu.c:1887:\t\t\thole_end = min(end, vma-\u003evm_start);\nfs/proc/task_mmu.c-1888-\t\telse\n--\nfs/proc/task_mmu.c=3406=static int show_numa_map(struct seq_file m, void v)\n--\nfs/proc/task_mmu.c-3424-\nfs/proc/task_mmu.c:3425:\tpol = __get_vma_policy(vma, vma-\u003evm_start, \u0026ilx);\nfs/proc/task_mmu.c-3426-\tif (pol) {\n--\nfs/proc/task_mmu.c-3432-\nfs/proc/task_mmu.c:3433:\tseq_printf(m, \"%08lx %s\", vma-\u003evm_start, buffer);\nfs/proc/task_mmu.c-3434-\n--\nfs/proc/task_mmu.c=3489=static const struct seq_operations proc_pid_numa_maps_op = {\nfs/proc/task_mmu.c:3490:\t.start = m_start,\nfs/proc/task_mmu.c-3491-\t.next = m_next,\n--\nfs/proc/task_nommu.c=21=void task_mem(struct seq_file m, struct mm_struct mm)\n--\nfs/proc/task_nommu.c-34-\t\t\tsize = kobjsize(region);\nfs/proc/task_nommu.c:35:\t\t\tsize += region-\u003evm_end - region-\u003evm_start;\nfs/proc/task_nommu.c-36-\t\t} else {\nfs/proc/task_nommu.c:37:\t\t\tsize = vma-\u003evm_end - vma-\u003evm_start;\nfs/proc/task_nommu.c-38-\t\t}\n--\nfs/proc/task_nommu.c=81=unsigned long task_vsize(struct mm_struct mm)\n--\nfs/proc/task_nommu.c-88-\tfor_each_vma(vmi, vma)\nfs/proc/task_nommu.c:89:\t\tvsize += vma-\u003evm_end - vma-\u003evm_start;\nfs/proc/task_nommu.c-90-\tmmap_read_unlock(mm);\n--\nfs/proc/task_nommu.c=94=unsigned long task_statm(struct mm_struct mm,\n--\nfs/proc/task_nommu.c-108-\t\t\tsize += kobjsize(region);\nfs/proc/task_nommu.c:109:\t\t\tsize += region-\u003evm_end - region-\u003evm_start;\nfs/proc/task_nommu.c-110-\t\t}\n--\nfs/proc/task_nommu.c=127=static int nommu_vma_show(struct seq_file m, struct vm_area_struct vma)\n--\nfs/proc/task_nommu.c-148-\t\t \"%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu \",\nfs/proc/task_nommu.c:149:\t\t vma-\u003evm_start,\nfs/proc/task_nommu.c-150-\t\t vma-\u003evm_end,\n--\nfs/proc/task_nommu.c=178=static struct vm_area_struct proc_get_vma(struct proc_maps_private priv,\n--\nfs/proc/task_nommu.c-183-\tif (vma) {\nfs/proc/task_nommu.c:184:\t\tppos = vma-\u003evm_start;\nfs/proc/task_nommu.c-185-\t} else {\n--\nfs/proc/task_nommu.c-191-\nfs/proc/task_nommu.c:192:static void m_start(struct seq_file m, loff_t ppos)\nfs/proc/task_nommu.c-193-{\n--\nfs/proc/task_nommu.c=245=static const struct seq_operations proc_pid_maps_ops = {\nfs/proc/task_nommu.c:246:\t.start\t= m_start,\nfs/proc/task_nommu.c-247-\t.next\t= m_next,\n--\nfs/proc/vmcore.c=592=static int mmap_vmcore(struct file file, struct vm_area_struct *vma)\nfs/proc/vmcore.c-593-{\nfs/proc/vmcore.c:594:\tsize_t size = vma-\u003evm_end - vma-\u003evm_start;\nfs/proc/vmcore.c-595-\tu64 start, end, len, tsz;\n--\nfs/proc/vmcore.c-616-\t\tpfn = __pa(elfcorebuf + start) \u003e\u003e PAGE_SHIFT;\nfs/proc/vmcore.c:617:\t\tif (remap_pfn_range(vma, vma-\u003evm_start, pfn, tsz,\nfs/proc/vmcore.c-618-\t\t\t\t vma-\u003evm_page_prot))\n--\nfs/proc/vmcore.c-649-\t\t\tstart_off = start - elfcorebuf_sz;\nfs/proc/vmcore.c:650:\t\t\tif (vmcoredd_mmap_dumps(vma, vma-\u003evm_start + len,\nfs/proc/vmcore.c-651-\t\t\t\t\t\tstart_off, tsz))\n--\nfs/proc/vmcore.c-666-\t\tkaddr = elfnotes_buf + start - elfcorebuf_sz - vmcoredd_orig_sz;\nfs/proc/vmcore.c:667:\t\tif (remap_vmalloc_range_partial(vma, vma-\u003evm_start + len,\nfs/proc/vmcore.c-668-\t\t\t\t\t\tkaddr, 0, tsz))\n--\nfs/proc/vmcore.c-685-\t\t\tpaddr = m-\u003epaddr + start - m-\u003eoffset;\nfs/proc/vmcore.c:686:\t\t\tif (vmcore_remap_oldmem_pfn(vma, vma-\u003evm_start + len,\nfs/proc/vmcore.c-687-\t\t\t\t\t\t paddr \u003e\u003e PAGE_SHIFT, tsz,\n--\nfs/proc/vmcore.c-700-fail:\nfs/proc/vmcore.c:701:\tdo_munmap(vma-\u003evm_mm, vma-\u003evm_start, len, NULL);\nfs/proc/vmcore.c-702-\treturn -EAGAIN;\n" }
19/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 28715 output: 30 thoughts: 594 Thoughts: My Initial Assessment of the Patch's Reach and Fuzzability Alright, let's break this down. First, I need to get a handle on the scope of these changes. Okay, it's touching `fs/proc/task_mmu.c`, which is a pretty crucial file. Let's see... a lot of functions are getting touched here: `unlock_ctx_mm`, `reset_lock_ctx`, `fallback_to_mmap_lock`, `drop_rcu`, and on and on down the list, all the way to `get_show_numa_ops`. That's a lot of memory management, VFS, and procfs interactions. And there's also changes in `tools/testing/selftests/proc/proc-maps-race.c`, which adds tests for `smaps_rollup` race conditions. Now for the key question: is this reachable code? Absolutely, yes! This is code directly dealing with `/proc/[pid]/maps`, `/proc/[pid]/smaps`, `/proc/[pid]/smaps_rollup`, `/proc/[pid]/numa_maps`, and so on. And, there's `ioctl(PROCMAP_QUERY)`. All accessible, directly from unprivileged userspace, via standard `read()` and `open()` calls on those `/proc` files or even `ioctl` calls. These changes involve refactoring locking, switching to per-VMA locks/RCU from `mmap_read_lock`, altering VMA handling, splitting `smap_gather_stats`, and addressing race conditions during smaps rollup. This is a deep dive into core memory management logic with complex locking, RCU, mmap lock fallbacks, and iterator invalidation. So, given the scope and the accessibility, this is definitively `WorthFuzzing = true`. Now, before I dig into a fuzzing strategy, I need to check the required configs. I need to figure out what kernel configuration options are required to enable this functionality. Let's look for `PROC_PAGE_MONITOR` in the Kconfig files, specifically `fs/proc/Kconfig` and `init/Kconfig`, to see what's needed.
20/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "config PROC_PAGE_MONITOR", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/Kconfig=83=config SYSCTL\n--\nfs/proc/Kconfig-100-\nfs/proc/Kconfig:101:config PROC_PAGE_MONITOR\nfs/proc/Kconfig-102- \tdefault y\n" }
21/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 29887 output: 33 thoughts: 19 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Diving into the Kernel Configuration for Procfs Okay, time to get my hands dirty. I'm thinking I need to understand the configuration options for the proc filesystem better, specifically how it relates to this feature I'm working on. Let's start with the source of truth, the kernel configuration. I'll navigate over to `fs/proc/Kconfig` and zoom in around line 101. That area's usually a good starting point for understanding how the various procfs features are conditionally compiled or disabled. I'm expecting to find the core definitions here, perhaps some dependencies on other kernel subsystems, and most importantly, the relevant Kconfig symbols. Hopefully, this section will illuminate the connection between the proc filesystem's basic structure and the specific component I'm interested in, revealing the necessary flags or dependencies. Let's see if this gives me the answers I need.
22/2	2026/09/20 21:53	tool	read-file	0m Args: { "File": "fs/proc/Kconfig", "FirstLine": 95, "LineCount": 25 } Results: { "Contents": " 95:\t\t option will enlarge the kernel by at least 8 KB.\n 96:\t\n 97:\t\t As it is generally a good thing, you should say Y here unless\n 98:\t\t building a kernel for install/rescue disks or your system is very\n 99:\t\t limited in memory.\n 100:\t\n 101:\tconfig PROC_PAGE_MONITOR\n 102:\t \tdefault y\n 103:\t\tdepends on PROC_FS \u0026\u0026 MMU\n 104:\t\tbool \"Enable /proc page monitoring\" if EXPERT\n 105:\t \thelp\n 106:\t\t Various /proc files exist to monitor process memory utilization:\n 107:\t\t /proc/pid/smaps, /proc/pid/clear_refs, /proc/pid/pagemap,\n 108:\t\t /proc/kpagecount, and /proc/kpageflags. Disabling these\n 109:\t\t interfaces will reduce the size of the kernel by approximately 4kb.\n 110:\t\n 111:\tconfig PROC_CHILDREN\n 112:\t\tbool \"Include /proc/\u003cpid\u003e/task/\u003ctid\u003e/children file\"\n 113:\t\tdepends on PROC_FS\n 114:\t\tdefault n\n 115:\t\thelp\n 116:\t\t Provides a fast way to retrieve first level children pids of a task. See\n 117:\t\t \u003cfile:Documentation/filesystems/proc.rst\u003e for more information.\n 118:\t\n 119:\t\t Say Y if you are running any user-space software which takes benefit from\n" }
23/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 30559 output: 29 thoughts: 744 Thoughts: Analyzing the Scope of These Changes Okay, so I'm looking at this diff and trying to understand the full picture. The initial thought is to identify the relevant configurations. I see `CONFIG_PROC_FS`, `CONFIG_MMU`, and `CONFIG_PROC_PAGE_MONITOR` are definitely involved. I quickly double-check `CONFIG_TRANSPARENT_HUGEPAGE`, just to be thorough, but the relevant code is conditional. Clearly, `PROC_FS` and `PROC_PAGE_MONITOR` are key here. Now, let's get down to brass tacks: what's actually changing, functionally? I need to identify the core functions that are being modified or introduced and which are specific to the implementation, and which are generally applicable. I went through the diff and I've identified the main functions involved, I also considered the implications for inlining by the compiler: 1. `show_smaps_rollup` which has a significant change involving per-VMA locks and RCU and is a pointer callback. 2. `smap_gather_stats_range` a new static function that gathers memory stats, so is also likely not inlined because of its static nature. 3. `smap_gather_stats` which is modified, but may not be ubiquitous. 4. `proc_get_vma` modified and has gate logic removed from it 5. `m_start`, `m_next`, `m_stop` modified, but are defined via `struct seq_operations` so are never inlined! 6. `do_procmap_query` which is modified, but doesn't seem to have a wide use. 7. `fallback_to_mmap_lock` which is modified to do with signatures and inlining. 8. `drop_rcu` and `reacquire_rcu` that are explicitly under `CONFIG_PROC_PAGE_MONITOR`. 9. `show_smap` a caller of `smap_gather_stats`. Looking at this list, nothing jumps out as being a general memory management primitive, like a page allocator or fault handler or common syscall. `show_smaps_rollup`, `smap_gather_stats_range`, `smap_gather_stats`, `proc_get_vma`, `m_start`, `m_next`, `m_stop`, and `do_procmap_query`... they all scream `/proc/[pid]/maps`, `/proc/[pid]/smaps`, `/proc/[pid]/smaps_rollup` to me – very specific to the `task_mmu` and procfs interfaces. Let me do a further check on `do_procmap_query` since it's called through `ioctl`.
24/2	2026/09/20 21:53	tool	grepper	0m Args: { "Expression": "do_procmap_query", "PathPrefix": "fs/proc" } Results: { "Output": "fs/proc/task_mmu.c=547=static struct vm_area_struct query_matching_vma(struct proc_maps_locking_ctx lock_ctx,\n--\nfs/proc/task_mmu.c-596-\nfs/proc/task_mmu.c:597:static int do_procmap_query(struct mm_struct mm, void __user uarg)\nfs/proc/task_mmu.c-598-{\n--\nfs/proc/task_mmu.c=762=static long procfs_procmap_ioctl(struct file file, unsigned int cmd, unsigned long arg)\n--\nfs/proc/task_mmu.c-769-\t\t/ priv-\u003elock_ctx.mm is set during file open operation /\nfs/proc/task_mmu.c:770:\t\treturn do_procmap_query(priv-\u003elock_ctx.mm, (void __user )arg);\nfs/proc/task_mmu.c-771-\tdefault:\n" }
25/2	2026/09/20 21:53	llm	patch-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 32199 output: 226 thoughts: 513 Thoughts: My Analysis of Procfs Memory Mapping Instrumentation Okay, so I'm diving into this `procfs` code, specifically the memory mapping aspects. My initial thought is to zero in on these symbols: `procfs_procmap_ioctl` calls `do_procmap_query`, that's a good starting point. But, what about the related functions like `smap_gather_stats_range`, `smap_gather_stats`, and `proc_get_vma`? They could be inlined, so I need to consider both possibilities. My focus should be, and needs to be, on ensuring that all important code paths are followed in my fuzzing process. Therefore, I will track the following: * `show_smaps_rollup` * `smap_gather_stats_range` * `smap_gather_stats` * `proc_get_vma` * `m_start` * `m_next` * `do_procmap_query` Now, let's confirm the relevant configurations. I see `CONFIG_PROC_FS` and `CONFIG_PROC_PAGE_MONITOR`, and the non-prefixed versions: `PROC_FS` and `PROC_PAGE_MONITOR`. Got it. Looking at the patch's reasoning, this is critical. It's touching locking and iteration logic in `fs/proc/task_mmu.c`. Specifically, `show_smaps_rollup` is being changed to use per-VMA locks and RCU via `proc_get_vma` with fallback to `mmap_lock` on contention, rather than holding the `mmap_read_lock` for the entire walk. The patch introduces `smap_gather_stats_range` to handle the tricky scenarios where VMAs get split, merged, or resized concurrently. It also refactors how sentinels and gates are handled in `m_start()`, `m_next()`, and `proc_get_vma()`. These are fundamental changes affecting memory management and the invariants of procfs locking. This is exactly what I need to target for fuzzing. Race conditions, deadlocks, UAF, and assertion failures are all potential vulnerabilities here. The analysis aligns perfectly with my requirements and guidelines. Time to call `set-results`.
26/2	2026/09/20 21:53	tool	set-results	0m Args: { "EnableConfigs": [ "PROC_FS", "PROC_PAGE_MONITOR" ], "FocusSymbols": [ "show_smaps_rollup", "smap_gather_stats_range", "smap_gather_stats", "proc_get_vma", "m_start", "m_next", "do_procmap_query" ], "Reasoning": "The patch modifies memory management and procfs iteration and locking logic in fs/proc/task_mmu.c. In particular, it transitions show_smaps_rollup() from holding mmap_read_lock throughout the walk to utilizing per-VMA locking and RCU iteration via proc_get_vma() with dynamic fallback on contention, adds smap_gather_stats_range() to handle concurrent VMA resizing/merges, and refactors gate VMA and lock state handling. These concurrency-sensitive paths in core memory management / procfs are fully reachable and warrant fuzzing.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "PROC_FS", "PROC_PAGE_MONITOR" ], "FocusSymbols": [ "show_smaps_rollup", "smap_gather_stats_range", "smap_gather_stats", "proc_get_vma", "m_start", "m_next", "do_procmap_query" ], "Reasoning": "The patch modifies memory management and procfs iteration and locking logic in fs/proc/task_mmu.c. In particular, it transitions show_smaps_rollup() from holding mmap_read_lock throughout the walk to utilizing per-VMA locking and RCU iteration via proc_get_vma() with dynamic fallback on contention, adds smap_gather_stats_range() to handle concurrent VMA resizing/merges, and refactors gate VMA and lock state handling. These concurrency-sensitive paths in core memory management / procfs are fully reachable and warrant fuzzing.", "WorthFuzzing": true }
27/1	2026/09/20 21:53	action	If	0m Args: { "WorthFuzzing": true } Results: null
28/2	2026/09/20 21:53	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch modifies `fs/proc/task_mmu.c` to allow `show_smaps_rollup` to utilize per-VMA locks with RCU and fall back to `mmap_lock` under contention, refactors gate VMA handling across `m_start`/`m_next`, inlines/reorders locking helpers, and extends selftests for `smaps_rollup` racing with VMA operations.\n\nPotential bugs introduced by these concurrency and iteration changes include locking issues (deadlocks, unbalanced lock/unlock), race conditions, and use-after-free or invalid pointer dereferences of `vm_area_struct` instances when dropping and retaking locks. All of these classes of bugs are thoroughly covered by standard KASAN, LOCKDEP, and kernel debug asserts.\n\nThere are no uninitialized memory risks:\n1. All local stack variables and structures (e.g. `struct mem_size_stats mss = {}`, `struct proc_maps_locking_ctx lock_ctx`) are explicitly zero-initialized.\n2. Data exposed to userspace is emitted as formatted ASCII text through `seq_file` helpers rather than binary structure copying.\n3. No struct padding, uninitialized buffers, or conditional branching based on uninitialized values are introduced.\n\nTherefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 65b8cf9238da96ba78f442644c1d90d5a151280b Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 20 21:52:59 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 052e8dc796bcf..c0d228036b8a6 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -130,28 +130,12 @@ static void release_task_mempolicy(struct proc_maps_private priv) } #endif -static inline int lock_ctx_mm(struct proc_maps_locking_ctx lock_ctx) -{ - int ret = mmap_read_lock_killable(lock_ctx->mm); - - if (!ret) - lock_ctx->mmap_locked = true; - - return ret; -} - -static inline void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx) +static void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx) { mmap_read_unlock(lock_ctx->mm); lock_ctx->mmap_locked = false; } -static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx) -{ - lock_ctx->locked_vma = NULL; - lock_ctx->mmap_locked = false; -} - static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx) { if (lock_ctx->locked_vma) { @@ -160,23 +144,10 @@ static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx) } } -static inline bool lock_vma_range(struct seq_file m, - struct proc_maps_locking_ctx lock_ctx) -{ - rcu_read_lock(); - reset_lock_ctx(lock_ctx); - - return true; -} - -static inline void unlock_vma_range(struct proc_maps_locking_ctx lock_ctx) +static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx) { - if (lock_ctx->mmap_locked) { - unlock_ctx_mm(lock_ctx); - } else { - unlock_ctx_vma(lock_ctx); - rcu_read_unlock(); - } + lock_ctx->locked_vma = NULL; + lock_ctx->mmap_locked = false; } static struct vm_area_struct get_next_vma(struct proc_maps_private priv, @@ -196,8 +167,8 @@ static struct vm_area_struct get_next_vma(struct proc_maps_private priv, return vma; } -static inline bool fallback_to_mmap_lock(struct proc_maps_private priv, - loff_t pos) +static bool fallback_to_mmap_lock(struct proc_maps_private priv, + loff_t pos) { struct proc_maps_locking_ctx lock_ctx = &priv->lock_ctx; @@ -213,7 +184,8 @@ static inline bool fallback_to_mmap_lock(struct proc_maps_private priv, return true; } -static inline void drop_rcu(struct proc_maps_private priv) +#ifdef CONFIG_PROC_PAGE_MONITOR +static void drop_rcu(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) return; @@ -221,7 +193,7 @@ static inline void drop_rcu(struct proc_maps_private priv) rcu_read_unlock(); } -static inline void reacquire_rcu(struct proc_maps_private priv) +static void reacquire_rcu(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) return; @@ -230,6 +202,7 @@ static inline void reacquire_rcu(struct proc_maps_private priv) / Reinitialize the iterator. / vma_iter_set(&priv->iter, priv->lock_ctx.locked_vma->vm_end); } +#endif static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos) { @@ -255,9 +228,6 @@ static struct vm_area_struct proc_get_vma(struct seq_file m, loff_t ppos) found the extended vma with the same vm_start. / ppos = vma->vm_end; - } else { - ppos = SENTINEL_VMA_GATE; - vma = get_gate_vma(priv->lock_ctx.mm); } return vma; @@ -267,6 +237,7 @@ static void m_start(struct seq_file m, loff_t ppos) { struct proc_maps_private priv = m->private; struct proc_maps_locking_ctx lock_ctx; + struct vm_area_struct vma; loff_t last_addr = ppos; struct mm_struct mm; @@ -286,13 +257,8 @@ static void m_start(struct seq_file m, loff_t ppos) return NULL; } - if (!lock_vma_range(m, lock_ctx)) { - mmput(mm); - put_task_struct(priv->task); - priv->task = NULL; - return ERR_PTR(-EINTR); - } - + rcu_read_lock(); + reset_lock_ctx(lock_ctx); /* * Reset current position if last_addr was set before * and it's not a sentinel. @@ -301,19 +267,39 @@ static void m_start(struct seq_file m, loff_t ppos) ppos = last_addr = priv->last_pos; vma_iter_init(&priv->iter, mm, (unsigned long)last_addr); hold_task_mempolicy(priv); + /* + * If seq_file had to flush its collected data right after m_next() set + * position to SENTINEL_VMA_GATE, m_start() will get that sentinel and + * should return gate_vma without calling proc_get_vma(). + / if (last_addr == SENTINEL_VMA_GATE) return get_gate_vma(mm); - return proc_get_vma(m, ppos); + vma = proc_get_vma(m, ppos); + if (vma) + return vma; + + / Return gate VMA at the end / + ppos = SENTINEL_VMA_GATE; + return get_gate_vma(mm); } static void m_next(struct seq_file m, void v, loff_t ppos) { + struct proc_maps_private priv = m->private; + struct vm_area_struct vma; + if (ppos == SENTINEL_VMA_GATE) { ppos = SENTINEL_VMA_END; return NULL; } - return proc_get_vma(m, ppos); + vma = proc_get_vma(m, ppos); + if (vma) + return vma; + + /* Return gate VMA at the end / + ppos = SENTINEL_VMA_GATE; + return get_gate_vma(priv->lock_ctx.mm); } static void m_stop(struct seq_file m, void v) @@ -325,7 +311,12 @@ static void m_stop(struct seq_file m, void v) return; release_task_mempolicy(priv); - unlock_vma_range(&priv->lock_ctx); + if (priv->lock_ctx.mmap_locked) { + unlock_ctx_mm(&priv->lock_ctx); + } else { + unlock_ctx_vma(&priv->lock_ctx); + rcu_read_unlock(); + } mmput(mm); put_task_struct(priv->task); priv->task = NULL; @@ -518,21 +509,6 @@ static int pid_maps_open(struct inode inode, struct file file) PROCMAP_QUERY_VMA_FLAGS \ ) -static int query_vma_setup(struct proc_maps_locking_ctx lock_ctx) -{ - reset_lock_ctx(lock_ctx); - - return 0; -} - -static void query_vma_teardown(struct proc_maps_locking_ctx lock_ctx) -{ - if (lock_ctx->mmap_locked) - unlock_ctx_mm(lock_ctx); - else - unlock_ctx_vma(lock_ctx); -} - static struct vm_area_struct query_vma_find_by_addr(struct proc_maps_locking_ctx lock_ctx, unsigned long addr) { @@ -653,12 +629,7 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg) if (!mm \|\| !mmget_not_zero(mm)) return -ESRCH; - err = query_vma_setup(&lock_ctx); - if (err) { - mmput(mm); - return err; - } - + reset_lock_ctx(&lock_ctx); vma = query_matching_vma(&lock_ctx, karg.query_addr, karg.query_flags); if (IS_ERR(vma)) { err = PTR_ERR(vma); @@ -732,7 +703,10 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg) vm_file = get_file(vma->vm_file); /* unlock vma or mmap_lock, and put mm_struct before copying data to user / - query_vma_teardown(&lock_ctx); + if (lock_ctx.mmap_locked) + unlock_ctx_mm(&lock_ctx); + else + unlock_ctx_vma(&lock_ctx); mmput(mm); if (karg.build_id_size) { @@ -773,7 +747,10 @@ static int do_procmap_query(struct mm_struct mm, void __user uarg) return 0; out: - query_vma_teardown(&lock_ctx); + if (lock_ctx.mmap_locked) + unlock_ctx_mm(&lock_ctx); + else + unlock_ctx_vma(&lock_ctx); mmput(mm); out_file: if (vm_file) @@ -1263,7 +1240,7 @@ static const struct mm_walk_ops smaps_shmem_walk_vma_lock_ops = { .walk_lock = PGWALK_VMA_RDLOCK_VERIFY, }; -static inline const struct mm_walk_ops +static const struct mm_walk_ops * get_smaps_walk_ops(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) @@ -1271,7 +1248,7 @@ get_smaps_walk_ops(struct proc_maps_private priv) return &smaps_walk_vma_lock_ops; } -static inline const struct mm_walk_ops * +static const struct mm_walk_ops * get_smaps_shmem_walk_ops(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) @@ -1279,20 +1256,26 @@ get_smaps_shmem_walk_ops(struct proc_maps_private priv) return &smaps_shmem_walk_vma_lock_ops; } -/* - * Gather mem stats from @vma with the indicated beginning - * address @start, and keep them in @mss. +/** + * smap_gather_stats_range() - Gather mem stats from a portion of the @vma. + * @priv: proc maps private state. + * @vma: The VMA to gather stats for. + * @mss: The accumulated stats. + * @start: The address from which to start. * - * Use vm_start of @vma as the beginning address if @start is 0. + * This gathers stats for the portion of the VMA starting at the @start + * address. / -static void smap_gather_stats(struct proc_maps_private priv, - struct vm_area_struct vma, - struct mem_size_stats mss, unsigned long start) +static void smap_gather_stats_range(struct proc_maps_private priv, + struct vm_area_struct vma, + struct mem_size_stats mss, + unsigned long start) { const struct mm_walk_ops ops = get_smaps_walk_ops(priv); + const bool is_partial = start > vma->vm_start; /* Invalid start / - if (start >= vma->vm_end) + if (start < vma->vm_start \|\| start >= vma->vm_end) return; if (vma == get_gate_vma(priv->lock_ctx.mm)) @@ -1303,33 +1286,39 @@ static void smap_gather_stats(struct proc_maps_private priv, if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) { /* - * For shared or readonly shmem mappings we know that all - * swapped out pages belong to the shmem object, and we can - * obtain the swap value much more efficiently. For private - * writable mappings, we might have COW pages that are - * not affected by the parent swapped out pages of the shmem - * object, so we have to distinguish them during the page walk. - * Unless we know that the shmem object (or the part mapped by - * our VMA) has no swapped out pages at all. + * CoW mappings might map anon folios that do not belong to + * shmem. Perform a less efficient page table walk in this + * situation, unless we know that the shmem object (or the + * part mapped by our VMA) has no swapped out pages at all. / - unsigned long shmem_swapped = shmem_swap_usage(vma); + const unsigned long shmem_swapped = shmem_swap_usage(vma); + const bool is_cow = vma_is_cow_mapping(vma); - if (!start && (!shmem_swapped \|\| (vma->vm_flags & VM_SHARED) \|\| - !(vma->vm_flags & VM_WRITE))) { - mss->swap += shmem_swapped; - } else { + if (is_partial \|\| (shmem_swapped && is_cow)) ops = get_smaps_shmem_walk_ops(priv); - } + else + mss->swap += shmem_swapped; } - if (!start) - walk_page_vma(vma, ops, mss); - else - walk_page_range(vma->vm_mm, start, vma->vm_end, ops, mss); + walk_page_range_vma(vma, start, vma->vm_end, ops, mss); reacquire_rcu(priv); } +/* + * smap_gather_stats() - Gather mem stats from the entire @vma. + * @priv: proc maps private state. + * @vma: The VMA to gather stats for. + * @mss: The accumulated stats. + * + * This gathers stats for the whole of the VMA. + / +static void smap_gather_stats(struct proc_maps_private priv, + struct vm_area_struct vma, struct mem_size_stats mss) +{ + smap_gather_stats_range(priv, vma, mss, vma->vm_start); +} + #define SEQ_PUT_DEC(str, val) \ seq_put_decimal_ull_width(m, str, (val) >> 10, 8) @@ -1380,7 +1369,7 @@ static int show_smap(struct seq_file m, void v) struct vm_area_struct vma = v; struct mem_size_stats mss = {}; - smap_gather_stats(priv, vma, &mss, 0); + smap_gather_stats(priv, vma, &mss); show_map_vma(m, vma); @@ -1405,12 +1394,14 @@ static int show_smap(struct seq_file m, void v) static int show_smaps_rollup(struct seq_file m, void v) { struct proc_maps_private priv = m->private; + struct proc_maps_locking_ctx lock_ctx = &priv->lock_ctx; + struct mm_struct mm = lock_ctx->mm; struct mem_size_stats mss = {}; - struct mm_struct mm = priv->lock_ctx.mm; + unsigned long last_vma_end = 0; + unsigned long vma_start = 0; struct vm_area_struct vma; - unsigned long vma_start = 0, last_vma_end = 0; + loff_t pos = 0; int ret = 0; - VMA_ITERATOR(vmi, mm, 0); priv->task = get_proc_task(priv->inode); if (!priv->task) @@ -1421,89 +1412,63 @@ static int show_smaps_rollup(struct seq_file m, void v) goto out_put_task; } - ret = lock_ctx_mm(&priv->lock_ctx); - if (ret) - goto out_put_mm; - hold_task_mempolicy(priv); - vma = vma_next(&vmi); + rcu_read_lock(); + reset_lock_ctx(lock_ctx); + vma_iter_init(&priv->iter, mm, 0); + vma = proc_get_vma(m, &pos); if (unlikely(!vma)) goto empty_set; - vma_start = vma->vm_start; - do { - smap_gather_stats(priv, vma, &mss, 0); + if (!IS_ERR(vma)) + vma_start = vma->vm_start; + + while (vma) { + if (IS_ERR(vma)) { + ret = PTR_ERR(vma); + goto out_unlock; + } + + if (vma->vm_start < last_vma_end) { + /* + * After retaking the lock, already reported VMA grew + * or got merged with the next one and we found it + * again. Gather stats for the remaining portion by + * starting at last_vma_end. + / + smap_gather_stats_range(priv, vma, &mss, last_vma_end); + } else { + / Found next unreported VMA, start from its beginning / + smap_gather_stats(priv, vma, &mss); + } last_vma_end = vma->vm_end; / - * Release mmap_lock temporarily if someone wants to - * access it for write request. + * If the VMA lock is not taken, we hold the often contended + * mmap lock. This can happen if we had to fall back to the + * mmap lock. + * + * To relieve pressure, check if it is indeed contended, then + * temporarily release it. / - if (mmap_lock_is_contended(mm)) { - vma_iter_invalidate(&vmi); - unlock_ctx_mm(&priv->lock_ctx); - ret = lock_ctx_mm(&priv->lock_ctx); - if (ret) { - release_task_mempolicy(priv); - goto out_put_mm; - } - + if (lock_ctx->mmap_locked && + mmap_lock_is_contended(lock_ctx->mm)) { + unlock_ctx_mm(lock_ctx); / - * After dropping the lock, there are four cases to - * consider. See the following example for explanation. - * - * +------+------+-----------+ - * \| VMA1 \| VMA2 \| VMA3 \| - * +------+------+-----------+ - * \| \| \| \| - * 4k 8k 16k 400k - * - * Suppose we drop the lock after reading VMA2 due to - * contention, then we get: - * - * last_vma_end = 16k - * - * 1) VMA2 is freed, but VMA3 exists: - * - * vma_next(vmi) will return VMA3. - * In this case, just continue from VMA3. - * - * 2) VMA2 still exists: - * - * vma_next(vmi) will return VMA3. - * In this case, just continue from VMA3. - * - * 3) No more VMAs can be found: - * - * vma_next(vmi) will return NULL. - * No more things to do, just break. - * - * 4) (last_vma_end - 1) is the middle of a vma (VMA'): - * - * vma_next(vmi) will return VMA' whose range - * contains last_vma_end. - * Iterate VMA' from last_vma_end. + * Even though we previously fell back to mmap lock, + * we try taking VMA lock for the next VMA, since it + * might not be under modification. In the worst case + * we will fall back to mmap lock again. / - vma = vma_next(&vmi); - / Case 3 above / - if (!vma) - break; - - / Case 1 and 2 above / - if (vma->vm_start >= last_vma_end) { - smap_gather_stats(priv, vma, &mss, 0); - last_vma_end = vma->vm_end; - continue; - } - - / Case 4 above / - if (vma->vm_end > last_vma_end) { - smap_gather_stats(priv, vma, &mss, last_vma_end); - last_vma_end = vma->vm_end; - } + rcu_read_lock(); + reset_lock_ctx(lock_ctx); + / Resume from the last position. / + pos = last_vma_end; + vma_iter_init(&priv->iter, mm, pos); } - } for_each_vma(vmi, vma); + vma = proc_get_vma(m, &pos); + } empty_set: show_vma_header_prefix(m, vma_start, last_vma_end, 0, 0, 0, 0); @@ -1512,10 +1477,14 @@ static int show_smaps_rollup(struct seq_file m, void v) __show_smap(m, &mss, true); +out_unlock: + if (lock_ctx->mmap_locked) { + unlock_ctx_mm(lock_ctx); + } else { + unlock_ctx_vma(lock_ctx); + rcu_read_unlock(); + } release_task_mempolicy(priv); - unlock_ctx_mm(&priv->lock_ctx); - -out_put_mm: mmput(mm); out_put_task: put_task_struct(priv->task); @@ -1605,7 +1574,7 @@ struct clear_refs_private { enum clear_refs_types type; }; -static inline bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, pte_t pte) +static bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, pte_t pte) { struct folio folio; @@ -1621,8 +1590,8 @@ static inline bool pte_is_pinned(struct vm_area_struct vma, unsigned long addr, return folio_maybe_dma_pinned(folio); } -static inline void clear_soft_dirty(struct vm_area_struct vma, - unsigned long addr, pte_t pte) +static void clear_soft_dirty(struct vm_area_struct vma, unsigned long addr, + pte_t pte) { if (!pgtable_supports_soft_dirty()) return; @@ -1653,7 +1622,7 @@ static inline void clear_soft_dirty(struct vm_area_struct vma, } #if defined(CONFIG_TRANSPARENT_HUGEPAGE) -static inline void clear_soft_dirty_pmd(struct vm_area_struct vma, +static void clear_soft_dirty_pmd(struct vm_area_struct vma, unsigned long addr, pmd_t pmdp) { pmd_t old, pmd = pmdp; @@ -1679,7 +1648,7 @@ static inline void clear_soft_dirty_pmd(struct vm_area_struct vma, } } #else -static inline void clear_soft_dirty_pmd(struct vm_area_struct vma, +static void clear_soft_dirty_pmd(struct vm_area_struct vma, unsigned long addr, pmd_t pmdp) { } @@ -1881,7 +1850,7 @@ struct pagemapread { #define PM_END_OF_BUFFER 1 -static inline pagemap_entry_t make_pme(u64 frame, u64 flags) +static pagemap_entry_t make_pme(u64 frame, u64 flags) { return (pagemap_entry_t) { .pme = (frame & PM_PFRAME_MASK) \| flags }; } @@ -3423,7 +3392,7 @@ static const struct mm_walk_ops show_numa_vma_lock_ops = { .walk_lock = PGWALK_VMA_RDLOCK_VERIFY, }; -static inline const struct mm_walk_ops * +static const struct mm_walk_ops * get_show_numa_ops(struct proc_maps_private priv) { if (priv->lock_ctx.mmap_locked) diff --git a/tools/testing/selftests/proc/proc-maps-race.c b/tools/testing/selftests/proc/proc-maps-race.c index 415eccb704684..bf4c5073f6fc8 100644 --- a/tools/testing/selftests/proc/proc-maps-race.c +++ b/tools/testing/selftests/proc/proc-maps-race.c @@ -80,6 +80,61 @@ enum maps_file { struct vma_modifier_info; +enum smaps_rollup_stat { + Rss, + Pss, + Pss_Dirty, + Pss_Anon, + Pss_File, + Pss_Shmem, + Shared_Clean, + Shared_Dirty, + Private_Clean, + Private_Dirty, + Referenced, + Anonymous, + KSM, + LazyFree, + AnonHugePages, + ShmemPmdMapped, + FilePmdMapped, + Shared_Hugetlb, + Private_Hugetlb, + Swap, + SwapPss, + Locked, + RollupFieldCount +}; + +static const char smaps_rollup_stat_names[RollupFieldCount] = { + "Rss", + "Pss", + "Pss_Dirty", + "Pss_Anon", + "Pss_File", + "Pss_Shmem", + "Shared_Clean", + "Shared_Dirty", + "Private_Clean", + "Private_Dirty", + "Referenced", + "Anonymous", + "KSM", + "LazyFree", + "AnonHugePages", + "ShmemPmdMapped", + "FilePmdMapped", + "Shared_Hugetlb", + "Private_Hugetlb", + "Swap", + "SwapPss", + "Locked", +}; + +struct smaps_rollup_stats { + unsigned long values[RollupFieldCount]; +}; + FIXTURE(proc_maps_race) { struct vma_modifier_info mod_info; @@ -91,6 +146,7 @@ FIXTURE(proc_maps_race) enum maps_file maps_file; int shared_mem_size; int skip_pages; + int rollup_fd; int page_size; int vma_count; bool verbose; @@ -132,12 +188,12 @@ struct vma_modifier_info { void child_mapped_addr[]; }; -static bool read_page(FIXTURE_DATA(proc_maps_race) self, +static bool read_page(FIXTURE_DATA(proc_maps_race) self, int fd, struct page_content page) { ssize_t bytes_read; - bytes_read = read(self->maps_fd, page->data, self->page_size); + bytes_read = read(fd, page->data, self->page_size); if (bytes_read <= 0) return false; @@ -175,7 +231,7 @@ static int locate_containing_page(FIXTURE_DATA(proc_maps_race) self, char curr_pos; char end_pos; - if (!read_page(self, &self->page1)) + if (!read_page(self, self->maps_fd, &self->page1)) return -1; curr_pos = self->page1.data; @@ -205,10 +261,11 @@ static bool read_two_pages(FIXTURE_DATA(proc_maps_race) self) return false; for (int i = 0; i < self->skip_pages; i++) - if (!read_page(self, &self->page1)) + if (!read_page(self, self->maps_fd, &self->page1)) return false; - return read_page(self, &self->page1) && read_page(self, &self->page2); + return read_page(self, self->maps_fd, &self->page1) && + read_page(self, self->maps_fd, &self->page2); } static void copy_line(const char line_start, const char line_end, @@ -317,6 +374,61 @@ static bool read_boundary_lines(FIXTURE_DATA(proc_maps_race) self, &first_line->end_addr) == 2; } +static bool parse_smaps_rollup(FIXTURE_DATA(proc_maps_race) self, + struct smaps_rollup_stats stats) +{ + unsigned int dev_maj, dev_min, inode; + unsigned long start, end, offs; + unsigned long value; + char name[32], perm[5]; + char curr_pos; + char end_pos; + char line_end; + + if (lseek(self->rollup_fd, 0, SEEK_SET) < 0) + return false; + + if (!read_page(self, self->rollup_fd, &self->page1)) + return false; + + curr_pos = self->page1.data; + end_pos = self->page1.data + self->page1.size; + + line_end = strchr(curr_pos, '\n'); + if (!line_end) + return false; + + if (sscanf(curr_pos, "%lx-%lx %4s %lx %u:%u %u %31s", + &start, &end, perm, &offs, &dev_maj, &dev_min, &inode, name) != 8) + return false; + + if (strcmp(name, "[rollup]")) + return false; + + for (int stat = 0; stat < ARRAY_SIZE(smaps_rollup_stat_names); stat++) { + int len; + + curr_pos = line_end + 1; + if (curr_pos >= end_pos) + return false; + + line_end = strchr(curr_pos, '\n'); + if (!line_end) + return false; + + if (sscanf(curr_pos, "%31s %lu kB", name, &value) != 2) + return false; + + len = strlen(name); + if (name[len - 1] != ':' \|\| strncmp(name, smaps_rollup_stat_names[stat], len - 1)) + return false; + + stats->values[stat] = value; + } + + return true; +} + / Thread synchronization routines / static void wait_for_state(struct vma_modifier_info mod_info, enum test_state state) { @@ -397,6 +509,40 @@ static bool print_boundaries_on(bool condition, const char title, return condition; } +static void print_smaps_rollup_stats(const char title, FIXTURE_DATA(proc_maps_race) self, + struct smaps_rollup_stats stats) +{ + printf("%s", title); + for (int stat = 0; stat < ARRAY_SIZE(smaps_rollup_stat_names); stat++) + printf("%64s %lu kB\n", smaps_rollup_stat_names[stat], stats->values[stat]); +} + +static bool cmp_smaps_rollup_stat(struct smaps_rollup_stats s1, + struct smaps_rollup_stats s2, enum smaps_rollup_stat stat) +{ + return s1->values[stat] == s2->values[stat]; +} + +static bool compare_smaps_rollup(FIXTURE_DATA(proc_maps_race) self, + struct smaps_rollup_stats expected, + struct smaps_rollup_stats actual) +{ + / + * Clean/dirty metrics might change but Pss-related ones + * should stay constant. + / + if (cmp_smaps_rollup_stat(expected, actual, Pss) && + cmp_smaps_rollup_stat(expected, actual, Pss_Anon) && + cmp_smaps_rollup_stat(expected, actual, Pss_File) && + cmp_smaps_rollup_stat(expected, actual, Pss_Shmem)) + return true; + + print_smaps_rollup_stats("Expected stats:", self, expected); + print_smaps_rollup_stats("Actual stats:", self, actual); + + return false; +} + static void report_test_start(const char name, bool verbose) { if (verbose) @@ -572,6 +718,7 @@ FIXTURE_SETUP(proc_maps_race) unsigned long first_map_addr; unsigned long last_map_addr; unsigned long duration_sec; + char rollup_fname[32]; char fname[32]; self->page_size = (unsigned long)sysconf(_SC_PAGESIZE); @@ -649,6 +796,9 @@ FIXTURE_SETUP(proc_maps_race) break; case SMAPS: sprintf(fname, "/proc/%d/smaps", self->pid); + sprintf(rollup_fname, "/proc/%d/smaps_rollup", self->pid); + self->rollup_fd = open(rollup_fname, O_RDONLY); + ASSERT_NE(self->rollup_fd, -1); break; default: ksft_exit_fail(); @@ -711,6 +861,8 @@ FIXTURE_TEARDOWN(proc_maps_race) for (int i = 0; i < self->vma_count; i++) munmap(self->mod_info->child_mapped_addr[i], self->page_size); close(self->maps_fd); + if (self->maps_file == SMAPS) + close(self->rollup_fd); waitpid(self->pid, &status, 0); munmap(self->mod_info, self->shared_mem_size); } @@ -723,6 +875,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) struct line_content split_first_line; struct line_content restored_last_line; struct line_content restored_first_line; + struct smaps_rollup_stats orig_stats; wait_for_state(mod_info, SETUP_READY); @@ -736,6 +889,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) report_test_start("Tearing from split", self->verbose); ASSERT_TRUE(capture_mod_pattern(self, &split_last_line, &split_first_line, &restored_last_line, &restored_first_line)); + if (self->maps_file == SMAPS) + ASSERT_TRUE(parse_smaps_rollup(self, &orig_stats)); /* Now start concurrent modifications for self->duration_sec / signal_state(mod_info, TEST_READY); @@ -799,6 +954,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_split) vma_end == self->last_line.end_addr) \|\| (vma_start == split_first_line.start_addr && vma_end == split_first_line.end_addr)); + } else { + struct smaps_rollup_stats stats; + + ASSERT_TRUE(parse_smaps_rollup(self, &stats)); + ASSERT_TRUE(compare_smaps_rollup(self, &orig_stats, &stats)); } clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); @@ -817,6 +977,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) struct line_content shrunk_first_line; struct line_content restored_last_line; struct line_content restored_first_line; + struct smaps_rollup_stats orig_stats; wait_for_state(mod_info, SETUP_READY); @@ -830,6 +991,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) report_test_start("Tearing from resize", self->verbose); ASSERT_TRUE(capture_mod_pattern(self, &shrunk_last_line, &shrunk_first_line, &restored_last_line, &restored_first_line)); + if (self->maps_file == SMAPS) + ASSERT_TRUE(parse_smaps_rollup(self, &orig_stats)); / Now start concurrent modifications for self->duration_sec / signal_state(mod_info, TEST_READY); @@ -880,6 +1043,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_resize) ASSERT_TRUE(vma_start == self->last_line.start_addr && (vma_end - vma_start == self->page_size 3 \|\| vma_end - vma_start == self->page_size)); + } else { + struct smaps_rollup_stats stats; + + ASSERT_TRUE(parse_smaps_rollup(self, &stats)); + ASSERT_TRUE(compare_smaps_rollup(self, &orig_stats, &stats)); } clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose); @@ -898,6 +1066,7 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) struct line_content remapped_first_line; struct line_content restored_last_line; struct line_content restored_first_line; + struct smaps_rollup_stats orig_stats; wait_for_state(mod_info, SETUP_READY); @@ -911,6 +1080,8 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) report_test_start("Tearing from remap", self->verbose); ASSERT_TRUE(capture_mod_pattern(self, &remapped_last_line, &remapped_first_line, &restored_last_line, &restored_first_line)); + if (self->maps_file == SMAPS) + ASSERT_TRUE(parse_smaps_rollup(self, &orig_stats)); /* Now start concurrent modifications for self->duration_sec / signal_state(mod_info, TEST_READY); @@ -963,6 +1134,11 @@ TEST_F(proc_maps_race, test_maps_tearing_from_remap) vma_end - vma_start == self->page_size 3) \|\| (vma_start == self->last_line.start_addr + self->page_size && vma_end - vma_start == self->page_size)); + } else { + struct smaps_rollup_stats stats; + + ASSERT_TRUE(parse_smaps_rollup(self, &stats)); + ASSERT_TRUE(compare_smaps_rollup(self, &orig_stats, &stats)); } clock_gettime(CLOCK_MONOTONIC_COARSE, &end_ts); end_test_iteration(&end_ts, self->verbose);
29/3	2026/09/20 21:53	llm	kmsan-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 13435 output: 38 thoughts: 1838 Thoughts: KMSAN Fuzzing Assessment for Patch Series Okay, let's break this down. My goal is to determine if this patch series warrants a dedicated KMSAN fuzzing session, beyond the standard KASAN fuzzing we already have. First, I need to understand the scope of the changes. I see two files modified: `fs/proc/task_mmu.c` and `tools/testing/selftests/proc/proc-maps-race.c`. The core logic appears to be within the first file, so that's where I need to focus. Looking at `fs/proc/task_mmu.c`, this patch series seems to be refactoring how the `/proc/<pid>/maps` interface works, particularly around locking and traversal of VMAs. The code removes or replaces `lock_ctx_mm`, `unlock_ctx_mm`, `lock_vma_range`, `unlock_vma_range`, `query_vma_setup`, and `query_vma_teardown` with a different locking/RCU scheme, `reset_lock_ctx` and inline unlocking. The changes look like they are refactoring how the traversal through the VMAs and the acquisition of the memory map information from them is being handled. This is an improvement but it's important to make sure it doesn't have any regressions related to uninitialized memory. `show_smaps_rollup`, which is heavily modified, now uses per-VMA locking or RCU instead of holding `mmap_read_lock` for the entire traversal. This is likely the most significant change. Functions like `smap_gather_stats` have been refactored. Additionally, some functions had their `inline` keyword removed, which may have performance implications, but isn't relevant to memory safety. Finally, the selftests have been updated. Now, let's consider the KMSAN vs. KASAN landscape. KMSAN is primarily concerned with detecting reads of uninitialized memory and kernel-to-user memory information leaks, while KASAN focuses on out-of-bounds accesses and use-after-free bugs. LOCKDEP catches locking issues. To determine if KMSAN is necessary, I'll need to apply the provided rules: 1. Does the patch introduce kernel structures sent to userspace with potentially uninitialized fields? 2. Does the patch introduce conditional logic or branching that depends on uninitialized variables? 3. Does the patch deal with initialization of complex data structures with potentially uninitialized fields? 4. Does the patch introduce changes in bounds checks, lengths, or logic that may allow access to uninitialized data in buffers? Looking back at the code, in `show_smaps_rollup`, the `mss` struct is initialized to zero (`= {}`), and relevant variables like `last_vma_end`, `vma_start`, `pos`, and `ret` are initialized. This makes it less likely. However, I need to carefully inspect `proc_get_vma` and `do_procmap_query` to confirm that nothing within this code or surrounding code, that may affect the VMAs, could lead to uninitialized memory being exposed. Since this is an interface to user space, it is necessary to check all the surrounding code. It is not obvious from the small diff that there are no such cases. I will now use `grepper` or `read-file` to check `fs/proc/task_mmu.c` thoroughly. I'll need to look for any data structures being passed to userspace or any conditional logic where an uninitialized variable could influence the outcome. Based on the initial analysis, I'm leaning toward needing KMSAN, but I have to be absolutely sure.
30/3	2026/09/20 21:53	tool	read-file	0m Args: { "File": "fs/proc/task_mmu.c", "FirstLine": 210, "LineCount": 55 } Results: { "Contents": " 210:\t\tstruct vm_area_struct vma;\n 211:\t\n 212:\tretry:\n 213:\t\tvma = get_next_vma(priv, ppos);\n 214:\t\t/* EINTR of EAGAIN is possible /\n 215:\t\tif (IS_ERR(vma)) {\n 216:\t\t\tif (PTR_ERR(vma) == -EAGAIN \u0026\u0026 fallback_to_mmap_lock(priv, ppos))\n 217:\t\t\t\tgoto retry;\n 218:\t\n 219:\t\t\treturn vma;\n 220:\t\t}\n 221:\t\n 222:\t\t/* Store previous position to be able to restart if needed /\n 223:\t\tpriv-\u003elast_pos = ppos;\n 224:\t\tif (vma) {\n 225:\t\t\t/\n 226:\t\t\t Track the end of the reported vma to ensure position changes\n 227:\t\t\t * even if previous vma was merged with the next vma and we\n 228:\t\t\t * found the extended vma with the same vm_start.\n 229:\t\t\t /\n 230:\t\t\tppos = vma-\u003evm_end;\n 231:\t\t}\n 232:\t\n 233:\t\treturn vma;\n 234:\t}\n 235:\t\n 236:\tstatic void m_start(struct seq_file m, loff_t ppos)\n 237:\t{\n 238:\t\tstruct proc_maps_private priv = m-\u003eprivate;\n 239:\t\tstruct proc_maps_locking_ctx lock_ctx;\n 240:\t\tstruct vm_area_struct vma;\n 241:\t\tloff_t last_addr = ppos;\n 242:\t\tstruct mm_struct mm;\n 243:\t\n 244:\t\t/* See m_next(). Zero at the start or after lseek. /\n 245:\t\tif (last_addr == SENTINEL_VMA_END)\n 246:\t\t\treturn NULL;\n 247:\t\n 248:\t\tpriv-\u003etask = get_proc_task(priv-\u003einode);\n 249:\t\tif (!priv-\u003etask)\n 250:\t\t\treturn ERR_PTR(-ESRCH);\n 251:\t\n 252:\t\tlock_ctx = \u0026priv-\u003elock_ctx;\n 253:\t\tmm = lock_ctx-\u003emm;\n 254:\t\tif (!mm \|\| !mmget_not_zero(mm)) {\n 255:\t\t\tput_task_struct(priv-\u003etask);\n 256:\t\t\tpriv-\u003etask = NULL;\n 257:\t\t\treturn NULL;\n 258:\t\t}\n 259:\t\n 260:\t\trcu_read_lock();\n 261:\t\treset_lock_ctx(lock_ctx);\n 262:\t\t/\n 263:\t\t * Reset current position if last_addr was set before\n 264:\t\t * and it's not a sentinel.\n" }
31/3	2026/09/20 21:53	llm	kmsan-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 16914 output: 38 thoughts: 23 Thoughts: Here's a summary of my thought process, as requested: Diving into `do_procmap_query` Okay, so I need to get a handle on how this query function is operating. Specifically, I'm focusing on the `do_procmap_query` function, and I'm going to zoom in on lines 620 through 760. That's a reasonable chunk of code to digest at once. This section likely contains the core logic for either constructing the query, processing the results, or both. I need to understand how it's behaving, especially in terms of its complexity, potential bottlenecks, and any areas that might benefit from optimization or clarification. I'm looking for the essential parts of how the querying process works, and how data is handled. This seems like a promising starting point for a deeper dive.
32/3	2026/09/20 21:54	tool	read-file	0m Args: { "File": "fs/proc/task_mmu.c", "FirstLine": 620, "LineCount": 80 } Results: { "Contents": " 620:\t\t/* reject unknown flags /\n 621:\t\tif (karg.query_flags \u0026 ~PROCMAP_QUERY_VALID_FLAGS_MASK)\n 622:\t\t\treturn -EINVAL;\n 623:\t\t/ either both buffer address and size are set, or both should be zero /\n 624:\t\tif (!!karg.vma_name_size != !!karg.vma_name_addr)\n 625:\t\t\treturn -EINVAL;\n 626:\t\tif (!!karg.build_id_size != !!karg.build_id_addr)\n 627:\t\t\treturn -EINVAL;\n 628:\t\n 629:\t\tif (!mm \|\| !mmget_not_zero(mm))\n 630:\t\t\treturn -ESRCH;\n 631:\t\n 632:\t\treset_lock_ctx(\u0026lock_ctx);\n 633:\t\tvma = query_matching_vma(\u0026lock_ctx, karg.query_addr, karg.query_flags);\n 634:\t\tif (IS_ERR(vma)) {\n 635:\t\t\terr = PTR_ERR(vma);\n 636:\t\t\tvma = NULL;\n 637:\t\t\tgoto out;\n 638:\t\t}\n 639:\t\n 640:\t\tkarg.vma_start = vma-\u003evm_start;\n 641:\t\tkarg.vma_end = vma-\u003evm_end;\n 642:\t\n 643:\t\tkarg.vma_flags = 0;\n 644:\t\tif (vma-\u003evm_flags \u0026 VM_READ)\n 645:\t\t\tkarg.vma_flags \|= PROCMAP_QUERY_VMA_READABLE;\n 646:\t\tif (vma-\u003evm_flags \u0026 VM_WRITE)\n 647:\t\t\tkarg.vma_flags \|= PROCMAP_QUERY_VMA_WRITABLE;\n 648:\t\tif (vma-\u003evm_flags \u0026 VM_EXEC)\n 649:\t\t\tkarg.vma_flags \|= PROCMAP_QUERY_VMA_EXECUTABLE;\n 650:\t\tif (vma-\u003evm_flags \u0026 VM_MAYSHARE)\n 651:\t\t\tkarg.vma_flags \|= PROCMAP_QUERY_VMA_SHARED;\n 652:\t\n 653:\t\tkarg.vma_page_size = vma_kernel_pagesize(vma);\n 654:\t\n 655:\t\tif (vma-\u003evm_file) {\n 656:\t\t\tconst struct inode inode = file_user_inode(vma-\u003evm_file);\n 657:\t\n 658:\t\t\tkarg.vma_offset = ((__u64)vma-\u003evm_pgoff) \u003c\u003c PAGE_SHIFT;\n 659:\t\t\tkarg.dev_major = MAJOR(inode-\u003ei_sb-\u003es_dev);\n 660:\t\t\tkarg.dev_minor = MINOR(inode-\u003ei_sb-\u003es_dev);\n 661:\t\t\tkarg.inode = inode-\u003ei_ino;\n 662:\t\t} else {\n 663:\t\t\tkarg.vma_offset = 0;\n 664:\t\t\tkarg.dev_major = 0;\n 665:\t\t\tkarg.dev_minor = 0;\n 666:\t\t\tkarg.inode = 0;\n 667:\t\t}\n 668:\t\n 669:\t\tif (karg.vma_name_size) {\n 670:\t\t\tsize_t name_buf_sz = min_t(size_t, PATH_MAX, karg.vma_name_size);\n 671:\t\t\tconst struct path path;\n 672:\t\t\tconst char name_fmt;\n 673:\t\t\tsize_t name_sz = 0;\n 674:\t\n 675:\t\t\tget_vma_name(vma, \u0026path, \u0026name, \u0026name_fmt);\n 676:\t\n 677:\t\t\tif (path \|\| name_fmt \|\| name) {\n 678:\t\t\t\tname_buf = kmalloc(name_buf_sz, GFP_KERNEL);\n 679:\t\t\t\tif (!name_buf) {\n 680:\t\t\t\t\terr = -ENOMEM;\n 681:\t\t\t\t\tgoto out;\n 682:\t\t\t\t}\n 683:\t\t\t}\n 684:\t\t\tif (path) {\n 685:\t\t\t\tname = d_path(path, name_buf, name_buf_sz);\n 686:\t\t\t\tif (IS_ERR(name)) {\n 687:\t\t\t\t\terr = PTR_ERR(name);\n 688:\t\t\t\t\tgoto out;\n 689:\t\t\t\t}\n 690:\t\t\t\tname_sz = name_buf + name_buf_sz - name;\n 691:\t\t\t} else if (name \|\| name_fmt) {\n 692:\t\t\t\tname_sz = 1 + snprintf(name_buf, name_buf_sz, name_fmt ?: \"%s\", name);\n 693:\t\t\t\tname = name_buf;\n 694:\t\t\t}\n 695:\t\t\tif (name_sz \u003e name_buf_sz) {\n 696:\t\t\t\terr = -ENAMETOOLONG;\n 697:\t\t\t\tgoto out;\n 698:\t\t\t}\n 699:\t\t\tkarg.vma_name_size = name_sz;\n" }
33/3	2026/09/20 21:54	llm	kmsan-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 18546 output: 37 thoughts: 3700 Thoughts: Analysis of Memory Safety in proc_maps Patch Okay, so I've been digging into this patch. The core of it seems to be refactoring and optimizing the `proc_maps` code, specifically focusing on how it handles virtual memory areas (VMAs) and locking. I see that the primary change in `do_procmap_query` boils down to inlining those helper functions, `query_vma_setup` and `query_vma_teardown`. Essentially, the logic is identical – just tidied up a bit. That's fine, nothing jumps out at me as a major risk there. Now, looking at `show_smaps_rollup`, which is where the main logic resides, this is where it gets a little more interesting. The patch replaces an mmap lock with per-VMA locking. I'm focusing on potential uninitialized memory reads, especially since we're dealing with outputting data into a `seq_file`. The `mss` struct, which accumulates the memory size stats, is zero-initialized right at the beginning (`struct mem_size_stats mss = {};`). Any stats gathered within `smap_gather_stats_range` and `smap_gather_stats` and printed using `__show_smap` depend on the fields of `mss`. So, that seems safe enough. The `seq_file` itself uses methods like `seq_puts`, `seq_printf` which format data, so uninitialized memory should not be an issue. I'm particularly interested in that `proc_get_vma` function. The patch's removal of the gate VMA return, and the error-handling in `proc_get_vma`, and its usage within `show_smaps_rollup`, seems solid. If there's an error, it is returned via `ERR_PTR(...)`, and handled by the calling functions, and `show_smaps_rollup` jumps out to `empty_set` if the `proc_get_vma` return is `NULL` or error. The introduction of `smap_gather_stats_range` and changes to `smap_gather_stats` seem like a good refactor; they handle cases like partial VMAs and COW mappings separately. I checked `walk_page_range_vma`, and it’s standard page table walking logic, which should be fine. I also looked at how the gate VMA is handled, it is skipped entirely within `smap_gather_stats_range`, so it shouldn't present any issues. The patch's concurrency/locking changes are the most important part, I'm carefully reviewing the patch to ensure the memory safety of the process. Okay, so I've checked all the modified variables and data structures. It doesn't seem like the patch introduces any new risks of uninitialized memory usage or information leaks, and the new structure is fully zeroed before being read or copied. Based on my analysis, applying the KMSAN flag isn't warranted in this case.
34/3	2026/09/20 21:54	tool	grepper	0m Args: { "Expression": "proc_maps_locking_ctx", "PathPrefix": "fs/proc/task_mmu.c" } Results: { "Output": "fs/proc/task_mmu.c=128=static void release_task_mempolicy(struct proc_maps_private priv)\n--\nfs/proc/task_mmu.c-132-\nfs/proc/task_mmu.c:133:static void unlock_ctx_mm(struct proc_maps_locking_ctx lock_ctx)\nfs/proc/task_mmu.c-134-{\n--\nfs/proc/task_mmu.c-138-\nfs/proc/task_mmu.c:139:static void unlock_ctx_vma(struct proc_maps_locking_ctx lock_ctx)\nfs/proc/task_mmu.c-140-{\n--\nfs/proc/task_mmu.c-146-\nfs/proc/task_mmu.c:147:static void reset_lock_ctx(struct proc_maps_locking_ctx lock_ctx)\nfs/proc/task_mmu.c-148-{\n--\nfs/proc/task_mmu.c=153=static struct vm_area_struct get_next_vma(struct proc_maps_private priv,\n--\nfs/proc/task_mmu.c-155-{\nfs/proc/task_mmu.c:156:\tstruct proc_maps_locking_ctx lock_ctx = \u0026priv-\u003elock_ctx;\nfs/proc/task_mmu.c-157-\tstruct vm_area_struct vma;\n--\nfs/proc/task_mmu.c=170=static bool fallback_to_mmap_lock(struct proc_maps_private priv,\n--\nfs/proc/task_mmu.c-172-{\nfs/proc/task_mmu.c:173:\tstruct proc_maps_locking_ctx lock_ctx = \u0026priv-\u003elock_ctx;\nfs/proc/task_mmu.c-174-\n--\nfs/proc/task_mmu.c=236=static void m_start(struct seq_file m, loff_t ppos)\n--\nfs/proc/task_mmu.c-238-\tstruct proc_maps_private priv = m-\u003eprivate;\nfs/proc/task_mmu.c:239:\tstruct proc_maps_locking_ctx lock_ctx;\nfs/proc/task_mmu.c-240-\tstruct vm_area_struct vma;\n--\nfs/proc/task_mmu.c=494=static int pid_maps_open(struct inode inode, struct file file)\n--\nfs/proc/task_mmu.c-511-\nfs/proc/task_mmu.c:512:static struct vm_area_struct query_vma_find_by_addr(struct proc_maps_locking_ctx lock_ctx,\nfs/proc/task_mmu.c-513-\t\t\t\t\t\t unsigned long addr)\n--\nfs/proc/task_mmu.c-546-\nfs/proc/task_mmu.c:547:static struct vm_area_struct query_matching_vma(struct proc_maps_locking_ctx lock_ctx,\nfs/proc/task_mmu.c-548-\t\t\t\t\t\t unsigned long addr, u32 flags)\n--\nfs/proc/task_mmu.c=597=static int do_procmap_query(struct mm_struct mm, void __user uarg)\nfs/proc/task_mmu.c-598-{\nfs/proc/task_mmu.c:599:\tstruct proc_maps_locking_ctx lock_ctx = { .mm = mm };\nfs/proc/task_mmu.c-600-\tstruct procmap_query karg;\n--\nfs/proc/task_mmu.c=1394=static int show_smaps_rollup(struct seq_file m, void v)\n--\nfs/proc/task_mmu.c-1396-\tstruct proc_maps_private priv = m-\u003eprivate;\nfs/proc/task_mmu.c:1397:\tstruct proc_maps_locking_ctx lock_ctx = \u0026priv-\u003elock_ctx;\nfs/proc/task_mmu.c-1398-\tstruct mm_struct *mm = lock_ctx-\u003emm;\n" }
35/3	2026/09/20 21:54	llm	kmsan-evaluator	0m Model: gemini-3.8-flash Args: null Results: null Tokens: input: 24025 output: 309 thoughts: 1118 Thoughts: KMSAN Justification: A Concurrency and Locking Refactor Okay, so I've been taking a good hard look at this patch. My initial assessment is that `lock_ctx` is properly initialized, and that it's all about VMA traversal in `/proc/$pid/smaps_rollup`, with the key change being the switch to per-VMA locks (or a fallback to `mmap_read_lock`) instead of holding the `mmap_read_lock` for the entire duration. There's also some gate VMA handling refactoring and added race selftests. My main concerns here are the standard concurrency issues: race conditions, potential use-after-free scenarios with VMAs, deadlocks in the locking logic, and invalid memory dereferences due to incorrect pointer usage during the lock drop and reacquire cycle. I'm also watching out for incorrect stat calculations if the VMA range iteration is off. However, given my expertise, I'm pretty confident that these are precisely the types of issues that KASAN and LOCKDEP are designed to catch: out-of-bounds access, use-after-free, double frees, and locking problems. I see no uninitialized memory risks. No uninitialized buffers are being copied to userspace, and stack structures like `mss = {}` and `lock_ctx` are zero-initialized. I'm not seeing any changes to buffer lengths or bounds that could lead to info leaks of kernel memory. The output uses `seq_printf` and similar formatted output, not raw memory copies. There's no branching or conditional logic based on uninitialized values. Therefore, KMSAN seems unnecessary here. My focus should be on KASAN and LOCKDEP because the types of errors this patch could introduce are exactly the memory safety and locking bugs that KASAN and LOCKDEP are designed to find. I'm confident in setting `NeedsKMSAN = false`.
36/3	2026/09/20 21:54	tool	set-results	0m Args: { "KMSANReasoning": "The patch modifies `fs/proc/task_mmu.c` to allow `show_smaps_rollup` to utilize per-VMA locks with RCU and fall back to `mmap_lock` under contention, refactors gate VMA handling across `m_start`/`m_next`, inlines/reorders locking helpers, and extends selftests for `smaps_rollup` racing with VMA operations.\n\nPotential bugs introduced by these concurrency and iteration changes include locking issues (deadlocks, unbalanced lock/unlock), race conditions, and use-after-free or invalid pointer dereferences of `vm_area_struct` instances when dropping and retaking locks. All of these classes of bugs are thoroughly covered by standard KASAN, LOCKDEP, and kernel debug asserts.\n\nThere are no uninitialized memory risks:\n1. All local stack variables and structures (e.g. `struct mem_size_stats mss = {}`, `struct proc_maps_locking_ctx lock_ctx`) are explicitly zero-initialized.\n2. Data exposed to userspace is emitted as formatted ASCII text through `seq_file` helpers rather than binary structure copying.\n3. No struct padding, uninitialized buffers, or conditional branching based on uninitialized values are introduced.\n\nTherefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false } Results: { "KMSANReasoning": "The patch modifies `fs/proc/task_mmu.c` to allow `show_smaps_rollup` to utilize per-VMA locks with RCU and fall back to `mmap_lock` under contention, refactors gate VMA handling across `m_start`/`m_next`, inlines/reorders locking helpers, and extends selftests for `smaps_rollup` racing with VMA operations.\n\nPotential bugs introduced by these concurrency and iteration changes include locking issues (deadlocks, unbalanced lock/unlock), race conditions, and use-after-free or invalid pointer dereferences of `vm_area_struct` instances when dropping and retaking locks. All of these classes of bugs are thoroughly covered by standard KASAN, LOCKDEP, and kernel debug asserts.\n\nThere are no uninitialized memory risks:\n1. All local stack variables and structures (e.g. `struct mem_size_stats mss = {}`, `struct proc_maps_locking_ctx lock_ctx`) are explicitly zero-initialized.\n2. Data exposed to userspace is emitted as formatted ASCII text through `seq_file` helpers rather than binary structure copying.\n3. No struct padding, uninitialized buffers, or conditional branching based on uninitialized values are introduced.\n\nTherefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false }

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)