AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` which is only called once during kernel boot in the `__init` function `thp_shrinker_init`. Since it is executed only during initialization and cannot be triggered from userspace, it is not suitable for fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit a7f7d5faf9f95202ba84f8af5cb6e74cdb9e69ec\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jul 28 05:53:18 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/arm64/include/asm/set_memory.h b/arch/arm64/include/asm/set_memory.h\nindex 90f61b17275e1b..7083260303c3cd 100644\n--- a/arch/arm64/include/asm/set_memory.h\n+++ b/arch/arm64/include/asm/set_memory.h\n@@ -14,6 +14,8 @@ int set_memory_valid(unsigned long addr, int numpages, int enable);\n int set_direct_map_invalid_noflush(struct page *page);\n int set_direct_map_default_noflush(struct page *page);\n int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\n+#define set_direct_map_ro_noflush set_direct_map_ro_noflush\n bool kernel_page_present(struct page *page);\n \n int set_memory_encrypted(unsigned long addr, int numpages);\ndiff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c\nindex ce035e1b4eaf66..c51236b6165199 100644\n--- a/arch/arm64/mm/pageattr.c\n+++ b/arch/arm64/mm/pageattr.c\n@@ -365,6 +365,16 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n \treturn set_memory_valid(addr, nr, valid);\n }\n \n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\n+{\n+\tif (!can_set_direct_map())\n+\t\treturn 0;\n+\n+\treturn update_range_prot((unsigned long)addr, PAGE_SIZE * nr_pages,\n+\t\t\t\t __pgprot(PTE_RDONLY),\n+\t\t\t\t __pgprot(PTE_WRITE));\n+}\n+\n #ifdef CONFIG_DEBUG_PAGEALLOC\n /*\n  * This is - apart from the return value - doing the same\ndiff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h\nindex 4362c26aa992db..bd3817e06052c0 100644\n--- a/arch/x86/include/asm/set_memory.h\n+++ b/arch/x86/include/asm/set_memory.h\n@@ -89,6 +89,8 @@ int set_pages_rw(struct page *page, int numpages);\n int set_direct_map_invalid_noflush(struct page *page);\n int set_direct_map_default_noflush(struct page *page);\n int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\n+#define set_direct_map_ro_noflush set_direct_map_ro_noflush\n bool kernel_page_present(struct page *page);\n \n extern int kernel_set_to_readonly;\ndiff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c\nindex d023a40a1e0345..5987f4c84f6fe9 100644\n--- a/arch/x86/mm/pat/set_memory.c\n+++ b/arch/x86/mm/pat/set_memory.c\n@@ -2662,6 +2662,21 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n \treturn __set_pages_np(page, nr);\n }\n \n+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\n+{\n+\tunsigned long tempaddr = (unsigned long)addr;\n+\tstruct cpa_data cpa = {\n+\t\t.vaddr = \u0026tempaddr,\n+\t\t.pgd = NULL,\n+\t\t.numpages = nr_pages,\n+\t\t.mask_set = __pgprot(0),\n+\t\t.mask_clr = __pgprot(_PAGE_RW | _PAGE_DIRTY),\n+\t\t.flags = CPA_NO_CHECK_ALIAS,\n+\t};\n+\n+\treturn __change_page_attr_set_clr(\u0026cpa, 1);\n+}\n+\n #ifdef CONFIG_DEBUG_PAGEALLOC\n void __kernel_map_pages(struct page *page, int numpages, int enable)\n {\ndiff --git a/include/linux/set_memory.h b/include/linux/set_memory.h\nindex 3030d9245f5ac8..e83ced6a382777 100644\n--- a/include/linux/set_memory.h\n+++ b/include/linux/set_memory.h\n@@ -40,6 +40,24 @@ static inline int set_direct_map_valid_noflush(struct page *page,\n \treturn 0;\n }\n \n+/**\n+ * set_direct_map_ro_noflush - make a direct-map range read-only\n+ * @addr: start address in the direct map\n+ * @nr_pages: number of pages starting at @addr\n+ *\n+ * Make the direct-map range starting at @addr read-only without invalidating\n+ * TLBs. Callers must either ensure that no stale writable translations can\n+ * be used, or treat the permission change as a best-effort hardening step.\n+ *\n+ * Return: 0 on success or when direct-map permission changes are unsupported,\n+ * or a negative errno on failure.\n+ */\n+static inline int set_direct_map_ro_noflush(const void *addr,\n+\t\t\t\t\t    unsigned long nr_pages)\n+{\n+\treturn 0;\n+}\n+\n static inline bool kernel_page_present(struct page *page)\n {\n \treturn true;\n@@ -56,6 +74,17 @@ static inline bool can_set_direct_map(void)\n }\n #define can_set_direct_map can_set_direct_map\n #endif\n+\n+#ifndef set_direct_map_ro_noflush\n+/* See the comment above the generic fallback for the _noflush contract. */\n+static inline int set_direct_map_ro_noflush(const void *addr,\n+\t\t\t\t\t    unsigned long nr_pages)\n+{\n+\treturn 0;\n+}\n+\n+#define set_direct_map_ro_noflush set_direct_map_ro_noflush\n+#endif\n #endif /* CONFIG_ARCH_HAS_SET_DIRECT_MAP */\n \n #ifdef CONFIG_X86_64\ndiff --git a/mm/huge_memory.c b/mm/huge_memory.c\nindex 970e077019b75a..4425ae5560cbd7 100644\n--- a/mm/huge_memory.c\n+++ b/mm/huge_memory.c\n@@ -40,8 +40,10 @@\n #include \u003clinux/pgalloc.h\u003e\n #include \u003clinux/pgalloc_tag.h\u003e\n #include \u003clinux/pagewalk.h\u003e\n+#include \u003clinux/set_memory.h\u003e\n \n #include \u003casm/tlb.h\u003e\n+#include \u003casm/tlbflush.h\u003e\n #include \"internal.h\"\n #include \"swap.h\"\n \n@@ -932,6 +934,8 @@ static int __init thp_shrinker_init(void)\n \tshrinker_register(deferred_split_shrinker);\n \n \tif (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO)) {\n+\t\tunsigned long addr;\n+\n \t\t/*\n \t\t * Bump the reference of the huge_zero_folio and do not\n \t\t * initialize the shrinker.\n@@ -940,8 +944,18 @@ static int __init thp_shrinker_init(void)\n \t\t * that get_huge_zero_folio() will most likely not fail as\n \t\t * thp_shrinker_init() is invoked early on during boot.\n \t\t */\n-\t\tif (!get_huge_zero_folio())\n+\t\tif (!get_huge_zero_folio()) {\n \t\t\tpr_warn(\"Allocating persistent huge zero folio failed\\n\");\n+\t\t\treturn 0;\n+\t\t}\n+\n+\t\taddr = (unsigned long)folio_address(huge_zero_folio);\n+\t\t/*\n+\t\t * The folio was zeroed through the writable direct map. Flush\n+\t\t * after the page-table update to invalidate stale translations.\n+\t\t */\n+\t\tset_direct_map_ro_noflush((void *)addr, HPAGE_PMD_NR);\n+\t\tflush_tlb_kernel_range(addr, addr + HPAGE_PMD_SIZE);\n \t\treturn 0;\n \t}\n \n"
}

best-expensive

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` which is only called once during kernel boot in the `__init` function `thp_shrinker_init`. Since it is executed only during initialization and cannot be triggered from userspace, it is not suitable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit a7f7d5faf9f95202ba84f8af5cb6e74cdb9e69ec
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jul 28 05:53:18 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/arm64/include/asm/set_memory.h b/arch/arm64/include/asm/set_memory.h
index 90f61b17275e1b..7083260303c3cd 100644
--- a/arch/arm64/include/asm/set_memory.h
+++ b/arch/arm64/include/asm/set_memory.h
@@ -14,6 +14,8 @@ int set_memory_valid(unsigned long addr, int numpages, int enable);
 int set_direct_map_invalid_noflush(struct page *page);
 int set_direct_map_default_noflush(struct page *page);
 int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);
+#define set_direct_map_ro_noflush set_direct_map_ro_noflush
 bool kernel_page_present(struct page *page);
 
 int set_memory_encrypted(unsigned long addr, int numpages);
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index ce035e1b4eaf66..c51236b6165199 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -365,6 +365,16 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)
 	return set_memory_valid(addr, nr, valid);
 }
 
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)
+{
+	if (!can_set_direct_map())
+		return 0;
+
+	return update_range_prot((unsigned long)addr, PAGE_SIZE * nr_pages,
+				 __pgprot(PTE_RDONLY),
+				 __pgprot(PTE_WRITE));
+}
+
 #ifdef CONFIG_DEBUG_PAGEALLOC
 /*
  * This is - apart from the return value - doing the same
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index 4362c26aa992db..bd3817e06052c0 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -89,6 +89,8 @@ int set_pages_rw(struct page *page, int numpages);
 int set_direct_map_invalid_noflush(struct page *page);
 int set_direct_map_default_noflush(struct page *page);
 int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);
+#define set_direct_map_ro_noflush set_direct_map_ro_noflush
 bool kernel_page_present(struct page *page);
 
 extern int kernel_set_to_readonly;
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d023a40a1e0345..5987f4c84f6fe9 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -2662,6 +2662,21 @@ int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)
 	return __set_pages_np(page, nr);
 }
 
+int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)
+{
+	unsigned long tempaddr = (unsigned long)addr;
+	struct cpa_data cpa = {
+		.vaddr = &tempaddr,
+		.pgd = NULL,
+		.numpages = nr_pages,
+		.mask_set = __pgprot(0),
+		.mask_clr = __pgprot(_PAGE_RW | _PAGE_DIRTY),
+		.flags = CPA_NO_CHECK_ALIAS,
+	};
+
+	return __change_page_attr_set_clr(&cpa, 1);
+}
+
 #ifdef CONFIG_DEBUG_PAGEALLOC
 void __kernel_map_pages(struct page *page, int numpages, int enable)
 {
diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h
index 3030d9245f5ac8..e83ced6a382777 100644
--- a/include/linux/set_memory.h
+++ b/include/linux/set_memory.h
@@ -40,6 +40,24 @@ static inline int set_direct_map_valid_noflush(struct page *page,
 	return 0;
 }
 
+/**
+ * set_direct_map_ro_noflush - make a direct-map range read-only
+ * @addr: start address in the direct map
+ * @nr_pages: number of pages starting at @addr
+ *
+ * Make the direct-map range starting at @addr read-only without invalidating
+ * TLBs. Callers must either ensure that no stale writable translations can
+ * be used, or treat the permission change as a best-effort hardening step.
+ *
+ * Return: 0 on success or when direct-map permission changes are unsupported,
+ * or a negative errno on failure.
+ */
+static inline int set_direct_map_ro_noflush(const void *addr,
+					    unsigned long nr_pages)
+{
+	return 0;
+}
+
 static inline bool kernel_page_present(struct page *page)
 {
 	return true;
@@ -56,6 +74,17 @@ static inline bool can_set_direct_map(void)
 }
 #define can_set_direct_map can_set_direct_map
 #endif
+
+#ifndef set_direct_map_ro_noflush
+/* See the comment above the generic fallback for the _noflush contract. */
+static inline int set_direct_map_ro_noflush(const void *addr,
+					    unsigned long nr_pages)
+{
+	return 0;
+}
+
+#define set_direct_map_ro_noflush set_direct_map_ro_noflush
+#endif
 #endif /* CONFIG_ARCH_HAS_SET_DIRECT_MAP */
 
 #ifdef CONFIG_X86_64
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 970e077019b75a..4425ae5560cbd7 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -40,8 +40,10 @@
 #include <linux/pgalloc.h>
 #include <linux/pgalloc_tag.h>
 #include <linux/pagewalk.h>
+#include <linux/set_memory.h>
 
 #include <asm/tlb.h>
+#include <asm/tlbflush.h>
 #include "internal.h"
 #include "swap.h"
 
@@ -932,6 +934,8 @@ static int __init thp_shrinker_init(void)
 	shrinker_register(deferred_split_shrinker);
 
 	if (IS_ENABLED(CONFIG_PERSISTENT_HUGE_ZERO_FOLIO)) {
+		unsigned long addr;
+
 		/*
 		 * Bump the reference of the huge_zero_folio and do not
 		 * initialize the shrinker.
@@ -940,8 +944,18 @@ static int __init thp_shrinker_init(void)
 		 * that get_huge_zero_folio() will most likely not fail as
 		 * thp_shrinker_init() is invoked early on during boot.
 		 */
-		if (!get_huge_zero_folio())
+		if (!get_huge_zero_folio()) {
 			pr_warn("Allocating persistent huge zero folio failed\n");
+			return 0;
+		}
+
+		addr = (unsigned long)folio_address(huge_zero_folio);
+		/*
+		 * The folio was zeroed through the writable direct map. Flush
+		 * after the page-table update to invalidate stale translations.
+		 */
+		set_direct_map_ro_noflush((void *)addr, HPAGE_PMD_NR);
+		flush_tlb_kernel_range(addr, addr + HPAGE_PMD_SIZE);
 		return 0;
 	}
 

gemini-3.1-pro-preview

null

null

							input: 4121
							output: 24
							thoughts: 333
						

**Analyzing the Patch for Fuzzing Potential**

Okay, so we've got a new patch introducing `set_direct_map_ro_noflush` to `arch/arm64` and `arch/x86`, and it's being used within `mm/huge_memory.c`, specifically during `thp_shrinker_init` when `CONFIG_PERSISTENT_HUGE_ZERO_FOLIO` is enabled. My initial thought is, "is this worth a fuzzing pass?".

Let's break this down. First, `CONFIG_PERSISTENT_HUGE_ZERO_FOLIO` – right, that's defined in `mm/huge_memory.c`, and `thp_shrinker_init` is an `__init` function. The patch's core function is about making huge zero folios read-only within the direct map. Now, that raises a flag. __init functions are, by their nature, executed early in the boot process. Fuzzing usually doesn't hit those directly; it's focused on runtime behavior. The call to `set_direct_map_ro_noflush` in the patch is a single call in boot, based on this condition.

However, `set_direct_map_ro_noflush` itself is an API. Even though *this* patch uses it only within `thp_shrinker_init`, APIs can be called in other parts of the kernel. This is worth checking. I'll need to use `default_api:grepper` to search the codebase for additional callers of `set_direct_map_ro_noflush`. If it's *only* used here, fuzzing it directly is less relevant but any other uses would open it up as a possibility for fuzzing.

{
  "Expression": "set_direct_map_ro_noflush"
}

{
  "Output": "arch/arm64/include/asm/set_memory.h=16=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\narch/arm64/include/asm/set_memory.h:17:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\narch/arm64/include/asm/set_memory.h:18:#define set_direct_map_ro_noflush set_direct_map_ro_noflush\narch/arm64/include/asm/set_memory.h-19-bool kernel_page_present(struct page *page);\n--\narch/arm64/mm/pageattr.c=358=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n--\narch/arm64/mm/pageattr.c-367-\narch/arm64/mm/pageattr.c:368:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\narch/arm64/mm/pageattr.c-369-{\n--\narch/x86/include/asm/set_memory.h=91=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid);\narch/x86/include/asm/set_memory.h:92:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages);\narch/x86/include/asm/set_memory.h:93:#define set_direct_map_ro_noflush set_direct_map_ro_noflush\narch/x86/include/asm/set_memory.h-94-bool kernel_page_present(struct page *page);\n--\narch/x86/mm/pat/set_memory.c=2657=int set_direct_map_valid_noflush(struct page *page, unsigned nr, bool valid)\n--\narch/x86/mm/pat/set_memory.c-2664-\narch/x86/mm/pat/set_memory.c:2665:int set_direct_map_ro_noflush(const void *addr, unsigned long nr_pages)\narch/x86/mm/pat/set_memory.c-2666-{\n--\ninclude/linux/set_memory.h=37=static inline int set_direct_map_valid_noflush(struct page *page,\n--\ninclude/linux/set_memory.h-43-/**\ninclude/linux/set_memory.h:44: * set_direct_map_ro_noflush - make a direct-map range read-only\ninclude/linux/set_memory.h-45- * @addr: start address in the direct map\n--\ninclude/linux/set_memory.h-54- */\ninclude/linux/set_memory.h:55:static inline int set_direct_map_ro_noflush(const void *addr,\ninclude/linux/set_memory.h-56-\t\t\t\t\t    unsigned long nr_pages)\n--\ninclude/linux/set_memory.h=71=static inline bool can_set_direct_map(void)\n--\ninclude/linux/set_memory.h-77-\ninclude/linux/set_memory.h:78:#ifndef set_direct_map_ro_noflush\ninclude/linux/set_memory.h-79-/* See the comment above the generic fallback for the _noflush contract. */\ninclude/linux/set_memory.h:80:static inline int set_direct_map_ro_noflush(const void *addr,\ninclude/linux/set_memory.h-81-\t\t\t\t\t    unsigned long nr_pages)\n--\ninclude/linux/set_memory.h-85-\ninclude/linux/set_memory.h:86:#define set_direct_map_ro_noflush set_direct_map_ro_noflush\ninclude/linux/set_memory.h-87-#endif\n--\nmm/huge_memory.c=923=static int __init thp_shrinker_init(void)\n--\nmm/huge_memory.c-956-\t\t */\nmm/huge_memory.c:957:\t\tset_direct_map_ro_noflush((void *)addr, HPAGE_PMD_NR);\nmm/huge_memory.c-958-\t\tflush_tlb_kernel_range(addr, addr + HPAGE_PMD_SIZE);\n"
}

gemini-3.1-pro-preview

null

null

							input: 5977
							output: 96
							thoughts: 247
						

**Fuzzing Analysis: `set_direct_map_ro_noflush`**

Okay, let me think this through. The only call site for `set_direct_map_ro_noflush` is within `thp_shrinker_init`, and that's an `__init` function. That means it's only executed once, at boot time. So, right off the bat, I'm thinking, "No, this isn't fuzzable." Fuzzing targets user-space interactions, right? This is completely off the critical path, occurring before any of those interactions are established.

But wait, hold on. Is there some subtle side effect I'm missing? This patch *does* introduce `set_direct_map_ro_noflush`, which fundamentally alters page permissions, specifically at boot. What if a fuzzer *somehow* managed to write to a huge zero folio? This would likely cause a crash or fault. However, those folios are *supposed* to be read-only anyway; this just represents additional hardening, enforced within the direct map. Because it occurs *only* at boot time, there's no way a fuzzer could directly trigger or exercise the code, right?

Therefore, after reviewing all factors, it seems it is not suitable for fuzzing.
I will return `WorthFuzzing=false`.
My reasoning is the function `set_direct_map_ro_noflush` is called during the boot in the `__init` function `thp_shrinker_init`. Because the new function is executed only during the initialization phase, it cannot be targeted from userspace, so it is not suitable for fuzzing.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` which is only called once during kernel boot in the `__init` function `thp_shrinker_init`. Since it is executed only during initialization and cannot be triggered from userspace, it is not suitable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch introduces a new function `set_direct_map_ro_noflush` which is only called once during kernel boot in the `__init` function `thp_shrinker_init`. Since it is executed only during initialization and cannot be triggered from userspace, it is not suitable for fuzzing.",
  "WorthFuzzing": false
}