AI Trajectory

null

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the logic in `find_next_to_unuse` to skip empty swap clusters entirely, which is a functional change in the swapoff path. This code is reachable via the `sys_swapoff` system call.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit e210de873c59de9b96aff14d381d7171e39a465b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Aug 6 23:03:23 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/swap.h b/include/linux/swap.h\nindex 2cb1d29307c54..2b14e2e9673b4 100644\n--- a/include/linux/swap.h\n+++ b/include/linux/swap.h\n@@ -246,7 +246,7 @@ struct swap_info_struct {\n \tstruct plist_node list;\t\t/* entry in swap_active_head */\n \tsigned char\ttype;\t\t/* strange name for an index */\n \tunsigned int\tmax;\t\t/* size of this swap device */\n-\tstruct swap_cluster_info *cluster_info; /* cluster info. Only for SSD */\n+\tstruct swap_cluster_info *cluster_info; /* array, one entry per cluster */\n \tstruct list_head free_clusters; /* free clusters list */\n \tstruct list_head full_clusters; /* full clusters list */\n \tstruct list_head nonfull_clusters[SWAP_NR_ORDERS];\ndiff --git a/mm/swapfile.c b/mm/swapfile.c\nindex dea2d3b36e06f..0d24efd32eb03 100644\n--- a/mm/swapfile.c\n+++ b/mm/swapfile.c\n@@ -370,8 +370,6 @@ static void discard_swap_cluster(struct swap_info_struct *si,\n \t}\n }\n \n-#define LATENCY_LIMIT\t\t256\n-\n static inline bool cluster_is_empty(struct swap_cluster_info *info)\n {\n \treturn info-\u003ecount == 0;\n@@ -2763,7 +2761,9 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type)\n static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n \t\t\t\t\tunsigned int prev)\n {\n-\tunsigned int i;\n+\tstruct swap_cluster_info *ci;\n+\tunsigned long i, end;\n+\tunsigned int ci_off;\n \tunsigned long swp_tb;\n \n \t/*\n@@ -2772,19 +2772,36 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n \t * hits are okay, and sys_swapoff() has already prevented new\n \t * allocations from this area (while holding swap_lock).\n \t */\n-\tfor (i = prev + 1; i \u003c si-\u003emax; i++) {\n-\t\tswp_tb = swap_table_get(__swap_offset_to_cluster(si, i),\n-\t\t\t\t\ti % SWAPFILE_CLUSTER);\n-\t\tif (!swp_tb_is_null(swp_tb) \u0026\u0026 !swp_tb_is_bad(swp_tb))\n-\t\t\tbreak;\n-\t\tif ((i % LATENCY_LIMIT) == 0)\n+\ti = prev + 1;\n+\twhile (i \u003c si-\u003emax) {\n+\t\tci = __swap_offset_to_cluster(si, i);\n+\t\tend = min_t(unsigned long,\n+\t\t\t    ALIGN_DOWN(i, SWAPFILE_CLUSTER) + SWAPFILE_CLUSTER,\n+\t\t\t    si-\u003emax);\n+\n+\t\t/*\n+\t\t * An empty cluster has no slot in use, so skip it whole.\n+\t\t * A slot is uncounted only after its folio left the swap\n+\t\t * cache, so there is nothing here for try_to_unuse() to act on.\n+\t\t * Count only drops here, so a READ_ONCE() without ci-\u003elock is\n+\t\t * enough, unlike in every other cluster_is_empty() caller.\n+\t\t */\n+\t\tif (!READ_ONCE(ci-\u003ecount)) {\n+\t\t\ti = end;\n \t\t\tcond_resched();\n-\t}\n+\t\t\tcontinue;\n+\t\t}\n \n-\tif (i == si-\u003emax)\n-\t\ti = 0;\n+\t\tci_off = i % SWAPFILE_CLUSTER;\n+\t\tfor (; i \u003c end; ci_off++, i++) {\n+\t\t\tswp_tb = swap_table_get(ci, ci_off);\n+\t\t\tif (!swp_tb_is_null(swp_tb) \u0026\u0026 !swp_tb_is_bad(swp_tb))\n+\t\t\t\treturn i;\n+\t\t}\n+\t\tcond_resched();\n+\t}\n \n-\treturn i;\n+\treturn 0;\n }\n \n static int try_to_unuse(unsigned int type)\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the logic in `find_next_to_unuse` to skip empty swap clusters entirely, which is a functional change in the swapoff path. This code is reachable via the `sys_swapoff` system call.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e210de873c59de9b96aff14d381d7171e39a465b
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Aug 6 23:03:23 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/swap.h b/include/linux/swap.h
index 2cb1d29307c54..2b14e2e9673b4 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -246,7 +246,7 @@ struct swap_info_struct {
 	struct plist_node list;		/* entry in swap_active_head */
 	signed char	type;		/* strange name for an index */
 	unsigned int	max;		/* size of this swap device */
-	struct swap_cluster_info *cluster_info; /* cluster info. Only for SSD */
+	struct swap_cluster_info *cluster_info; /* array, one entry per cluster */
 	struct list_head free_clusters; /* free clusters list */
 	struct list_head full_clusters; /* full clusters list */
 	struct list_head nonfull_clusters[SWAP_NR_ORDERS];
diff --git a/mm/swapfile.c b/mm/swapfile.c
index dea2d3b36e06f..0d24efd32eb03 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -370,8 +370,6 @@ static void discard_swap_cluster(struct swap_info_struct *si,
 	}
 }
 
-#define LATENCY_LIMIT		256
-
 static inline bool cluster_is_empty(struct swap_cluster_info *info)
 {
 	return info->count == 0;
@@ -2763,7 +2761,9 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type)
 static unsigned int find_next_to_unuse(struct swap_info_struct *si,
 					unsigned int prev)
 {
-	unsigned int i;
+	struct swap_cluster_info *ci;
+	unsigned long i, end;
+	unsigned int ci_off;
 	unsigned long swp_tb;
 
 	/*
@@ -2772,19 +2772,36 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,
 	 * hits are okay, and sys_swapoff() has already prevented new
 	 * allocations from this area (while holding swap_lock).
 	 */
-	for (i = prev + 1; i < si->max; i++) {
-		swp_tb = swap_table_get(__swap_offset_to_cluster(si, i),
-					i % SWAPFILE_CLUSTER);
-		if (!swp_tb_is_null(swp_tb) && !swp_tb_is_bad(swp_tb))
-			break;
-		if ((i % LATENCY_LIMIT) == 0)
+	i = prev + 1;
+	while (i < si->max) {
+		ci = __swap_offset_to_cluster(si, i);
+		end = min_t(unsigned long,
+			    ALIGN_DOWN(i, SWAPFILE_CLUSTER) + SWAPFILE_CLUSTER,
+			    si->max);
+
+		/*
+		 * An empty cluster has no slot in use, so skip it whole.
+		 * A slot is uncounted only after its folio left the swap
+		 * cache, so there is nothing here for try_to_unuse() to act on.
+		 * Count only drops here, so a READ_ONCE() without ci->lock is
+		 * enough, unlike in every other cluster_is_empty() caller.
+		 */
+		if (!READ_ONCE(ci->count)) {
+			i = end;
 			cond_resched();
-	}
+			continue;
+		}
 
-	if (i == si->max)
-		i = 0;
+		ci_off = i % SWAPFILE_CLUSTER;
+		for (; i < end; ci_off++, i++) {
+			swp_tb = swap_table_get(ci, ci_off);
+			if (!swp_tb_is_null(swp_tb) && !swp_tb_is_bad(swp_tb))
+				return i;
+		}
+		cond_resched();
+	}
 
-	return i;
+	return 0;
 }
 
 static int try_to_unuse(unsigned int type)

gemini-3.1-pro-preview

null

null

							input: 2953
							output: 32
							thoughts: 212
						

**Analyzing the Swapfile Patch**

Okay, so I've got this patch – a pretty targeted modification to `find_next_to_unuse` within `mm/swapfile.c`. My initial scan tells me it's changing how the system locates the *next* swap entry to be marked as unused. The key is that it's optimizing the loop: now, it skips entire empty clusters based on a check against `ci->count`. This immediately flags it as a functional change; it's going to alter the behavior of swapfile operations, specifically `swapoff` or possibly when we `try_to_unuse` a swap entry.

First, I need to confirm reachability. Is this changed function even *used*? Okay, a quick check tells me `find_next_to_unuse` is called by `try_to_unuse`, which itself is called by `sys_swapoff`. Excellent. `sys_swapoff` is, of course, a system call. That means it’s definitely reachable and a target for fuzzing.

Now, let's nail down the specifics. I'm going to look for the exact symbol names and the configuration involved. `find_next_to_unuse` is declared static, as is `try_to_unuse`. And `sys_swapoff` is, as expected, a syscall.

Alright, time to get my hands dirty. I'll need to double-check that `try_to_unuse` is *actually* in `mm/swapfile.c`... let's take a look.

{
  "Expression": "try_to_unuse",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=1314=static void swap_range_free(struct swap_info_struct *si, unsigned long offset,\n--\nmm/swapfile.c-1336-\t/*\nmm/swapfile.c:1337:\t * Make sure that try_to_unuse() observes si-\u003einuse_pages reaching 0\nmm/swapfile.c-1338-\t * only after the above cleanups are done.\n--\nmm/swapfile.c=2471=static int unuse_pte(struct vm_area_struct *vma, pmd_t *pmd,\n--\nmm/swapfile.c-2482-\t * If the folio is removed from swap cache by others, continue to\nmm/swapfile.c:2483:\t * unuse other PTEs. try_to_unuse may try again if we missed this one.\nmm/swapfile.c-2484-\t */\n--\nmm/swapfile.c=2761=static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n--\nmm/swapfile.c-2784-\t\t * A slot is uncounted only after its folio left the swap\nmm/swapfile.c:2785:\t\t * cache, so there is nothing here for try_to_unuse() to act on.\nmm/swapfile.c-2786-\t\t * Count only drops here, so a READ_ONCE() without ci-\u003elock is\n--\nmm/swapfile.c-2806-\nmm/swapfile.c:2807:static int try_to_unuse(unsigned int type)\nmm/swapfile.c-2808-{\n--\nmm/swapfile.c-2901-\t/*\nmm/swapfile.c:2902:\t * Make sure that further cleanups after try_to_unuse() returns happen\nmm/swapfile.c-2903-\t * after swap_range_free() reduces si-\u003einuse_pages to 0.\n--\nmm/swapfile.c-2909-/*\nmm/swapfile.c:2910: * After a successful try_to_unuse, if no swap is now in use, we know\nmm/swapfile.c-2911- * we can empty the mmlist.  swap_lock must be held on entry and exit.\n--\nmm/swapfile.c=3153=SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)\n--\nmm/swapfile.c-3213-\tset_current_oom_origin();\nmm/swapfile.c:3214:\terr = try_to_unuse(p-\u003etype);\nmm/swapfile.c-3215-\tclear_current_oom_origin();\n"
}

gemini-3.1-pro-preview

null

null

							input: 4238
							output: 23
							thoughts: 23
						

Here's my take on those thoughts:

**Analyzing the Swap Deactivation System Call**

Okay, so I'm looking at `sys_swapoff`. Straight to the point – this is about deactivating swap space. Now, before I dive too deep into the kernel code, I need to check something fundamental. Is there even a conditional compile flag involved here? I'm thinking of `CONFIG_SWAP`. If that's not enabled, the whole thing might be a no-op, or at least significantly different in its implementation. Gotta verify that config setting is enabled, before I proceed.

{
  "Expression": "config SWAP",
  "PathPrefix": ""
}

{
  "Output": "arch/mips/Kconfig=1263=config MIPS_SPRAM\n--\narch/mips/Kconfig-1265-\narch/mips/Kconfig:1266:config SWAP_IO_SPACE\narch/mips/Kconfig-1267-\tbool\n--\narch/sh/Kconfig=126=config IO_TRAPPED\n--\narch/sh/Kconfig-128-\narch/sh/Kconfig:129:config SWAP_IO_SPACE\narch/sh/Kconfig-130-\tbool\n--\nmm/Kconfig=9=config ARCH_NO_SWAP\n--\nmm/Kconfig-11-\nmm/Kconfig:12:menuconfig SWAP\nmm/Kconfig-13-\tbool \"Support for paging of anonymous memory (swap)\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 4623
							output: 34
							thoughts: 938
						

**Analyzing the Swapoff Patch**

Okay, so I'm looking at this patch and, first things first, I've confirmed that `CONFIG_SWAP` is relevant here. The function of interest is definitely `sys_swapoff`. I've checked and double-checked that `sys_swapoff` is the primary entry point and that `try_to_unuse` is only called from within it. The patch modifies `find_next_to_unuse`, which is called by `try_to_unuse`, solidifying `sys_swapoff` as the core.

I've made sure `sys_swapoff` is the correct name by verifying that `SYSCALL_DEFINE1(swapoff, ...)` expands to `sys_swapoff` or `__x64_sys_swapoff` and that `sys_swapoff` is defined. This confirms that `sys_swapoff` is a legitimate syscall and thus a good focus.

I've also confirmed that `try_to_unuse` is static.

The patch itself is a functional change focused on optimizing `find_next_to_unuse` by skipping empty clusters. It appears to optimize searching for swap entries, which are relevant to the unmapping process.

Looking at the code, it looks like a good change. The code now iterates through clusters of swap entries. If a cluster is empty, it skips the entire cluster; that should save a good amount of time. I can see that skipping empty clusters is an optimization worth fuzzing, and it looks like it will optimize the `find_next_to_unuse` function.

I have:
*   `CONFIG_SWAP` as the configuration
*   `sys_swapoff` as the focus symbol.

I can confirm that Syzkaller handles syscalls using generic names, and that `sys_swapoff` is correctly defined.

{
  "Expression": "SYSCALL_DEFINE.*swapoff",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=3135=static void flush_percpu_swap_cluster(struct swap_info_struct *si)\n--\nmm/swapfile.c-3152-\nmm/swapfile.c:3153:SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)\nmm/swapfile.c-3154-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 6104
							output: 34
							thoughts: 161
						

**Analyzing the Linux Swapoff System Call**

Okay, so I'm looking at the `SYSCALL_DEFINE1(swapoff, ...)` macro. Right, that generates the `sys_swapoff` function (or potentially `__x64_sys_swapoff` on x86_64, depending on the architecture). That `sys_swapoff` is the key entry point here. I'll provide that as the focus symbol, that makes the most sense.

Now, I was initially considering `try_to_unuse`, but that's static. Hmm, providing a static function as the focus symbol is generally a bad idea. They can be inlined by the compiler, meaning no distinct symbol, or might not even be exported. Although, `try_to_unuse` is a pretty large function. Maybe it isn't inlined? Probably best to just stick with the canonical entry point, `sys_swapoff`. It's definitely the better choice.

Let's quickly check. Are there any other relevant entry points that would also be interesting to consider? Is `find_next_to_unuse` called from anywhere outside the function?

{
  "Expression": "find_next_to_unuse",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=2733=static int unuse_mm(struct mm_struct *mm, unsigned int type)\n--\nmm/swapfile.c-2760- */\nmm/swapfile.c:2761:static unsigned int find_next_to_unuse(struct swap_info_struct *si,\nmm/swapfile.c-2762-\t\t\t\t\tunsigned int prev)\n--\nmm/swapfile.c=2807=static int try_to_unuse(unsigned int type)\n--\nmm/swapfile.c-2860-\t       !signal_pending(current) \u0026\u0026\nmm/swapfile.c:2861:\t       (i = find_next_to_unuse(si, i)) != 0) {\nmm/swapfile.c-2862-\n"
}

gemini-3.1-pro-preview

null

null

							input: 6763
							output: 90
							thoughts: 110
						

**My Analysis of the Swapoff Path**

Okay, so the investigation points clearly. The change, the *only* change, that's interesting here stems directly from `try_to_unuse`. Thus, my focus must be sharply on the system call `sys_swapoff`. It's the sole entry point.

I need to flag this for fuzzing. Definitely `WorthFuzzing: true`. The rationale is that this patch fundamentally changes how `find_next_to_unuse` behaves; specifically, it skips empty swap clusters. This represents a functional alteration within the `swapoff` execution path. And, critically, the code affected *is* reachable via the `sys_swapoff` system call.

Therefore, `FocusSymbols` will be: `["sys_swapoff"]`.

Lastly, the fuzzing needs to be appropriately configured: `EnableConfigs: ["SWAP"]`.

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the logic in `find_next_to_unuse` to skip empty swap clusters entirely, which is a functional change in the swapoff path. This code is reachable via the `sys_swapoff` system call.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the logic in `find_next_to_unuse` to skip empty swap clusters entirely, which is a functional change in the swapoff path. This code is reachable via the `sys_swapoff` system call.",
  "WorthFuzzing": true
}