AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/07/06 04:29 flow patch-triage
0m Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch is a pure refactoring that moves the definition of `struct blk_plug` and related functions from `include/linux/blkdev.h` to a new header `include/linux/blk_plug.h`, and updates the `#include` directives in various files accordingly. It also adds a few missing includes to io_uring headers. There are no functional changes to the kernel logic.",
  "WorthFuzzing": false
}
1/1 2026/07/06 04:29 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit 963fb067282f6738d962f6a3707568bbb4a33b29\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jul 6 04:29:46 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/fs/aio.c b/fs/aio.c\nindex f57fa21a250353..ebdb0e5b95fd97 100644\n--- a/fs/aio.c\n+++ b/fs/aio.c\n@@ -35,7 +35,7 @@\n #include \u003clinux/workqueue.h\u003e\n #include \u003clinux/security.h\u003e\n #include \u003clinux/eventfd.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/compat.h\u003e\n #include \u003clinux/migrate.h\u003e\n #include \u003clinux/ramfs.h\u003e\ndiff --git a/fs/fs-writeback.c b/fs/fs-writeback.c\nindex fdb8766d275a17..d064072284f414 100644\n--- a/fs/fs-writeback.c\n+++ b/fs/fs-writeback.c\n@@ -25,7 +25,7 @@\n #include \u003clinux/pagemap.h\u003e\n #include \u003clinux/kthread.h\u003e\n #include \u003clinux/writeback.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/backing-dev.h\u003e\n #include \u003clinux/tracepoint.h\u003e\n #include \u003clinux/device.h\u003e\ndiff --git a/include/linux/blk_plug.h b/include/linux/blk_plug.h\nnew file mode 100644\nindex 00000000000000..2ac1265662ad4f\n--- /dev/null\n+++ b/include/linux/blk_plug.h\n@@ -0,0 +1,95 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+#ifndef _LINUX_BLK_PLUG_H\n+#define _LINUX_BLK_PLUG_H\n+\n+#include \u003clinux/sched.h\u003e\n+\n+struct blk_plug_cb;\n+typedef void (*blk_plug_cb_fn)(struct blk_plug_cb *cb, bool from_schedule);\n+\n+struct rq_list {\n+\tstruct request *head;\n+\tstruct request *tail;\n+};\n+\n+#ifdef CONFIG_BLOCK\n+/*\n+ * blk_plug permits building a queue of related requests by holding the I/O\n+ * fragments for a short period. This allows merging of sequential requests\n+ * into single larger request. As the requests are moved from a per-task list to\n+ * the device's request_queue in a batch, this results in improved scalability\n+ * as the lock contention for request_queue lock is reduced.\n+ *\n+ * It is ok not to disable preemption when adding the request to the plug list\n+ * or when attempting a merge. For details, please see schedule() where\n+ * blk_flush_plug() is called.\n+ */\n+struct blk_plug {\n+\tstruct rq_list mq_list; /* blk-mq requests */\n+\n+\t/* if ios_left is \u003e 1, we can batch tag/rq allocations */\n+\tstruct rq_list cached_rqs;\n+\tu64 cur_ktime;\n+\tunsigned short nr_ios;\n+\n+\tunsigned short rq_count;\n+\n+\tbool multiple_queues;\n+\tbool has_elevator;\n+\n+\tstruct list_head cb_list; /* md requires an unplug callback */\n+};\n+\n+void blk_start_plug(struct blk_plug *);\n+void blk_start_plug_nr_ios(struct blk_plug *, unsigned short);\n+void blk_finish_plug(struct blk_plug *);\n+\n+void __blk_flush_plug(struct blk_plug *plug, bool from_schedule);\n+static inline void blk_flush_plug(struct blk_plug *plug, bool async)\n+{\n+\tif (plug)\n+\t\t__blk_flush_plug(plug, async);\n+}\n+\n+static __always_inline void blk_plug_invalidate_ts(void)\n+{\n+\tif (unlikely(current-\u003eflags \u0026 PF_BLOCK_TS)) {\n+\t\tcurrent-\u003eplug-\u003ecur_ktime = 0;\n+\t\tcurrent-\u003eflags \u0026= ~PF_BLOCK_TS;\n+\t}\n+}\n+\n+struct blk_plug_cb {\n+\tstruct list_head list;\n+\tblk_plug_cb_fn callback;\n+\tvoid *data;\n+};\n+\n+struct blk_plug_cb *blk_check_plugged(blk_plug_cb_fn unplug, void *data,\n+\t\tint size);\n+#else /* CONFIG_BLOCK */\n+struct blk_plug {\n+};\n+\n+static inline void blk_start_plug(struct blk_plug *plug)\n+{\n+}\n+\n+static inline void blk_start_plug_nr_ios(struct blk_plug *plug,\n+\t\t\t\t\t unsigned short nr_ios)\n+{\n+}\n+\n+static inline void blk_finish_plug(struct blk_plug *plug)\n+{\n+}\n+\n+static inline void blk_flush_plug(struct blk_plug *plug, bool async)\n+{\n+}\n+\n+static inline void blk_plug_invalidate_ts(void)\n+{\n+}\n+#endif /* CONFIG_BLOCK */\n+#endif /* _LINUX_BLK_PLUG_H */\ndiff --git a/include/linux/blkdev.h b/include/linux/blkdev.h\nindex 9213a5716f95a7..20cb8ed7d987aa 100644\n--- a/include/linux/blkdev.h\n+++ b/include/linux/blkdev.h\n@@ -7,6 +7,7 @@\n \n #include \u003clinux/types.h\u003e\n #include \u003clinux/blk_types.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/device.h\u003e\n #include \u003clinux/list.h\u003e\n #include \u003clinux/llist.h\u003e\n@@ -21,7 +22,6 @@\n #include \u003clinux/rcupdate.h\u003e\n #include \u003clinux/percpu-refcount.h\u003e\n #include \u003clinux/blkzoned.h\u003e\n-#include \u003clinux/sched.h\u003e\n #include \u003clinux/sbitmap.h\u003e\n #include \u003clinux/uuid.h\u003e\n #include \u003clinux/xarray.h\u003e\n@@ -1169,94 +1169,10 @@ extern void blk_put_queue(struct request_queue *);\n \n void blk_mark_disk_dead(struct gendisk *disk);\n \n-struct rq_list {\n-\tstruct request *head;\n-\tstruct request *tail;\n-};\n-\n #ifdef CONFIG_BLOCK\n-/*\n- * blk_plug permits building a queue of related requests by holding the I/O\n- * fragments for a short period. This allows merging of sequential requests\n- * into single larger request. As the requests are moved from a per-task list to\n- * the device's request_queue in a batch, this results in improved scalability\n- * as the lock contention for request_queue lock is reduced.\n- *\n- * It is ok not to disable preemption when adding the request to the plug list\n- * or when attempting a merge. For details, please see schedule() where\n- * blk_flush_plug() is called.\n- */\n-struct blk_plug {\n-\tstruct rq_list mq_list; /* blk-mq requests */\n-\n-\t/* if ios_left is \u003e 1, we can batch tag/rq allocations */\n-\tstruct rq_list cached_rqs;\n-\tu64 cur_ktime;\n-\tunsigned short nr_ios;\n-\n-\tunsigned short rq_count;\n-\n-\tbool multiple_queues;\n-\tbool has_elevator;\n-\n-\tstruct list_head cb_list; /* md requires an unplug callback */\n-};\n-\n-struct blk_plug_cb;\n-typedef void (*blk_plug_cb_fn)(struct blk_plug_cb *, bool);\n-struct blk_plug_cb {\n-\tstruct list_head list;\n-\tblk_plug_cb_fn callback;\n-\tvoid *data;\n-};\n-extern struct blk_plug_cb *blk_check_plugged(blk_plug_cb_fn unplug,\n-\t\t\t\t\t     void *data, int size);\n-extern void blk_start_plug(struct blk_plug *);\n-extern void blk_start_plug_nr_ios(struct blk_plug *, unsigned short);\n-extern void blk_finish_plug(struct blk_plug *);\n-\n-void __blk_flush_plug(struct blk_plug *plug, bool from_schedule);\n-static inline void blk_flush_plug(struct blk_plug *plug, bool async)\n-{\n-\tif (plug)\n-\t\t__blk_flush_plug(plug, async);\n-}\n-\n-static __always_inline void blk_plug_invalidate_ts(void)\n-{\n-\tif (unlikely(current-\u003eflags \u0026 PF_BLOCK_TS)) {\n-\t\tcurrent-\u003eplug-\u003ecur_ktime = 0;\n-\t\tcurrent-\u003eflags \u0026= ~PF_BLOCK_TS;\n-\t}\n-}\n-\n int blkdev_issue_flush(struct block_device *bdev);\n long nr_blockdev_pages(void);\n #else /* CONFIG_BLOCK */\n-struct blk_plug {\n-};\n-\n-static inline void blk_start_plug_nr_ios(struct blk_plug *plug,\n-\t\t\t\t\t unsigned short nr_ios)\n-{\n-}\n-\n-static inline void blk_start_plug(struct blk_plug *plug)\n-{\n-}\n-\n-static inline void blk_finish_plug(struct blk_plug *plug)\n-{\n-}\n-\n-static inline void blk_flush_plug(struct blk_plug *plug, bool async)\n-{\n-}\n-\n-static inline void blk_plug_invalidate_ts(void)\n-{\n-}\n-\n static inline int blkdev_issue_flush(struct block_device *bdev)\n {\n \treturn 0;\ndiff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h\nindex a2c623a67a251c..f302bb3fcf8e95 100644\n--- a/include/linux/io_uring_types.h\n+++ b/include/linux/io_uring_types.h\n@@ -1,7 +1,7 @@\n #ifndef IO_URING_TYPES_H\n #define IO_URING_TYPES_H\n \n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/hashtable.h\u003e\n #include \u003clinux/task_work.h\u003e\n #include \u003clinux/bitmap.h\u003e\ndiff --git a/io_uring/io_uring.h b/io_uring/io_uring.h\nindex cb736b81542248..9771d4557ed391 100644\n--- a/io_uring/io_uring.h\n+++ b/io_uring/io_uring.h\n@@ -3,6 +3,7 @@\n #define IOU_CORE_H\n \n #include \u003clinux/errno.h\u003e\n+#include \u003clinux/file.h\u003e\n #include \u003clinux/lockdep.h\u003e\n #include \u003clinux/resume_user_mode.h\u003e\n #include \u003clinux/poll.h\u003e\ndiff --git a/io_uring/kbuf.c b/io_uring/kbuf.c\nindex 3cd29477fff2d3..e58bff9037f1ba 100644\n--- a/io_uring/kbuf.c\n+++ b/io_uring/kbuf.c\n@@ -7,6 +7,7 @@\n #include \u003clinux/slab.h\u003e\n #include \u003clinux/namei.h\u003e\n #include \u003clinux/poll.h\u003e\n+#include \u003clinux/uio.h\u003e\n #include \u003clinux/vmalloc.h\u003e\n #include \u003clinux/io_uring.h\u003e\n \ndiff --git a/io_uring/rsrc.h b/io_uring/rsrc.h\nindex 98ae8ef51009dc..eacfdb70f20313 100644\n--- a/io_uring/rsrc.h\n+++ b/io_uring/rsrc.h\n@@ -2,8 +2,10 @@\n #ifndef IOU_RSRC_H\n #define IOU_RSRC_H\n \n+#include \u003clinux/bvec.h\u003e\n #include \u003clinux/io_uring_types.h\u003e\n #include \u003clinux/lockdep.h\u003e\n+#include \u003clinux/uio.h\u003e\n \n #define IO_VEC_CACHE_SOFT_CAP\t\t256\n \ndiff --git a/io_uring/rw.h b/io_uring/rw.h\nindex 9bd7fbf70ea9b2..1179506f929f47 100644\n--- a/io_uring/rw.h\n+++ b/io_uring/rw.h\n@@ -2,6 +2,7 @@\n \n #include \u003clinux/io_uring_types.h\u003e\n #include \u003clinux/pagemap.h\u003e\n+#include \u003clinux/uio.h\u003e\n \n struct io_meta_state {\n \tu32\t\t\tseed;\ndiff --git a/kernel/exit.c b/kernel/exit.c\nindex 1056422bc1013e..2140d0515f9e4b 100644\n--- a/kernel/exit.c\n+++ b/kernel/exit.c\n@@ -48,7 +48,6 @@\n #include \u003clinux/audit.h\u003e /* for audit_free() */\n #include \u003clinux/resource.h\u003e\n #include \u003clinux/task_io_accounting_ops.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n #include \u003clinux/task_work.h\u003e\n #include \u003clinux/fs_struct.h\u003e\n #include \u003clinux/init_task.h\u003e\ndiff --git a/kernel/sched/core.c b/kernel/sched/core.c\nindex 96226707c2f613..616774777dea37 100644\n--- a/kernel/sched/core.c\n+++ b/kernel/sched/core.c\n@@ -40,7 +40,6 @@\n #include \u003clinux/sched/rseq_api.h\u003e\n #include \u003clinux/sched/rt.h\u003e\n \n-#include \u003clinux/blkdev.h\u003e\n #include \u003clinux/context_tracking.h\u003e\n #include \u003clinux/cpuset.h\u003e\n #include \u003clinux/delayacct.h\u003e\ndiff --git a/mm/madvise.c b/mm/madvise.c\nindex cd9bb077072ccb..f6b7ef0f8b1b3d 100644\n--- a/mm/madvise.c\n+++ b/mm/madvise.c\n@@ -25,7 +25,7 @@\n #include \u003clinux/ksm.h\u003e\n #include \u003clinux/fs.h\u003e\n #include \u003clinux/file.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/backing-dev.h\u003e\n #include \u003clinux/pagewalk.h\u003e\n #include \u003clinux/swap.h\u003e\ndiff --git a/mm/page-writeback.c b/mm/page-writeback.c\nindex e98748112d1ed1..d1fd6ba58ae500 100644\n--- a/mm/page-writeback.c\n+++ b/mm/page-writeback.c\n@@ -25,7 +25,6 @@\n #include \u003clinux/init.h\u003e\n #include \u003clinux/backing-dev.h\u003e\n #include \u003clinux/task_io_accounting_ops.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n #include \u003clinux/mpage.h\u003e\n #include \u003clinux/rmap.h\u003e\n #include \u003clinux/percpu.h\u003e\ndiff --git a/mm/readahead.c b/mm/readahead.c\nindex 558c92957518b7..6e5563290287ed 100644\n--- a/mm/readahead.c\n+++ b/mm/readahead.c\n@@ -113,7 +113,7 @@\n  * -\u003eread_folio() which may be less efficient.\n  */\n \n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/dax.h\u003e\n #include \u003clinux/gfp.h\u003e\ndiff --git a/mm/swap_state.c b/mm/swap_state.c\nindex 9c3a5cf9977860..727a17ee782111 100644\n--- a/mm/swap_state.c\n+++ b/mm/swap_state.c\n@@ -17,7 +17,7 @@\n #include \u003clinux/pagemap.h\u003e\n #include \u003clinux/folio_batch.h\u003e\n #include \u003clinux/backing-dev.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/migrate.h\u003e\n #include \u003clinux/vmalloc.h\u003e\n #include \u003clinux/huge_mm.h\u003e\ndiff --git a/mm/vmscan.c b/mm/vmscan.c\nindex 35c3bb15ae96a3..b957664abb26ee 100644\n--- a/mm/vmscan.c\n+++ b/mm/vmscan.c\n@@ -25,7 +25,7 @@\n #include \u003clinux/vmstat.h\u003e\n #include \u003clinux/file.h\u003e\n #include \u003clinux/writeback.h\u003e\n-#include \u003clinux/blkdev.h\u003e\n+#include \u003clinux/blk_plug.h\u003e\n #include \u003clinux/buffer_head.h\u003e\t/* for buffer_heads_over_limit */\n #include \u003clinux/mm_inline.h\u003e\n #include \u003clinux/backing-dev.h\u003e\n"
}
2/1 2026/07/06 04:29 agent patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch is a pure refactoring that moves the definition of `struct blk_plug` and related functions from `include/linux/blkdev.h` to a new header `include/linux/blk_plug.h`, and updates the `#include` directives in various files accordingly. It also adds a few missing includes to io_uring headers. There are no functional changes to the kernel logic.",
  "WorthFuzzing": false
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit 963fb067282f6738d962f6a3707568bbb4a33b29
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jul 6 04:29:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/fs/aio.c b/fs/aio.c
index f57fa21a250353..ebdb0e5b95fd97 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -35,7 +35,7 @@
 #include <linux/workqueue.h>
 #include <linux/security.h>
 #include <linux/eventfd.h>
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/compat.h>
 #include <linux/migrate.h>
 #include <linux/ramfs.h>
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index fdb8766d275a17..d064072284f414 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -25,7 +25,7 @@
 #include <linux/pagemap.h>
 #include <linux/kthread.h>
 #include <linux/writeback.h>
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/backing-dev.h>
 #include <linux/tracepoint.h>
 #include <linux/device.h>
diff --git a/include/linux/blk_plug.h b/include/linux/blk_plug.h
new file mode 100644
index 00000000000000..2ac1265662ad4f
--- /dev/null
+++ b/include/linux/blk_plug.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_BLK_PLUG_H
+#define _LINUX_BLK_PLUG_H
+
+#include <linux/sched.h>
+
+struct blk_plug_cb;
+typedef void (*blk_plug_cb_fn)(struct blk_plug_cb *cb, bool from_schedule);
+
+struct rq_list {
+	struct request *head;
+	struct request *tail;
+};
+
+#ifdef CONFIG_BLOCK
+/*
+ * blk_plug permits building a queue of related requests by holding the I/O
+ * fragments for a short period. This allows merging of sequential requests
+ * into single larger request. As the requests are moved from a per-task list to
+ * the device's request_queue in a batch, this results in improved scalability
+ * as the lock contention for request_queue lock is reduced.
+ *
+ * It is ok not to disable preemption when adding the request to the plug list
+ * or when attempting a merge. For details, please see schedule() where
+ * blk_flush_plug() is called.
+ */
+struct blk_plug {
+	struct rq_list mq_list; /* blk-mq requests */
+
+	/* if ios_left is > 1, we can batch tag/rq allocations */
+	struct rq_list cached_rqs;
+	u64 cur_ktime;
+	unsigned short nr_ios;
+
+	unsigned short rq_count;
+
+	bool multiple_queues;
+	bool has_elevator;
+
+	struct list_head cb_list; /* md requires an unplug callback */
+};
+
+void blk_start_plug(struct blk_plug *);
+void blk_start_plug_nr_ios(struct blk_plug *, unsigned short);
+void blk_finish_plug(struct blk_plug *);
+
+void __blk_flush_plug(struct blk_plug *plug, bool from_schedule);
+static inline void blk_flush_plug(struct blk_plug *plug, bool async)
+{
+	if (plug)
+		__blk_flush_plug(plug, async);
+}
+
+static __always_inline void blk_plug_invalidate_ts(void)
+{
+	if (unlikely(current->flags & PF_BLOCK_TS)) {
+		current->plug->cur_ktime = 0;
+		current->flags &= ~PF_BLOCK_TS;
+	}
+}
+
+struct blk_plug_cb {
+	struct list_head list;
+	blk_plug_cb_fn callback;
+	void *data;
+};
+
+struct blk_plug_cb *blk_check_plugged(blk_plug_cb_fn unplug, void *data,
+		int size);
+#else /* CONFIG_BLOCK */
+struct blk_plug {
+};
+
+static inline void blk_start_plug(struct blk_plug *plug)
+{
+}
+
+static inline void blk_start_plug_nr_ios(struct blk_plug *plug,
+					 unsigned short nr_ios)
+{
+}
+
+static inline void blk_finish_plug(struct blk_plug *plug)
+{
+}
+
+static inline void blk_flush_plug(struct blk_plug *plug, bool async)
+{
+}
+
+static inline void blk_plug_invalidate_ts(void)
+{
+}
+#endif /* CONFIG_BLOCK */
+#endif /* _LINUX_BLK_PLUG_H */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 9213a5716f95a7..20cb8ed7d987aa 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -7,6 +7,7 @@
 
 #include <linux/types.h>
 #include <linux/blk_types.h>
+#include <linux/blk_plug.h>
 #include <linux/device.h>
 #include <linux/list.h>
 #include <linux/llist.h>
@@ -21,7 +22,6 @@
 #include <linux/rcupdate.h>
 #include <linux/percpu-refcount.h>
 #include <linux/blkzoned.h>
-#include <linux/sched.h>
 #include <linux/sbitmap.h>
 #include <linux/uuid.h>
 #include <linux/xarray.h>
@@ -1169,94 +1169,10 @@ extern void blk_put_queue(struct request_queue *);
 
 void blk_mark_disk_dead(struct gendisk *disk);
 
-struct rq_list {
-	struct request *head;
-	struct request *tail;
-};
-
 #ifdef CONFIG_BLOCK
-/*
- * blk_plug permits building a queue of related requests by holding the I/O
- * fragments for a short period. This allows merging of sequential requests
- * into single larger request. As the requests are moved from a per-task list to
- * the device's request_queue in a batch, this results in improved scalability
- * as the lock contention for request_queue lock is reduced.
- *
- * It is ok not to disable preemption when adding the request to the plug list
- * or when attempting a merge. For details, please see schedule() where
- * blk_flush_plug() is called.
- */
-struct blk_plug {
-	struct rq_list mq_list; /* blk-mq requests */
-
-	/* if ios_left is > 1, we can batch tag/rq allocations */
-	struct rq_list cached_rqs;
-	u64 cur_ktime;
-	unsigned short nr_ios;
-
-	unsigned short rq_count;
-
-	bool multiple_queues;
-	bool has_elevator;
-
-	struct list_head cb_list; /* md requires an unplug callback */
-};
-
-struct blk_plug_cb;
-typedef void (*blk_plug_cb_fn)(struct blk_plug_cb *, bool);
-struct blk_plug_cb {
-	struct list_head list;
-	blk_plug_cb_fn callback;
-	void *data;
-};
-extern struct blk_plug_cb *blk_check_plugged(blk_plug_cb_fn unplug,
-					     void *data, int size);
-extern void blk_start_plug(struct blk_plug *);
-extern void blk_start_plug_nr_ios(struct blk_plug *, unsigned short);
-extern void blk_finish_plug(struct blk_plug *);
-
-void __blk_flush_plug(struct blk_plug *plug, bool from_schedule);
-static inline void blk_flush_plug(struct blk_plug *plug, bool async)
-{
-	if (plug)
-		__blk_flush_plug(plug, async);
-}
-
-static __always_inline void blk_plug_invalidate_ts(void)
-{
-	if (unlikely(current->flags & PF_BLOCK_TS)) {
-		current->plug->cur_ktime = 0;
-		current->flags &= ~PF_BLOCK_TS;
-	}
-}
-
 int blkdev_issue_flush(struct block_device *bdev);
 long nr_blockdev_pages(void);
 #else /* CONFIG_BLOCK */
-struct blk_plug {
-};
-
-static inline void blk_start_plug_nr_ios(struct blk_plug *plug,
-					 unsigned short nr_ios)
-{
-}
-
-static inline void blk_start_plug(struct blk_plug *plug)
-{
-}
-
-static inline void blk_finish_plug(struct blk_plug *plug)
-{
-}
-
-static inline void blk_flush_plug(struct blk_plug *plug, bool async)
-{
-}
-
-static inline void blk_plug_invalidate_ts(void)
-{
-}
-
 static inline int blkdev_issue_flush(struct block_device *bdev)
 {
 	return 0;
diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h
index a2c623a67a251c..f302bb3fcf8e95 100644
--- a/include/linux/io_uring_types.h
+++ b/include/linux/io_uring_types.h
@@ -1,7 +1,7 @@
 #ifndef IO_URING_TYPES_H
 #define IO_URING_TYPES_H
 
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/hashtable.h>
 #include <linux/task_work.h>
 #include <linux/bitmap.h>
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index cb736b81542248..9771d4557ed391 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -3,6 +3,7 @@
 #define IOU_CORE_H
 
 #include <linux/errno.h>
+#include <linux/file.h>
 #include <linux/lockdep.h>
 #include <linux/resume_user_mode.h>
 #include <linux/poll.h>
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 3cd29477fff2d3..e58bff9037f1ba 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -7,6 +7,7 @@
 #include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/poll.h>
+#include <linux/uio.h>
 #include <linux/vmalloc.h>
 #include <linux/io_uring.h>
 
diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h
index 98ae8ef51009dc..eacfdb70f20313 100644
--- a/io_uring/rsrc.h
+++ b/io_uring/rsrc.h
@@ -2,8 +2,10 @@
 #ifndef IOU_RSRC_H
 #define IOU_RSRC_H
 
+#include <linux/bvec.h>
 #include <linux/io_uring_types.h>
 #include <linux/lockdep.h>
+#include <linux/uio.h>
 
 #define IO_VEC_CACHE_SOFT_CAP		256
 
diff --git a/io_uring/rw.h b/io_uring/rw.h
index 9bd7fbf70ea9b2..1179506f929f47 100644
--- a/io_uring/rw.h
+++ b/io_uring/rw.h
@@ -2,6 +2,7 @@
 
 #include <linux/io_uring_types.h>
 #include <linux/pagemap.h>
+#include <linux/uio.h>
 
 struct io_meta_state {
 	u32			seed;
diff --git a/kernel/exit.c b/kernel/exit.c
index 1056422bc1013e..2140d0515f9e4b 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -48,7 +48,6 @@
 #include <linux/audit.h> /* for audit_free() */
 #include <linux/resource.h>
 #include <linux/task_io_accounting_ops.h>
-#include <linux/blkdev.h>
 #include <linux/task_work.h>
 #include <linux/fs_struct.h>
 #include <linux/init_task.h>
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 96226707c2f613..616774777dea37 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -40,7 +40,6 @@
 #include <linux/sched/rseq_api.h>
 #include <linux/sched/rt.h>
 
-#include <linux/blkdev.h>
 #include <linux/context_tracking.h>
 #include <linux/cpuset.h>
 #include <linux/delayacct.h>
diff --git a/mm/madvise.c b/mm/madvise.c
index cd9bb077072ccb..f6b7ef0f8b1b3d 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -25,7 +25,7 @@
 #include <linux/ksm.h>
 #include <linux/fs.h>
 #include <linux/file.h>
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/backing-dev.h>
 #include <linux/pagewalk.h>
 #include <linux/swap.h>
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index e98748112d1ed1..d1fd6ba58ae500 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -25,7 +25,6 @@
 #include <linux/init.h>
 #include <linux/backing-dev.h>
 #include <linux/task_io_accounting_ops.h>
-#include <linux/blkdev.h>
 #include <linux/mpage.h>
 #include <linux/rmap.h>
 #include <linux/percpu.h>
diff --git a/mm/readahead.c b/mm/readahead.c
index 558c92957518b7..6e5563290287ed 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -113,7 +113,7 @@
  * ->read_folio() which may be less efficient.
  */
 
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/kernel.h>
 #include <linux/dax.h>
 #include <linux/gfp.h>
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 9c3a5cf9977860..727a17ee782111 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -17,7 +17,7 @@
 #include <linux/pagemap.h>
 #include <linux/folio_batch.h>
 #include <linux/backing-dev.h>
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/migrate.h>
 #include <linux/vmalloc.h>
 #include <linux/huge_mm.h>
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 35c3bb15ae96a3..b957664abb26ee 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -25,7 +25,7 @@
 #include <linux/vmstat.h>
 #include <linux/file.h>
 #include <linux/writeback.h>
-#include <linux/blkdev.h>
+#include <linux/blk_plug.h>
 #include <linux/buffer_head.h>	/* for buffer_heads_over_limit */
 #include <linux/mm_inline.h>
 #include <linux/backing-dev.h>

3/2 2026/07/06 04:29 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 6212
							output: 114
							thoughts: 738

Thoughts: 
**Refactoring Patch Assessment**

Okay, let's break this down. I've got a patch here that's essentially performing a header cleanup and refactoring related to `blk_plug`. The core of it involves moving `struct blk_plug` and associated functions out of `include/linux/blkdev.h` and into a new header, `include/linux/blk_plug.h`. Then it updates a bunch of files to reflect this change – replacing the old include with the new one, or adding missing includes where necessary in the `io_uring` subsystem. My immediate question is, does this introduce any *functional* changes?

Looking at the diff, it's pretty clear: no. We're creating the new header file, `blk_plug.h`, and populating it with the definitions for `struct blk_plug_cb`, `struct rq_list`, `struct blk_plug`, and the associated inline functions like `blk_start_plug` and `blk_finish_plug`. These were *already* present, just in the wrong header file, `blkdev.h`. The existing `blkdev.h` is updated to include the new header. The remaining changes are simply fixing up includes to point to the correct header. This is, in effect, a header file reorganization and nothing else.

I'm double-checking the diff to be absolutely certain. The new `blk_plug.h` file clearly shows the relocated definitions. The changes to other files are merely include adjustments. There's no modification of code logic, data structures beyond moving them, or any alteration of functionality.

Therefore, because this is purely a refactoring, there's no reason to believe this patch would introduce any fuzzer-relevant behavior. I'm going to set `WorthFuzzing` to `false` and move on.

4/2 2026/07/06 04:29 tool set-results
0m Args: 
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch is a pure refactoring that moves the definition of `struct blk_plug` and related functions from `include/linux/blkdev.h` to a new header `include/linux/blk_plug.h`, and updates the `#include` directives in various files accordingly. It also adds a few missing includes to io_uring headers. There are no functional changes to the kernel logic.",
  "WorthFuzzing": false
}

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch is a pure refactoring that moves the definition of `struct blk_plug` and related functions from `include/linux/blkdev.h` to a new header `include/linux/blk_plug.h`, and updates the `#include` directives in various files accordingly. It also adds a few missing includes to io_uring headers. There are no functional changes to the kernel logic.",
  "WorthFuzzing": false
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)