AI Trajectory

null

{
  "EnableConfigs": [
    "LRU_GEN"
  ],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies page reclaim heuristics to activate file-backed executable folios after first usage. It affects both standard LRU and Multi-Gen LRU (MGLRU) paths. The modified functions are core memory management reclaim paths (e.g., folio_referenced, shrink_active_list), which are hot-path functions, so no specific focus symbols are provided.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 8ff528308e867a884128dc73a495e8a41487cbf3\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 16 20:53:06 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h\nindex b5c4dc0f3fe326..30fdf105631213 100644\n--- a/include/linux/mm_inline.h\n+++ b/include/linux/mm_inline.h\n@@ -30,6 +30,12 @@ static inline int folio_is_file_lru(const struct folio *folio)\n \treturn !folio_test_swapbacked(folio);\n }\n \n+static inline bool folio_is_exec_file(const struct folio *folio,\n+\t\tconst vma_flags_t *vma_flags)\n+{\n+\treturn vma_flags_test(vma_flags, VMA_EXEC_BIT) \u0026\u0026 folio_is_file_lru(folio);\n+}\n+\n static __always_inline void __update_lru_size(struct lruvec *lruvec,\n \t\t\t\tenum lru_list lru, enum zone_type zid,\n \t\t\t\tlong nr_pages)\ndiff --git a/include/linux/rmap.h b/include/linux/rmap.h\nindex 8dc0871e5f0011..e090aa09825d52 100644\n--- a/include/linux/rmap.h\n+++ b/include/linux/rmap.h\n@@ -843,7 +843,7 @@ static inline int folio_try_share_anon_rmap_pmd(struct folio *folio,\n  * Called from mm/vmscan.c to handle paging out\n  */\n int folio_referenced(struct folio *, int is_locked,\n-\t\t\tstruct mem_cgroup *memcg, vm_flags_t *vm_flags);\n+\t\tstruct mem_cgroup *memcg, vma_flags_t *vma_flags);\n \n void try_to_migrate(struct folio *folio, enum ttu_flags flags);\n void try_to_unmap(struct folio *, enum ttu_flags flags);\n@@ -975,10 +975,9 @@ struct anon_vma *folio_lock_anon_vma_read(const struct folio *folio,\n #define anon_vma_prepare(vma)\t(0)\n \n static inline int folio_referenced(struct folio *folio, int is_locked,\n-\t\t\t\t  struct mem_cgroup *memcg,\n-\t\t\t\t  vm_flags_t *vm_flags)\n+\t\tstruct mem_cgroup *memcg, vma_flags_t *vma_flags)\n {\n-\t*vm_flags = 0;\n+\tvma_flags_clear_all(vma_flags);\n \treturn 0;\n }\n \ndiff --git a/mm/rmap.c b/mm/rmap.c\nindex e854679553b9c3..4085540b6a25f4 100644\n--- a/mm/rmap.c\n+++ b/mm/rmap.c\n@@ -907,7 +907,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)\n struct folio_referenced_arg {\n \tint mapcount;\n \tint referenced;\n-\tvm_flags_t vm_flags;\n+\tvma_flags_t vma_flags;\n \tstruct mem_cgroup *memcg;\n };\n \n@@ -926,7 +926,7 @@ static bool folio_referenced_one(struct folio *folio,\n \t\taddress = pvmw.address;\n \t\tnr = 1;\n \n-\t\tif (vma-\u003evm_flags \u0026 VM_LOCKED) {\n+\t\tif (vma_test(vma, VMA_LOCKED_BIT)) {\n \t\t\tptes++;\n \t\t\tpra-\u003emapcount--;\n \n@@ -947,7 +947,7 @@ static bool folio_referenced_one(struct folio *folio,\n \t\t\t/* Restore the mlock which got missed */\n \t\t\tmlock_vma_folio(folio, vma);\n \t\t\tpage_vma_mapped_walk_done(\u0026pvmw);\n-\t\t\tpra-\u003evm_flags |= VM_LOCKED;\n+\t\t\tvma_flags_set(\u0026pra-\u003evma_flags, VMA_LOCKED_BIT);\n \t\t\treturn false; /* To break the loop */\n \t\t}\n \n@@ -1015,8 +1015,11 @@ static bool folio_referenced_one(struct folio *folio,\n \t\treferenced++;\n \n \tif (referenced) {\n+\t\tvma_flags_t vma_flags = vma-\u003eflags;\n+\n \t\tpra-\u003ereferenced++;\n-\t\tpra-\u003evm_flags |= vma-\u003evm_flags \u0026 ~VM_LOCKED;\n+\t\tvma_flags_clear(\u0026vma_flags, VMA_LOCKED_BIT);\n+\t\tvma_flags_set_mask(\u0026pra-\u003evma_flags, vma_flags);\n \t}\n \n \tif (!pra-\u003emapcount)\n@@ -1054,7 +1057,7 @@ static bool invalid_folio_referenced_vma(struct vm_area_struct *vma, void *arg)\n  * @folio: The folio to test.\n  * @is_locked: Caller holds lock on the folio.\n  * @memcg: target memory cgroup\n- * @vm_flags: A combination of all the vma-\u003evm_flags which referenced the folio.\n+ * @vma_flags: A combination of all the vma-\u003eflags which referenced the folio.\n  *\n  * Quick test_and_clear_referenced for all mappings of a folio,\n  *\n@@ -1062,7 +1065,7 @@ static bool invalid_folio_referenced_vma(struct vm_area_struct *vma, void *arg)\n  * the function bailed out due to rmap lock contention.\n  */\n int folio_referenced(struct folio *folio, int is_locked,\n-\t\t     struct mem_cgroup *memcg, vm_flags_t *vm_flags)\n+\t\tstruct mem_cgroup *memcg, vma_flags_t *vma_flags)\n {\n \tbool we_locked = false;\n \tstruct folio_referenced_arg pra = {\n@@ -1078,7 +1081,7 @@ int folio_referenced(struct folio *folio, int is_locked,\n \t};\n \n \tVM_WARN_ON_ONCE_FOLIO(folio_is_zone_device(folio), folio);\n-\t*vm_flags = 0;\n+\tvma_flags_clear_all(vma_flags);\n \tif (!pra.mapcount)\n \t\treturn 0;\n \n@@ -1092,7 +1095,7 @@ int folio_referenced(struct folio *folio, int is_locked,\n \t}\n \n \trmap_walk(folio, \u0026rwc);\n-\t*vm_flags = pra.vm_flags;\n+\tvma_flags_set_mask(vma_flags, pra.vma_flags);\n \n \tif (we_locked)\n \t\tfolio_unlock(folio);\ndiff --git a/mm/vmscan.c b/mm/vmscan.c\nindex 986dde8e7429f3..fa808721b64d19 100644\n--- a/mm/vmscan.c\n+++ b/mm/vmscan.c\n@@ -835,11 +835,15 @@ enum folio_references {\n  * with PG_active set. In contrast, the aging (page table walk) path uses\n  * folio_update_gen().\n  */\n-static bool lru_gen_set_refs(struct folio *folio)\n+static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)\n {\n \t/* see the comment on LRU_REFS_FLAGS */\n \tif (!folio_test_referenced(folio) \u0026\u0026 !folio_test_workingset(folio)) {\n \t\tset_mask_bits(\u0026folio-\u003eflags.f, LRU_REFS_MASK, BIT(PG_referenced));\n+\t\t/* Activate file-backed executable folios after first usage. */\n+\t\tif (folio_is_exec_file(folio, vma_flags))\n+\t\t\treturn true;\n+\n \t\treturn false;\n \t}\n \n@@ -851,7 +855,7 @@ static bool lru_gen_set_refs(struct folio *folio)\n \treturn true;\n }\n #else\n-static bool lru_gen_set_refs(struct folio *folio)\n+static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)\n {\n \treturn false;\n }\n@@ -861,16 +865,16 @@ static enum folio_references folio_check_references(struct folio *folio,\n \t\t\t\t\t\t  struct scan_control *sc)\n {\n \tint referenced_ptes, referenced_folio;\n-\tvm_flags_t vm_flags;\n+\tvma_flags_t vma_flags;\n \n \treferenced_ptes = folio_referenced(folio, 1, sc-\u003etarget_mem_cgroup,\n-\t\t\t\t\t   \u0026vm_flags);\n+\t\t\t\t\t   \u0026vma_flags);\n \n \t/*\n \t * The supposedly reclaimable folio was found to be in a VM_LOCKED vma.\n \t * Let the folio, now marked Mlocked, be moved to the unevictable list.\n \t */\n-\tif (vm_flags \u0026 VM_LOCKED)\n+\tif (vma_flags_test(\u0026vma_flags, VMA_LOCKED_BIT))\n \t\treturn FOLIOREF_ACTIVATE;\n \n \t/*\n@@ -886,7 +890,7 @@ static enum folio_references folio_check_references(struct folio *folio,\n \t\tif (!referenced_ptes)\n \t\t\treturn FOLIOREF_RECLAIM;\n \n-\t\treturn lru_gen_set_refs(folio) ? FOLIOREF_ACTIVATE : FOLIOREF_KEEP;\n+\t\treturn lru_gen_set_refs(folio, \u0026vma_flags) ? FOLIOREF_ACTIVATE : FOLIOREF_KEEP;\n \t}\n \n \treferenced_folio = folio_test_clear_referenced(folio);\n@@ -914,7 +918,7 @@ static enum folio_references folio_check_references(struct folio *folio,\n \t\t/*\n \t\t * Activate file-backed executable folios after first usage.\n \t\t */\n-\t\tif ((vm_flags \u0026 VM_EXEC) \u0026\u0026 folio_is_file_lru(folio))\n+\t\tif (folio_is_exec_file(folio, \u0026vma_flags))\n \t\t\treturn FOLIOREF_ACTIVATE;\n \n \t\treturn FOLIOREF_KEEP;\n@@ -2065,7 +2069,7 @@ static void shrink_active_list(unsigned long nr_to_scan,\n {\n \tunsigned long nr_taken;\n \tunsigned long nr_scanned;\n-\tvm_flags_t vm_flags;\n+\tvma_flags_t vma_flags;\n \tLIST_HEAD(l_hold);\t/* The folios which were snipped off */\n \tLIST_HEAD(l_active);\n \tLIST_HEAD(l_inactive);\n@@ -2109,7 +2113,7 @@ static void shrink_active_list(unsigned long nr_to_scan,\n \n \t\t/* Referenced or rmap lock contention: rotate */\n \t\tif (folio_referenced(folio, 0, sc-\u003etarget_mem_cgroup,\n-\t\t\t\t     \u0026vm_flags) != 0) {\n+\t\t\t\t     \u0026vma_flags) != 0) {\n \t\t\t/*\n \t\t\t * Identify referenced, file-backed active folios and\n \t\t\t * give them one more trip around the active list. So\n@@ -2119,7 +2123,7 @@ static void shrink_active_list(unsigned long nr_to_scan,\n \t\t\t * IO, plus JVM can create lots of anon VM_EXEC folios,\n \t\t\t * so we ignore them here.\n \t\t\t */\n-\t\t\tif ((vm_flags \u0026 VM_EXEC) \u0026\u0026 folio_is_file_lru(folio)) {\n+\t\t\tif (folio_is_exec_file(folio, \u0026vma_flags)) {\n \t\t\t\tnr_rotated += folio_nr_pages(folio);\n \t\t\t\tlist_add(\u0026folio-\u003elru, \u0026l_active);\n \t\t\t\tcontinue;\n@@ -3188,7 +3192,7 @@ static bool positive_ctrl_err(struct ctrl_pos *sp, struct ctrl_pos *pv)\n  ******************************************************************************/\n \n /* promote pages accessed through page tables */\n-static int folio_update_gen(struct folio *folio, int gen)\n+static int folio_update_gen(struct folio *folio, int gen, const vma_flags_t *vma_flags)\n {\n \tunsigned long new_flags, old_flags = READ_ONCE(folio-\u003eflags.f);\n \n@@ -3196,10 +3200,15 @@ static int folio_update_gen(struct folio *folio, int gen)\n \n \t/* see the comment on LRU_REFS_FLAGS */\n \tif (!folio_test_referenced(folio) \u0026\u0026 !folio_test_workingset(folio)) {\n+\t\t/* Activate file-backed executable folios after first usage. */\n+\t\tif (folio_is_exec_file(folio, vma_flags))\n+\t\t\tgoto promote;\n+\n \t\tset_mask_bits(\u0026folio-\u003eflags.f, LRU_REFS_MASK, BIT(PG_referenced));\n \t\treturn -1;\n \t}\n \n+promote:\n \tdo {\n \t\t/* lru_gen_del_folio() has isolated this page? */\n \t\tif (!(old_flags \u0026 LRU_GEN_MASK))\n@@ -3428,8 +3437,8 @@ static bool suitable_to_scan(int total, int young)\n \treturn young * n \u003e= total;\n }\n \n-static void walk_update_folio(struct lru_gen_mm_walk *walk, struct folio *folio,\n-\t\t\t      int new_gen, bool dirty)\n+static void walk_update_folio(struct lru_gen_mm_walk *walk, struct vm_area_struct *vma,\n+\t\tstruct folio *folio, int new_gen, bool dirty)\n {\n \tint old_gen;\n \n@@ -3442,10 +3451,10 @@ static void walk_update_folio(struct lru_gen_mm_walk *walk, struct folio *folio,\n \t\tfolio_mark_dirty(folio);\n \n \tif (walk) {\n-\t\told_gen = folio_update_gen(folio, new_gen);\n+\t\told_gen = folio_update_gen(folio, new_gen, \u0026vma-\u003eflags);\n \t\tif (old_gen \u003e= 0 \u0026\u0026 old_gen != new_gen)\n \t\t\tupdate_batch_size(walk, folio, old_gen, new_gen);\n-\t} else if (lru_gen_set_refs(folio)) {\n+\t} else if (lru_gen_set_refs(folio, \u0026vma-\u003eflags)) {\n \t\told_gen = folio_lru_gen(folio);\n \t\tif (old_gen \u003e= 0 \u0026\u0026 old_gen != new_gen)\n \t\t\tfolio_activate(folio);\n@@ -3518,7 +3527,7 @@ static bool walk_pte_range(pmd_t *pmd, unsigned long start, unsigned long end,\n \t\t\tcontinue;\n \n \t\tif (last != folio) {\n-\t\t\twalk_update_folio(walk, last, gen, dirty);\n+\t\t\twalk_update_folio(walk, args-\u003evma, last, gen, dirty);\n \n \t\t\tlast = folio;\n \t\t\tdirty = false;\n@@ -3531,7 +3540,7 @@ static bool walk_pte_range(pmd_t *pmd, unsigned long start, unsigned long end,\n \t\twalk-\u003emm_stats[MM_LEAF_YOUNG] += nr;\n \t}\n \n-\twalk_update_folio(walk, last, gen, dirty);\n+\twalk_update_folio(walk, args-\u003evma, last, gen, dirty);\n \tlast = NULL;\n \n \tif (i \u003c PTRS_PER_PTE \u0026\u0026 get_next_vma(PMD_MASK, PAGE_SIZE, args, \u0026start, \u0026end))\n@@ -3609,7 +3618,7 @@ static void walk_pmd_range_locked(pud_t *pud, unsigned long addr, struct vm_area\n \t\t\tgoto next;\n \n \t\tif (last != folio) {\n-\t\t\twalk_update_folio(walk, last, gen, dirty);\n+\t\t\twalk_update_folio(walk, vma, last, gen, dirty);\n \n \t\t\tlast = folio;\n \t\t\tdirty = false;\n@@ -3623,7 +3632,7 @@ static void walk_pmd_range_locked(pud_t *pud, unsigned long addr, struct vm_area\n \t\ti = i \u003e MIN_LRU_BATCH ? 0 : find_next_bit(bitmap, MIN_LRU_BATCH, i) + 1;\n \t} while (i \u003c= MIN_LRU_BATCH);\n \n-\twalk_update_folio(walk, last, gen, dirty);\n+\twalk_update_folio(walk, vma, last, gen, dirty);\n \n \tlazy_mmu_mode_disable();\n \tspin_unlock(ptl);\n@@ -4258,7 +4267,7 @@ bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw, unsigned int nr)\n \t\t\tcontinue;\n \n \t\tif (last != folio) {\n-\t\t\twalk_update_folio(walk, last, gen, dirty);\n+\t\t\twalk_update_folio(walk, vma, last, gen, dirty);\n \n \t\t\tlast = folio;\n \t\t\tdirty = false;\n@@ -4270,7 +4279,7 @@ bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw, unsigned int nr)\n \t\tyoung += nr;\n \t}\n \n-\twalk_update_folio(walk, last, gen, dirty);\n+\twalk_update_folio(walk, vma, last, gen, dirty);\n \n \tlazy_mmu_mode_disable();\n \n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "LRU_GEN"
  ],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies page reclaim heuristics to activate file-backed executable folios after first usage. It affects both standard LRU and Multi-Gen LRU (MGLRU) paths. The modified functions are core memory management reclaim paths (e.g., folio_referenced, shrink_active_list), which are hot-path functions, so no specific focus symbols are provided.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 8ff528308e867a884128dc73a495e8a41487cbf3
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 16 20:53:06 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index b5c4dc0f3fe326..30fdf105631213 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -30,6 +30,12 @@ static inline int folio_is_file_lru(const struct folio *folio)
 	return !folio_test_swapbacked(folio);
 }
 
+static inline bool folio_is_exec_file(const struct folio *folio,
+		const vma_flags_t *vma_flags)
+{
+	return vma_flags_test(vma_flags, VMA_EXEC_BIT) && folio_is_file_lru(folio);
+}
+
 static __always_inline void __update_lru_size(struct lruvec *lruvec,
 				enum lru_list lru, enum zone_type zid,
 				long nr_pages)
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 8dc0871e5f0011..e090aa09825d52 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -843,7 +843,7 @@ static inline int folio_try_share_anon_rmap_pmd(struct folio *folio,
  * Called from mm/vmscan.c to handle paging out
  */
 int folio_referenced(struct folio *, int is_locked,
-			struct mem_cgroup *memcg, vm_flags_t *vm_flags);
+		struct mem_cgroup *memcg, vma_flags_t *vma_flags);
 
 void try_to_migrate(struct folio *folio, enum ttu_flags flags);
 void try_to_unmap(struct folio *, enum ttu_flags flags);
@@ -975,10 +975,9 @@ struct anon_vma *folio_lock_anon_vma_read(const struct folio *folio,
 #define anon_vma_prepare(vma)	(0)
 
 static inline int folio_referenced(struct folio *folio, int is_locked,
-				  struct mem_cgroup *memcg,
-				  vm_flags_t *vm_flags)
+		struct mem_cgroup *memcg, vma_flags_t *vma_flags)
 {
-	*vm_flags = 0;
+	vma_flags_clear_all(vma_flags);
 	return 0;
 }
 
diff --git a/mm/rmap.c b/mm/rmap.c
index e854679553b9c3..4085540b6a25f4 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -907,7 +907,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
 struct folio_referenced_arg {
 	int mapcount;
 	int referenced;
-	vm_flags_t vm_flags;
+	vma_flags_t vma_flags;
 	struct mem_cgroup *memcg;
 };
 
@@ -926,7 +926,7 @@ static bool folio_referenced_one(struct folio *folio,
 		address = pvmw.address;
 		nr = 1;
 
-		if (vma->vm_flags & VM_LOCKED) {
+		if (vma_test(vma, VMA_LOCKED_BIT)) {
 			ptes++;
 			pra->mapcount--;
 
@@ -947,7 +947,7 @@ static bool folio_referenced_one(struct folio *folio,
 			/* Restore the mlock which got missed */
 			mlock_vma_folio(folio, vma);
 			page_vma_mapped_walk_done(&pvmw);
-			pra->vm_flags |= VM_LOCKED;
+			vma_flags_set(&pra->vma_flags, VMA_LOCKED_BIT);
 			return false; /* To break the loop */
 		}
 
@@ -1015,8 +1015,11 @@ static bool folio_referenced_one(struct folio *folio,
 		referenced++;
 
 	if (referenced) {
+		vma_flags_t vma_flags = vma->flags;
+
 		pra->referenced++;
-		pra->vm_flags |= vma->vm_flags & ~VM_LOCKED;
+		vma_flags_clear(&vma_flags, VMA_LOCKED_BIT);
+		vma_flags_set_mask(&pra->vma_flags, vma_flags);
 	}
 
 	if (!pra->mapcount)
@@ -1054,7 +1057,7 @@ static bool invalid_folio_referenced_vma(struct vm_area_struct *vma, void *arg)
  * @folio: The folio to test.
  * @is_locked: Caller holds lock on the folio.
  * @memcg: target memory cgroup
- * @vm_flags: A combination of all the vma->vm_flags which referenced the folio.
+ * @vma_flags: A combination of all the vma->flags which referenced the folio.
  *
  * Quick test_and_clear_referenced for all mappings of a folio,
  *
@@ -1062,7 +1065,7 @@ static bool invalid_folio_referenced_vma(struct vm_area_struct *vma, void *arg)
  * the function bailed out due to rmap lock contention.
  */
 int folio_referenced(struct folio *folio, int is_locked,
-		     struct mem_cgroup *memcg, vm_flags_t *vm_flags)
+		struct mem_cgroup *memcg, vma_flags_t *vma_flags)
 {
 	bool we_locked = false;
 	struct folio_referenced_arg pra = {
@@ -1078,7 +1081,7 @@ int folio_referenced(struct folio *folio, int is_locked,
 	};
 
 	VM_WARN_ON_ONCE_FOLIO(folio_is_zone_device(folio), folio);
-	*vm_flags = 0;
+	vma_flags_clear_all(vma_flags);
 	if (!pra.mapcount)
 		return 0;
 
@@ -1092,7 +1095,7 @@ int folio_referenced(struct folio *folio, int is_locked,
 	}
 
 	rmap_walk(folio, &rwc);
-	*vm_flags = pra.vm_flags;
+	vma_flags_set_mask(vma_flags, pra.vma_flags);
 
 	if (we_locked)
 		folio_unlock(folio);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 986dde8e7429f3..fa808721b64d19 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -835,11 +835,15 @@ enum folio_references {
  * with PG_active set. In contrast, the aging (page table walk) path uses
  * folio_update_gen().
  */
-static bool lru_gen_set_refs(struct folio *folio)
+static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)
 {
 	/* see the comment on LRU_REFS_FLAGS */
 	if (!folio_test_referenced(folio) && !folio_test_workingset(folio)) {
 		set_mask_bits(&folio->flags.f, LRU_REFS_MASK, BIT(PG_referenced));
+		/* Activate file-backed executable folios after first usage. */
+		if (folio_is_exec_file(folio, vma_flags))
+			return true;
+
 		return false;
 	}
 
@@ -851,7 +855,7 @@ static bool lru_gen_set_refs(struct folio *folio)
 	return true;
 }
 #else
-static bool lru_gen_set_refs(struct folio *folio)
+static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)
 {
 	return false;
 }
@@ -861,16 +865,16 @@ static enum folio_references folio_check_references(struct folio *folio,
 						  struct scan_control *sc)
 {
 	int referenced_ptes, referenced_folio;
-	vm_flags_t vm_flags;
+	vma_flags_t vma_flags;
 
 	referenced_ptes = folio_referenced(folio, 1, sc->target_mem_cgroup,
-					   &vm_flags);
+					   &vma_flags);
 
 	/*
 	 * The supposedly reclaimable folio was found to be in a VM_LOCKED vma.
 	 * Let the folio, now marked Mlocked, be moved to the unevictable list.
 	 */
-	if (vm_flags & VM_LOCKED)
+	if (vma_flags_test(&vma_flags, VMA_LOCKED_BIT))
 		return FOLIOREF_ACTIVATE;
 
 	/*
@@ -886,7 +890,7 @@ static enum folio_references folio_check_references(struct folio *folio,
 		if (!referenced_ptes)
 			return FOLIOREF_RECLAIM;
 
-		return lru_gen_set_refs(folio) ? FOLIOREF_ACTIVATE : FOLIOREF_KEEP;
+		return lru_gen_set_refs(folio, &vma_flags) ? FOLIOREF_ACTIVATE : FOLIOREF_KEEP;
 	}
 
 	referenced_folio = folio_test_clear_referenced(folio);
@@ -914,7 +918,7 @@ static enum folio_references folio_check_references(struct folio *folio,
 		/*
 		 * Activate file-backed executable folios after first usage.
 		 */
-		if ((vm_flags & VM_EXEC) && folio_is_file_lru(folio))
+		if (folio_is_exec_file(folio, &vma_flags))
 			return FOLIOREF_ACTIVATE;
 
 		return FOLIOREF_KEEP;
@@ -2065,7 +2069,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
 {
 	unsigned long nr_taken;
 	unsigned long nr_scanned;
-	vm_flags_t vm_flags;
+	vma_flags_t vma_flags;
 	LIST_HEAD(l_hold);	/* The folios which were snipped off */
 	LIST_HEAD(l_active);
 	LIST_HEAD(l_inactive);
@@ -2109,7 +2113,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
 
 		/* Referenced or rmap lock contention: rotate */
 		if (folio_referenced(folio, 0, sc->target_mem_cgroup,
-				     &vm_flags) != 0) {
+				     &vma_flags) != 0) {
 			/*
 			 * Identify referenced, file-backed active folios and
 			 * give them one more trip around the active list. So
@@ -2119,7 +2123,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
 			 * IO, plus JVM can create lots of anon VM_EXEC folios,
 			 * so we ignore them here.
 			 */
-			if ((vm_flags & VM_EXEC) && folio_is_file_lru(folio)) {
+			if (folio_is_exec_file(folio, &vma_flags)) {
 				nr_rotated += folio_nr_pages(folio);
 				list_add(&folio->lru, &l_active);
 				continue;
@@ -3188,7 +3192,7 @@ static bool positive_ctrl_err(struct ctrl_pos *sp, struct ctrl_pos *pv)
  ******************************************************************************/
 
 /* promote pages accessed through page tables */
-static int folio_update_gen(struct folio *folio, int gen)
+static int folio_update_gen(struct folio *folio, int gen, const vma_flags_t *vma_flags)
 {
 	unsigned long new_flags, old_flags = READ_ONCE(folio->flags.f);
 
@@ -3196,10 +3200,15 @@ static int folio_update_gen(struct folio *folio, int gen)
 
 	/* see the comment on LRU_REFS_FLAGS */
 	if (!folio_test_referenced(folio) && !folio_test_workingset(folio)) {
+		/* Activate file-backed executable folios after first usage. */
+		if (folio_is_exec_file(folio, vma_flags))
+			goto promote;
+
 		set_mask_bits(&folio->flags.f, LRU_REFS_MASK, BIT(PG_referenced));
 		return -1;
 	}
 
+promote:
 	do {
 		/* lru_gen_del_folio() has isolated this page? */
 		if (!(old_flags & LRU_GEN_MASK))
@@ -3428,8 +3437,8 @@ static bool suitable_to_scan(int total, int young)
 	return young * n >= total;
 }
 
-static void walk_update_folio(struct lru_gen_mm_walk *walk, struct folio *folio,
-			      int new_gen, bool dirty)
+static void walk_update_folio(struct lru_gen_mm_walk *walk, struct vm_area_struct *vma,
+		struct folio *folio, int new_gen, bool dirty)
 {
 	int old_gen;
 
@@ -3442,10 +3451,10 @@ static void walk_update_folio(struct lru_gen_mm_walk *walk, struct folio *folio,
 		folio_mark_dirty(folio);
 
 	if (walk) {
-		old_gen = folio_update_gen(folio, new_gen);
+		old_gen = folio_update_gen(folio, new_gen, &vma->flags);
 		if (old_gen >= 0 && old_gen != new_gen)
 			update_batch_size(walk, folio, old_gen, new_gen);
-	} else if (lru_gen_set_refs(folio)) {
+	} else if (lru_gen_set_refs(folio, &vma->flags)) {
 		old_gen = folio_lru_gen(folio);
 		if (old_gen >= 0 && old_gen != new_gen)
 			folio_activate(folio);
@@ -3518,7 +3527,7 @@ static bool walk_pte_range(pmd_t *pmd, unsigned long start, unsigned long end,
 			continue;
 
 		if (last != folio) {
-			walk_update_folio(walk, last, gen, dirty);
+			walk_update_folio(walk, args->vma, last, gen, dirty);
 
 			last = folio;
 			dirty = false;
@@ -3531,7 +3540,7 @@ static bool walk_pte_range(pmd_t *pmd, unsigned long start, unsigned long end,
 		walk->mm_stats[MM_LEAF_YOUNG] += nr;
 	}
 
-	walk_update_folio(walk, last, gen, dirty);
+	walk_update_folio(walk, args->vma, last, gen, dirty);
 	last = NULL;
 
 	if (i < PTRS_PER_PTE && get_next_vma(PMD_MASK, PAGE_SIZE, args, &start, &end))
@@ -3609,7 +3618,7 @@ static void walk_pmd_range_locked(pud_t *pud, unsigned long addr, struct vm_area
 			goto next;
 
 		if (last != folio) {
-			walk_update_folio(walk, last, gen, dirty);
+			walk_update_folio(walk, vma, last, gen, dirty);
 
 			last = folio;
 			dirty = false;
@@ -3623,7 +3632,7 @@ static void walk_pmd_range_locked(pud_t *pud, unsigned long addr, struct vm_area
 		i = i > MIN_LRU_BATCH ? 0 : find_next_bit(bitmap, MIN_LRU_BATCH, i) + 1;
 	} while (i <= MIN_LRU_BATCH);
 
-	walk_update_folio(walk, last, gen, dirty);
+	walk_update_folio(walk, vma, last, gen, dirty);
 
 	lazy_mmu_mode_disable();
 	spin_unlock(ptl);
@@ -4258,7 +4267,7 @@ bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw, unsigned int nr)
 			continue;
 
 		if (last != folio) {
-			walk_update_folio(walk, last, gen, dirty);
+			walk_update_folio(walk, vma, last, gen, dirty);
 
 			last = folio;
 			dirty = false;
@@ -4270,7 +4279,7 @@ bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw, unsigned int nr)
 		young += nr;
 	}
 
-	walk_update_folio(walk, last, gen, dirty);
+	walk_update_folio(walk, vma, last, gen, dirty);
 
 	lazy_mmu_mode_disable();
 

gemini-3.1-pro-preview

null

null

							input: 6198
							output: 31
							thoughts: 842
						

**Analyzing a Patch: Page Reclaim and Executable Files**

Okay, so I'm looking at this patch and it's modifying how the kernel handles VMA flags in relation to folio referencing and related functions. Specifically, it's replacing `vm_flags_t` with `vma_flags_t`, which, hold on, seems to be a different type, maybe a struct? Aha, I see in `include/linux/mm_inline.h`, `vma_flags_t` is used within `folio_is_exec_file`. That clears it up. So, the patch is changing `vm_flags_t *vm_flags` to `vma_flags_t *vma_flags` in `folio_referenced`.

The key here is that `lru_gen_set_refs` is being updated to take `vma_flags`, which wasn't the case previously. Now, this function will activate file-backed executable folios *after* their first usage. That's a definite functional change to how page reclaim, specifically both MGLRU and the standard LRU, operates. This is interesting. It's modifying core MM code – things like `mm/vmscan.c` and `mm/rmap.c` – so this could have significant implications. And, yeah, page reclaim is definitely a reachable and functional part of the system.

This has me thinking. Given this change to core MM logic, fuzzing is *absolutely* in order. I need to figure out which functions are most critical for focused fuzzing.

Let's see, it looks like these are the modified functions: `folio_referenced`, `folio_check_references`, `shrink_active_list`, `folio_update_gen`, `walk_update_folio`, `walk_pte_range`, `walk_pmd_range_locked`, and `lru_gen_look_around`.

Now, wait a minute, `folio_referenced`, `shrink_active_list`, and `folio_check_references` are *very* hot-path functions in memory reclaim. And `lru_gen_look_around` is related to MGLRU. The goal here is to identify targets that are NOT the hot path. Let me think about this... specific syscalls or operations that might trigger this logic? Memory pressure, page reclaim, swap, `madvise`...

Okay, the prompt is telling me to find something beyond the obvious. It says, "Avoid listing generic hot-path functions to prevent skewed test distributions." Right, the goal is to pinpoint something more specific. `shrink_active_list`, `folio_referenced`, `folio_check_references` are definitely hot. What about `lru_gen_look_around`? Maybe that's an option?

Hmm, it's a core MM change. Isolating a single non-hot-path function is challenging here. Maybe that inline function, `folio_is_exec_file`? Let's check `mm/vmscan.c` for calls to `folio_check_references`. I'll use `grepper` to find calls to `folio_check_references` now.

{
  "Expression": "folio_check_references",
  "PathPrefix": "mm/vmscan.c"
}

{
  "Output": "mm/vmscan.c=858=static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)\n--\nmm/vmscan.c-863-\nmm/vmscan.c:864:static enum folio_references folio_check_references(struct folio *folio,\nmm/vmscan.c-865-\t\t\t\t\t\t  struct scan_control *sc)\n--\nmm/vmscan.c=1055=static unsigned int shrink_folio_list(struct list_head *folio_list,\n--\nmm/vmscan.c-1228-\t\tif (!ignore_references)\nmm/vmscan.c:1229:\t\t\treferences = folio_check_references(folio, sc);\nmm/vmscan.c-1230-\n"
}

gemini-3.1-pro-preview

null

null

							input: 7962
							output: 29
							thoughts: 110
						

**Analyzing the MGLRU Implementation**

Okay, so I'm looking at how this Multi-Gen LRU (MGLRU) stuff is wired up. From what I'm seeing, `folio_check_references` is called from `shrink_folio_list`, which is a key part of the shrinking process. And I need to remember that `shrink_active_list` is also being modified here. Then, I see `walk_update_folio` being called from multiple places: `walk_pte_range`, `walk_pmd_range_locked`, and `lru_gen_look_around`. That connects those functions to both MGLRU and the standard LRU. This all seems to be part of the core MGLRU implementation or at least interacts heavily with it.

Now, a critical question for optimization and tuning this is: Is MGLRU enabled by default? I need to know if this is something that I'm dealing with out-of-the-box or if I have to explicitly configure it. I'm going to jump into the Kconfig files, specifically the memory management section, to quickly determine the default setting for MGLRU. That will tell me where to go next.

{
  "Expression": "config LRU_GEN",
  "PathPrefix": "mm/Kconfig"
}

{
  "Output": "mm/Kconfig=1405=endif # USERFAULTFD\n--\nmm/Kconfig-1407-# multi-gen LRU {\nmm/Kconfig:1408:config LRU_GEN\nmm/Kconfig-1409-\tbool \"Multi-Gen LRU\"\n--\nmm/Kconfig-1416-\nmm/Kconfig:1417:config LRU_GEN_ENABLED\nmm/Kconfig-1418-\tbool \"Enable by default\"\n--\nmm/Kconfig-1422-\nmm/Kconfig:1423:config LRU_GEN_STATS\nmm/Kconfig-1424-\tbool \"Full stats for debugging\"\n--\nmm/Kconfig-1431-\nmm/Kconfig:1432:config LRU_GEN_WALKS_MMU\nmm/Kconfig-1433-\tdef_bool y\n"
}

gemini-3.1-pro-preview

null

null

							input: 8592
							output: 34
							thoughts: 133
						

**Analyzing the LRU Generation Configuration**

Okay, so it looks like `LRU_GEN` and `LRU_GEN_ENABLED` are the configurations I need to pay attention to. The immediate question is whether this modified code depends on `LRU_GEN` specifically. Let's trace it out. The patch is touching `lru_gen_set_refs`, `folio_update_gen`, `walk_update_folio`, `walk_pte_range`, `walk_pmd_range_locked`, and `lru_gen_look_around`. Given those function names, they're almost certainly guarded by an `#ifdef CONFIG_LRU_GEN` somewhere. My next step will be to verify that assumption. I'll need to dig into `mm/vmscan.c` and specifically examine the code around the `lru_gen_set_refs` function call to confirm and understand the conditional compilation.

{
  "Expression": "lru_gen_set_refs",
  "PathPrefix": "mm/vmscan.c"
}

{
  "Output": "mm/vmscan.c=825=enum folio_references {\n--\nmm/vmscan.c-837- */\nmm/vmscan.c:838:static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)\nmm/vmscan.c-839-{\n--\nmm/vmscan.c-857-#else\nmm/vmscan.c:858:static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)\nmm/vmscan.c-859-{\n--\nmm/vmscan.c=864=static enum folio_references folio_check_references(struct folio *folio,\n--\nmm/vmscan.c-892-\nmm/vmscan.c:893:\t\treturn lru_gen_set_refs(folio, \u0026vma_flags) ? FOLIOREF_ACTIVATE : FOLIOREF_KEEP;\nmm/vmscan.c-894-\t}\n--\nmm/vmscan.c=3440=static void walk_update_folio(struct lru_gen_mm_walk *walk, struct vm_area_struct *vma,\n--\nmm/vmscan.c-3456-\t\t\tupdate_batch_size(walk, folio, old_gen, new_gen);\nmm/vmscan.c:3457:\t} else if (lru_gen_set_refs(folio, \u0026vma-\u003eflags)) {\nmm/vmscan.c-3458-\t\told_gen = folio_lru_gen(folio);\n"
}

gemini-3.1-pro-preview

null

null

							input: 9367
							output: 34
							thoughts: 21
						

Okay, here's my interpretation of that thought process, tailored for an expert audience:

**Investigating Conditional Compilation of `lru_gen_set_refs`**

Right, let's dive in. The immediate goal is clear: I need to quickly determine the conditional compilation environment that impacts the `lru_gen_set_refs` function. Specifically, I need to know what `#ifdef` or `#if` preprocessor directives control whether or not this function is included in the build. Knowing this will be crucial for understanding its availability in different build configurations, and for debugging if I encounter unexpected behavior or its absence in certain scenarios. Understanding the conditional compilation context is paramount to understanding the overall design.

{
  "Expression": "#ifdef CONFIG_LRU_GEN",
  "PathPrefix": "mm/vmscan.c"
}

{
  "Output": "mm/vmscan.c=825=enum folio_references {\n--\nmm/vmscan.c-830-\nmm/vmscan.c:831:#ifdef CONFIG_LRU_GEN\nmm/vmscan.c-832-/*\n--\nmm/vmscan.c=2610=static bool can_age_anon_pages(struct lruvec *lruvec,\n--\nmm/vmscan.c-2621-\nmm/vmscan.c:2622:#ifdef CONFIG_LRU_GEN\nmm/vmscan.c-2623-\nmm/vmscan.c=2624=DEFINE_STATIC_KEY_FALSE(lru_switch);\nmm/vmscan.c:2625:#ifdef CONFIG_LRU_GEN_ENABLED\nmm/vmscan.c-2626-DEFINE_STATIC_KEY_ARRAY_TRUE(lru_gen_caps, NR_LRU_GEN_CAPS);\n--\nmm/vmscan.c=2806=static void reset_bloom_filter(struct lru_gen_mm_state *mm_state, unsigned long seq)\n--\nmm/vmscan.c-2825-\nmm/vmscan.c:2826:#ifdef CONFIG_LRU_GEN_WALKS_MMU\nmm/vmscan.c-2827-\n"
}

gemini-3.1-pro-preview

null

null

							input: 9909
							output: 31
							thoughts: 79
						

Okay, let's break this down.

**Analyzing the Patch's Scope**

Right, so I'm looking at this patch and immediately, `CONFIG_LRU_GEN` jumps out at me as a key point. It seems pretty central to what's being altered. But then, it's also touching `folio_check_references` and `shrink_active_list`. Hang on... those aren't part of `CONFIG_LRU_GEN`, those are standard LRU functions. That feels... unexpected. I need to confirm this. I'm going to double check the code right now. Are those functions really outside the scope of `CONFIG_LRU_GEN`? I need to verify what the patch is *really* doing.

{
  "Expression": "folio_check_references",
  "PathPrefix": "mm/vmscan.c"
}

{
  "Output": "mm/vmscan.c=858=static bool lru_gen_set_refs(struct folio *folio, const vma_flags_t *vma_flags)\n--\nmm/vmscan.c-863-\nmm/vmscan.c:864:static enum folio_references folio_check_references(struct folio *folio,\nmm/vmscan.c-865-\t\t\t\t\t\t  struct scan_control *sc)\n--\nmm/vmscan.c=1055=static unsigned int shrink_folio_list(struct list_head *folio_list,\n--\nmm/vmscan.c-1228-\t\tif (!ignore_references)\nmm/vmscan.c:1229:\t\t\treferences = folio_check_references(folio, sc);\nmm/vmscan.c-1230-\n"
}

gemini-3.1-pro-preview

null

null

							input: 10390
							output: 28
							thoughts: 404
						

**Fuzzing Focus for This Memory Management Patch**

Okay, so this patch is touching the core memory management code, specifically the LRU functionality, both the standard implementation and MGLRU. The key modification seems to be in `folio_referenced` within `mm/rmap.c`, a function used by both LRU implementations. My initial thought is to identify specific functions for targeted fuzzing, but the prompt advises avoiding generic hot-path functions.

Now, which ones are worth specific attention? `folio_check_references` is the standard LRU function, but it's *also* a hot-path function.  I need to be careful not to create a skewed test distribution. The other functions that are modified are also all hot-path functions, `shrink_active_list`, `folio_update_gen`, `walk_update_folio`, `walk_pte_range`, `walk_pmd_range_locked`, and `lru_gen_look_around`.

Considering the advice, I need to choose carefully. `folio_referenced` is called during page reclaim. It's definitely active but perhaps not *as* intensely hot as something like `page_add_rmap`. Still, hot enough to be considered a hot path. And `folio_is_exec_file` is inline, so fuzzing it directly won't be possible.

That leaves `lru_gen_look_around`. This one is called during a page fault, specifically within `do_set_pte` or similar. Since it has specific context, it's a good candidate to consider, but first, I'll check its call sites to be sure it's the right choice.

{
  "Expression": "lru_gen_look_around",
  "PathPrefix": ""
}

{
  "Output": "Documentation/mm/multigen_lru.rst=187=can incur the highest CPU cost in the reclaim path.\nDocumentation/mm/multigen_lru.rst-188-\nDocumentation/mm/multigen_lru.rst:189:``lru_gen_look_around()`` exploits spatial locality to reduce the\nDocumentation/mm/multigen_lru.rst-190-trips into the rmap. It scans the adjacent PTEs of a young PTE and\n--\nDocumentation/mm/multigen_lru.rst=199=in the set.\nDocumentation/mm/multigen_lru.rst-200-\nDocumentation/mm/multigen_lru.rst:201:In the eviction path, specifically, in ``lru_gen_look_around()``, if a\nDocumentation/mm/multigen_lru.rst-202-PMD has a sufficient number of hot pages, its address is placed in the\n--\ninclude/linux/mmzone.h=689=void lru_gen_init_lruvec(struct lruvec *lruvec);\ninclude/linux/mmzone.h:690:bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw, unsigned int nr);\ninclude/linux/mmzone.h-691-\n--\ninclude/linux/mmzone.h=708=static inline void lru_gen_init_lruvec(struct lruvec *lruvec)\n--\ninclude/linux/mmzone.h-711-\ninclude/linux/mmzone.h:712:static inline bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw,\ninclude/linux/mmzone.h-713-\t\tunsigned int nr)\n--\nmm/rmap.c=917=static bool folio_referenced_one(struct folio *folio,\n--\nmm/rmap.c-981-\t\tif (lru_gen_enabled() \u0026\u0026 !lru_gen_switching() \u0026\u0026 pvmw.pte) {\nmm/rmap.c:982:\t\t\tif (lru_gen_look_around(\u0026pvmw, nr))\nmm/rmap.c-983-\t\t\t\treferenced++;\n--\nmm/vmscan.c=2714=static bool __maybe_unused seq_is_valid(struct lruvec *lruvec)\n--\nmm/vmscan.c-2743- * walk_pmd_range(); the eviction also report them when walking the rmap\nmm/vmscan.c:2744: * in lru_gen_look_around().\nmm/vmscan.c-2745- *\n--\nmm/vmscan.c=3996=static bool try_to_inc_max_seq(struct lruvec *lruvec, unsigned long seq,\n--\nmm/vmscan.c-4015-\t * If the hardware doesn't automatically set the accessed bit, fallback\nmm/vmscan.c:4016:\t * to lru_gen_look_around(), which only clears the accessed bit in a\nmm/vmscan.c-4017-\t * handful of PTEs. Spreading the work out over a period of time usually\n--\nmm/vmscan.c=4135=static void lru_gen_age_node(struct pglist_data *pgdat, struct scan_control *sc)\n--\nmm/vmscan.c-4181- */\nmm/vmscan.c:4182:bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw, unsigned int nr)\nmm/vmscan.c-4183-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 12086
							output: 113
							thoughts: 955
						

**Fuzzing Strategy for Memory Management Change**

Okay, so I'm looking at this patch and my initial thought is that it touches core MM code, specifically reclaim and the LRU. `lru_gen_look_around` is called from `folio_referenced_one`, which tells me this is definitely in the reclaim path. Given the scope, this is *definitely* worth fuzzing.

My first impulse is to list the modified functions: `folio_referenced`, `folio_check_references`, `shrink_active_list`, `lru_gen_look_around`, `walk_pte_range`, and `walk_pmd_range_locked`. Let's see about specific configs.

Ah, `LRU_GEN` is the key config for Multi-Gen LRU. It seems it is enabled by default in some configs, but I should definitely specify it. However, since the patch *also* modifies standard LRU, it isn't strictly necessary. But, to ensure comprehensive MGLRU testing, I'll add it.

Now, wait a minute, `folio_is_exec_file` is the interesting part. It's used to activate file-backed executable folios after first usage. That's a *functional* change in how the kernel handles these types of mappings.

Let's trace `folio_is_exec_file`. It's used in `lru_gen_set_refs`, `folio_check_references`, `shrink_active_list`, and `folio_update_gen`. This confirms it's a significant change to memory management behavior.

Therefore, `WorthFuzzing` should be set to `true`.

Regarding `FocusSymbols`, I initially thought to include those modified functions. However, the prompt says to avoid generic hot-path functions. `folio_referenced`, `shrink_active_list`, and `lru_gen_look_around` are all *very* hot during reclaim, essentially making them hot-path. If I include them, I'm just telling the fuzzer to focus on what it is already doing. Should I exclude them and list something else? No, `folio_check_references` and `lru_gen_look_around` are also hot-path functions.

"Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Should avoid hot-path functions." Because these functions are key MM reclaim paths, and by their nature, hot when memory is under pressure, I will leave `FocusSymbols` empty.

Actually, `folio_referenced` is called by `shrink_folio_list`, which is called by `shrink_lruvec`, which confirms my initial assessment.

As for `EnableConfigs`, `LRU_GEN` is the only specific config I need. I'll double-check this later to be sure. The code changes are in `mm/rmap.c` and `mm/vmscan.c`, and `LRU_GEN` is the only related config.

Okay, back to `folio_is_exec_file`. I see that it checks `VMA_EXEC_BIT`. This is standard functionality relating to executable mappings via `mmap` with `PROT_EXEC`. That is something for sure.

So, let's review: This is a functional change that activates file-backed executable folios *after* first usage, and it's a significant change to page reclaim heuristics. Definitely worth fuzzing!

My final settings will be:

*   `WorthFuzzing = true`
*   `EnableConfigs = ["LRU_GEN"]`
*   `FocusSymbols = []`
*   `Reasoning = "The patch modifies page reclaim heuristics to activate file-backed executable folios after first usage. It affects both standard LRU and Multi-Gen LRU (MGLRU) paths. The modified functions are core memory management reclaim paths (e.g., folio_referenced, shrink_active_list), which are hot-path functions, so no specific focus symbols are provided."`

{
  "EnableConfigs": [
    "LRU_GEN"
  ],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies page reclaim heuristics to activate file-backed executable folios after first usage. It affects both standard LRU and Multi-Gen LRU (MGLRU) paths. The modified functions are core memory management reclaim paths (e.g., folio_referenced, shrink_active_list), which are hot-path functions, so no specific focus symbols are provided.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "LRU_GEN"
  ],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies page reclaim heuristics to activate file-backed executable folios after first usage. It affects both standard LRU and Multi-Gen LRU (MGLRU) paths. The modified functions are core memory management reclaim paths (e.g., folio_referenced, shrink_active_list), which are hot-path functions, so no specific focus symbols are provided.",
  "WorthFuzzing": true
}