| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/06/25 22:11 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"MINIX_FS"
],
"FocusSymbols": [
"minix_dio_read_iter",
"minix_dio_write_end_io",
"minix_dio_write_iter",
"minix_file_read_iter",
"minix_file_write_iter",
"minix_file_open",
"minix_writeback_range",
"minix_writepages",
"minix_read_folio",
"minix_readahead",
"minix_bmap",
"minix_iomap_begin",
"minix_iomap_end",
"V1_minix_iomap_begin",
"V2_minix_iomap_begin"
],
"Reasoning": "The patch introduces iomap support for the minix filesystem, replacing older buffer_head-based operations for regular files. This is a significant functional change to the core read/write/mmap logic of the minix filesystem and should be heavily fuzzed to ensure no regressions or vulnerabilities are introduced.",
"WorthFuzzing": true
} |
| 1/1 | 2026/06/25 22:11 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 2dded9ae223eb78f485e1d03d203ea388b24bcae\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jun 25 22:11:20 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/minix/file.c b/fs/minix/file.c\nindex 86e5943cd2ff74..1f42171154018d 100644\n--- a/fs/minix/file.c\n+++ b/fs/minix/file.c\n@@ -17,17 +17,162 @@ int minix_fsync(struct file *file, loff_t start, loff_t end, int datasync)\n \t\t\tstart, end, datasync);\n }\n \n+static ssize_t minix_dio_read_iter(struct kiocb *iocb, struct iov_iter *to)\n+{\n+\tstruct inode *inode = iocb-\u003eki_filp-\u003ef_mapping-\u003ehost;\n+\tssize_t ret;\n+\n+\tinode_lock_shared(inode);\n+\n+\tconst struct iomap_ops *ops = minix_iomap_ops_ver(inode);\n+\n+\tret = iomap_dio_rw(iocb, to, ops, NULL, 0, NULL, 0);\n+\tinode_unlock_shared(inode);\n+\treturn ret;\n+}\n+\n+static int minix_dio_write_end_io(struct kiocb *iocb, ssize_t size, int error,\n+\t\tunsigned int flags)\n+{\n+\tstruct inode *inode = file_inode(iocb-\u003eki_filp);\n+\tloff_t pos = iocb-\u003eki_pos;\n+\n+\tif (error)\n+\t\treturn error;\n+\n+\tpos += size;\n+\tif (size \u0026\u0026 pos \u003e i_size_read(inode)) {\n+\t\ti_size_write(inode, pos);\n+\t\tmark_inode_dirty(inode);\n+\t}\n+\treturn 0;\n+}\n+\n+static const struct iomap_dio_ops minix_dio_write_ops = {\n+\t.end_io = minix_dio_write_end_io,\n+};\n+\n+static ssize_t minix_dio_write_iter(struct kiocb *iocb, struct iov_iter *from)\n+{\n+\tstruct inode *inode = iocb-\u003eki_filp-\u003ef_mapping-\u003ehost;\n+\tssize_t ret;\n+\tunsigned int flags = 0;\n+\tunsigned long blocksize = inode-\u003ei_sb-\u003es_blocksize;\n+\n+\tinode_lock(inode);\n+\tret = generic_write_checks(iocb, from);\n+\tif (ret \u003c= 0)\n+\t\tgoto out_unlock;\n+\n+\tret = kiocb_modified(iocb);\n+\tif (ret)\n+\t\tgoto out_unlock;\n+\n+\tif (iocb-\u003eki_pos + iov_iter_count(from) \u003e i_size_read(inode) ||\n+\t\t!IS_ALIGNED(iocb-\u003eki_pos | iov_iter_alignment(from), blocksize))\n+\t\tflags |= IOMAP_DIO_FORCE_WAIT;\n+\n+\tconst struct iomap_ops *ops = minix_iomap_ops_ver(inode);\n+\n+\tret = iomap_dio_rw(iocb, from, ops,\n+\t\t\u0026minix_dio_write_ops, flags, NULL, 0);\n+\tif (ret == -ENOTBLK)\n+\t\tret = 0; /* fallback to buffered */\n+\n+\tif (ret \u003e= 0 \u0026\u0026 iov_iter_count(from)) {\n+\t\tloff_t pos;\n+\t\tloff_t endbyte;\n+\t\tssize_t status;\n+\n+\t\tiocb-\u003eki_flags \u0026= ~IOCB_DIRECT;\n+\t\tpos = iocb-\u003eki_pos;\n+\t\tstatus = iomap_file_buffered_write(iocb, from, ops,\n+\t\t\tNULL, NULL);\n+\t\tif (unlikely(status \u003c 0)) {\n+\t\t\tret = status;\n+\t\t\tgoto out_unlock;\n+\t\t}\n+\n+\t\tret += status;\n+\t\tendbyte = pos + status - 1;\n+\t\tstatus = filemap_write_and_wait_range(inode-\u003ei_mapping, pos, endbyte);\n+\t\tif (!status) {\n+\t\t\tinvalidate_mapping_pages(inode-\u003ei_mapping,\n+\t\t\t\tpos \u003e\u003e PAGE_SHIFT,\n+\t\t\t\tendbyte \u003e\u003e PAGE_SHIFT);\n+\t\t\tif (ret \u003e 0)\n+\t\t\t\tret = generic_write_sync(iocb, ret);\n+\t\t} else {\n+\t\t\tret = status;\n+\t\t}\n+\t}\n+\n+out_unlock:\n+\tinode_unlock(inode);\n+\treturn ret;\n+}\n+\n+static ssize_t minix_file_read_iter(struct kiocb *iocb, struct iov_iter *to)\n+{\n+\tif (iocb-\u003eki_flags \u0026 IOCB_DIRECT)\n+\t\treturn minix_dio_read_iter(iocb, to);\n+\n+\treturn generic_file_read_iter(iocb, to);\n+}\n+\n+static ssize_t minix_file_write_iter(struct kiocb *iocb, struct iov_iter *from)\n+{\n+\tstruct inode *inode = iocb-\u003eki_filp-\u003ef_mapping-\u003ehost;\n+\tssize_t ret;\n+\n+\t/* minix_dio_write_iter also locks the inode and appears to do the same\n+\t * general sorts of checks as this, so just return directly from there.\n+\t */\n+\tif (iocb-\u003eki_flags \u0026 IOCB_DIRECT)\n+\t\treturn minix_dio_write_iter(iocb, from);\n+\n+\tinode_lock(inode);\n+\tret = generic_write_checks(iocb, from);\n+\tif (ret \u003c= 0)\n+\t\tgoto unlock;\n+\n+\tret = file_modified(iocb-\u003eki_filp);\n+\tif (ret)\n+\t\tgoto unlock;\n+\n+\tconst struct iomap_ops *ops = minix_iomap_ops_ver(inode);\n+\n+\tret = iomap_file_buffered_write(iocb, from, ops,\n+\t\t\tNULL, NULL);\n+\n+\tif (ret \u003e 0)\n+\t\tret = generic_write_sync(iocb, ret);\n+\n+unlock:\n+\tinode_unlock(inode);\n+\treturn ret;\n+}\n+\n+static int minix_file_open(struct inode *inode, struct file *filp)\n+{\n+\tfilp-\u003ef_mode |= FMODE_CAN_ODIRECT;\n+\treturn generic_file_open(inode, filp);\n+}\n+\n /*\n- * We have mostly NULLs here: the current defaults are OK for\n- * the minix filesystem.\n+ * We still have some NULLs here, but not as many of the current defaults are\n+ * still OK for the minix filesystem.\n */\n+\n const struct file_operations minix_file_operations = {\n \t.llseek\t\t= generic_file_llseek,\n-\t.read_iter\t= generic_file_read_iter,\n-\t.write_iter\t= generic_file_write_iter,\n+\t.read_iter\t= minix_file_read_iter,\n+\t.write_iter\t= minix_file_write_iter,\n \t.mmap_prepare\t= generic_file_mmap_prepare,\n+\t.open\t\t= minix_file_open,\n \t.fsync\t\t= minix_fsync,\n \t.splice_read\t= filemap_splice_read,\n+\t.splice_write\t= iter_file_splice_write,\n };\n \n static int minix_setattr(struct mnt_idmap *idmap,\ndiff --git a/fs/minix/inode.c b/fs/minix/inode.c\nindex c30cc590698d6f..cd12e59ce9b9d2 100644\n--- a/fs/minix/inode.c\n+++ b/fs/minix/inode.c\n@@ -436,6 +436,31 @@ static int minix_statfs(struct dentry *dentry, struct kstatfs *buf)\n \treturn 0;\n }\n \n+static ssize_t minix_writeback_range(struct iomap_writepage_ctx *wpc,\n+\tstruct folio *folio, u64 pos, unsigned int len, u64 end_pos)\n+{\n+\tint error;\n+\n+\tif (pos \u003c wpc-\u003eiomap.offset ||\n+\t\t\tpos \u003e= wpc-\u003eiomap.offset + wpc-\u003eiomap.length) {\n+\t\tif (INODE_VERSION(wpc-\u003einode) == MINIX_V1)\n+\t\t\terror = V1_minix_iomap_begin(wpc-\u003einode, pos, len, 0,\n+\t\t\t\t\u0026wpc-\u003eiomap, NULL);\n+\t\telse\n+\t\t\terror = V2_minix_iomap_begin(wpc-\u003einode, pos, len, 0,\n+\t\t\t\t\u0026wpc-\u003eiomap, NULL);\n+\t\tif (error)\n+\t\t\treturn error;\n+\t}\n+\n+\treturn iomap_add_to_ioend(wpc, folio, pos, end_pos, len);\n+}\n+\n+static const struct iomap_writeback_ops minix_writeback_ops = {\n+\t.writeback_range = minix_writeback_range,\n+\t.writeback_submit = iomap_ioend_writeback_submit,\n+};\n+\n static int minix_get_block(struct inode *inode, sector_t block,\n \t\t struct buffer_head *bh_result, int create)\n {\n@@ -445,17 +470,45 @@ static int minix_get_block(struct inode *inode, sector_t block,\n \t\treturn V2_minix_get_block(inode, block, bh_result, create);\n }\n \n-static int minix_writepages(struct address_space *mapping,\n+/* The old minix_writepages, preserved for directory operations. */\n+static int minix_block_writepages(struct address_space *mapping,\n \t\tstruct writeback_control *wbc)\n {\n \treturn mpage_writepages(mapping, wbc, minix_get_block);\n }\n \n+static int minix_writepages(struct address_space *mapping,\n+\t\tstruct writeback_control *wbc)\n+{\n+\tstruct iomap_writepage_ctx wpc = {\n+\t\t.inode = mapping-\u003ehost,\n+\t\t.wbc = wbc,\n+\t\t.ops = \u0026minix_writeback_ops,\n+\t};\n+\treturn iomap_writepages(\u0026wpc);\n+}\n+\n static int minix_read_folio(struct file *file, struct folio *folio)\n+{\n+\tconst struct iomap_ops *ops = minix_iomap_ops_ver(file-\u003ef_inode);\n+\n+\tiomap_bio_read_folio(folio, ops);\n+\treturn 0;\n+}\n+\n+/* The old minix_read_folio, preserved for directory operations. */\n+static int minix_block_read_folio(struct file *file, struct folio *folio)\n {\n \treturn block_read_full_folio(folio, minix_get_block);\n }\n \n+static void minix_readahead(struct readahead_control *rac)\n+{\n+\tconst struct iomap_ops *ops = minix_iomap_ops_ver(rac-\u003efile-\u003ef_inode);\n+\n+\tiomap_bio_readahead(rac, ops);\n+}\n+\n int minix_prepare_chunk(struct folio *folio, loff_t pos, unsigned len)\n {\n \treturn __block_write_begin(folio, pos, len, minix_get_block);\n@@ -487,19 +540,36 @@ static int minix_write_begin(const struct kiocb *iocb,\n \n static sector_t minix_bmap(struct address_space *mapping, sector_t block)\n {\n-\treturn generic_block_bmap(mapping,block,minix_get_block);\n+\tconst struct iomap_ops *ops = minix_iomap_ops_ver(mapping-\u003ehost);\n+\n+\treturn iomap_bmap(mapping, block, ops);\n }\n \n static const struct address_space_operations minix_aops = {\n-\t.dirty_folio\t= block_dirty_folio,\n-\t.invalidate_folio = block_invalidate_folio,\n+\t.dirty_folio\t= iomap_dirty_folio,\n+\t.invalidate_folio = iomap_invalidate_folio,\n \t.read_folio = minix_read_folio,\n+\t.readahead = minix_readahead,\n \t.writepages = minix_writepages,\n+\t.migrate_folio = filemap_migrate_folio,\n+\t.bmap = minix_bmap,\n+\t.is_partially_uptodate = iomap_is_partially_uptodate,\n+\t.release_folio = iomap_release_folio,\n+\t.error_remove_folio = generic_error_remove_folio,\n+};\n+\n+/* A special aops for directories that keeps using the buffer head chunks, at\n+ * least for the time being.\n+ */\n+static const struct address_space_operations minix_dir_aops = {\n+\t.dirty_folio = block_dirty_folio,\n+\t.invalidate_folio = block_invalidate_folio,\n+\t.read_folio = minix_block_read_folio,\n \t.write_begin = minix_write_begin,\n \t.write_end = generic_write_end,\n \t.migrate_folio = buffer_migrate_folio,\n \t.bmap = minix_bmap,\n-\t.direct_IO = noop_direct_IO\n+\t.writepages = minix_block_writepages,\n };\n \n static const struct inode_operations minix_symlink_inode_operations = {\n@@ -516,7 +586,7 @@ void minix_set_inode(struct inode *inode, dev_t rdev)\n \t} else if (S_ISDIR(inode-\u003ei_mode)) {\n \t\tinode-\u003ei_op = \u0026minix_dir_inode_operations;\n \t\tinode-\u003ei_fop = \u0026minix_dir_operations;\n-\t\tinode-\u003ei_mapping-\u003ea_ops = \u0026minix_aops;\n+\t\tinode-\u003ei_mapping-\u003ea_ops = \u0026minix_dir_aops;\n \t} else if (S_ISLNK(inode-\u003ei_mode)) {\n \t\tinode-\u003ei_op = \u0026minix_symlink_inode_operations;\n \t\tinode_nohighmem(inode);\n@@ -768,4 +838,3 @@ module_init(init_minix_fs)\n module_exit(exit_minix_fs)\n MODULE_DESCRIPTION(\"Minix file system\");\n MODULE_LICENSE(\"GPL\");\n-\ndiff --git a/fs/minix/iomap.c b/fs/minix/iomap.c\nnew file mode 100644\nindex 00000000000000..7bb0439e366996\n--- /dev/null\n+++ b/fs/minix/iomap.c\n@@ -0,0 +1,114 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+/*\n+ * iomap functions for minix. At least the first pass of this file was taken\n+ * from the xiafs iomap.c, which is fitting since the xiafs module in turn\n+ * borrowed heavily from the modernized minix fs kernel module.\n+ */\n+\n+/*\n+ * minix_iomap_begin - map a file range to disk blocks. It acts as a replacement\n+ * for get_block in itree_common.c, at least in the important ways, and is\n+ * adapted from it, but it uses iomap instead of buffer_head. This is taken\n+ * directly from the out-of-tree xiafs iomap changes, and the exfat iomap\n+ * changes were an inspiration for that.\n+ */\n+static int minix_iomap_begin(struct inode *inode, loff_t offset, loff_t length,\n+\tunsigned int flags, struct iomap *iomap, struct iomap *srcmap)\n+{\n+\tstruct super_block *sb = inode-\u003ei_sb;\n+\tunsigned int blkbits = sb-\u003es_blocksize_bits;\n+\tsector_t iblock = offset \u003e\u003e blkbits;\n+\tint create = flags \u0026 IOMAP_WRITE;\n+\n+\t/* Mostly taken from modern-xiafs itree.c get_block with elements from\n+\t * similar exfat operations.\n+\t */\n+\tint offsets[DEPTH];\n+\tIndirect chain[DEPTH];\n+\tIndirect *partial;\n+\tint depth = block_to_path(inode, iblock, offsets);\n+\tint left;\n+\tint err = -EIO;\n+\n+\tsector_t phys;\n+\n+\t/* block is beyond max file size */\n+\tif (depth == 0)\n+\t\tgoto out;\n+\n+\tiomap-\u003ebdev = inode-\u003ei_sb-\u003es_bdev;\n+\n+reread:\n+\tpartial = get_branch(inode, depth, offsets, chain, \u0026err);\n+\n+\t/* Simplest case - block found, no allocation needed */\n+\tif (!partial) {\n+\t\t/* Bit of a weird order, but it'll make sense when you get to\n+\t\t * the bottom.\n+\t\t */\n+\t\tiomap-\u003eflags = IOMAP_F_MERGED;\n+got_it:\n+\t\tphys = block_to_cpu(chain[depth - 1].key);\n+\t\tpartial = chain+depth-1;\n+\t\t/* Set up the iomap struct before cleaning up */\n+\t\tiomap-\u003etype = IOMAP_MAPPED;\n+\t\tiomap-\u003eaddr = (u64)phys \u003c\u003c blkbits;\n+\t\tiomap-\u003elength = 1 \u003c\u003c blkbits;\n+\t\tiomap-\u003eoffset = (u64)iblock \u003c\u003c blkbits;\n+\t\tgoto cleanup;\n+\t}\n+\n+\t/* Next simple case - plain lookup or failed read of indirect block */\n+\tif (!create || err == -EIO) {\n+\t\tiomap-\u003etype = IOMAP_HOLE;\n+\t\tiomap-\u003eaddr = IOMAP_NULL_ADDR;\n+\t\tiomap-\u003elength = 1 \u003c\u003c blkbits;\n+\t\tiomap-\u003eoffset = (u64)iblock \u003c\u003c blkbits;\n+\t\tiomap-\u003eflags = 0;\n+cleanup:\n+\t\twhile (partial \u003e chain) {\n+\t\t\tbrelse(partial-\u003ebh);\n+\t\t\tpartial--;\n+\t\t}\n+out:\n+\t\treturn err;\n+\t}\n+\n+\t/*\n+\t * Indirect block might be removed by truncate while we were\n+\t * reading it. Handling of that case (forget what we've got and\n+\t * reread) is taken out of the main path.\n+\t */\n+\tif (err == -EAGAIN)\n+\t\tgoto changed;\n+\n+\tleft = (chain + depth) - partial;\n+\terr = alloc_branch(inode, left, offsets + (partial - chain), partial);\n+\tif (err)\n+\t\tgoto cleanup;\n+\n+\tif (splice_branch(inode, chain, partial, left) \u003c 0)\n+\t\tgoto changed;\n+\n+\t/* Successful allocation, mapping it. */\n+\tiomap-\u003eflags = IOMAP_F_NEW;\n+\tgoto got_it;\n+\n+changed:\n+\twhile (partial \u003e chain) {\n+\t\tbrelse(partial-\u003ebh);\n+\t\tpartial--;\n+\t}\n+\tgoto reread;\n+}\n+\n+/*\n+ * minix_iomap_end ends up being a nop; since minix doesn't have any extents or\n+ * transactions to worry about, there isn't anything to update here. The on-disk\n+ * indirect blocks get dirtied in minix_iomap_begin.\n+ */\n+static int minix_iomap_end(struct inode *inode, loff_t offset, loff_t length,\n+\tssize_t written, unsigned int flags, struct iomap *iomap)\n+{\n+\treturn 0;\n+}\ndiff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c\nindex 1fed906042aa84..58c29f4443d372 100644\n--- a/fs/minix/itree_v1.c\n+++ b/fs/minix/itree_v1.c\n@@ -49,6 +49,18 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])\n }\n \n #include \"itree_common.c\"\n+/* NOTA BENE:\n+ *\n+ * This is icky to me, but at the same time having it be a standalone C file\n+ * that's compiled to object form and linked separately like it is in xiafs is\n+ * much nastier in minix because of the different versions of the minix fs that\n+ * have some very, very different aspects, like the size of block_t. I don't\n+ * like it, but since minix already has this pattern where a common itree file\n+ * is included in the itree_v1 and itree_v2(and v3) files, I'm including iomap.c\n+ * in these files as well. It does at least avoid exporting some currently\n+ * static functions that aren't needed anywhere but itree_common.c and iomap.c.\n+ */\n+#include \"iomap.c\"\n \n int V1_minix_get_block(struct inode * inode, long block,\n \t\t\tstruct buffer_head *bh_result, int create)\n@@ -61,7 +73,18 @@ void V1_minix_truncate(struct inode * inode)\n \ttruncate(inode);\n }\n \n-unsigned V1_minix_blocks(loff_t size, struct super_block *sb)\n+unsigned int V1_minix_blocks(loff_t size, struct super_block *sb)\n {\n \treturn nblocks(size, sb);\n }\n+\n+int V1_minix_iomap_begin(struct inode *inode, loff_t offset, loff_t length,\n+\tunsigned int flags, struct iomap *iomap, struct iomap *srcmap)\n+{\n+\treturn minix_iomap_begin(inode, offset, length, flags, iomap, srcmap);\n+}\n+\n+const struct iomap_ops V1_minix_iomap_ops = {\n+\t.iomap_begin = V1_minix_iomap_begin,\n+\t.iomap_end = minix_iomap_end,\n+};\ndiff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c\nindex 9d00f31a2d9d15..fc7a5ae8fa1ca3 100644\n--- a/fs/minix/itree_v2.c\n+++ b/fs/minix/itree_v2.c\n@@ -57,6 +57,10 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])\n }\n \n #include \"itree_common.c\"\n+/* See the note in itree_v1 in a comment that starts \"NOTA BENE\" for an\n+ * explanation for why iomap.c is included here.\n+ */\n+#include \"iomap.c\"\n \n int V2_minix_get_block(struct inode * inode, long block,\n \t\t\tstruct buffer_head *bh_result, int create)\n@@ -69,7 +73,18 @@ void V2_minix_truncate(struct inode * inode)\n \ttruncate(inode);\n }\n \n-unsigned V2_minix_blocks(loff_t size, struct super_block *sb)\n+unsigned int V2_minix_blocks(loff_t size, struct super_block *sb)\n {\n \treturn nblocks(size, sb);\n }\n+\n+int V2_minix_iomap_begin(struct inode *inode, loff_t offset, loff_t length,\n+\tunsigned int flags, struct iomap *iomap, struct iomap *srcmap)\n+{\n+\treturn minix_iomap_begin(inode, offset, length, flags, iomap, srcmap);\n+}\n+\n+const struct iomap_ops V2_minix_iomap_ops = {\n+\t.iomap_begin = V2_minix_iomap_begin,\n+\t.iomap_end = minix_iomap_end,\n+};\ndiff --git a/fs/minix/minix.h b/fs/minix/minix.h\nindex f2025c9b58252f..face7410034602 100644\n--- a/fs/minix/minix.h\n+++ b/fs/minix/minix.h\n@@ -5,6 +5,7 @@\n #include \u003clinux/fs.h\u003e\n #include \u003clinux/pagemap.h\u003e\n #include \u003clinux/minix_fs.h\u003e\n+#include \u003clinux/iomap.h\u003e\n \n #define INODE_VERSION(inode)\tminix_sb(inode-\u003ei_sb)-\u003es_version\n #define MINIX_V1\t\t0x0001\t\t/* original minix fs */\n@@ -56,7 +57,7 @@ int minix_new_block(struct inode *inode);\n void minix_free_block(struct inode *inode, unsigned long block);\n unsigned long minix_count_free_blocks(struct super_block *sb);\n int minix_getattr(struct mnt_idmap *, const struct path *,\n-\t\tstruct kstat *, u32, unsigned int);\n+\t\tstruct kstat *, u32, unsigned);\n int minix_prepare_chunk(struct folio *folio, loff_t pos, unsigned len);\n struct mapping_metadata_bhs *minix_get_metadata_bhs(struct inode *inode);\n int minix_fsync(struct file *file, loff_t start, loff_t end, int datasync);\n@@ -80,10 +81,19 @@ int minix_set_link(struct minix_dir_entry *de, struct folio *folio,\n struct minix_dir_entry *minix_dotdot(struct inode*, struct folio **);\n ino_t minix_inode_by_name(struct dentry*);\n \n+extern int V1_minix_iomap_begin(struct inode *inode, loff_t offset,\n+\tloff_t length, unsigned int flags, struct iomap *iomap,\n+\tstruct iomap *srcmap);\n+extern int V2_minix_iomap_begin(struct inode *inode, loff_t offset,\n+\tloff_t length, unsigned int flags, struct iomap *iomap,\n+\tstruct iomap *srcmap);\n+\n extern const struct inode_operations minix_file_inode_operations;\n extern const struct inode_operations minix_dir_inode_operations;\n extern const struct file_operations minix_file_operations;\n extern const struct file_operations minix_dir_operations;\n+extern const struct iomap_ops V1_minix_iomap_ops;\n+extern const struct iomap_ops V2_minix_iomap_ops;\n \n static inline struct minix_sb_info *minix_sb(struct super_block *sb)\n {\n@@ -95,11 +105,17 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)\n \treturn container_of(inode, struct minix_inode_info, vfs_inode);\n }\n \n-static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)\n+static inline unsigned int minix_blocks_needed(unsigned int bits, unsigned int blocksize)\n {\n \treturn DIV_ROUND_UP(bits, blocksize * 8);\n }\n \n+static inline const struct iomap_ops *minix_iomap_ops_ver(struct inode *inode)\n+{\n+\treturn (INODE_VERSION(inode) == MINIX_V1) ?\n+\t\t\u0026V1_minix_iomap_ops : \u0026V2_minix_iomap_ops;\n+}\n+\n #if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) \u0026\u0026 \\\n \tdefined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)\n \n@@ -129,7 +145,7 @@ static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)\n * big-endian 16bit indexed bitmaps\n */\n \n-static inline int minix_find_first_zero_bit(const void *vaddr, unsigned size)\n+static inline int minix_find_first_zero_bit(const void *vaddr, unsigned int size)\n {\n \tconst unsigned short *p = vaddr, *addr = vaddr;\n \tunsigned short num;\n"
} |
| 2/1 | 2026/06/25 22:11 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"MINIX_FS"
],
"FocusSymbols": [
"minix_dio_read_iter",
"minix_dio_write_end_io",
"minix_dio_write_iter",
"minix_file_read_iter",
"minix_file_write_iter",
"minix_file_open",
"minix_writeback_range",
"minix_writepages",
"minix_read_folio",
"minix_readahead",
"minix_bmap",
"minix_iomap_begin",
"minix_iomap_end",
"V1_minix_iomap_begin",
"V2_minix_iomap_begin"
],
"Reasoning": "The patch introduces iomap support for the minix filesystem, replacing older buffer_head-based operations for regular files. This is a significant functional change to the core read/write/mmap logic of the minix filesystem and should be heavily fuzzed to ensure no regressions or vulnerabilities are introduced.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 2dded9ae223eb78f485e1d03d203ea388b24bcae
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Jun 25 22:11:20 2026 +0000
syz-cluster: applied patch under review
diff --git a/fs/minix/file.c b/fs/minix/file.c
index 86e5943cd2ff74..1f42171154018d 100644
--- a/fs/minix/file.c
+++ b/fs/minix/file.c
@@ -17,17 +17,162 @@ int minix_fsync(struct file *file, loff_t start, loff_t end, int datasync)
start, end, datasync);
}
+static ssize_t minix_dio_read_iter(struct kiocb *iocb, struct iov_iter *to)
+{
+ struct inode *inode = iocb->ki_filp->f_mapping->host;
+ ssize_t ret;
+
+ inode_lock_shared(inode);
+
+ const struct iomap_ops *ops = minix_iomap_ops_ver(inode);
+
+ ret = iomap_dio_rw(iocb, to, ops, NULL, 0, NULL, 0);
+ inode_unlock_shared(inode);
+ return ret;
+}
+
+static int minix_dio_write_end_io(struct kiocb *iocb, ssize_t size, int error,
+ unsigned int flags)
+{
+ struct inode *inode = file_inode(iocb->ki_filp);
+ loff_t pos = iocb->ki_pos;
+
+ if (error)
+ return error;
+
+ pos += size;
+ if (size && pos > i_size_read(inode)) {
+ i_size_write(inode, pos);
+ mark_inode_dirty(inode);
+ }
+ return 0;
+}
+
+static const struct iomap_dio_ops minix_dio_write_ops = {
+ .end_io = minix_dio_write_end_io,
+};
+
+static ssize_t minix_dio_write_iter(struct kiocb *iocb, struct iov_iter *from)
+{
+ struct inode *inode = iocb->ki_filp->f_mapping->host;
+ ssize_t ret;
+ unsigned int flags = 0;
+ unsigned long blocksize = inode->i_sb->s_blocksize;
+
+ inode_lock(inode);
+ ret = generic_write_checks(iocb, from);
+ if (ret <= 0)
+ goto out_unlock;
+
+ ret = kiocb_modified(iocb);
+ if (ret)
+ goto out_unlock;
+
+ if (iocb->ki_pos + iov_iter_count(from) > i_size_read(inode) ||
+ !IS_ALIGNED(iocb->ki_pos | iov_iter_alignment(from), blocksize))
+ flags |= IOMAP_DIO_FORCE_WAIT;
+
+ const struct iomap_ops *ops = minix_iomap_ops_ver(inode);
+
+ ret = iomap_dio_rw(iocb, from, ops,
+ &minix_dio_write_ops, flags, NULL, 0);
+ if (ret == -ENOTBLK)
+ ret = 0; /* fallback to buffered */
+
+ if (ret >= 0 && iov_iter_count(from)) {
+ loff_t pos;
+ loff_t endbyte;
+ ssize_t status;
+
+ iocb->ki_flags &= ~IOCB_DIRECT;
+ pos = iocb->ki_pos;
+ status = iomap_file_buffered_write(iocb, from, ops,
+ NULL, NULL);
+ if (unlikely(status < 0)) {
+ ret = status;
+ goto out_unlock;
+ }
+
+ ret += status;
+ endbyte = pos + status - 1;
+ status = filemap_write_and_wait_range(inode->i_mapping, pos, endbyte);
+ if (!status) {
+ invalidate_mapping_pages(inode->i_mapping,
+ pos >> PAGE_SHIFT,
+ endbyte >> PAGE_SHIFT);
+ if (ret > 0)
+ ret = generic_write_sync(iocb, ret);
+ } else {
+ ret = status;
+ }
+ }
+
+out_unlock:
+ inode_unlock(inode);
+ return ret;
+}
+
+static ssize_t minix_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+{
+ if (iocb->ki_flags & IOCB_DIRECT)
+ return minix_dio_read_iter(iocb, to);
+
+ return generic_file_read_iter(iocb, to);
+}
+
+static ssize_t minix_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+{
+ struct inode *inode = iocb->ki_filp->f_mapping->host;
+ ssize_t ret;
+
+ /* minix_dio_write_iter also locks the inode and appears to do the same
+ * general sorts of checks as this, so just return directly from there.
+ */
+ if (iocb->ki_flags & IOCB_DIRECT)
+ return minix_dio_write_iter(iocb, from);
+
+ inode_lock(inode);
+ ret = generic_write_checks(iocb, from);
+ if (ret <= 0)
+ goto unlock;
+
+ ret = file_modified(iocb->ki_filp);
+ if (ret)
+ goto unlock;
+
+ const struct iomap_ops *ops = minix_iomap_ops_ver(inode);
+
+ ret = iomap_file_buffered_write(iocb, from, ops,
+ NULL, NULL);
+
+ if (ret > 0)
+ ret = generic_write_sync(iocb, ret);
+
+unlock:
+ inode_unlock(inode);
+ return ret;
+}
+
+static int minix_file_open(struct inode *inode, struct file *filp)
+{
+ filp->f_mode |= FMODE_CAN_ODIRECT;
+ return generic_file_open(inode, filp);
+}
+
/*
- * We have mostly NULLs here: the current defaults are OK for
- * the minix filesystem.
+ * We still have some NULLs here, but not as many of the current defaults are
+ * still OK for the minix filesystem.
*/
+
const struct file_operations minix_file_operations = {
.llseek = generic_file_llseek,
- .read_iter = generic_file_read_iter,
- .write_iter = generic_file_write_iter,
+ .read_iter = minix_file_read_iter,
+ .write_iter = minix_file_write_iter,
.mmap_prepare = generic_file_mmap_prepare,
+ .open = minix_file_open,
.fsync = minix_fsync,
.splice_read = filemap_splice_read,
+ .splice_write = iter_file_splice_write,
};
static int minix_setattr(struct mnt_idmap *idmap,
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index c30cc590698d6f..cd12e59ce9b9d2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -436,6 +436,31 @@ static int minix_statfs(struct dentry *dentry, struct kstatfs *buf)
return 0;
}
+static ssize_t minix_writeback_range(struct iomap_writepage_ctx *wpc,
+ struct folio *folio, u64 pos, unsigned int len, u64 end_pos)
+{
+ int error;
+
+ if (pos < wpc->iomap.offset ||
+ pos >= wpc->iomap.offset + wpc->iomap.length) {
+ if (INODE_VERSION(wpc->inode) == MINIX_V1)
+ error = V1_minix_iomap_begin(wpc->inode, pos, len, 0,
+ &wpc->iomap, NULL);
+ else
+ error = V2_minix_iomap_begin(wpc->inode, pos, len, 0,
+ &wpc->iomap, NULL);
+ if (error)
+ return error;
+ }
+
+ return iomap_add_to_ioend(wpc, folio, pos, end_pos, len);
+}
+
+static const struct iomap_writeback_ops minix_writeback_ops = {
+ .writeback_range = minix_writeback_range,
+ .writeback_submit = iomap_ioend_writeback_submit,
+};
+
static int minix_get_block(struct inode *inode, sector_t block,
struct buffer_head *bh_result, int create)
{
@@ -445,17 +470,45 @@ static int minix_get_block(struct inode *inode, sector_t block,
return V2_minix_get_block(inode, block, bh_result, create);
}
-static int minix_writepages(struct address_space *mapping,
+/* The old minix_writepages, preserved for directory operations. */
+static int minix_block_writepages(struct address_space *mapping,
struct writeback_control *wbc)
{
return mpage_writepages(mapping, wbc, minix_get_block);
}
+static int minix_writepages(struct address_space *mapping,
+ struct writeback_control *wbc)
+{
+ struct iomap_writepage_ctx wpc = {
+ .inode = mapping->host,
+ .wbc = wbc,
+ .ops = &minix_writeback_ops,
+ };
+ return iomap_writepages(&wpc);
+}
+
static int minix_read_folio(struct file *file, struct folio *folio)
+{
+ const struct iomap_ops *ops = minix_iomap_ops_ver(file->f_inode);
+
+ iomap_bio_read_folio(folio, ops);
+ return 0;
+}
+
+/* The old minix_read_folio, preserved for directory operations. */
+static int minix_block_read_folio(struct file *file, struct folio *folio)
{
return block_read_full_folio(folio, minix_get_block);
}
+static void minix_readahead(struct readahead_control *rac)
+{
+ const struct iomap_ops *ops = minix_iomap_ops_ver(rac->file->f_inode);
+
+ iomap_bio_readahead(rac, ops);
+}
+
int minix_prepare_chunk(struct folio *folio, loff_t pos, unsigned len)
{
return __block_write_begin(folio, pos, len, minix_get_block);
@@ -487,19 +540,36 @@ static int minix_write_begin(const struct kiocb *iocb,
static sector_t minix_bmap(struct address_space *mapping, sector_t block)
{
- return generic_block_bmap(mapping,block,minix_get_block);
+ const struct iomap_ops *ops = minix_iomap_ops_ver(mapping->host);
+
+ return iomap_bmap(mapping, block, ops);
}
static const struct address_space_operations minix_aops = {
- .dirty_folio = block_dirty_folio,
- .invalidate_folio = block_invalidate_folio,
+ .dirty_folio = iomap_dirty_folio,
+ .invalidate_folio = iomap_invalidate_folio,
.read_folio = minix_read_folio,
+ .readahead = minix_readahead,
.writepages = minix_writepages,
+ .migrate_folio = filemap_migrate_folio,
+ .bmap = minix_bmap,
+ .is_partially_uptodate = iomap_is_partially_uptodate,
+ .release_folio = iomap_release_folio,
+ .error_remove_folio = generic_error_remove_folio,
+};
+
+/* A special aops for directories that keeps using the buffer head chunks, at
+ * least for the time being.
+ */
+static const struct address_space_operations minix_dir_aops = {
+ .dirty_folio = block_dirty_folio,
+ .invalidate_folio = block_invalidate_folio,
+ .read_folio = minix_block_read_folio,
.write_begin = minix_write_begin,
.write_end = generic_write_end,
.migrate_folio = buffer_migrate_folio,
.bmap = minix_bmap,
- .direct_IO = noop_direct_IO
+ .writepages = minix_block_writepages,
};
static const struct inode_operations minix_symlink_inode_operations = {
@@ -516,7 +586,7 @@ void minix_set_inode(struct inode *inode, dev_t rdev)
} else if (S_ISDIR(inode->i_mode)) {
inode->i_op = &minix_dir_inode_operations;
inode->i_fop = &minix_dir_operations;
- inode->i_mapping->a_ops = &minix_aops;
+ inode->i_mapping->a_ops = &minix_dir_aops;
} else if (S_ISLNK(inode->i_mode)) {
inode->i_op = &minix_symlink_inode_operations;
inode_nohighmem(inode);
@@ -768,4 +838,3 @@ module_init(init_minix_fs)
module_exit(exit_minix_fs)
MODULE_DESCRIPTION("Minix file system");
MODULE_LICENSE("GPL");
-
diff --git a/fs/minix/iomap.c b/fs/minix/iomap.c
new file mode 100644
index 00000000000000..7bb0439e366996
--- /dev/null
+++ b/fs/minix/iomap.c
@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * iomap functions for minix. At least the first pass of this file was taken
+ * from the xiafs iomap.c, which is fitting since the xiafs module in turn
+ * borrowed heavily from the modernized minix fs kernel module.
+ */
+
+/*
+ * minix_iomap_begin - map a file range to disk blocks. It acts as a replacement
+ * for get_block in itree_common.c, at least in the important ways, and is
+ * adapted from it, but it uses iomap instead of buffer_head. This is taken
+ * directly from the out-of-tree xiafs iomap changes, and the exfat iomap
+ * changes were an inspiration for that.
+ */
+static int minix_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
+ unsigned int flags, struct iomap *iomap, struct iomap *srcmap)
+{
+ struct super_block *sb = inode->i_sb;
+ unsigned int blkbits = sb->s_blocksize_bits;
+ sector_t iblock = offset >> blkbits;
+ int create = flags & IOMAP_WRITE;
+
+ /* Mostly taken from modern-xiafs itree.c get_block with elements from
+ * similar exfat operations.
+ */
+ int offsets[DEPTH];
+ Indirect chain[DEPTH];
+ Indirect *partial;
+ int depth = block_to_path(inode, iblock, offsets);
+ int left;
+ int err = -EIO;
+
+ sector_t phys;
+
+ /* block is beyond max file size */
+ if (depth == 0)
+ goto out;
+
+ iomap->bdev = inode->i_sb->s_bdev;
+
+reread:
+ partial = get_branch(inode, depth, offsets, chain, &err);
+
+ /* Simplest case - block found, no allocation needed */
+ if (!partial) {
+ /* Bit of a weird order, but it'll make sense when you get to
+ * the bottom.
+ */
+ iomap->flags = IOMAP_F_MERGED;
+got_it:
+ phys = block_to_cpu(chain[depth - 1].key);
+ partial = chain+depth-1;
+ /* Set up the iomap struct before cleaning up */
+ iomap->type = IOMAP_MAPPED;
+ iomap->addr = (u64)phys << blkbits;
+ iomap->length = 1 << blkbits;
+ iomap->offset = (u64)iblock << blkbits;
+ goto cleanup;
+ }
+
+ /* Next simple case - plain lookup or failed read of indirect block */
+ if (!create || err == -EIO) {
+ iomap->type = IOMAP_HOLE;
+ iomap->addr = IOMAP_NULL_ADDR;
+ iomap->length = 1 << blkbits;
+ iomap->offset = (u64)iblock << blkbits;
+ iomap->flags = 0;
+cleanup:
+ while (partial > chain) {
+ brelse(partial->bh);
+ partial--;
+ }
+out:
+ return err;
+ }
+
+ /*
+ * Indirect block might be removed by truncate while we were
+ * reading it. Handling of that case (forget what we've got and
+ * reread) is taken out of the main path.
+ */
+ if (err == -EAGAIN)
+ goto changed;
+
+ left = (chain + depth) - partial;
+ err = alloc_branch(inode, left, offsets + (partial - chain), partial);
+ if (err)
+ goto cleanup;
+
+ if (splice_branch(inode, chain, partial, left) < 0)
+ goto changed;
+
+ /* Successful allocation, mapping it. */
+ iomap->flags = IOMAP_F_NEW;
+ goto got_it;
+
+changed:
+ while (partial > chain) {
+ brelse(partial->bh);
+ partial--;
+ }
+ goto reread;
+}
+
+/*
+ * minix_iomap_end ends up being a nop; since minix doesn't have any extents or
+ * transactions to worry about, there isn't anything to update here. The on-disk
+ * indirect blocks get dirtied in minix_iomap_begin.
+ */
+static int minix_iomap_end(struct inode *inode, loff_t offset, loff_t length,
+ ssize_t written, unsigned int flags, struct iomap *iomap)
+{
+ return 0;
+}
diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
index 1fed906042aa84..58c29f4443d372 100644
--- a/fs/minix/itree_v1.c
+++ b/fs/minix/itree_v1.c
@@ -49,6 +49,18 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
}
#include "itree_common.c"
+/* NOTA BENE:
+ *
+ * This is icky to me, but at the same time having it be a standalone C file
+ * that's compiled to object form and linked separately like it is in xiafs is
+ * much nastier in minix because of the different versions of the minix fs that
+ * have some very, very different aspects, like the size of block_t. I don't
+ * like it, but since minix already has this pattern where a common itree file
+ * is included in the itree_v1 and itree_v2(and v3) files, I'm including iomap.c
+ * in these files as well. It does at least avoid exporting some currently
+ * static functions that aren't needed anywhere but itree_common.c and iomap.c.
+ */
+#include "iomap.c"
int V1_minix_get_block(struct inode * inode, long block,
struct buffer_head *bh_result, int create)
@@ -61,7 +73,18 @@ void V1_minix_truncate(struct inode * inode)
truncate(inode);
}
-unsigned V1_minix_blocks(loff_t size, struct super_block *sb)
+unsigned int V1_minix_blocks(loff_t size, struct super_block *sb)
{
return nblocks(size, sb);
}
+
+int V1_minix_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
+ unsigned int flags, struct iomap *iomap, struct iomap *srcmap)
+{
+ return minix_iomap_begin(inode, offset, length, flags, iomap, srcmap);
+}
+
+const struct iomap_ops V1_minix_iomap_ops = {
+ .iomap_begin = V1_minix_iomap_begin,
+ .iomap_end = minix_iomap_end,
+};
diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
index 9d00f31a2d9d15..fc7a5ae8fa1ca3 100644
--- a/fs/minix/itree_v2.c
+++ b/fs/minix/itree_v2.c
@@ -57,6 +57,10 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
}
#include "itree_common.c"
+/* See the note in itree_v1 in a comment that starts "NOTA BENE" for an
+ * explanation for why iomap.c is included here.
+ */
+#include "iomap.c"
int V2_minix_get_block(struct inode * inode, long block,
struct buffer_head *bh_result, int create)
@@ -69,7 +73,18 @@ void V2_minix_truncate(struct inode * inode)
truncate(inode);
}
-unsigned V2_minix_blocks(loff_t size, struct super_block *sb)
+unsigned int V2_minix_blocks(loff_t size, struct super_block *sb)
{
return nblocks(size, sb);
}
+
+int V2_minix_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
+ unsigned int flags, struct iomap *iomap, struct iomap *srcmap)
+{
+ return minix_iomap_begin(inode, offset, length, flags, iomap, srcmap);
+}
+
+const struct iomap_ops V2_minix_iomap_ops = {
+ .iomap_begin = V2_minix_iomap_begin,
+ .iomap_end = minix_iomap_end,
+};
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index f2025c9b58252f..face7410034602 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -5,6 +5,7 @@
#include <linux/fs.h>
#include <linux/pagemap.h>
#include <linux/minix_fs.h>
+#include <linux/iomap.h>
#define INODE_VERSION(inode) minix_sb(inode->i_sb)->s_version
#define MINIX_V1 0x0001 /* original minix fs */
@@ -56,7 +57,7 @@ int minix_new_block(struct inode *inode);
void minix_free_block(struct inode *inode, unsigned long block);
unsigned long minix_count_free_blocks(struct super_block *sb);
int minix_getattr(struct mnt_idmap *, const struct path *,
- struct kstat *, u32, unsigned int);
+ struct kstat *, u32, unsigned);
int minix_prepare_chunk(struct folio *folio, loff_t pos, unsigned len);
struct mapping_metadata_bhs *minix_get_metadata_bhs(struct inode *inode);
int minix_fsync(struct file *file, loff_t start, loff_t end, int datasync);
@@ -80,10 +81,19 @@ int minix_set_link(struct minix_dir_entry *de, struct folio *folio,
struct minix_dir_entry *minix_dotdot(struct inode*, struct folio **);
ino_t minix_inode_by_name(struct dentry*);
+extern int V1_minix_iomap_begin(struct inode *inode, loff_t offset,
+ loff_t length, unsigned int flags, struct iomap *iomap,
+ struct iomap *srcmap);
+extern int V2_minix_iomap_begin(struct inode *inode, loff_t offset,
+ loff_t length, unsigned int flags, struct iomap *iomap,
+ struct iomap *srcmap);
+
extern const struct inode_operations minix_file_inode_operations;
extern const struct inode_operations minix_dir_inode_operations;
extern const struct file_operations minix_file_operations;
extern const struct file_operations minix_dir_operations;
+extern const struct iomap_ops V1_minix_iomap_ops;
+extern const struct iomap_ops V2_minix_iomap_ops;
static inline struct minix_sb_info *minix_sb(struct super_block *sb)
{
@@ -95,11 +105,17 @@ static inline struct minix_inode_info *minix_i(struct inode *inode)
return container_of(inode, struct minix_inode_info, vfs_inode);
}
-static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
+static inline unsigned int minix_blocks_needed(unsigned int bits, unsigned int blocksize)
{
return DIV_ROUND_UP(bits, blocksize * 8);
}
+static inline const struct iomap_ops *minix_iomap_ops_ver(struct inode *inode)
+{
+ return (INODE_VERSION(inode) == MINIX_V1) ?
+ &V1_minix_iomap_ops : &V2_minix_iomap_ops;
+}
+
#if defined(CONFIG_MINIX_FS_NATIVE_ENDIAN) && \
defined(CONFIG_MINIX_FS_BIG_ENDIAN_16BIT_INDEXED)
@@ -129,7 +145,7 @@ static inline unsigned minix_blocks_needed(unsigned bits, unsigned blocksize)
* big-endian 16bit indexed bitmaps
*/
-static inline int minix_find_first_zero_bit(const void *vaddr, unsigned size)
+static inline int minix_find_first_zero_bit(const void *vaddr, unsigned int size)
{
const unsigned short *p = vaddr, *addr = vaddr;
unsigned short num;
|
| 3/2 | 2026/06/25 22:11 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 8930 output: 19 thoughts: 225 Thoughts: **My Assessment of the Minix Iomap Patch** Okay, so we've got a patch here introducing iomap support into the Minix filesystem, interesting. The core of this is the replacement of the existing buffer_head-based operations with iomap primitives, specifically for regular files. Directories are staying with the buffer_head approach for now, which is a sensible, incremental change. They've added a slew of new functions: `minix_dio_read_iter`, `minix_dio_write_iter`, the standard file iterators, `minix_writeback_range`, `minix_writepages`, and the folio functions. Additionally, we have `minix_bmap` – the block mapping function, which will be interesting to review. Looks like they've spun up a new `fs/minix/iomap.c` file with `minix_iomap_begin` and `minix_iomap_end`, which are the standard begin/end points for iomap operations, and probably where the core logic resides. This is clearly a functional change, a significant refactoring of a fundamental part of Minix's IO path. Given the depth of this change, I *definitely* need to earmark this for fuzzing. We're touching critical code that deals with data access, and any subtle bug here could have serious consequences. Now, let's get a handle on the build configuration aspects. I need to figure out how this is enabled. Time to use `grepper` to search the Kconfig files. I'll search for `MINIX` within the filesystem source directory, particularly in `fs/minix/Kconfig` or anything similarly named. I need to understand what config options are exposed so that I understand where and when this functionality is enabled. |
| 4/2 | 2026/06/25 22:11 | tool | grepper |
0mArgs:{
"Expression": "config MINIX_FS"
}Results: {
"Output": "fs/minix/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/minix/Kconfig:2:config MINIX_FS\nfs/minix/Kconfig-3-\ttristate \"Minix file system support\"\n--\nfs/minix/Kconfig-20-\nfs/minix/Kconfig:21:config MINIX_FS_NATIVE_ENDIAN\nfs/minix/Kconfig-22-\tdef_bool MINIX_FS\n--\nfs/minix/Kconfig-24-\nfs/minix/Kconfig:25:config MINIX_FS_BIG_ENDIAN_16BIT_INDEXED\nfs/minix/Kconfig-26-\tdef_bool MINIX_FS\n"
} |
| 5/2 | 2026/06/25 22:11 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9757 output: 257 thoughts: 376 Thoughts: **Analyzing the Minix FS Patch** Okay, so the configuration is definitely targeting `MINIX_FS`. My focus here is to identify key symbols introduced or modified by this patch, the ones most likely to yield interesting fuzzing targets. Looking at the changes, I've got a solid list of potential functions to include in my `FocusSymbols`: `minix_dio_read_iter`, `minix_dio_write_iter`, `minix_file_read_iter`, `minix_file_write_iter`, `minix_writeback_range`, `minix_writepages`, `minix_read_folio`, `minix_readahead`, `minix_bmap`, `minix_iomap_begin`, `minix_iomap_end`, `V1_minix_iomap_begin`, and `V2_minix_iomap_begin`. I've quickly confirmed the function names against the patch's changes, just to ensure accuracy. Based on this, I'm confident that all of these functions represent entry points or critical operations within the Minix filesystem implementation. They're strong candidates for detailed fuzzing analysis because they are newly introduced or altered, making them prime targets for uncovering potential vulnerabilities. Now, I'm ready to move forward and set the results accordingly. |
| 6/2 | 2026/06/25 22:11 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"MINIX_FS"
],
"FocusSymbols": [
"minix_dio_read_iter",
"minix_dio_write_end_io",
"minix_dio_write_iter",
"minix_file_read_iter",
"minix_file_write_iter",
"minix_file_open",
"minix_writeback_range",
"minix_writepages",
"minix_read_folio",
"minix_readahead",
"minix_bmap",
"minix_iomap_begin",
"minix_iomap_end",
"V1_minix_iomap_begin",
"V2_minix_iomap_begin"
],
"Reasoning": "The patch introduces iomap support for the minix filesystem, replacing older buffer_head-based operations for regular files. This is a significant functional change to the core read/write/mmap logic of the minix filesystem and should be heavily fuzzed to ensure no regressions or vulnerabilities are introduced.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"MINIX_FS"
],
"FocusSymbols": [
"minix_dio_read_iter",
"minix_dio_write_end_io",
"minix_dio_write_iter",
"minix_file_read_iter",
"minix_file_write_iter",
"minix_file_open",
"minix_writeback_range",
"minix_writepages",
"minix_read_folio",
"minix_readahead",
"minix_bmap",
"minix_iomap_begin",
"minix_iomap_end",
"V1_minix_iomap_begin",
"V2_minix_iomap_begin"
],
"Reasoning": "The patch introduces iomap support for the minix filesystem, replacing older buffer_head-based operations for regular files. This is a significant functional change to the core read/write/mmap logic of the minix filesystem and should be heavily fuzzed to ensure no regressions or vulnerabilities are introduced.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|