AI Trajectory

null

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the core logic in `find_next_to_unuse` used during `swapoff` to skip empty swap clusters. This alters the execution flow of swap deallocation and is reachable via the `swapoff` syscall.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 31e462c86c0eb46b66f9613adfe04045ace6830a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Aug 5 16:38:28 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/swap.h b/include/linux/swap.h\nindex 2cb1d29307c54..2b14e2e9673b4 100644\n--- a/include/linux/swap.h\n+++ b/include/linux/swap.h\n@@ -246,7 +246,7 @@ struct swap_info_struct {\n \tstruct plist_node list;\t\t/* entry in swap_active_head */\n \tsigned char\ttype;\t\t/* strange name for an index */\n \tunsigned int\tmax;\t\t/* size of this swap device */\n-\tstruct swap_cluster_info *cluster_info; /* cluster info. Only for SSD */\n+\tstruct swap_cluster_info *cluster_info; /* array, one entry per cluster */\n \tstruct list_head free_clusters; /* free clusters list */\n \tstruct list_head full_clusters; /* full clusters list */\n \tstruct list_head nonfull_clusters[SWAP_NR_ORDERS];\ndiff --git a/mm/swapfile.c b/mm/swapfile.c\nindex dea2d3b36e06f..36e4e8884b764 100644\n--- a/mm/swapfile.c\n+++ b/mm/swapfile.c\n@@ -370,8 +370,6 @@ static void discard_swap_cluster(struct swap_info_struct *si,\n \t}\n }\n \n-#define LATENCY_LIMIT\t\t256\n-\n static inline bool cluster_is_empty(struct swap_cluster_info *info)\n {\n \treturn info-\u003ecount == 0;\n@@ -2763,7 +2761,9 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type)\n static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n \t\t\t\t\tunsigned int prev)\n {\n-\tunsigned int i;\n+\tstruct swap_cluster_info *ci;\n+\tunsigned long i, end;\n+\tunsigned int ci_off;\n \tunsigned long swp_tb;\n \n \t/*\n@@ -2772,19 +2772,34 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n \t * hits are okay, and sys_swapoff() has already prevented new\n \t * allocations from this area (while holding swap_lock).\n \t */\n-\tfor (i = prev + 1; i \u003c si-\u003emax; i++) {\n-\t\tswp_tb = swap_table_get(__swap_offset_to_cluster(si, i),\n-\t\t\t\t\ti % SWAPFILE_CLUSTER);\n-\t\tif (!swp_tb_is_null(swp_tb) \u0026\u0026 !swp_tb_is_bad(swp_tb))\n-\t\t\tbreak;\n-\t\tif ((i % LATENCY_LIMIT) == 0)\n+\ti = prev + 1;\n+\twhile (i \u003c si-\u003emax) {\n+\t\tci = __swap_offset_to_cluster(si, i);\n+\t\tci_off = i % SWAPFILE_CLUSTER;\n+\t\tend = i - ci_off + SWAPFILE_CLUSTER;\n+\n+\t\t/*\n+\t\t * An empty cluster has no slot in use, so skip it whole.\n+\t\t * A slot is uncounted only after its folio left the swap\n+\t\t * cache, so there is nothing here for try_to_unuse() to act on.\n+\t\t * Count only drops here, so a READ_ONCE() without ci-\u003elock is\n+\t\t * enough, unlike in every other cluster_is_empty() caller.\n+\t\t */\n+\t\tif (!READ_ONCE(ci-\u003ecount)) {\n+\t\t\ti = end;\n \t\t\tcond_resched();\n-\t}\n+\t\t\tcontinue;\n+\t\t}\n \n-\tif (i == si-\u003emax)\n-\t\ti = 0;\n+\t\tfor (; i \u003c end; ci_off++, i++) {\n+\t\t\tswp_tb = swap_table_get(ci, ci_off);\n+\t\t\tif (!swp_tb_is_null(swp_tb) \u0026\u0026 !swp_tb_is_bad(swp_tb))\n+\t\t\t\treturn i;\n+\t\t}\n+\t\tcond_resched();\n+\t}\n \n-\treturn i;\n+\treturn 0;\n }\n \n static int try_to_unuse(unsigned int type)\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the core logic in `find_next_to_unuse` used during `swapoff` to skip empty swap clusters. This alters the execution flow of swap deallocation and is reachable via the `swapoff` syscall.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 31e462c86c0eb46b66f9613adfe04045ace6830a
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Aug 5 16:38:28 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/swap.h b/include/linux/swap.h
index 2cb1d29307c54..2b14e2e9673b4 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -246,7 +246,7 @@ struct swap_info_struct {
 	struct plist_node list;		/* entry in swap_active_head */
 	signed char	type;		/* strange name for an index */
 	unsigned int	max;		/* size of this swap device */
-	struct swap_cluster_info *cluster_info; /* cluster info. Only for SSD */
+	struct swap_cluster_info *cluster_info; /* array, one entry per cluster */
 	struct list_head free_clusters; /* free clusters list */
 	struct list_head full_clusters; /* full clusters list */
 	struct list_head nonfull_clusters[SWAP_NR_ORDERS];
diff --git a/mm/swapfile.c b/mm/swapfile.c
index dea2d3b36e06f..36e4e8884b764 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -370,8 +370,6 @@ static void discard_swap_cluster(struct swap_info_struct *si,
 	}
 }
 
-#define LATENCY_LIMIT		256
-
 static inline bool cluster_is_empty(struct swap_cluster_info *info)
 {
 	return info->count == 0;
@@ -2763,7 +2761,9 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type)
 static unsigned int find_next_to_unuse(struct swap_info_struct *si,
 					unsigned int prev)
 {
-	unsigned int i;
+	struct swap_cluster_info *ci;
+	unsigned long i, end;
+	unsigned int ci_off;
 	unsigned long swp_tb;
 
 	/*
@@ -2772,19 +2772,34 @@ static unsigned int find_next_to_unuse(struct swap_info_struct *si,
 	 * hits are okay, and sys_swapoff() has already prevented new
 	 * allocations from this area (while holding swap_lock).
 	 */
-	for (i = prev + 1; i < si->max; i++) {
-		swp_tb = swap_table_get(__swap_offset_to_cluster(si, i),
-					i % SWAPFILE_CLUSTER);
-		if (!swp_tb_is_null(swp_tb) && !swp_tb_is_bad(swp_tb))
-			break;
-		if ((i % LATENCY_LIMIT) == 0)
+	i = prev + 1;
+	while (i < si->max) {
+		ci = __swap_offset_to_cluster(si, i);
+		ci_off = i % SWAPFILE_CLUSTER;
+		end = i - ci_off + SWAPFILE_CLUSTER;
+
+		/*
+		 * An empty cluster has no slot in use, so skip it whole.
+		 * A slot is uncounted only after its folio left the swap
+		 * cache, so there is nothing here for try_to_unuse() to act on.
+		 * Count only drops here, so a READ_ONCE() without ci->lock is
+		 * enough, unlike in every other cluster_is_empty() caller.
+		 */
+		if (!READ_ONCE(ci->count)) {
+			i = end;
 			cond_resched();
-	}
+			continue;
+		}
 
-	if (i == si->max)
-		i = 0;
+		for (; i < end; ci_off++, i++) {
+			swp_tb = swap_table_get(ci, ci_off);
+			if (!swp_tb_is_null(swp_tb) && !swp_tb_is_bad(swp_tb))
+				return i;
+		}
+		cond_resched();
+	}
 
-	return i;
+	return 0;
 }
 
 static int try_to_unuse(unsigned int type)

gemini-3.1-pro-preview

null

null

							input: 2929
							output: 32
							thoughts: 147
						

**Fuzzing the Swap-Off Optimization**

Okay, so I've got this patch affecting `mm/swapfile.c` and `include/linux/swap.h`. It's pretty focused; the key modification is to `find_next_to_unuse` within `mm/swapfile.c`. From a quick glance, it looks like a targeted optimization to skip empty clusters when searching for the next swap entry to unuse. This directly impacts the swapoff functionality, specifically the `try_to_unuse` path. Definitely worth taking a close look at this patch.

My initial thought is that this is critical core kernel logic, particularly because it's related to swapoff. Because of this and the nature of the change, this is prime candidate for fuzzing.

Now, let's dive into the code a bit deeper. I need to understand the relationship between `find_next_to_unuse` and `try_to_unuse`. I recall that `try_to_unuse` is involved in the `sys_swapoff` (or `ksys_swapoff`) system call path. I should probably quickly verify that assumption before proceeding with more detailed analysis.

{
  "Expression": "try_to_unuse",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=1314=static void swap_range_free(struct swap_info_struct *si, unsigned long offset,\n--\nmm/swapfile.c-1336-\t/*\nmm/swapfile.c:1337:\t * Make sure that try_to_unuse() observes si-\u003einuse_pages reaching 0\nmm/swapfile.c-1338-\t * only after the above cleanups are done.\n--\nmm/swapfile.c=2471=static int unuse_pte(struct vm_area_struct *vma, pmd_t *pmd,\n--\nmm/swapfile.c-2482-\t * If the folio is removed from swap cache by others, continue to\nmm/swapfile.c:2483:\t * unuse other PTEs. try_to_unuse may try again if we missed this one.\nmm/swapfile.c-2484-\t */\n--\nmm/swapfile.c=2761=static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n--\nmm/swapfile.c-2783-\t\t * A slot is uncounted only after its folio left the swap\nmm/swapfile.c:2784:\t\t * cache, so there is nothing here for try_to_unuse() to act on.\nmm/swapfile.c-2785-\t\t * Count only drops here, so a READ_ONCE() without ci-\u003elock is\n--\nmm/swapfile.c-2804-\nmm/swapfile.c:2805:static int try_to_unuse(unsigned int type)\nmm/swapfile.c-2806-{\n--\nmm/swapfile.c-2899-\t/*\nmm/swapfile.c:2900:\t * Make sure that further cleanups after try_to_unuse() returns happen\nmm/swapfile.c-2901-\t * after swap_range_free() reduces si-\u003einuse_pages to 0.\n--\nmm/swapfile.c-2907-/*\nmm/swapfile.c:2908: * After a successful try_to_unuse, if no swap is now in use, we know\nmm/swapfile.c-2909- * we can empty the mmlist.  swap_lock must be held on entry and exit.\n--\nmm/swapfile.c=3151=SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)\n--\nmm/swapfile.c-3211-\tset_current_oom_origin();\nmm/swapfile.c:3212:\terr = try_to_unuse(p-\u003etype);\nmm/swapfile.c-3213-\tclear_current_oom_origin();\n"
}

gemini-3.1-pro-preview

null

null

							input: 4062
							output: 34
							thoughts: 194
						

**Analyzing the Swapoff Implementation**

Okay, so this patch is clearly touching the code that governs how swap space is deactivated. Specifically, it seems to be changing `find_next_to_unuse`, which itself feeds into `try_to_unuse`, and ultimately, `sys_swapoff`. From a functional standpoint, this is definitely a reachable code path, so that's good. My instinct is that this area warrants a fuzzing campaign focused on the `sys_swapoff` and `try_to_unuse` functions.

Wait a second. I need to make sure I'm thinking about this correctly. Since `find_next_to_unuse` and `try_to_unuse` are both static, the actual syscall interface has to be `__x64_sys_swapoff` or `sys_swapoff`. That's the entry point to investigate further, but I need to ensure I'm getting the right entrypoint.

Just to be thorough, I should check `mm/swapfile.c` for both `try_to_unuse` and `find_next_to_unuse` to be sure. That's the likely location for these functions.

{
  "Expression": "find_next_to_unuse",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=2733=static int unuse_mm(struct mm_struct *mm, unsigned int type)\n--\nmm/swapfile.c-2760- */\nmm/swapfile.c:2761:static unsigned int find_next_to_unuse(struct swap_info_struct *si,\nmm/swapfile.c-2762-\t\t\t\t\tunsigned int prev)\n--\nmm/swapfile.c=2805=static int try_to_unuse(unsigned int type)\n--\nmm/swapfile.c-2858-\t       !signal_pending(current) \u0026\u0026\nmm/swapfile.c:2859:\t       (i = find_next_to_unuse(si, i)) != 0) {\nmm/swapfile.c-2860-\n"
}

gemini-3.1-pro-preview

null

null

							input: 4761
							output: 23
							thoughts: 37
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing the Swap Deactivation Entry Point**

Right, so `sys_swapoff` is the key function we're looking at here, the main entry point for the entire swap deactivation process. Let me quickly scan for any potential configurations that might influence its behavior. We're obviously dealing with swap itself, and the base enabling condition for all this is, as expected, `CONFIG_SWAP`. Good, that makes sense. So, with `CONFIG_SWAP` enabled we're at least in the right ballpark. Let's see what else we can uncover.

{
  "Expression": "config SWAP",
  "PathPrefix": ""
}

{
  "Output": "arch/mips/Kconfig=1263=config MIPS_SPRAM\n--\narch/mips/Kconfig-1265-\narch/mips/Kconfig:1266:config SWAP_IO_SPACE\narch/mips/Kconfig-1267-\tbool\n--\narch/sh/Kconfig=126=config IO_TRAPPED\n--\narch/sh/Kconfig-128-\narch/sh/Kconfig:129:config SWAP_IO_SPACE\narch/sh/Kconfig-130-\tbool\n--\nmm/Kconfig=9=config ARCH_NO_SWAP\n--\nmm/Kconfig-11-\nmm/Kconfig:12:menuconfig SWAP\nmm/Kconfig-13-\tbool \"Support for paging of anonymous memory (swap)\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 5172
							output: 35
							thoughts: 199
						

**Analyzing the Swap Configuration and Functionality**

Okay, so I'm looking at this patch and the first thing that jumps out is `CONFIG_SWAP`. Is there *anything* else configuration-wise that's relevant here? I need to be thorough. The changes are in `include/linux/swap.h` and `mm/swapfile.c`, which makes sense. Just to be sure, I should verify that `SWAP` isn't listed and make sure `CONFIG_SWAP` is defined in the configuration. Although, `SWAP` is almost always enabled by default, it is always wise to explicitly declare `CONFIG_SWAP`.

Next, I need to understand the entry points. Let me see... I see `find_next_to_unuse` and `try_to_unuse` which are static functions; those won't be exposed directly. The key here seems to be `sys_swapoff`, which *is* a syscall. That's the only direct entry point I see, so it makes sense to confirm that.

Alright, double-checking, yes, `sys_swapoff` is the system call. Now, I need to carefully examine `mm/swapfile.c` to see precisely how `sys_swapoff` is implemented and what the dependencies are.

{
  "Expression": "SYSCALL_DEFINE1\\(swapoff",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=3133=static void flush_percpu_swap_cluster(struct swap_info_struct *si)\n--\nmm/swapfile.c-3150-\nmm/swapfile.c:3151:SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)\nmm/swapfile.c-3152-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 5790
							output: 34
							thoughts: 158
						

**Analyzing the Kernel's `sys_swapoff` Implementation**

Okay, I'm going to start by focusing on `sys_swapoff`. Let's see how that's implemented. Aha, it looks like it's defined using `SYSCALL_DEFINE1(swapoff, ...)`. That means the real function name might be `__x64_sys_swapoff`, `__se_sys_swapoff`, or just plain `sys_swapoff`. In most syzkaller cases, specifying `sys_swapoff` or `__x64_sys_swapoff` is sufficient. So, `sys_swapoff` should be just fine here.

Now, a quick check of the source code reveals that `try_to_unuse` is declared as `static`, which is interesting. Wait a minute, it's not inlined, and it's a relatively large function. I want to confirm whether or not it has been inlined. Let me investigate.

{
  "Expression": "static int try_to_unuse",
  "PathPrefix": "mm/swapfile.c"
}

{
  "Output": "mm/swapfile.c=2761=static unsigned int find_next_to_unuse(struct swap_info_struct *si,\n--\nmm/swapfile.c-2804-\nmm/swapfile.c:2805:static int try_to_unuse(unsigned int type)\nmm/swapfile.c-2806-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 6295
							output: 32
							thoughts: 128
						

**Analyzing Swapoff Functionality for Syzkaller Integration**

Okay, so I'm looking at this `try_to_unuse` function – it's pretty hefty, and not marked inline, which is immediately a red flag. I need to figure out the most effective way to integrate this functionality with Syzkaller for fuzzing. I was initially leaning toward including both `try_to_unuse` and `sys_swapoff` in my analysis.

Then I remembered Syzkaller's preference for non-static, non-inlined API entrypoints over internal static helper functions. This changes things. `sys_swapoff` is likely a better target. It's a syscall, and Syzkaller is definitely familiar with it as `sys_swapoff`.

I'm double-checking. Is there anything else? No, `sys_swapoff` looks like the only function that is a system call.

Now, I'll quickly check if `CONFIG_SWAP` is the only relevant configuration option. Need to make sure the fuzz target is as straightforward as possible.

{
  "Expression": "obj-\\$\\(CONFIG_SWAP\\)",
  "PathPrefix": "mm/Makefile"
}

{
  "Output": "mm/Makefile=76=endif\nmm/Makefile-77-\nmm/Makefile:78:obj-$(CONFIG_SWAP)\t+= page_io.o swap_state.o swapfile.o\nmm/Makefile-79-obj-$(CONFIG_ZSWAP)\t+= zswap.o\n"
}

gemini-3.1-pro-preview

null

null

							input: 6770
							output: 90
							thoughts: 298
						

**Analyzing the Swapoff Patch**

Okay, so `CONFIG_SWAP` is definitely needed for this. Let's revisit this patch. It looks like the main change is in `find_next_to_unuse`, where it's being modified to skip empty clusters. This is a performance tweak, but it directly impacts the core logic of how swap entries are found during `swapoff`. This means it *could* introduce subtle, unexpected behavior during swap deallocation. It's almost certainly functionally correct, and therefore I need to fuzz this thoroughly.

My reasoning? The patch is fundamentally changing how we find swap entries during `swapoff`. This is exposed through the `swapoff` system call. The focus symbols are clearly `sys_swapoff`. We need `CONFIG_SWAP` enabled.

Now, a quick check. Is `sys_swapoff` the correct symbol name? I'm pretty sure it is, but let's confirm. Yes, `SYSCALL_DEFINE1(swapoff, ...)` expands to `sys_swapoff`, and there are architecture-specific wrappers. Syzkaller can handle either `sys_swapoff` or `__x64_sys_swapoff`. `sys_swapoff` is the canonical name, and therefore I will provide that.

Ah, and I remember from the prompt: "Prefer non-static, non-inlined API entrypoint functions over internal static helper functions". `sys_swapoff` fits that description perfectly. Great. I think I'm ready to write the response now.

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the core logic in `find_next_to_unuse` used during `swapoff` to skip empty swap clusters. This alters the execution flow of swap deallocation and is reachable via the `swapoff` syscall.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "SWAP"
  ],
  "FocusSymbols": [
    "sys_swapoff"
  ],
  "Reasoning": "The patch modifies the core logic in `find_next_to_unuse` used during `swapoff` to skip empty swap clusters. This alters the execution flow of swap deallocation and is reachable via the `swapoff` syscall.",
  "WorthFuzzing": true
}