AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/25 14:11	flow	patch-triage	10m Args: null Results: { "EnableConfigs": [ "NETFS_SUPPORT", "CACHEFILES", "9P_FS", "NET_9P", "CIFS", "CEPH_FS", "AFS_FS", "NFS_FS", "NFS_FSCACHE" ], "FocusSymbols": [ "cachefiles_set_object_xattr", "cachefiles_check_auxdata", "netfs_readahead", "netfs_read_folio", "netfs_write_begin", "netfs_prefetch_for_write", "netfs_unbuffered_write_iter_locked", "netfs_wait_for_put_ra_refs", "netfs_alloc_request", "netfs_read_set_unlock_at", "netfs_read_subreq_progress", "netfs_unlock_abandoned_read_pages", "netfs_read_single", "rolling_buffer_bulk_load_from_ra", "netfs_prepare_write" ], "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.", "NeedsKMSAN": true, "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.", "WorthFuzzing": true }
1/1	2026/08/25 14:11	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 973032d62ca4dc98bf40ee8ea0fc4e48fdbf7eb9\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Aug 25 14:11:17 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c\nindex f8ae78b3f7b6d..c70bf67e52b01 100644\n--- a/fs/cachefiles/xattr.c\n+++ b/fs/cachefiles/xattr.c\n@@ -13,6 +13,7 @@\n #include \u003clinux/quotaops.h\u003e\n #include \u003clinux/xattr.h\u003e\n #include \u003clinux/slab.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n #include \"internal.h\"\n \n #define CACHEFILES_COOKIE_TYPE_DATA 1\n@@ -50,7 +51,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object)\n \n \t_enter(\"%x,#%d\", object-\u003edebug_id, len);\n \n-\tbuf = kmalloc(sizeof(struct cachefiles_xattr) + len, GFP_KERNEL);\n+\tbuf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);\n \tif (!buf)\n \t\treturn -ENOMEM;\n \n@@ -60,6 +61,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object)\n \tbuf-\u003econtent\t\t= object-\u003econtent_info;\n \tif (test_bit(FSCACHE_COOKIE_LOCAL_WRITE, \u0026object-\u003ecookie-\u003eflags))\n \t\tbuf-\u003econtent\t= CACHEFILES_CONTENT_DIRTY;\n+\tput_unaligned_be64(0, (__be64 )buf-\u003edata);\n \tif (len \u003e 0)\n \t\tmemcpy(buf-\u003edata, fscache_get_aux(object-\u003ecookie), len);\n \n@@ -77,8 +79,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object)\n \t\ttrace_cachefiles_vfs_error(object, file_inode(file), ret,\n \t\t\t\t\t cachefiles_trace_setxattr_error);\n \t\ttrace_cachefiles_coherency(object, file_inode(file)-\u003ei_ino,\n-\t\t\t\t\t be64_to_cpup((__be64 )buf-\u003edata),\n-\t\t\t\t\t buf-\u003econtent,\n+\t\t\t\t\t buf-\u003edata, buf-\u003econtent,\n \t\t\t\t\t cachefiles_coherency_set_fail);\n \t\tif (ret != -ENOMEM)\n \t\t\tcachefiles_io_error_obj(\n@@ -86,8 +87,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object)\n \t\t\t\t\"Failed to set xattr with error %d\", ret);\n \t} else {\n \t\ttrace_cachefiles_coherency(object, file_inode(file)-\u003ei_ino,\n-\t\t\t\t\t be64_to_cpup((__be64 )buf-\u003edata),\n-\t\t\t\t\t buf-\u003econtent,\n+\t\t\t\t\t buf-\u003edata, buf-\u003econtent,\n \t\t\t\t\t cachefiles_coherency_set_ok);\n \t}\n \n@@ -110,9 +110,10 @@ int cachefiles_check_auxdata(struct cachefiles_object object, struct file file\n \tint ret = -ESTALE;\n \n \ttlen = sizeof(struct cachefiles_xattr) + len;\n-\tbuf = kmalloc(tlen, GFP_KERNEL);\n+\tbuf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);\n \tif (!buf)\n \t\treturn -ENOMEM;\n+\tput_unaligned_be64(0, (__be64 )buf-\u003edata);\n \n \txlen = cachefiles_inject_read_error();\n \tif (xlen == 0)\n@@ -148,8 +149,7 @@ int cachefiles_check_auxdata(struct cachefiles_object object, struct file file\n \n out:\n \ttrace_cachefiles_coherency(object, file_inode(file)-\u003ei_ino,\n-\t\t\t\t be64_to_cpup((__be64 )buf-\u003edata),\n-\t\t\t\t buf-\u003econtent, why);\n+\t\t\t\t buf-\u003edata, buf-\u003econtent, why);\n \tkfree(buf);\n \treturn ret;\n }\ndiff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c\nindex 7fdfa4f27e349..a2a9d8c083f99 100644\n--- a/fs/netfs/buffered_read.c\n+++ b/fs/netfs/buffered_read.c\n@@ -54,6 +54,42 @@ static void netfs_rreq_expand(struct netfs_io_request rreq,\n \t}\n }\n \n+/\n+ Drop the folio refs acquired from the readahead API.\n+ /\n+static void netfs_bulk_drop_ra_refs(struct netfs_io_request rreq)\n+{\n+\tstruct folio_batch fbatch;\n+\tstruct folio folio;\n+\tpgoff_t nr_pages = DIV_ROUND_UP(rreq-\u003elen, PAGE_SIZE);\n+\tpgoff_t first = rreq-\u003estart / PAGE_SIZE;\n+\tXA_STATE(xas, \u0026rreq-\u003emapping-\u003ei_pages, first);\n+\n+\tfolio_batch_init(\u0026fbatch);\n+\n+\trcu_read_lock();\n+\n+\txas_for_each(\u0026xas, folio, first + nr_pages - 1) {\n+\t\tif (xas_retry(\u0026xas, folio))\n+\t\t\tcontinue;\n+\n+\t\tif (!folio_batch_add(\u0026fbatch, folio))\n+\t\t\tfolio_batch_release(\u0026fbatch);\n+\t}\n+\n+\trcu_read_unlock();\n+\tfolio_batch_release(\u0026fbatch);\n+\ttrace_netfs_rreq(rreq, netfs_rreq_trace_ra_put_ref);\n+\tclear_bit_unlock(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags);\n+\twake_up(\u0026rreq-\u003ewaitq);\n+}\n+\n+static void netfs_maybe_bulk_drop_ra_refs(struct netfs_io_request rreq)\n+{\n+\tif (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\tnetfs_bulk_drop_ra_refs(rreq);\n+}\n+\n /\n Begin an operation, and fetch the stored zero point value from the cookie if\n * available.\n@@ -74,12 +110,8 @@ static int netfs_begin_cache_read(struct netfs_io_request rreq, struct netfs_in\n \n * Returns the limited size if successful and -ENOMEM if insufficient memory\n * available.\n- \n- [!] NOTE: This must be run in the same thread as -\u003eissue_read() was called\n- * in as we access the readahead_control struct.\n /\n-static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq,\n-\t\t\t\t\t struct readahead_control ractl)\n+static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq)\n {\n \tstruct netfs_io_request rreq = subreq-\u003erreq;\n \tsize_t rsize = subreq-\u003elen;\n@@ -87,30 +119,6 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq,\n \tif (subreq-\u003esource == NETFS_DOWNLOAD_FROM_SERVER)\n \t\trsize = umin(rsize, rreq-\u003eio_streams[0].sreq_max_len);\n \n-\tif (ractl) {\n-\t\t/* If we don't have sufficient folios in the rolling buffer,\n-\t\t * extract a folioq's worth from the readahead region at a time\n-\t\t * into the buffer. Note that this acquires a ref on each page\n-\t\t * that we will need to release later - but we don't want to do\n-\t\t * that until after we've started the I/O.\n-\t\t /\n-\t\tstruct folio_batch put_batch;\n-\n-\t\tfolio_batch_init(\u0026put_batch);\n-\t\twhile (rreq-\u003esubmitted \u003c subreq-\u003estart + rsize) {\n-\t\t\tssize_t added;\n-\n-\t\t\tadded = rolling_buffer_load_from_ra(\u0026rreq-\u003ebuffer, ractl,\n-\t\t\t\t\t\t\t \u0026put_batch);\n-\t\t\tif (added \u003c 0) {\n-\t\t\t\tfolio_batch_release(\u0026put_batch);\n-\t\t\t\treturn added;\n-\t\t\t}\n-\t\t\trreq-\u003esubmitted += added;\n-\t\t}\n-\t\tfolio_batch_release(\u0026put_batch);\n-\t}\n-\n \tsubreq-\u003elen = rsize;\n \tif (unlikely(rreq-\u003eio_streams[0].sreq_max_segs)) {\n \t\tsize_t limit = netfs_limit_iter(\u0026rreq-\u003ebuffer.iter, 0, rsize,\n@@ -208,8 +216,7 @@ static void netfs_issue_read(struct netfs_io_request rreq,\n * slicing up the region to be read according to available cache blocks and\n * network rsize.\n /\n-static void netfs_read_to_pagecache(struct netfs_io_request rreq,\n-\t\t\t\t struct readahead_control ractl)\n+static void netfs_read_to_pagecache(struct netfs_io_request rreq)\n {\n \tunsigned long long start = rreq-\u003estart;\n \tssize_t size = rreq-\u003elen;\n@@ -288,7 +295,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request rreq,\n \t\tbreak;\n \n \tissue:\n-\t\tslice = netfs_prepare_read_iterator(subreq, ractl);\n+\t\tslice = netfs_prepare_read_iterator(subreq);\n \t\tif (slice \u003c 0) {\n \t\t\tret = slice;\n \t\t\tnetfs_cancel_read(subreq, ret);\n@@ -302,6 +309,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request rreq,\n \t\t}\n \n \t\tnetfs_issue_read(rreq, subreq);\n+\t\tnetfs_maybe_bulk_drop_ra_refs(rreq);\n \n \t\tif (test_bit(NETFS_RREQ_PAUSE, \u0026rreq-\u003eflags))\n \t\t\tnetfs_wait_for_paused_read(rreq);\n@@ -339,7 +347,8 @@ void netfs_readahead(struct readahead_control ractl)\n {\n \tstruct netfs_io_request rreq;\n \tstruct netfs_inode ictx = netfs_inode(ractl-\u003emapping-\u003ehost);\n-\tunsigned long long start = readahead_pos(ractl);\n+\tssize_t added;\n+\tuoff_t start = readahead_pos(ractl);\n \tsize_t size = readahead_length(ractl);\n \tint ret;\n \n@@ -360,11 +369,24 @@ void netfs_readahead(struct readahead_control ractl)\n \n \tnetfs_rreq_expand(rreq, ractl);\n \n-\trreq-\u003esubmitted = rreq-\u003estart;\n-\tif (rolling_buffer_init(\u0026rreq-\u003ebuffer, rreq-\u003edebug_id, ITER_DEST, rreq-\u003egfp) \u003c 0)\n+\t/* Load the folios to be read into a bvecq chain. Note that this\n+\t * acquires a ref on each folio that we will need to release later -\n+\t * but we don't want to do that until after we've started the I/O.\n+\t /\n+\tadded = rolling_buffer_bulk_load_from_ra(\u0026rreq-\u003ebuffer, ractl,\n+\t\t\t\t\t\t rreq-\u003edebug_id, rreq-\u003egfp);\n+\tif (added \u003c 0) {\n+\t\tret = added;\n \t\tgoto cleanup_free;\n-\tnetfs_read_to_pagecache(rreq, ractl);\n+\t}\n+\t__set_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags);\n+\n+\trreq-\u003esubmitted = rreq-\u003estart + added;\n+\trreq-\u003ecleaned_to = rreq-\u003estart;\n+\tnetfs_read_set_unlock_at(rreq);\n \n+\tnetfs_read_to_pagecache(rreq);\n+\tnetfs_maybe_bulk_drop_ra_refs(rreq);\n \treturn netfs_put_request(rreq, netfs_rreq_trace_put_return);\n \n cleanup_free:\n@@ -387,6 +409,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request rreq, struct fo\n \tif (added \u003c 0)\n \t\treturn added;\n \trreq-\u003esubmitted = rreq-\u003estart + added;\n+\trreq-\u003eprogress_at = added;\n \treturn 0;\n }\n \n@@ -457,7 +480,7 @@ static int netfs_read_gaps(struct file file, struct folio folio)\n \tiov_iter_bvec(\u0026rreq-\u003ebuffer.iter, ITER_DEST, bvec, i, rreq-\u003elen);\n \trreq-\u003esubmitted = rreq-\u003estart + flen;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \n \tret = netfs_wait_for_read(rreq);\n \tif (ret \u003e= 0) {\n@@ -532,7 +555,7 @@ int netfs_read_folio(struct file file, struct folio folio)\n \tif (ret \u003c 0)\n \t\tgoto discard;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \tret = netfs_wait_for_read(rreq);\n \tnetfs_put_request(rreq, netfs_rreq_trace_put_return);\n \treturn ret \u003c 0 ? ret : 0;\n@@ -689,7 +712,7 @@ int netfs_write_begin(struct netfs_inode ctx,\n \tif (ret \u003c 0)\n \t\tgoto error_put;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \tret = netfs_wait_for_read(rreq);\n \tnetfs_put_request(rreq, netfs_rreq_trace_put_return);\n \tif (ret \u003c 0)\n@@ -754,7 +777,7 @@ int netfs_prefetch_for_write(struct file file, struct folio folio,\n \tif (ret \u003c 0)\n \t\tgoto error_put;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \tret = netfs_wait_for_read(rreq);\n \tnetfs_put_request(rreq, netfs_rreq_trace_put_return);\n \treturn ret \u003c 0 ? ret : 0;\ndiff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c\nindex c16fbad286a17..7173ce04bac63 100644\n--- a/fs/netfs/direct_write.c\n+++ b/fs/netfs/direct_write.c\n@@ -21,7 +21,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request wreq)\n \t/* Okay, declare that all I/O is complete. /\n \ttrace_netfs_rreq(wreq, netfs_rreq_trace_write_done);\n \n-\tif (!wreq-\u003eerror)\n+\tif (wreq-\u003etransferred)\n \t\tnetfs_update_i_size(ictx, \u0026ictx-\u003einode, wreq-\u003estart, wreq-\u003etransferred);\n \n \tif (wreq-\u003eorigin == NETFS_DIO_WRITE \u0026\u0026\n@@ -51,7 +51,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request wreq)\n \t\twreq-\u003eiocb-\u003eki_pos += written;\n \t\tif (wreq-\u003eiocb-\u003eki_complete) {\n \t\t\ttrace_netfs_rreq(wreq, netfs_rreq_trace_ki_complete);\n-\t\t\twreq-\u003eiocb-\u003eki_complete(wreq-\u003eiocb, wreq-\u003eerror ?: written);\n+\t\t\twreq-\u003eiocb-\u003eki_complete(wreq-\u003eiocb, written ?: wreq-\u003eerror);\n \t\t}\n \t\twreq-\u003eiocb = VFS_PTR_POISON;\n \t}\n@@ -95,7 +95,7 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq)\n {\n \tstruct netfs_io_subrequest subreq = NULL;\n \tstruct netfs_io_stream stream = \u0026wreq-\u003eio_streams[0];\n-\tint ret;\n+\tint ret = 0;\n \n \t_enter(\"%llx\", wreq-\u003elen);\n \n@@ -110,6 +110,10 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq)\n \t\tif (!subreq) {\n \t\t\tnetfs_prepare_write(wreq, stream, wreq-\u003estart + wreq-\u003etransferred);\n \t\t\tsubreq = stream-\u003econstruct;\n+\t\t\tif (!subreq) {\n+\t\t\t\tret = -ENOMEM;\n+\t\t\t\tbreak;\n+\t\t\t}\n \t\t\tstream-\u003econstruct = NULL;\n \t\t}\n \n@@ -121,8 +125,14 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq)\n \t\t}\n \n \t\tiov_iter_truncate(\u0026subreq-\u003eio_iter, wreq-\u003elen - wreq-\u003etransferred);\n-\t\tif (!iov_iter_count(\u0026subreq-\u003eio_iter))\n+\t\tif (!iov_iter_count(\u0026subreq-\u003eio_iter)) {\n+\t\t\tpr_warn(\"netfs: Unexpected zero-length iterator R=%08x\\n\",\n+\t\t\t\twreq-\u003edebug_id);\n+\t\t\t__set_bit(NETFS_SREQ_FAILED, \u0026subreq-\u003eflags);\n+\t\t\tnetfs_write_subrequest_terminated(subreq, -EIO);\n+\t\t\twreq-\u003eerror = -EIO;\n \t\t\tbreak;\n+\t\t}\n \n \t\tsubreq-\u003elen = netfs_limit_iter(\u0026subreq-\u003eio_iter, 0,\n \t\t\t\t\t stream-\u003esreq_max_len,\n@@ -139,13 +149,11 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq)\n \t\tif (test_bit(NETFS_SREQ_NEED_RETRY, \u0026subreq-\u003eflags)) {\n \t\t\tretry = true;\n \t\t} else if (test_bit(NETFS_SREQ_FAILED, \u0026subreq-\u003eflags)) {\n-\t\t\tret = subreq-\u003eerror;\n-\t\t\twreq-\u003eerror = ret;\n+\t\t\twreq-\u003eerror = subreq-\u003eerror;\n \t\t\tnetfs_see_subrequest(subreq, netfs_sreq_trace_see_failed);\n \t\t\tsubreq = NULL;\n \t\t\tbreak;\n \t\t}\n-\t\tret = 0;\n \n \t\tif (!retry) {\n \t\t\tnetfs_unbuffered_write_collect(wreq, stream, subreq);\n@@ -288,11 +296,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb iocb, struct iov_iter \n \t\tret = -EIOCBQUEUED;\n \t} else {\n \t\tret = netfs_unbuffered_write(wreq);\n-\t\tif (ret \u003c 0) {\n-\t\t\t_debug(\"begin = %zd\", ret);\n-\t\t} else {\n+\t\tif (wreq-\u003etransferred) {\n \t\t\tiocb-\u003eki_pos += wreq-\u003etransferred;\n-\t\t\tret = wreq-\u003etransferred ?: wreq-\u003eerror;\n+\t\t\tret = wreq-\u003etransferred;\n+\t\t} else if (wreq-\u003eerror) {\n+\t\t\tret = wreq-\u003eerror;\n \t\t}\n \n \t\tnetfs_put_request(wreq, netfs_rreq_trace_put_complete);\ndiff --git a/fs/netfs/internal.h b/fs/netfs/internal.h\nindex 420ee7b26580f..c734cad7063e5 100644\n--- a/fs/netfs/internal.h\n+++ b/fs/netfs/internal.h\n@@ -79,6 +79,7 @@ ssize_t netfs_wait_for_read(struct netfs_io_request rreq);\n ssize_t netfs_wait_for_write(struct netfs_io_request rreq);\n void netfs_wait_for_paused_read(struct netfs_io_request rreq);\n void netfs_wait_for_paused_write(struct netfs_io_request rreq);\n+void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq);\n \n /\n * objects.c\n@@ -109,6 +110,7 @@ static inline void netfs_see_subrequest(struct netfs_io_subrequest subreq,\n /\n * read_collect.c\n /\n+void netfs_read_set_unlock_at(struct netfs_io_request rreq);\n bool netfs_read_collection(struct netfs_io_request rreq);\n void netfs_read_collection_worker(struct work_struct work);\n void netfs_cancel_read(struct netfs_io_subrequest subreq, int error);\ndiff --git a/fs/netfs/misc.c b/fs/netfs/misc.c\nindex 5d554512ed23a..f5c1c463f4ff7 100644\n--- a/fs/netfs/misc.c\n+++ b/fs/netfs/misc.c\n@@ -563,3 +563,22 @@ void netfs_wait_for_paused_write(struct netfs_io_request rreq)\n {\n \treturn netfs_wait_for_pause(rreq, netfs_write_collection);\n }\n+\n+/\n+ Wait for the readahead-acquired refs to be put.\n+ /\n+void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq)\n+{\n+\tDEFINE_WAIT(myself);\n+\n+\tfor (;;) {\n+\t\ttrace_netfs_rreq(rreq, netfs_rreq_trace_wait_put_ra_refs);\n+\t\tprepare_to_wait(\u0026rreq-\u003ewaitq, \u0026myself, TASK_UNINTERRUPTIBLE);\n+\t\tif (!test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\t\tbreak;\n+\t\tschedule();\n+\t}\n+\n+\ttrace_netfs_rreq(rreq, netfs_rreq_trace_waited_put_ra_refs);\n+\tfinish_wait(\u0026rreq-\u003ewaitq, \u0026myself);\n+}\ndiff --git a/fs/netfs/objects.c b/fs/netfs/objects.c\nindex 01461a74642d6..7f6a3e912602e 100644\n--- a/fs/netfs/objects.c\n+++ b/fs/netfs/objects.c\n@@ -41,24 +41,32 @@ struct netfs_io_request netfs_alloc_request(struct address_space mapping,\n \n \tmemset(rreq, 0, kmem_cache_size(cache));\n \tINIT_WORK(\u0026rreq-\u003ecleanup_work, netfs_free_request);\n-\trreq-\u003egfp\t= gfp;\n-\trreq-\u003estart\t= start;\n-\trreq-\u003elen\t= len;\n-\trreq-\u003eorigin\t= origin;\n-\trreq-\u003enetfs_ops\t= ctx-\u003eops;\n-\trreq-\u003emapping\t= mapping;\n-\trreq-\u003einode\t= inode;\n-\trreq-\u003ei_size\t= i_size_read(inode);\n-\trreq-\u003edebug_id\t= atomic_inc_return(\u0026debug_ids);\n-\trreq-\u003ewsize\t= INT_MAX;\n+\trreq-\u003egfp\t\t= gfp;\n+\trreq-\u003estart\t\t= start;\n+\trreq-\u003ecollected_to\t= start;\n+\trreq-\u003ecleaned_to\t= start;\n+\trreq-\u003elen\t\t= len;\n+\trreq-\u003eprogress_at\t= 0;\n+\trreq-\u003eorigin\t\t= origin;\n+\trreq-\u003enetfs_ops\t\t= ctx-\u003eops;\n+\trreq-\u003emapping\t\t= mapping;\n+\trreq-\u003einode\t\t= inode;\n+\trreq-\u003ei_size\t\t= i_size_read(inode);\n+\trreq-\u003edebug_id\t\t= atomic_inc_return(\u0026debug_ids);\n+\trreq-\u003ewsize\t\t= INT_MAX;\n \trreq-\u003eio_streams[0].sreq_max_len = ULONG_MAX;\n \trreq-\u003eio_streams[0].sreq_max_segs = 0;\n \tspin_lock_init(\u0026rreq-\u003elock);\n-\tINIT_LIST_HEAD(\u0026rreq-\u003eio_streams[0].subrequests);\n-\tINIT_LIST_HEAD(\u0026rreq-\u003eio_streams[1].subrequests);\n \tinit_waitqueue_head(\u0026rreq-\u003ewaitq);\n \trefcount_set(\u0026rreq-\u003eref, 2);\n \n+\tfor (int s = 0; s \u003c NR_IO_STREAMS; s++) {\n+\t\tstruct netfs_io_stream stream = \u0026rreq-\u003eio_streams[s];\n+\n+\t\tINIT_LIST_HEAD(\u0026stream-\u003esubrequests);\n+\t\tstream-\u003ecollected_to = rreq-\u003estart;\n+\t}\n+\n \tif (origin == NETFS_READAHEAD \|\|\n \t origin == NETFS_READPAGE \|\|\n \t origin == NETFS_READ_GAPS \|\|\ndiff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c\nindex 23660a5901246..8ba162cf568b2 100644\n--- a/fs/netfs/read_collect.c\n+++ b/fs/netfs/read_collect.c\n@@ -94,6 +94,35 @@ static void netfs_unlock_read_folio(struct netfs_io_request rreq,\n \tfolioq_clear(folioq, slot);\n }\n \n+/\n+ Determine how much to gather before unlocking more folios.\n+ /\n+void netfs_read_set_unlock_at(struct netfs_io_request rreq)\n+{\n+\tstruct folio_queue folioq = rreq-\u003ebuffer.tail;\n+\tunsigned int slot = rreq-\u003ebuffer.first_tail_slot;\n+\tsize_t cleaned_to = rreq-\u003ecleaned_to - rreq-\u003estart;\n+\tsize_t progress_at = cleaned_to;\n+\tsize_t minimum = 256 1024;\n+\n+\twhile (progress_at \u003c rreq-\u003elen) {\n+\t\tif (slot \u003e= folioq_count(folioq)) {\n+\t\t\tfolioq = folioq-\u003enext;\n+\t\t\tif (!folioq)\n+\t\t\t\tbreak;\n+\t\t\tslot = 0;\n+\t\t}\n+\n+\t\tprogress_at += folioq_folio_size(folioq, slot);\n+\t\tif (progress_at - cleaned_to \u003e= minimum)\n+\t\t\tbreak;\n+\t\tslot++;\n+\t}\n+\n+\tWRITE_ONCE(rreq-\u003eprogress_at, progress_at);\n+\ttrace_netfs_read_progress_at(rreq);\n+}\n+\n /\n Unlock any folios we've finished with.\n /\n@@ -112,16 +141,22 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq,\n \tif (slot \u003e= folioq_nr_slots(folioq)) {\n \t\tfolioq = rolling_buffer_delete_spent(\u0026rreq-\u003ebuffer);\n \t\tif (!folioq) {\n-\t\t\trreq-\u003efront_folio_order = 0;\n+\t\t\tWRITE_ONCE(rreq-\u003eprogress_at, ULONG_MAX);\n \t\t\treturn;\n \t\t}\n \t\tslot = 0;\n \t}\n \n+\t/* We have to wait for readahead refs to have been released before we\n+\t * can unlock any folios as the ref-dropper walks i_pages and the only\n+\t * thing preventing these folios from being removed is the folio lock.\n+\t /\n+\tif (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\tnetfs_wait_for_put_ra_refs(rreq);\n+\n \tfor (;;) {\n \t\tstruct folio folio;\n-\t\tunsigned long long fpos, fend;\n-\t\tunsigned int order;\n+\t\tunsigned long long fpos = rreq-\u003ecleaned_to, fend;\n \t\tsize_t fsize;\n \n \t\tif (notes \u0026 COPY_TO_CACHE)\n@@ -133,9 +168,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq,\n \t\t\t rreq-\u003edebug_id, folio-\u003eindex))\n \t\t\ttrace_netfs_folio(folio, netfs_folio_trace_not_locked);\n \n-\t\torder = folioq_folio_order(folioq, slot);\n-\t\trreq-\u003efront_folio_order = order;\n-\t\tfsize = PAGE_SIZE \u003c\u003c order;\n+\t\tfsize = folioq_folio_size(folioq, slot);\n \t\tfpos = folio_pos(folio);\n \t\tfend = fpos + fsize;\n \n@@ -146,7 +179,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq,\n \t\t\tbreak;\n \n \t\tnetfs_unlock_read_folio(rreq, folioq, slot);\n-\t\tWRITE_ONCE(rreq-\u003ecleaned_to, fpos + fsize);\n+\t\tWRITE_ONCE(rreq-\u003ecleaned_to, fend);\n \t\tnotes \|= MADE_PROGRESS;\n \n \t\tclear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, \u0026rreq-\u003eflags);\n@@ -172,6 +205,8 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq,\n \trreq-\u003ebuffer.tail = folioq;\n done:\n \trreq-\u003ebuffer.first_tail_slot = slot;\n+\n+\tnetfs_read_set_unlock_at(rreq);\n }\n \n /\n@@ -232,7 +267,7 @@ static void netfs_collect_read_results(struct netfs_io_request rreq)\n \t\t subreqs.\n \t\t /\n \t\tif (notes \u0026 BUFFERED) {\n-\t\t\tsize_t fsize = PAGE_SIZE \u003c\u003c rreq-\u003efront_folio_order;\n+\t\t\tuoff_t unlock_at = rreq-\u003estart + rreq-\u003eprogress_at;\n \n \t\t\t/ Clear the tail of a short read. /\n \t\t\tif (!(notes \u0026 HIT_PENDING) \u0026\u0026\n@@ -257,7 +292,7 @@ static void netfs_collect_read_results(struct netfs_io_request rreq)\n \t\t\t\ttransferred = front-\u003elen;\n \t\t\t\ttrace_netfs_rreq(rreq, netfs_rreq_trace_set_abandon);\n \t\t\t}\n-\t\t\tif (front-\u003estart + transferred \u003e= rreq-\u003ecleaned_to + fsize \|\|\n+\t\t\tif (front-\u003estart + transferred \u003e= unlock_at \|\|\n \t\t\t test_bit(NETFS_SREQ_HIT_EOF, \u0026front-\u003eflags))\n \t\t\t\tnetfs_read_unlock_folios(rreq, \u0026notes);\n \t\t} else {\n@@ -477,20 +512,22 @@ void netfs_read_collection_worker(struct work_struct work)\n void netfs_read_subreq_progress(struct netfs_io_subrequest subreq)\n {\n \tstruct netfs_io_request rreq = subreq-\u003erreq;\n-\tstruct netfs_io_stream stream = \u0026rreq-\u003eio_streams[0];\n-\tsize_t fsize = PAGE_SIZE \u003c\u003c rreq-\u003efront_folio_order;\n-\n-\ttrace_netfs_sreq(subreq, netfs_sreq_trace_progress);\n+\tstruct netfs_io_stream stream = \u0026rreq-\u003eio_streams[subreq-\u003estream_nr];\n+\tsize_t progress_at = READ_ONCE(rreq-\u003eprogress_at);\n+\tuoff_t update_at = rreq-\u003estart + progress_at;\n+\tuoff_t transferred_to = subreq-\u003estart + subreq-\u003etransferred;\n \n \t/ If we are at the head of the queue, wake up the collector,\n \t * getting a ref to it if we were the ones to do so.\n \t /\n-\tif (subreq-\u003estart + subreq-\u003etransferred \u003e rreq-\u003ecleaned_to + fsize \u0026\u0026\n+\tif (progress_at != ULONG_MAX \u0026\u0026\n+\t transferred_to \u003e= update_at \u0026\u0026\n \t (rreq-\u003eorigin == NETFS_READAHEAD \|\|\n \t rreq-\u003eorigin == NETFS_READPAGE \|\|\n \t rreq-\u003eorigin == NETFS_READ_FOR_WRITE) \u0026\u0026\n \t list_is_first(\u0026subreq-\u003erreq_link, \u0026stream-\u003esubrequests)\n \t ) {\n+\t\ttrace_netfs_sreq(subreq, netfs_sreq_trace_progress);\n \t\t__set_bit(NETFS_SREQ_MADE_PROGRESS, \u0026subreq-\u003eflags);\n \t\tnetfs_wake_collector(rreq);\n \t}\ndiff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c\nindex 2b42758e01ec9..dd463a485139c 100644\n--- a/fs/netfs/read_retry.c\n+++ b/fs/netfs/read_retry.c\n@@ -292,6 +292,13 @@ void netfs_unlock_abandoned_read_pages(struct netfs_io_request rreq)\n {\n \tstruct folio_queue p;\n \n+\t/ We have to wait for readahead refs to have been released before we\n+\t * can unlock any folios as the ref-dropper walks i_pages and the only\n+\t * thing preventing these folios from being removed is the folio lock.\n+\t /\n+\tif (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\tnetfs_wait_for_put_ra_refs(rreq);\n+\n \tfor (p = rreq-\u003ebuffer.tail; p; p = p-\u003enext) {\n \t\tfor (int slot = 0; slot \u003c folioq_count(p); slot++) {\n \t\t\tstruct folio folio = folioq_folio(p, slot);\ndiff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c\nindex 8833550d2eb60..de67ac41548d1 100644\n--- a/fs/netfs/read_single.c\n+++ b/fs/netfs/read_single.c\n@@ -170,6 +170,8 @@ ssize_t netfs_read_single(struct inode inode, struct file file, struct iov_ite\n \tif (IS_ERR(rreq))\n \t\treturn PTR_ERR(rreq);\n \n+\trreq-\u003eprogress_at = rreq-\u003elen;\n+\n \tret = netfs_single_begin_cache_read(rreq, ictx);\n \tif (ret == -ENOMEM \|\| ret == -EINTR \|\| ret == -ERESTARTSYS)\n \t\tgoto cleanup_free;\ndiff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c\nindex 8c0026836f9c1..424e77a9a1098 100644\n--- a/fs/netfs/rolling_buffer.c\n+++ b/fs/netfs/rolling_buffer.c\n@@ -115,42 +115,65 @@ int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp)\n }\n \n /\n- * Decant the list of folios to read into a rolling buffer.\n+ * Decant the entire list of folios to read into a rolling buffer.\n /\n-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer roll,\n-\t\t\t\t struct readahead_control ractl,\n-\t\t\t\t struct folio_batch put_batch)\n+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll,\n+\t\t\t\t\t struct readahead_control ractl,\n+\t\t\t\t\t unsigned int rreq_id, gfp_t gfp)\n {\n \tstruct folio_queue fq;\n-\tstruct page vec;\n-\tint nr, ix, to;\n-\tssize_t size = 0;\n+\tssize_t loaded = 0;\n \n-\tif (rolling_buffer_make_space(roll, GFP_KERNEL) \u003c 0)\n-\t\treturn -ENOMEM;\n+\twhile (ractl-\u003e_nr_pages - ractl-\u003e_batch_count \u003e 0) {\n+\t\tunsigned int nr;\n \n-\tfq = roll-\u003ehead;\n-\tvec = (struct page )fq-\u003evec.folios;\n-\tnr = __readahead_batch(ractl, vec + folio_batch_count(\u0026fq-\u003evec),\n-\t\t\t folio_batch_space(\u0026fq-\u003evec));\n-\tix = fq-\u003evec.nr;\n-\tto = ix + nr;\n-\tfq-\u003evec.nr = to;\n-\tfor (; ix \u003c to; ix++) {\n-\t\tstruct folio folio = folioq_folio(fq, ix);\n-\t\tunsigned int order = folio_order(folio);\n-\n-\t\tfq-\u003eorders[ix] = order;\n-\t\tsize += PAGE_SIZE \u003c\u003c order;\n-\t\ttrace_netfs_folio(folio, netfs_folio_trace_read);\n-\t\tif (!folio_batch_add(put_batch, folio))\n-\t\t\tfolio_batch_release(put_batch);\n+\t\t/* Allocate a folioq to put some folios into and attach it to\n+\t\t * the rolling buffer.\n+\t\t /\n+\t\tfq = netfs_folioq_alloc(rreq_id, gfp,\n+\t\t\t\t\tnetfs_trace_folioq_make_space);\n+\t\tif (!fq)\n+\t\t\tgoto nomem_unlock;\n+\t\tfq-\u003eprev = roll-\u003ehead;\n+\t\tif (!roll-\u003etail)\n+\t\t\troll-\u003etail = fq;\n+\t\telse\n+\t\t\troll-\u003ehead-\u003enext = fq;\n+\t\troll-\u003ehead = fq;\n+\n+\t\t/ Get a batch of folios and note their orders. /\n+\t\tnr = __readahead_batch(ractl, (struct page )fq-\u003evec.folios,\n+\t\t\t\t folioq_nr_slots(fq));\n+\t\tif (WARN_ON_ONCE(!nr))\n+\t\t\tbreak;\n+\t\tfq-\u003evec.nr = nr;\n+\n+\t\tfor (int slot = 0; slot \u003c nr; slot++) {\n+\t\t\tstruct folio folio = folioq_folio(fq, slot);\n+\t\t\tunsigned int order;\n+\n+\t\t\torder = folio_order(folio);\n+\t\t\tfq-\u003eorders[slot] = order;\n+\t\t\tloaded += PAGE_SIZE \u003c\u003c order;\n+\t\t\ttrace_netfs_folio(folio, netfs_folio_trace_read);\n+\t\t}\n \t}\n-\tWRITE_ONCE(roll-\u003eiter.count, roll-\u003eiter.count + size);\n \n-\t/* Store the counter after setting the slot. /\n-\tsmp_store_release(\u0026roll-\u003enext_head_slot, to);\n-\treturn size;\n+\tWRITE_ONCE(roll-\u003eiter.count, loaded);\n+\tiov_iter_folio_queue(\u0026roll-\u003eiter, ITER_DEST, roll-\u003etail, 0, 0, loaded);\n+\treturn loaded;\n+\n+nomem_unlock:\n+\tfor (fq = roll-\u003etail; fq; fq = fq-\u003enext) {\n+\t\tfor (int slot = 0; slot \u003c folioq_count(fq); slot++) {\n+\t\t\tfolio_unlock(fq-\u003evec.folios[slot]);\n+\t\t\tfolioq_mark(fq, slot);\n+\t\t}\n+\t}\n+\trolling_buffer_clear(roll);\n+\troll-\u003ehead = NULL;\n+\troll-\u003etail = NULL;\n+\treturn -ENOMEM;\n }\n \n /\ndiff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c\nindex 2d9cfcd43658f..851f6f93ad45a 100644\n--- a/fs/netfs/write_issue.c\n+++ b/fs/netfs/write_issue.c\n@@ -170,6 +170,8 @@ void netfs_prepare_write(struct netfs_io_request wreq,\n \t\trolling_buffer_make_space(\u0026wreq-\u003ebuffer, wreq-\u003egfp);\n \n \tsubreq = netfs_alloc_subrequest(wreq);\n+\tif (!subreq)\n+\t\treturn;\n \tsubreq-\u003esource\t\t= stream-\u003esource;\n \tsubreq-\u003estart\t\t= start;\n \tsubreq-\u003estream_nr\t= stream-\u003estream_nr;\ndiff --git a/include/linux/netfs.h b/include/linux/netfs.h\nindex f837a501008c9..1cf2ef3ce18b8 100644\n--- a/include/linux/netfs.h\n+++ b/include/linux/netfs.h\n@@ -246,6 +246,7 @@ struct netfs_io_request {\n \tunsigned long long\tsubmitted;\t/ Amount submitted for I/O so far /\n \tunsigned long long\tlen;\t\t/ Length of the request /\n \tsize_t\t\t\ttransferred;\t/ Amount to be indicated as transferred /\n+\tsize_t\t\t\tprogress_at;\t/ Report read progress when hit this much read /\n \tlong\t\t\terror;\t\t/ 0 or error that occurred /\n \tunsigned long long\ti_size;\t\t/ Size of the file /\n \tunsigned long long\tstart;\t\t/ Start position /\n@@ -262,7 +263,6 @@ struct netfs_io_request {\n \tatomic_t\t\tsubreq_counter;\t/ Next subreq-\u003edebug_index /\n \tunsigned int\t\tnr_group_rel;\t/ Number of refs to release on -\u003egroup /\n \tspinlock_t\t\tlock;\t\t/ Lock for queuing subreqs /\n-\tunsigned char\t\tfront_folio_order; / Order (size) of front folio /\n \tenum netfs_io_origin\torigin;\t\t/ Origin of the request /\n \tbool\t\t\tdirect_bv_unpin; / T if direct_bv[] must be unpinned /\n \trefcount_t\t\tref;\n@@ -278,6 +278,7 @@ struct netfs_io_request {\n #define NETFS_RREQ_FOLIO_COPY_TO_CACHE\t10\t/ Copy current folio to cache from read /\n #define NETFS_RREQ_UPLOAD_TO_SERVER\t11\t/ Need to write to the server /\n #define NETFS_RREQ_USE_IO_ITER\t\t12\t/ Use -\u003eio_iter rather than -\u003ei_pages /\n+#define NETFS_RREQ_NEED_PUT_RA_REFS\t17\t/ Need to put the folio refs RA gave us /\n #define NETFS_RREQ_USE_PGPRIV2\t\t31\t/ [DEPRECATED] Use PG_private_2 to mark\n \t\t\t\t\t\t * write to cache on read /\n \tconst struct netfs_request_ops netfs_ops;\ndiff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h\nindex 9e5dad29669cf..a97f7cfaacaad 100644\n--- a/include/linux/rolling_buffer.h\n+++ b/include/linux/rolling_buffer.h\n@@ -45,9 +45,9 @@ struct rolling_buffer_snapshot {\n int rolling_buffer_init(struct rolling_buffer roll, unsigned int rreq_id,\n \t\t\tunsigned int direction, gfp_t gfp);\n int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp);\n-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer roll,\n-\t\t\t\t struct readahead_control ractl,\n-\t\t\t\t struct folio_batch put_batch);\n+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll,\n+\t\t\t\t\t struct readahead_control ractl,\n+\t\t\t\t\t unsigned int rreq_id, gfp_t gfp);\n ssize_t rolling_buffer_append(struct rolling_buffer roll, struct folio folio,\n \t\t\t unsigned int flags, gfp_t gfp);\n struct folio_queue rolling_buffer_delete_spent(struct rolling_buffer roll);\ndiff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h\nindex 9259bc71049e0..e3101410e8b2d 100644\n--- a/include/trace/events/cachefiles.h\n+++ b/include/trace/events/cachefiles.h\n@@ -372,7 +372,7 @@ TRACE_EVENT(cachefiles_rename,\n TRACE_EVENT(cachefiles_coherency,\n \t TP_PROTO(struct cachefiles_object obj,\n \t\t ino_t ino,\n-\t\t u64 disk_aux,\n+\t\t const void disk_aux,\n \t\t enum cachefiles_content content,\n \t\t enum cachefiles_coherency_trace why),\n \n@@ -389,12 +389,27 @@ TRACE_EVENT(cachefiles_coherency,\n \t\t\t ),\n \n \t TP_fast_assign(\n+\t\t union {\n+\t\t\t __be16 s[4];\n+\t\t\t __be64 ll;\n+\t\t } x;\n+\n \t\t __entry-\u003eobj\t= obj-\u003edebug_id;\n \t\t __entry-\u003ewhy\t= why;\n \t\t __entry-\u003econtent\t= content;\n \t\t __entry-\u003eino\t= ino;\n \t\t __entry-\u003eaux\t= be64_to_cpup((__be64 )obj-\u003ecookie-\u003einline_aux);\n-\t\t __entry-\u003edisk_aux\t= disk_aux;\n+\n+\t\t /* cachefiles_xattr::data is 2-byte aligned but not 8-byte aligned. /\n+\t\t if (disk_aux) {\n+\t\t\t x.s[0] = ((__be16 )disk_aux)[0];\n+\t\t\t x.s[1] = ((__be16 )disk_aux)[1];\n+\t\t\t x.s[2] = ((__be16 )disk_aux)[2];\n+\t\t\t x.s[3] = ((__be16 )disk_aux)[3];\n+\t\t\t __entry-\u003edisk_aux = be64_to_cpu(x.ll);\n+\t\t } else {\n+\t\t\t __entry-\u003edisk_aux = 0;\n+\t\t }\n \t\t\t ),\n \n \t TP_printk(\"o=%08x %s B=%llx c=%u aux=%llx dsk=%llx\",\ndiff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h\nindex 082cb03c61316..b5da315274ad5 100644\n--- a/include/trace/events/netfs.h\n+++ b/include/trace/events/netfs.h\n@@ -59,6 +59,7 @@\n \tEM(netfs_rreq_trace_free,\t\t\"FREE \")\t\\\n \tEM(netfs_rreq_trace_intr,\t\t\"INTR \")\t\\\n \tEM(netfs_rreq_trace_ki_complete,\t\"KI-CMPL\")\t\\\n+\tEM(netfs_rreq_trace_ra_put_ref,\t\t\"RA-PUT \")\t\\\n \tEM(netfs_rreq_trace_recollect,\t\t\"RECLLCT\")\t\\\n \tEM(netfs_rreq_trace_redirty,\t\t\"REDIRTY\")\t\\\n \tEM(netfs_rreq_trace_resubmit,\t\t\"RESUBMT\")\t\\\n@@ -70,9 +71,11 @@\n \tEM(netfs_rreq_trace_unpause,\t\t\"UNPAUSE\")\t\\\n \tEM(netfs_rreq_trace_wait_ip,\t\t\"WAIT-IP\")\t\\\n \tEM(netfs_rreq_trace_wait_pause,\t\t\"--PAUSED--\")\t\\\n+\tEM(netfs_rreq_trace_wait_put_ra_refs,\t\"WAIT-P-RA\")\t\\\n \tEM(netfs_rreq_trace_wait_quiesce,\t\"WAIT-QUIESCE\")\t\\\n \tEM(netfs_rreq_trace_waited_ip,\t\t\"DONE-IP\")\t\\\n \tEM(netfs_rreq_trace_waited_pause,\t\"--UNPAUSED--\")\t\\\n+\tEM(netfs_rreq_trace_waited_put_ra_refs,\t\"DONE-P-RA\")\t\\\n \tEM(netfs_rreq_trace_waited_quiesce,\t\"DONE-QUIESCE\")\t\\\n \tEM(netfs_rreq_trace_wake_ip,\t\t\"WAKE-IP\")\t\\\n \tEM(netfs_rreq_trace_wake_queue,\t\t\"WAKE-Q \")\t\\\n@@ -786,6 +789,27 @@ TRACE_EVENT(netfs_folioq,\n \t\t __print_symbolic(__entry-\u003etrace, netfs_folioq_traces))\n \t );\n \n+TRACE_EVENT(netfs_read_progress_at,\n+\t TP_PROTO(const struct netfs_io_request rreq),\n+\n+\t TP_ARGS(rreq),\n+\n+\t TP_STRUCT__entry(\n+\t\t __field(unsigned int,\trreq)\n+\t\t __field(size_t,\t\tprogress_at)\n+\t\t __field(size_t,\t\tcleaned_to)\n+\t\t\t ),\n+\n+\t TP_fast_assign(\n+\t\t __entry-\u003erreq\t= rreq-\u003edebug_id;\n+\t\t __entry-\u003ecleaned_to\t= rreq-\u003ecleaned_to - rreq-\u003estart;\n+\t\t __entry-\u003eprogress_at = rreq-\u003eprogress_at;\n+\t\t\t ),\n+\n+\t TP_printk(\"R=%08x cln=%zx prg=%zx\",\n+\t\t __entry-\u003erreq, __entry-\u003ecleaned_to, __entry-\u003eprogress_at)\n+\t );\n+\n #undef EM\n #undef E_\n #endif /* _TRACE_NETFS_H */\n" }
2/1	2026/08/25 14:11	agent	patch-evaluator	2m Model: best-expensive Args: null Results: { "EnableConfigs": [ "NETFS_SUPPORT", "CACHEFILES", "9P_FS", "NET_9P", "CIFS", "CEPH_FS", "AFS_FS", "NFS_FS", "NFS_FSCACHE" ], "FocusSymbols": [ "cachefiles_set_object_xattr", "cachefiles_check_auxdata", "netfs_readahead", "netfs_read_folio", "netfs_write_begin", "netfs_prefetch_for_write", "netfs_unbuffered_write_iter_locked", "netfs_wait_for_put_ra_refs", "netfs_alloc_request", "netfs_read_set_unlock_at", "netfs_read_subreq_progress", "netfs_unlock_abandoned_read_pages", "netfs_read_single", "rolling_buffer_bulk_load_from_ra", "netfs_prepare_write" ], "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 973032d62ca4dc98bf40ee8ea0fc4e48fdbf7eb9 Author: syz-cluster <triage@syzkaller.com> Date: Tue Aug 25 14:11:17 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c index f8ae78b3f7b6d..c70bf67e52b01 100644 --- a/fs/cachefiles/xattr.c +++ b/fs/cachefiles/xattr.c @@ -13,6 +13,7 @@ #include <linux/quotaops.h> #include <linux/xattr.h> #include <linux/slab.h> +#include <linux/unaligned.h> #include "internal.h" #define CACHEFILES_COOKIE_TYPE_DATA 1 @@ -50,7 +51,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) _enter("%x,#%d", object->debug_id, len); - buf = kmalloc(sizeof(struct cachefiles_xattr) + len, GFP_KERNEL); + buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL); if (!buf) return -ENOMEM; @@ -60,6 +61,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) buf->content = object->content_info; if (test_bit(FSCACHE_COOKIE_LOCAL_WRITE, &object->cookie->flags)) buf->content = CACHEFILES_CONTENT_DIRTY; + put_unaligned_be64(0, (__be64 )buf->data); if (len > 0) memcpy(buf->data, fscache_get_aux(object->cookie), len); @@ -77,8 +79,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) trace_cachefiles_vfs_error(object, file_inode(file), ret, cachefiles_trace_setxattr_error); trace_cachefiles_coherency(object, file_inode(file)->i_ino, - be64_to_cpup((__be64 )buf->data), - buf->content, + buf->data, buf->content, cachefiles_coherency_set_fail); if (ret != -ENOMEM) cachefiles_io_error_obj( @@ -86,8 +87,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) "Failed to set xattr with error %d", ret); } else { trace_cachefiles_coherency(object, file_inode(file)->i_ino, - be64_to_cpup((__be64 )buf->data), - buf->content, + buf->data, buf->content, cachefiles_coherency_set_ok); } @@ -110,9 +110,10 @@ int cachefiles_check_auxdata(struct cachefiles_object object, struct file file int ret = -ESTALE; tlen = sizeof(struct cachefiles_xattr) + len; - buf = kmalloc(tlen, GFP_KERNEL); + buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL); if (!buf) return -ENOMEM; + put_unaligned_be64(0, (__be64 )buf->data); xlen = cachefiles_inject_read_error(); if (xlen == 0) @@ -148,8 +149,7 @@ int cachefiles_check_auxdata(struct cachefiles_object object, struct file file out: trace_cachefiles_coherency(object, file_inode(file)->i_ino, - be64_to_cpup((__be64 )buf->data), - buf->content, why); + buf->data, buf->content, why); kfree(buf); return ret; } diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c index 7fdfa4f27e349..a2a9d8c083f99 100644 --- a/fs/netfs/buffered_read.c +++ b/fs/netfs/buffered_read.c @@ -54,6 +54,42 @@ static void netfs_rreq_expand(struct netfs_io_request rreq, } } +/* + * Drop the folio refs acquired from the readahead API. + / +static void netfs_bulk_drop_ra_refs(struct netfs_io_request rreq) +{ + struct folio_batch fbatch; + struct folio folio; + pgoff_t nr_pages = DIV_ROUND_UP(rreq->len, PAGE_SIZE); + pgoff_t first = rreq->start / PAGE_SIZE; + XA_STATE(xas, &rreq->mapping->i_pages, first); + + folio_batch_init(&fbatch); + + rcu_read_lock(); + + xas_for_each(&xas, folio, first + nr_pages - 1) { + if (xas_retry(&xas, folio)) + continue; + + if (!folio_batch_add(&fbatch, folio)) + folio_batch_release(&fbatch); + } + + rcu_read_unlock(); + folio_batch_release(&fbatch); + trace_netfs_rreq(rreq, netfs_rreq_trace_ra_put_ref); + clear_bit_unlock(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags); + wake_up(&rreq->waitq); +} + +static void netfs_maybe_bulk_drop_ra_refs(struct netfs_io_request rreq) +{ + if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + netfs_bulk_drop_ra_refs(rreq); +} + /* * Begin an operation, and fetch the stored zero point value from the cookie if * available. @@ -74,12 +110,8 @@ static int netfs_begin_cache_read(struct netfs_io_request rreq, struct netfs_in * Returns the limited size if successful and -ENOMEM if insufficient memory * available. - * - * [!] NOTE: This must be run in the same thread as ->issue_read() was called - * in as we access the readahead_control struct. / -static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq, - struct readahead_control ractl) +static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq) { struct netfs_io_request rreq = subreq->rreq; size_t rsize = subreq->len; @@ -87,30 +119,6 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq, if (subreq->source == NETFS_DOWNLOAD_FROM_SERVER) rsize = umin(rsize, rreq->io_streams[0].sreq_max_len); - if (ractl) { - /* If we don't have sufficient folios in the rolling buffer, - * extract a folioq's worth from the readahead region at a time - * into the buffer. Note that this acquires a ref on each page - * that we will need to release later - but we don't want to do - * that until after we've started the I/O. - / - struct folio_batch put_batch; - - folio_batch_init(&put_batch); - while (rreq->submitted < subreq->start + rsize) { - ssize_t added; - - added = rolling_buffer_load_from_ra(&rreq->buffer, ractl, - &put_batch); - if (added < 0) { - folio_batch_release(&put_batch); - return added; - } - rreq->submitted += added; - } - folio_batch_release(&put_batch); - } - subreq->len = rsize; if (unlikely(rreq->io_streams[0].sreq_max_segs)) { size_t limit = netfs_limit_iter(&rreq->buffer.iter, 0, rsize, @@ -208,8 +216,7 @@ static void netfs_issue_read(struct netfs_io_request rreq, * slicing up the region to be read according to available cache blocks and * network rsize. / -static void netfs_read_to_pagecache(struct netfs_io_request rreq, - struct readahead_control ractl) +static void netfs_read_to_pagecache(struct netfs_io_request rreq) { unsigned long long start = rreq->start; ssize_t size = rreq->len; @@ -288,7 +295,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request rreq, break; issue: - slice = netfs_prepare_read_iterator(subreq, ractl); + slice = netfs_prepare_read_iterator(subreq); if (slice < 0) { ret = slice; netfs_cancel_read(subreq, ret); @@ -302,6 +309,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request rreq, } netfs_issue_read(rreq, subreq); + netfs_maybe_bulk_drop_ra_refs(rreq); if (test_bit(NETFS_RREQ_PAUSE, &rreq->flags)) netfs_wait_for_paused_read(rreq); @@ -339,7 +347,8 @@ void netfs_readahead(struct readahead_control ractl) { struct netfs_io_request rreq; struct netfs_inode ictx = netfs_inode(ractl->mapping->host); - unsigned long long start = readahead_pos(ractl); + ssize_t added; + uoff_t start = readahead_pos(ractl); size_t size = readahead_length(ractl); int ret; @@ -360,11 +369,24 @@ void netfs_readahead(struct readahead_control ractl) netfs_rreq_expand(rreq, ractl); - rreq->submitted = rreq->start; - if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST, rreq->gfp) < 0) + /* Load the folios to be read into a bvecq chain. Note that this + * acquires a ref on each folio that we will need to release later - + * but we don't want to do that until after we've started the I/O. + / + added = rolling_buffer_bulk_load_from_ra(&rreq->buffer, ractl, + rreq->debug_id, rreq->gfp); + if (added < 0) { + ret = added; goto cleanup_free; - netfs_read_to_pagecache(rreq, ractl); + } + __set_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags); + + rreq->submitted = rreq->start + added; + rreq->cleaned_to = rreq->start; + netfs_read_set_unlock_at(rreq); + netfs_read_to_pagecache(rreq); + netfs_maybe_bulk_drop_ra_refs(rreq); return netfs_put_request(rreq, netfs_rreq_trace_put_return); cleanup_free: @@ -387,6 +409,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request rreq, struct fo if (added < 0) return added; rreq->submitted = rreq->start + added; + rreq->progress_at = added; return 0; } @@ -457,7 +480,7 @@ static int netfs_read_gaps(struct file file, struct folio folio) iov_iter_bvec(&rreq->buffer.iter, ITER_DEST, bvec, i, rreq->len); rreq->submitted = rreq->start + flen; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); if (ret >= 0) { @@ -532,7 +555,7 @@ int netfs_read_folio(struct file file, struct folio folio) if (ret < 0) goto discard; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); netfs_put_request(rreq, netfs_rreq_trace_put_return); return ret < 0 ? ret : 0; @@ -689,7 +712,7 @@ int netfs_write_begin(struct netfs_inode ctx, if (ret < 0) goto error_put; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); netfs_put_request(rreq, netfs_rreq_trace_put_return); if (ret < 0) @@ -754,7 +777,7 @@ int netfs_prefetch_for_write(struct file file, struct folio folio, if (ret < 0) goto error_put; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); netfs_put_request(rreq, netfs_rreq_trace_put_return); return ret < 0 ? ret : 0; diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c index c16fbad286a17..7173ce04bac63 100644 --- a/fs/netfs/direct_write.c +++ b/fs/netfs/direct_write.c @@ -21,7 +21,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request wreq) /* Okay, declare that all I/O is complete. / trace_netfs_rreq(wreq, netfs_rreq_trace_write_done); - if (!wreq->error) + if (wreq->transferred) netfs_update_i_size(ictx, &ictx->inode, wreq->start, wreq->transferred); if (wreq->origin == NETFS_DIO_WRITE && @@ -51,7 +51,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request wreq) wreq->iocb->ki_pos += written; if (wreq->iocb->ki_complete) { trace_netfs_rreq(wreq, netfs_rreq_trace_ki_complete); - wreq->iocb->ki_complete(wreq->iocb, wreq->error ?: written); + wreq->iocb->ki_complete(wreq->iocb, written ?: wreq->error); } wreq->iocb = VFS_PTR_POISON; } @@ -95,7 +95,7 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) { struct netfs_io_subrequest subreq = NULL; struct netfs_io_stream stream = &wreq->io_streams[0]; - int ret; + int ret = 0; _enter("%llx", wreq->len); @@ -110,6 +110,10 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) if (!subreq) { netfs_prepare_write(wreq, stream, wreq->start + wreq->transferred); subreq = stream->construct; + if (!subreq) { + ret = -ENOMEM; + break; + } stream->construct = NULL; } @@ -121,8 +125,14 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) } iov_iter_truncate(&subreq->io_iter, wreq->len - wreq->transferred); - if (!iov_iter_count(&subreq->io_iter)) + if (!iov_iter_count(&subreq->io_iter)) { + pr_warn("netfs: Unexpected zero-length iterator R=%08x\n", + wreq->debug_id); + __set_bit(NETFS_SREQ_FAILED, &subreq->flags); + netfs_write_subrequest_terminated(subreq, -EIO); + wreq->error = -EIO; break; + } subreq->len = netfs_limit_iter(&subreq->io_iter, 0, stream->sreq_max_len, @@ -139,13 +149,11 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) { retry = true; } else if (test_bit(NETFS_SREQ_FAILED, &subreq->flags)) { - ret = subreq->error; - wreq->error = ret; + wreq->error = subreq->error; netfs_see_subrequest(subreq, netfs_sreq_trace_see_failed); subreq = NULL; break; } - ret = 0; if (!retry) { netfs_unbuffered_write_collect(wreq, stream, subreq); @@ -288,11 +296,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb iocb, struct iov_iter ret = -EIOCBQUEUED; } else { ret = netfs_unbuffered_write(wreq); - if (ret < 0) { - _debug("begin = %zd", ret); - } else { + if (wreq->transferred) { iocb->ki_pos += wreq->transferred; - ret = wreq->transferred ?: wreq->error; + ret = wreq->transferred; + } else if (wreq->error) { + ret = wreq->error; } netfs_put_request(wreq, netfs_rreq_trace_put_complete); diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h index 420ee7b26580f..c734cad7063e5 100644 --- a/fs/netfs/internal.h +++ b/fs/netfs/internal.h @@ -79,6 +79,7 @@ ssize_t netfs_wait_for_read(struct netfs_io_request rreq); ssize_t netfs_wait_for_write(struct netfs_io_request rreq); void netfs_wait_for_paused_read(struct netfs_io_request rreq); void netfs_wait_for_paused_write(struct netfs_io_request rreq); +void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq); / * objects.c @@ -109,6 +110,7 @@ static inline void netfs_see_subrequest(struct netfs_io_subrequest subreq, / * read_collect.c / +void netfs_read_set_unlock_at(struct netfs_io_request rreq); bool netfs_read_collection(struct netfs_io_request rreq); void netfs_read_collection_worker(struct work_struct work); void netfs_cancel_read(struct netfs_io_subrequest subreq, int error); diff --git a/fs/netfs/misc.c b/fs/netfs/misc.c index 5d554512ed23a..f5c1c463f4ff7 100644 --- a/fs/netfs/misc.c +++ b/fs/netfs/misc.c @@ -563,3 +563,22 @@ void netfs_wait_for_paused_write(struct netfs_io_request rreq) { return netfs_wait_for_pause(rreq, netfs_write_collection); } + +/* + * Wait for the readahead-acquired refs to be put. + / +void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq) +{ + DEFINE_WAIT(myself); + + for (;;) { + trace_netfs_rreq(rreq, netfs_rreq_trace_wait_put_ra_refs); + prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE); + if (!test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + break; + schedule(); + } + + trace_netfs_rreq(rreq, netfs_rreq_trace_waited_put_ra_refs); + finish_wait(&rreq->waitq, &myself); +} diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c index 01461a74642d6..7f6a3e912602e 100644 --- a/fs/netfs/objects.c +++ b/fs/netfs/objects.c @@ -41,24 +41,32 @@ struct netfs_io_request netfs_alloc_request(struct address_space mapping, memset(rreq, 0, kmem_cache_size(cache)); INIT_WORK(&rreq->cleanup_work, netfs_free_request); - rreq->gfp = gfp; - rreq->start = start; - rreq->len = len; - rreq->origin = origin; - rreq->netfs_ops = ctx->ops; - rreq->mapping = mapping; - rreq->inode = inode; - rreq->i_size = i_size_read(inode); - rreq->debug_id = atomic_inc_return(&debug_ids); - rreq->wsize = INT_MAX; + rreq->gfp = gfp; + rreq->start = start; + rreq->collected_to = start; + rreq->cleaned_to = start; + rreq->len = len; + rreq->progress_at = 0; + rreq->origin = origin; + rreq->netfs_ops = ctx->ops; + rreq->mapping = mapping; + rreq->inode = inode; + rreq->i_size = i_size_read(inode); + rreq->debug_id = atomic_inc_return(&debug_ids); + rreq->wsize = INT_MAX; rreq->io_streams[0].sreq_max_len = ULONG_MAX; rreq->io_streams[0].sreq_max_segs = 0; spin_lock_init(&rreq->lock); - INIT_LIST_HEAD(&rreq->io_streams[0].subrequests); - INIT_LIST_HEAD(&rreq->io_streams[1].subrequests); init_waitqueue_head(&rreq->waitq); refcount_set(&rreq->ref, 2); + for (int s = 0; s < NR_IO_STREAMS; s++) { + struct netfs_io_stream stream = &rreq->io_streams[s]; + + INIT_LIST_HEAD(&stream->subrequests); + stream->collected_to = rreq->start; + } + if (origin == NETFS_READAHEAD \|\| origin == NETFS_READPAGE \|\| origin == NETFS_READ_GAPS \|\| diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c index 23660a5901246..8ba162cf568b2 100644 --- a/fs/netfs/read_collect.c +++ b/fs/netfs/read_collect.c @@ -94,6 +94,35 @@ static void netfs_unlock_read_folio(struct netfs_io_request rreq, folioq_clear(folioq, slot); } +/* + * Determine how much to gather before unlocking more folios. + / +void netfs_read_set_unlock_at(struct netfs_io_request rreq) +{ + struct folio_queue folioq = rreq->buffer.tail; + unsigned int slot = rreq->buffer.first_tail_slot; + size_t cleaned_to = rreq->cleaned_to - rreq->start; + size_t progress_at = cleaned_to; + size_t minimum = 256 1024; + + while (progress_at < rreq->len) { + if (slot >= folioq_count(folioq)) { + folioq = folioq->next; + if (!folioq) + break; + slot = 0; + } + + progress_at += folioq_folio_size(folioq, slot); + if (progress_at - cleaned_to >= minimum) + break; + slot++; + } + + WRITE_ONCE(rreq->progress_at, progress_at); + trace_netfs_read_progress_at(rreq); +} + /* * Unlock any folios we've finished with. / @@ -112,16 +141,22 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, if (slot >= folioq_nr_slots(folioq)) { folioq = rolling_buffer_delete_spent(&rreq->buffer); if (!folioq) { - rreq->front_folio_order = 0; + WRITE_ONCE(rreq->progress_at, ULONG_MAX); return; } slot = 0; } + /* We have to wait for readahead refs to have been released before we + * can unlock any folios as the ref-dropper walks i_pages and the only + * thing preventing these folios from being removed is the folio lock. + / + if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + netfs_wait_for_put_ra_refs(rreq); + for (;;) { struct folio folio; - unsigned long long fpos, fend; - unsigned int order; + unsigned long long fpos = rreq->cleaned_to, fend; size_t fsize; if (notes & COPY_TO_CACHE) @@ -133,9 +168,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, rreq->debug_id, folio->index)) trace_netfs_folio(folio, netfs_folio_trace_not_locked); - order = folioq_folio_order(folioq, slot); - rreq->front_folio_order = order; - fsize = PAGE_SIZE << order; + fsize = folioq_folio_size(folioq, slot); fpos = folio_pos(folio); fend = fpos + fsize; @@ -146,7 +179,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, break; netfs_unlock_read_folio(rreq, folioq, slot); - WRITE_ONCE(rreq->cleaned_to, fpos + fsize); + WRITE_ONCE(rreq->cleaned_to, fend); notes \|= MADE_PROGRESS; clear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, &rreq->flags); @@ -172,6 +205,8 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, rreq->buffer.tail = folioq; done: rreq->buffer.first_tail_slot = slot; + + netfs_read_set_unlock_at(rreq); } / @@ -232,7 +267,7 @@ static void netfs_collect_read_results(struct netfs_io_request rreq) subreqs. / if (notes & BUFFERED) { - size_t fsize = PAGE_SIZE << rreq->front_folio_order; + uoff_t unlock_at = rreq->start + rreq->progress_at; / Clear the tail of a short read. / if (!(notes & HIT_PENDING) && @@ -257,7 +292,7 @@ static void netfs_collect_read_results(struct netfs_io_request rreq) transferred = front->len; trace_netfs_rreq(rreq, netfs_rreq_trace_set_abandon); } - if (front->start + transferred >= rreq->cleaned_to + fsize \|\| + if (front->start + transferred >= unlock_at \|\| test_bit(NETFS_SREQ_HIT_EOF, &front->flags)) netfs_read_unlock_folios(rreq, &notes); } else { @@ -477,20 +512,22 @@ void netfs_read_collection_worker(struct work_struct work) void netfs_read_subreq_progress(struct netfs_io_subrequest subreq) { struct netfs_io_request rreq = subreq->rreq; - struct netfs_io_stream stream = &rreq->io_streams[0]; - size_t fsize = PAGE_SIZE << rreq->front_folio_order; - - trace_netfs_sreq(subreq, netfs_sreq_trace_progress); + struct netfs_io_stream stream = &rreq->io_streams[subreq->stream_nr]; + size_t progress_at = READ_ONCE(rreq->progress_at); + uoff_t update_at = rreq->start + progress_at; + uoff_t transferred_to = subreq->start + subreq->transferred; / If we are at the head of the queue, wake up the collector, * getting a ref to it if we were the ones to do so. / - if (subreq->start + subreq->transferred > rreq->cleaned_to + fsize && + if (progress_at != ULONG_MAX && + transferred_to >= update_at && (rreq->origin == NETFS_READAHEAD \|\| rreq->origin == NETFS_READPAGE \|\| rreq->origin == NETFS_READ_FOR_WRITE) && list_is_first(&subreq->rreq_link, &stream->subrequests) ) { + trace_netfs_sreq(subreq, netfs_sreq_trace_progress); __set_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags); netfs_wake_collector(rreq); } diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c index 2b42758e01ec9..dd463a485139c 100644 --- a/fs/netfs/read_retry.c +++ b/fs/netfs/read_retry.c @@ -292,6 +292,13 @@ void netfs_unlock_abandoned_read_pages(struct netfs_io_request rreq) { struct folio_queue p; + / We have to wait for readahead refs to have been released before we + * can unlock any folios as the ref-dropper walks i_pages and the only + * thing preventing these folios from being removed is the folio lock. + / + if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + netfs_wait_for_put_ra_refs(rreq); + for (p = rreq->buffer.tail; p; p = p->next) { for (int slot = 0; slot < folioq_count(p); slot++) { struct folio folio = folioq_folio(p, slot); diff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c index 8833550d2eb60..de67ac41548d1 100644 --- a/fs/netfs/read_single.c +++ b/fs/netfs/read_single.c @@ -170,6 +170,8 @@ ssize_t netfs_read_single(struct inode inode, struct file file, struct iov_ite if (IS_ERR(rreq)) return PTR_ERR(rreq); + rreq->progress_at = rreq->len; + ret = netfs_single_begin_cache_read(rreq, ictx); if (ret == -ENOMEM \|\| ret == -EINTR \|\| ret == -ERESTARTSYS) goto cleanup_free; diff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c index 8c0026836f9c1..424e77a9a1098 100644 --- a/fs/netfs/rolling_buffer.c +++ b/fs/netfs/rolling_buffer.c @@ -115,42 +115,65 @@ int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp) } / - * Decant the list of folios to read into a rolling buffer. + * Decant the entire list of folios to read into a rolling buffer. / -ssize_t rolling_buffer_load_from_ra(struct rolling_buffer roll, - struct readahead_control ractl, - struct folio_batch put_batch) +ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll, + struct readahead_control ractl, + unsigned int rreq_id, gfp_t gfp) { struct folio_queue fq; - struct page vec; - int nr, ix, to; - ssize_t size = 0; + ssize_t loaded = 0; - if (rolling_buffer_make_space(roll, GFP_KERNEL) < 0) - return -ENOMEM; + while (ractl->_nr_pages - ractl->_batch_count > 0) { + unsigned int nr; - fq = roll->head; - vec = (struct page )fq->vec.folios; - nr = __readahead_batch(ractl, vec + folio_batch_count(&fq->vec), - folio_batch_space(&fq->vec)); - ix = fq->vec.nr; - to = ix + nr; - fq->vec.nr = to; - for (; ix < to; ix++) { - struct folio folio = folioq_folio(fq, ix); - unsigned int order = folio_order(folio); - - fq->orders[ix] = order; - size += PAGE_SIZE << order; - trace_netfs_folio(folio, netfs_folio_trace_read); - if (!folio_batch_add(put_batch, folio)) - folio_batch_release(put_batch); + /* Allocate a folioq to put some folios into and attach it to + * the rolling buffer. + / + fq = netfs_folioq_alloc(rreq_id, gfp, + netfs_trace_folioq_make_space); + if (!fq) + goto nomem_unlock; + fq->prev = roll->head; + if (!roll->tail) + roll->tail = fq; + else + roll->head->next = fq; + roll->head = fq; + + / Get a batch of folios and note their orders. / + nr = __readahead_batch(ractl, (struct page )fq->vec.folios, + folioq_nr_slots(fq)); + if (WARN_ON_ONCE(!nr)) + break; + fq->vec.nr = nr; + + for (int slot = 0; slot < nr; slot++) { + struct folio folio = folioq_folio(fq, slot); + unsigned int order; + + order = folio_order(folio); + fq->orders[slot] = order; + loaded += PAGE_SIZE << order; + trace_netfs_folio(folio, netfs_folio_trace_read); + } } - WRITE_ONCE(roll->iter.count, roll->iter.count + size); - /* Store the counter after setting the slot. / - smp_store_release(&roll->next_head_slot, to); - return size; + WRITE_ONCE(roll->iter.count, loaded); + iov_iter_folio_queue(&roll->iter, ITER_DEST, roll->tail, 0, 0, loaded); + return loaded; + +nomem_unlock: + for (fq = roll->tail; fq; fq = fq->next) { + for (int slot = 0; slot < folioq_count(fq); slot++) { + folio_unlock(fq->vec.folios[slot]); + folioq_mark(fq, slot); + } + } + rolling_buffer_clear(roll); + roll->head = NULL; + roll->tail = NULL; + return -ENOMEM; } / diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c index 2d9cfcd43658f..851f6f93ad45a 100644 --- a/fs/netfs/write_issue.c +++ b/fs/netfs/write_issue.c @@ -170,6 +170,8 @@ void netfs_prepare_write(struct netfs_io_request wreq, rolling_buffer_make_space(&wreq->buffer, wreq->gfp); subreq = netfs_alloc_subrequest(wreq); + if (!subreq) + return; subreq->source = stream->source; subreq->start = start; subreq->stream_nr = stream->stream_nr; diff --git a/include/linux/netfs.h b/include/linux/netfs.h index f837a501008c9..1cf2ef3ce18b8 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -246,6 +246,7 @@ struct netfs_io_request { unsigned long long submitted; / Amount submitted for I/O so far / unsigned long long len; / Length of the request / size_t transferred; / Amount to be indicated as transferred / + size_t progress_at; / Report read progress when hit this much read / long error; / 0 or error that occurred / unsigned long long i_size; / Size of the file / unsigned long long start; / Start position / @@ -262,7 +263,6 @@ struct netfs_io_request { atomic_t subreq_counter; / Next subreq->debug_index / unsigned int nr_group_rel; / Number of refs to release on ->group / spinlock_t lock; / Lock for queuing subreqs / - unsigned char front_folio_order; / Order (size) of front folio / enum netfs_io_origin origin; / Origin of the request / bool direct_bv_unpin; / T if direct_bv[] must be unpinned / refcount_t ref; @@ -278,6 +278,7 @@ struct netfs_io_request { #define NETFS_RREQ_FOLIO_COPY_TO_CACHE 10 / Copy current folio to cache from read / #define NETFS_RREQ_UPLOAD_TO_SERVER 11 / Need to write to the server / #define NETFS_RREQ_USE_IO_ITER 12 / Use ->io_iter rather than ->i_pages / +#define NETFS_RREQ_NEED_PUT_RA_REFS 17 / Need to put the folio refs RA gave us / #define NETFS_RREQ_USE_PGPRIV2 31 / [DEPRECATED] Use PG_private_2 to mark * write to cache on read / const struct netfs_request_ops netfs_ops; diff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h index 9e5dad29669cf..a97f7cfaacaad 100644 --- a/include/linux/rolling_buffer.h +++ b/include/linux/rolling_buffer.h @@ -45,9 +45,9 @@ struct rolling_buffer_snapshot { int rolling_buffer_init(struct rolling_buffer roll, unsigned int rreq_id, unsigned int direction, gfp_t gfp); int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp); -ssize_t rolling_buffer_load_from_ra(struct rolling_buffer roll, - struct readahead_control ractl, - struct folio_batch put_batch); +ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll, + struct readahead_control ractl, + unsigned int rreq_id, gfp_t gfp); ssize_t rolling_buffer_append(struct rolling_buffer roll, struct folio folio, unsigned int flags, gfp_t gfp); struct folio_queue rolling_buffer_delete_spent(struct rolling_buffer roll); diff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h index 9259bc71049e0..e3101410e8b2d 100644 --- a/include/trace/events/cachefiles.h +++ b/include/trace/events/cachefiles.h @@ -372,7 +372,7 @@ TRACE_EVENT(cachefiles_rename, TRACE_EVENT(cachefiles_coherency, TP_PROTO(struct cachefiles_object obj, ino_t ino, - u64 disk_aux, + const void disk_aux, enum cachefiles_content content, enum cachefiles_coherency_trace why), @@ -389,12 +389,27 @@ TRACE_EVENT(cachefiles_coherency, ), TP_fast_assign( + union { + __be16 s[4]; + __be64 ll; + } x; + __entry->obj = obj->debug_id; __entry->why = why; __entry->content = content; __entry->ino = ino; __entry->aux = be64_to_cpup((__be64 )obj->cookie->inline_aux); - __entry->disk_aux = disk_aux; + + /* cachefiles_xattr::data is 2-byte aligned but not 8-byte aligned. / + if (disk_aux) { + x.s[0] = ((__be16 )disk_aux)[0]; + x.s[1] = ((__be16 )disk_aux)[1]; + x.s[2] = ((__be16 )disk_aux)[2]; + x.s[3] = ((__be16 )disk_aux)[3]; + __entry->disk_aux = be64_to_cpu(x.ll); + } else { + __entry->disk_aux = 0; + } ), TP_printk("o=%08x %s B=%llx c=%u aux=%llx dsk=%llx", diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h index 082cb03c61316..b5da315274ad5 100644 --- a/include/trace/events/netfs.h +++ b/include/trace/events/netfs.h @@ -59,6 +59,7 @@ EM(netfs_rreq_trace_free, "FREE ") \ EM(netfs_rreq_trace_intr, "INTR ") \ EM(netfs_rreq_trace_ki_complete, "KI-CMPL") \ + EM(netfs_rreq_trace_ra_put_ref, "RA-PUT ") \ EM(netfs_rreq_trace_recollect, "RECLLCT") \ EM(netfs_rreq_trace_redirty, "REDIRTY") \ EM(netfs_rreq_trace_resubmit, "RESUBMT") \ @@ -70,9 +71,11 @@ EM(netfs_rreq_trace_unpause, "UNPAUSE") \ EM(netfs_rreq_trace_wait_ip, "WAIT-IP") \ EM(netfs_rreq_trace_wait_pause, "--PAUSED--") \ + EM(netfs_rreq_trace_wait_put_ra_refs, "WAIT-P-RA") \ EM(netfs_rreq_trace_wait_quiesce, "WAIT-QUIESCE") \ EM(netfs_rreq_trace_waited_ip, "DONE-IP") \ EM(netfs_rreq_trace_waited_pause, "--UNPAUSED--") \ + EM(netfs_rreq_trace_waited_put_ra_refs, "DONE-P-RA") \ EM(netfs_rreq_trace_waited_quiesce, "DONE-QUIESCE") \ EM(netfs_rreq_trace_wake_ip, "WAKE-IP") \ EM(netfs_rreq_trace_wake_queue, "WAKE-Q ") \ @@ -786,6 +789,27 @@ TRACE_EVENT(netfs_folioq, __print_symbolic(__entry->trace, netfs_folioq_traces)) ); +TRACE_EVENT(netfs_read_progress_at, + TP_PROTO(const struct netfs_io_request rreq), + + TP_ARGS(rreq), + + TP_STRUCT__entry( + __field(unsigned int, rreq) + __field(size_t, progress_at) + __field(size_t, cleaned_to) + ), + + TP_fast_assign( + __entry->rreq = rreq->debug_id; + __entry->cleaned_to = rreq->cleaned_to - rreq->start; + __entry->progress_at = rreq->progress_at; + ), + + TP_printk("R=%08x cln=%zx prg=%zx", + __entry->rreq, __entry->cleaned_to, __entry->progress_at) + ); + #undef EM #undef E_ #endif /* _TRACE_NETFS_H */
3/2	2026/08/25 14:11	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 14832 output: 30 thoughts: 808 Thoughts: My Initial Assessment of this Patch Okay, so I'm looking at a patch here, and it looks like we've got some changes touching `fs/cachefiles/xattr.c` and a whole bunch of stuff in `fs/netfs/`. The `cachefiles` bit is straightforward enough; it's fixing some memory alignment and out-of-bounds issues. Specifically, it seems like we're correctly using `put_unaligned_be64` to deal with these tracepoint issues. Good catch. Now, the `netfs` changes, that's where things get interesting. This is a substantial rewrite. It's a broad touch across `buffered_read`, `direct_write`, `internal.h`, `misc.c`, `objects.c`, `read_collect.c`, `read_retry.c`, `read_single.c`, `rolling_buffer.c`, and `write_issue.c`! We're talking about almost everything. Seems like it alters how readahead refs are managed, read iterators are prepared and folios are unlocked. I'm also seeing a fix for potential zero-length iterator issues in `netfs_unbuffered_write`. A significant rewrite. Given that `netfs` is used by a range of network filesystems – cifs, afs, 9p, ceph, etc. – this is definitely something to pay attention to. Since these filesystems can be mounted locally or over a network (even within a virtualized environment like QEMU), this is clearly `WorthFuzzing=true`. Now I need to zero in on the relevant CONFIG options. Clearly, `CONFIG_NETFS_SUPPORT` is the main one. We also need `CONFIG_CACHEFILES` since `fs/cachefiles/` is being touched. To actually use netfs, I'll need to check if things like `CONFIG_9P_FS`, `CONFIG_CIFS`, `CONFIG_CEPH_FS`, or `CONFIG_AFS_FS` are enabled. I'll take a look at the `Kconfig` files in both `fs/netfs/` and `fs/cachefiles/` to confirm.
4/2	2026/08/25 14:11	tool	grepper	0m Args: { "Expression": "config NETFS_SUPPORT", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/Kconfig-2-\nfs/netfs/Kconfig:3:config NETFS_SUPPORT\nfs/netfs/Kconfig-4-\ttristate\n" }
5/2	2026/08/25 14:11	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16206 output: 29 thoughts: 13 Thoughts: Here's a summary of my thought process, as requested: Kconfig Inspection: File System Caching Configuration Okay, so I'm thinking I need to delve into how the caching for the file system is configured. My initial instinct is to go straight to `fs/cachefiles/Kconfig`. That's where I'd expect to find the settings that control whether or not the caching functionality is enabled, and if so, how it's parameterized. I'm assuming that it will offer various options - perhaps related to the caching strategy, maximum cache size, eviction policies, or even the underlying storage devices used for the cache. The Kconfig file should define the dependencies and default values as well, giving me a solid understanding of how this caching system is integrated within the kernel build process. I'm expecting to see things like `CONFIG_CACHEFILES`, `CONFIG_CACHEFILES_FS`, `CONFIG_CACHEFILES_MAX_SIZE`, etc. within. Let's see what's in there...
6/2	2026/08/25 14:11	tool	grepper	0m Args: { "Expression": "config CACHEFILES", "PathPrefix": "fs/cachefiles/" } Results: { "Output": "fs/cachefiles/Kconfig-2-\nfs/cachefiles/Kconfig:3:config CACHEFILES\nfs/cachefiles/Kconfig-4-\ttristate \"Filesystem caching on files\"\n--\nfs/cachefiles/Kconfig-13-\nfs/cachefiles/Kconfig:14:config CACHEFILES_DEBUG\nfs/cachefiles/Kconfig-15-\tbool \"Debug CacheFiles\"\n--\nfs/cachefiles/Kconfig-22-\nfs/cachefiles/Kconfig:23:config CACHEFILES_ERROR_INJECTION\nfs/cachefiles/Kconfig-24-\tbool \"Provide error injection for cachefiles\"\n" }
7/2	2026/08/25 14:11	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16629 output: 33 thoughts: 16 Thoughts: Here's my take on those thoughts, from my perspective as an expert: Kconfig Dependency Deep Dive Okay, so I need to get a handle on the build configuration dependencies. My instinct says to start digging into the `fs/netfs/Kconfig` file. I'm assuming that's where the core configuration options for the network filesystem are defined. The goal is to understand what other kernel components or options must be enabled or are logically related to `netfs`. I'm expecting to see things like, "if NETWORKING is enabled, then this option is available," or perhaps dependencies on specific network protocol stacks, crypto libraries, or even specific hardware drivers. I need to understand the full web of connections this subsystem has within the kernel's build system so I don't introduce problems with other parts of the system. Let's see what Kconfig reveals.
8/2	2026/08/25 14:11	tool	read-file	0m Args: { "File": "fs/netfs/Kconfig", "FirstLine": 1, "LineCount": 50 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t\n 3:\tconfig NETFS_SUPPORT\n 4:\t\ttristate\n 5:\t\thelp\n 6:\t\t This option enables support for network filesystems, including\n 7:\t\t helpers for high-level buffered I/O, abstracting out read\n 8:\t\t segmentation, local caching and transparent huge page support.\n 9:\t\n 10:\tconfig NETFS_STATS\n 11:\t\tbool \"Gather statistical information on local caching\"\n 12:\t\tdepends on NETFS_SUPPORT \u0026\u0026 PROC_FS\n 13:\t\thelp\n 14:\t\t This option causes statistical information to be gathered on local\n 15:\t\t caching and exported through file:\n 16:\t\n 17:\t\t\t/proc/fs/fscache/stats\n 18:\t\n 19:\t\t The gathering of statistics adds a certain amount of overhead to\n 20:\t\t execution as there are a quite a few stats gathered, and on a\n 21:\t\t multi-CPU system these may be on cachelines that keep bouncing\n 22:\t\t between CPUs. On the other hand, the stats are very useful for\n 23:\t\t debugging purposes. Saying 'Y' here is recommended.\n 24:\t\n 25:\tconfig NETFS_DEBUG\n 26:\t\tbool \"Enable dynamic debugging netfslib and FS-Cache\"\n 27:\t\tdepends on NETFS_SUPPORT\n 28:\t\thelp\n 29:\t\t This permits debugging to be dynamically enabled in the local caching\n 30:\t\t management module. If this is set, the debugging output may be\n 31:\t\t enabled by setting bits in /sys/module/netfs/parameters/debug.\n 32:\t\n 33:\tconfig FSCACHE\n 34:\t\tbool \"General filesystem local caching manager\"\n 35:\t\tdepends on NETFS_SUPPORT\n 36:\t\thelp\n 37:\t\t This option enables a generic filesystem caching manager that can be\n 38:\t\t used by various network and other filesystems to cache data locally.\n 39:\t\t Different sorts of caches can be plugged in, depending on the\n 40:\t\t resources available.\n 41:\t\n 42:\t\t See Documentation/filesystems/caching/fscache.rst for more information.\n 43:\t\n 44:\tconfig FSCACHE_STATS\n 45:\t\tbool \"Gather statistical information on local caching\"\n 46:\t\tdepends on FSCACHE \u0026\u0026 PROC_FS\n 47:\t\tselect NETFS_STATS\n 48:\t\thelp\n 49:\t\t This option causes statistical information to be gathered on local\n 50:\t\t caching and exported through file:\n" }
9/2	2026/08/25 14:11	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 17552 output: 27 thoughts: 37 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience, and written as if they were my own: Digging into NETFS_SUPPORT Alright, so `NETFS_SUPPORT`. It's a tristate option, completely self-contained, no direct dependencies. Interesting. Usually, these sorts of things are picked up as a supporting component for various other filesystems. Let's dig in and figure out the upstream logic. Time to track down who is actually selecting `NETFS_SUPPORT`. I need to understand the architectural picture and identify the key configurations that drive its inclusion. This could reveal interesting patterns in how network filesystems are being designed and utilized within the kernel. Let's see what the select statements tell us.
10/2	2026/08/25 14:11	tool	grepper	0m Args: { "Expression": "select NETFS_SUPPORT", "PathPrefix": "fs/" } Results: { "Output": "fs/9p/Kconfig=2=config 9P_FS\n--\nfs/9p/Kconfig-4-\tdepends on NET_9P\nfs/9p/Kconfig:5:\tselect NETFS_SUPPORT\nfs/9p/Kconfig-6-\thelp\n--\nfs/afs/Kconfig=2=config AFS_FS\n--\nfs/afs/Kconfig-6-\tselect DNS_RESOLVER\nfs/afs/Kconfig:7:\tselect NETFS_SUPPORT\nfs/afs/Kconfig-8-\tselect CRYPTO_KRB5\n--\nfs/ceph/Kconfig=2=config CEPH_FS\n--\nfs/ceph/Kconfig-5-\tselect CEPH_LIB\nfs/ceph/Kconfig:6:\tselect NETFS_SUPPORT\nfs/ceph/Kconfig-7-\tselect FS_ENCRYPTION_ALGS if FS_ENCRYPTION\n--\nfs/nfs/Kconfig=173=config NFS_FSCACHE\n--\nfs/nfs/Kconfig-175-\tdepends on NFS_FS\nfs/nfs/Kconfig:176:\tselect NETFS_SUPPORT\nfs/nfs/Kconfig-177-\tselect FSCACHE\n--\nfs/smb/client/Kconfig=2=config CIFS\n--\nfs/smb/client/Kconfig-20-\tselect OID_REGISTRY\nfs/smb/client/Kconfig:21:\tselect NETFS_SUPPORT\nfs/smb/client/Kconfig-22-\thelp\n" }
11/2	2026/08/25 14:11	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18155 output: 49 thoughts: 662 Thoughts: Fuzzing Target Identification Okay, so I need to identify good targets for fuzzing. First, I need to make sure I'm covering the right filesystem support in the build. I'll definitely include `NETFS_SUPPORT`, then `CACHEFILES`, `9P_FS`, `CIFS`, `CEPH_FS`, and `AFS_FS` since those all seem relevant to this area of the kernel. Now, let's look at what the patch actually modifies. I see a lot of functions, and I need to hone in on the important ones. My initial thought is to exclude static functions, as they are less likely to be good entry points for fuzzing, and focus on the functions that are exported or at least used across multiple files. So, here's the list of non-static functions this patch touches: * `cachefiles_set_object_xattr` * `cachefiles_check_auxdata` * `netfs_readahead` * `netfs_read_folio` * `netfs_write_begin` * `netfs_prefetch_for_write` * `netfs_unbuffered_write_iter_locked` * `netfs_wait_for_put_ra_refs` * `netfs_alloc_request` * `netfs_read_set_unlock_at` * `netfs_read_subreq_progress` * `netfs_unlock_abandoned_read_pages` * `netfs_read_single` * `rolling_buffer_bulk_load_from_ra` * `netfs_prepare_write` Next, I need to make sure my initial assessment is correct. I should confirm that `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` are actually non-static and exposed somehow; a quick check of the source code confirms they are. The same will be done for `netfs_readahead` and the others to finalize the selection of targets.
12/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "^(int\|void\|ssize_t\|struct netfs_io_request \\\|bool) netfs_", "PathPrefix": "fs/netfs/" } Results:* { "Output": "fs/netfs/buffered_read.c=159=static void netfs_read_cache_to_pagecache(struct netfs_io_request rreq,\n--\nfs/netfs/buffered_read.c-168-\nfs/netfs/buffered_read.c:169:void netfs_queue_read(struct netfs_io_request rreq,\nfs/netfs/buffered_read.c-170-\t\t struct netfs_io_subrequest subreq)\n--\nfs/netfs/buffered_read.c=219=static void netfs_read_to_pagecache(struct netfs_io_request rreq)\n--\nfs/netfs/buffered_read.c-345- /\nfs/netfs/buffered_read.c:346:void netfs_readahead(struct readahead_control ractl)\nfs/netfs/buffered_read.c-347-{\n--\nfs/netfs/buffered_read.c=419=static int netfs_read_gaps(struct file file, struct folio folio)\n--\nfs/netfs/buffered_read.c-523- /\nfs/netfs/buffered_read.c:524:int netfs_read_folio(struct file file, struct folio folio)\nfs/netfs/buffered_read.c-525-{\n--\nfs/netfs/buffered_read.c=586=static bool netfs_skip_folio_read(struct folio folio, loff_t pos, size_t len,\n--\nfs/netfs/buffered_read.c-652- /\nfs/netfs/buffered_read.c:653:int netfs_write_begin(struct netfs_inode ctx,\nfs/netfs/buffered_read.c-654-\t\t struct file file, struct address_space mapping,\n--\nfs/netfs/buffered_read.c=740=EXPORT_SYMBOL(netfs_write_begin);\n--\nfs/netfs/buffered_read.c-744- /\nfs/netfs/buffered_read.c:745:int netfs_prefetch_for_write(struct file file, struct folio folio,\nfs/netfs/buffered_read.c-746-\t\t\t size_t offset, size_t len)\n--\nfs/netfs/buffered_read.c-812- /\nfs/netfs/buffered_read.c:813:ssize_t netfs_buffered_read_iter(struct kiocb iocb, struct iov_iter iter)\nfs/netfs/buffered_read.c-814-{\n--\nfs/netfs/buffered_read.c=830=EXPORT_SYMBOL(netfs_buffered_read_iter);\n--\nfs/netfs/buffered_read.c-852- /\nfs/netfs/buffered_read.c:853:ssize_t netfs_file_read_iter(struct kiocb iocb, struct iov_iter iter)\nfs/netfs/buffered_read.c-854-{\n--\nfs/netfs/buffered_write.c=19=static struct folio netfs_grab_folio_for_write(struct address_space mapping,\n--\nfs/netfs/buffered_write.c-36- /\nfs/netfs/buffered_write.c:37:void netfs_update_i_size(struct netfs_inode ctx, struct inode inode,\nfs/netfs/buffered_write.c-38-\t\t\t loff_t pos, size_t copied)\n--\nfs/netfs/buffered_write.c-86- /\nfs/netfs/buffered_write.c:87:ssize_t netfs_perform_write(struct kiocb iocb, struct iov_iter iter,\nfs/netfs/buffered_write.c-88-\t\t\t struct netfs_group netfs_group)\n--\nfs/netfs/buffered_write.c=443=EXPORT_SYMBOL(netfs_perform_write);\n--\nfs/netfs/buffered_write.c-467- /\nfs/netfs/buffered_write.c:468:ssize_t netfs_buffered_write_iter_locked(struct kiocb iocb, struct iov_iter from,\nfs/netfs/buffered_write.c-469-\t\t\t\t\t struct netfs_group netfs_group)\n--\nfs/netfs/buffered_write.c=486=EXPORT_SYMBOL(netfs_buffered_write_iter_locked);\n--\nfs/netfs/buffered_write.c-500- /\nfs/netfs/buffered_write.c:501:ssize_t netfs_file_write_iter(struct kiocb iocb, struct iov_iter from)\nfs/netfs/buffered_write.c-502-{\n--\nfs/netfs/direct_read.c=112=static ssize_t netfs_unbuffered_read(struct netfs_io_request rreq, bool sync)\n--\nfs/netfs/direct_read.c-152- /\nfs/netfs/direct_read.c:153:ssize_t netfs_unbuffered_read_iter_locked(struct kiocb iocb, struct iov_iter iter)\nfs/netfs/direct_read.c-154-{\n--\nfs/netfs/direct_read.c=230=EXPORT_SYMBOL(netfs_unbuffered_read_iter_locked);\n--\nfs/netfs/direct_read.c-239- /\nfs/netfs/direct_read.c:240:ssize_t netfs_unbuffered_read_iter(struct kiocb iocb, struct iov_iter iter)\nfs/netfs/direct_read.c-241-{\n--\nfs/netfs/direct_write.c=211=static void netfs_unbuffered_write_async(struct work_struct work)\n--\nfs/netfs/direct_write.c-222- /\nfs/netfs/direct_write.c:223:ssize_t netfs_unbuffered_write_iter_locked(struct kiocb iocb, struct iov_iter iter,\nfs/netfs/direct_write.c-224-\t\t\t\t\t\t struct netfs_group netfs_group)\n--\nfs/netfs/direct_write.c=316=EXPORT_SYMBOL(netfs_unbuffered_write_iter_locked);\n--\nfs/netfs/direct_write.c-330- /\nfs/netfs/direct_write.c:331:ssize_t netfs_unbuffered_write_iter(struct kiocb iocb, struct iov_iter from)\nfs/netfs/direct_write.c-332-{\n--\nfs/netfs/internal.h-25- /\nfs/netfs/internal.h:26:void netfs_queue_read(struct netfs_io_request rreq,\nfs/netfs/internal.h-27-\t\t struct netfs_io_subrequest subreq);\nfs/netfs/internal.h:28:void netfs_cache_read_terminated(void priv, ssize_t transferred_or_error);\nfs/netfs/internal.h:29:int netfs_prefetch_for_write(struct file file, struct folio folio,\nfs/netfs/internal.h-30-\t\t\t size_t offset, size_t len);\n--\nfs/netfs/internal.h-34- /\nfs/netfs/internal.h:35:void netfs_update_i_size(struct netfs_inode ctx, struct inode inode,\nfs/netfs/internal.h-36-\t\t\t loff_t pos, size_t copied);\n--\nfs/netfs/internal.h=71=struct folio_queue netfs_buffer_make_space(struct netfs_io_request rreq,\nfs/netfs/internal.h-72-\t\t\t\t\t enum netfs_folioq_trace trace);\nfs/netfs/internal.h:73:void netfs_reset_iter(struct netfs_io_subrequest subreq);\nfs/netfs/internal.h:74:void netfs_wake_collector(struct netfs_io_request rreq);\nfs/netfs/internal.h:75:void netfs_subreq_clear_in_progress(struct netfs_io_subrequest subreq);\nfs/netfs/internal.h:76:void netfs_wait_for_in_progress_stream(struct netfs_io_request rreq,\nfs/netfs/internal.h-77-\t\t\t\t struct netfs_io_stream stream);\nfs/netfs/internal.h:78:ssize_t netfs_wait_for_read(struct netfs_io_request rreq);\nfs/netfs/internal.h:79:ssize_t netfs_wait_for_write(struct netfs_io_request rreq);\nfs/netfs/internal.h:80:void netfs_wait_for_paused_read(struct netfs_io_request rreq);\nfs/netfs/internal.h:81:void netfs_wait_for_paused_write(struct netfs_io_request rreq);\nfs/netfs/internal.h:82:void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq);\nfs/netfs/internal.h-83-\n--\nfs/netfs/internal.h=87=struct netfs_io_request netfs_alloc_request(struct address_space mapping,\n--\nfs/netfs/internal.h-90-\t\t\t\t\t enum netfs_io_origin origin);\nfs/netfs/internal.h:91:void netfs_get_request(struct netfs_io_request rreq, enum netfs_rreq_ref_trace what);\nfs/netfs/internal.h:92:void netfs_clear_subrequests(struct netfs_io_request rreq);\nfs/netfs/internal.h:93:void netfs_put_request(struct netfs_io_request rreq, enum netfs_rreq_ref_trace what);\nfs/netfs/internal.h:94:void netfs_put_failed_request(struct netfs_io_request rreq);\nfs/netfs/internal.h-95-struct netfs_io_subrequest netfs_alloc_subrequest(struct netfs_io_request rreq);\n--\nfs/netfs/internal.h=103=static inline void netfs_see_subrequest(struct netfs_io_subrequest subreq,\n--\nfs/netfs/internal.h-112- /\nfs/netfs/internal.h:113:void netfs_read_set_unlock_at(struct netfs_io_request rreq);\nfs/netfs/internal.h:114:bool netfs_read_collection(struct netfs_io_request rreq);\nfs/netfs/internal.h:115:void netfs_read_collection_worker(struct work_struct work);\nfs/netfs/internal.h:116:void netfs_cancel_read(struct netfs_io_subrequest subreq, int error);\nfs/netfs/internal.h:117:void netfs_cache_read_terminated(void priv, ssize_t transferred_or_error);\nfs/netfs/internal.h-118-\n--\nfs/netfs/internal.h-121- /\nfs/netfs/internal.h:122:void netfs_pgpriv2_copy_to_cache(struct netfs_io_request rreq, struct folio folio);\nfs/netfs/internal.h:123:void netfs_pgpriv2_end_copy_to_cache(struct netfs_io_request rreq);\nfs/netfs/internal.h:124:bool netfs_pgpriv2_unlock_copied_folios(struct netfs_io_request wreq);\nfs/netfs/internal.h-125-\n--\nfs/netfs/internal.h-128- /\nfs/netfs/internal.h:129:void netfs_retry_reads(struct netfs_io_request rreq);\nfs/netfs/internal.h:130:void netfs_unlock_abandoned_read_pages(struct netfs_io_request rreq);\nfs/netfs/internal.h-131-\n--\nfs/netfs/internal.h=174=extern atomic_t netfs_n_folioq;\nfs/netfs/internal.h-175-\nfs/netfs/internal.h:176:int netfs_stats_show(struct seq_file m, void v);\nfs/netfs/internal.h-177-\n--\nfs/netfs/internal.h=183=static inline void netfs_stat_d(atomic_t stat)\n--\nfs/netfs/internal.h-195- /\nfs/netfs/internal.h:196:int netfs_folio_written_back(struct folio folio);\nfs/netfs/internal.h:197:bool netfs_write_collection(struct netfs_io_request wreq);\nfs/netfs/internal.h:198:void netfs_write_collection_worker(struct work_struct work);\nfs/netfs/internal.h-199-\n--\nfs/netfs/internal.h=203=struct netfs_io_request netfs_create_write_req(struct address_space mapping,\n--\nfs/netfs/internal.h-206-\t\t\t\t\t\tenum netfs_io_origin origin);\nfs/netfs/internal.h:207:void netfs_prepare_write(struct netfs_io_request wreq,\nfs/netfs/internal.h-208-\t\t\t struct netfs_io_stream stream,\nfs/netfs/internal.h-209-\t\t\t loff_t start);\nfs/netfs/internal.h:210:void netfs_reissue_write(struct netfs_io_stream stream,\nfs/netfs/internal.h-211-\t\t\t struct netfs_io_subrequest subreq,\nfs/netfs/internal.h-212-\t\t\t struct iov_iter source);\nfs/netfs/internal.h:213:void netfs_issue_write(struct netfs_io_request wreq,\nfs/netfs/internal.h-214-\t\t struct netfs_io_stream stream);\n--\nfs/netfs/internal.h=218=struct netfs_io_request netfs_begin_writethrough(struct kiocb iocb, size_t len);\nfs/netfs/internal.h:219:int netfs_advance_writethrough(struct netfs_io_request wreq, struct writeback_control wbc,\nfs/netfs/internal.h-220-\t\t\t struct folio folio, size_t copied, bool to_page_end,\nfs/netfs/internal.h-221-\t\t\t struct folio writethrough_cache);\nfs/netfs/internal.h:222:ssize_t netfs_end_writethrough(struct netfs_io_request wreq, struct writeback_control wbc,\nfs/netfs/internal.h-223-\t\t\t struct folio writethrough_cache);\n--\nfs/netfs/internal.h-227- /\nfs/netfs/internal.h:228:void netfs_retry_writes(struct netfs_io_request wreq);\nfs/netfs/internal.h-229-\n--\nfs/netfs/iterator.c-35- /\nfs/netfs/iterator.c:36:ssize_t netfs_extract_user_iter(struct iov_iter orig, size_t orig_len,\nfs/netfs/iterator.c-37-\t\t\t\tstruct iov_iter new,\n--\nfs/netfs/locking.c=37=static int netfs_block_o_direct(struct netfs_inode ictx)\n--\nfs/netfs/locking.c-60- /\nfs/netfs/locking.c:61:int netfs_start_io_read(struct inode inode)\nfs/netfs/locking.c-62-\t__acquires(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=83=EXPORT_SYMBOL(netfs_start_io_read);\n--\nfs/netfs/locking.c-91- /\nfs/netfs/locking.c:92:void netfs_end_io_read(struct inode inode)\nfs/netfs/locking.c-93-\t__releases(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=97=EXPORT_SYMBOL(netfs_end_io_read);\n--\nfs/netfs/locking.c-105- /\nfs/netfs/locking.c:106:int netfs_start_io_write(struct inode inode)\nfs/netfs/locking.c-107-\t__acquires(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=120=EXPORT_SYMBOL(netfs_start_io_write);\n--\nfs/netfs/locking.c-128- /\nfs/netfs/locking.c:129:void netfs_end_io_write(struct inode inode)\nfs/netfs/locking.c-130-\t__releases(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=137=static int netfs_block_buffered(struct inode inode)\n--\nfs/netfs/locking.c-171- /\nfs/netfs/locking.c:172:int netfs_start_io_direct(struct inode inode)\nfs/netfs/locking.c-173-\t__acquires(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=196=EXPORT_SYMBOL(netfs_start_io_direct);\n--\nfs/netfs/locking.c-204- /\nfs/netfs/locking.c:205:void netfs_end_io_direct(struct inode inode)\nfs/netfs/locking.c-206-\t__releases(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=215=static bool netfs_wb_begin_wait(struct netfs_inode ictx)\n--\nfs/netfs/locking.c-258- /\nfs/netfs/locking.c:259:bool netfs_wb_begin(struct netfs_inode ictx, bool nowait)\nfs/netfs/locking.c-260-{\n--\nfs/netfs/locking.c=270=EXPORT_SYMBOL(netfs_wb_begin);\n--\nfs/netfs/locking.c-276- /\nfs/netfs/locking.c:277:void netfs_wb_end(struct netfs_inode ictx)\nfs/netfs/locking.c-278-{\n--\nfs/netfs/misc.c-18- /\nfs/netfs/misc.c:19:int netfs_alloc_folioq_buffer(struct address_space mapping,\nfs/netfs/misc.c-20-\t\t\t struct folio_queue *_buffer,\n--\nfs/netfs/misc.c=69=EXPORT_SYMBOL(netfs_alloc_folioq_buffer);\n--\nfs/netfs/misc.c-77- /\nfs/netfs/misc.c:78:void netfs_free_folioq_buffer(struct folio_queue fq)\nfs/netfs/misc.c-79-{\n--\nfs/netfs/misc.c=105=EXPORT_SYMBOL(netfs_free_folioq_buffer);\n--\nfs/netfs/misc.c-112- /\nfs/netfs/misc.c:113:void netfs_reset_iter(struct netfs_io_subrequest subreq)\nfs/netfs/misc.c-114-{\n--\nfs/netfs/misc.c-135- /\nfs/netfs/misc.c:136:bool netfs_dirty_folio(struct address_space mapping, struct folio folio)\nfs/netfs/misc.c-137-{\n--\nfs/netfs/misc.c=163=EXPORT_SYMBOL(netfs_dirty_folio);\n--\nfs/netfs/misc.c-172- /\nfs/netfs/misc.c:173:int netfs_unpin_writeback(struct inode inode, struct writeback_control wbc)\nfs/netfs/misc.c-174-{\n--\nfs/netfs/misc.c=181=EXPORT_SYMBOL(netfs_unpin_writeback);\n--\nfs/netfs/misc.c-190- /\nfs/netfs/misc.c:191:void netfs_clear_inode_writeback(struct inode inode, const void aux)\nfs/netfs/misc.c-192-{\n--\nfs/netfs/misc.c=200=EXPORT_SYMBOL(netfs_clear_inode_writeback);\n--\nfs/netfs/misc.c-210- /\nfs/netfs/misc.c:211:void netfs_invalidate_folio(struct folio folio, size_t offset, size_t length)\nfs/netfs/misc.c-212-{\n--\nfs/netfs/misc.c=294=EXPORT_SYMBOL(netfs_invalidate_folio);\n--\nfs/netfs/misc.c-303- /\nfs/netfs/misc.c:304:bool netfs_release_folio(struct folio folio, gfp_t gfp)\nfs/netfs/misc.c-305-{\n--\nfs/netfs/misc.c=333=EXPORT_SYMBOL(netfs_release_folio);\n--\nfs/netfs/misc.c-337- /\nfs/netfs/misc.c:338:void netfs_wake_collector(struct netfs_io_request rreq)\nfs/netfs/misc.c-339-{\n--\nfs/netfs/misc.c-352- /\nfs/netfs/misc.c:353:void netfs_subreq_clear_in_progress(struct netfs_io_subrequest subreq)\nfs/netfs/misc.c-354-{\n--\nfs/netfs/misc.c-369- /\nfs/netfs/misc.c:370:void netfs_wait_for_in_progress_stream(struct netfs_io_request rreq,\nfs/netfs/misc.c-371-\t\t\t\t struct netfs_io_stream stream)\n--\nfs/netfs/misc.c=452=static ssize_t netfs_wait_for_in_progress(struct netfs_io_request rreq,\n--\nfs/netfs/misc.c-507-\nfs/netfs/misc.c:508:ssize_t netfs_wait_for_read(struct netfs_io_request rreq)\nfs/netfs/misc.c-509-{\n--\nfs/netfs/misc.c-512-\nfs/netfs/misc.c:513:ssize_t netfs_wait_for_write(struct netfs_io_request rreq)\nfs/netfs/misc.c-514-{\n--\nfs/netfs/misc.c=521=static void netfs_wait_for_pause(struct netfs_io_request rreq,\n--\nfs/netfs/misc.c-556-\nfs/netfs/misc.c:557:void netfs_wait_for_paused_read(struct netfs_io_request rreq)\nfs/netfs/misc.c-558-{\n--\nfs/netfs/misc.c-561-\nfs/netfs/misc.c:562:void netfs_wait_for_paused_write(struct netfs_io_request rreq)\nfs/netfs/misc.c-563-{\n--\nfs/netfs/misc.c-569- /\nfs/netfs/misc.c:570:void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq)\nfs/netfs/misc.c-571-{\n--\nfs/netfs/objects.c=17=struct netfs_io_request netfs_alloc_request(struct address_space mapping,\n--\nfs/netfs/objects.c-98-\nfs/netfs/objects.c:99:void netfs_get_request(struct netfs_io_request rreq, enum netfs_rreq_ref_trace what)\nfs/netfs/objects.c-100-{\n--\nfs/netfs/objects.c-106-\nfs/netfs/objects.c:107:void netfs_clear_subrequests(struct netfs_io_request rreq)\nfs/netfs/objects.c-108-{\n--\nfs/netfs/objects.c=165=static void netfs_free_request(struct work_struct work)\n--\nfs/netfs/objects.c-173-\nfs/netfs/objects.c:174:void netfs_put_request(struct netfs_io_request rreq, enum netfs_rreq_ref_trace what)\nfs/netfs/objects.c-175-{\n--\nfs/netfs/objects.c-192- /\nfs/netfs/objects.c:193:void netfs_put_failed_request(struct netfs_io_request rreq)\nfs/netfs/objects.c-194-{\n--\nfs/netfs/objects.c=210=struct netfs_io_subrequest netfs_alloc_subrequest(struct netfs_io_request rreq)\n--\nfs/netfs/objects.c-233-\nfs/netfs/objects.c:234:void netfs_get_subrequest(struct netfs_io_subrequest subreq,\nfs/netfs/objects.c-235-\t\t\t enum netfs_sreq_ref_trace what)\n--\nfs/netfs/objects.c=244=static void netfs_free_subrequest(struct netfs_io_subrequest subreq)\n--\nfs/netfs/objects.c-255-\nfs/netfs/objects.c:256:void netfs_put_subrequest(struct netfs_io_subrequest subreq,\nfs/netfs/objects.c-257-\t\t\t enum netfs_sreq_ref_trace what)\n--\nfs/netfs/read_collect.c=42=static void netfs_unlock_read_folio(struct netfs_io_request rreq,\n--\nfs/netfs/read_collect.c-99- /\nfs/netfs/read_collect.c:100:void netfs_read_set_unlock_at(struct netfs_io_request rreq)\nfs/netfs/read_collect.c-101-{\n--\nfs/netfs/read_collect.c=413=static void netfs_rreq_assess_single(struct netfs_io_request rreq)\n--\nfs/netfs/read_collect.c-440- /\nfs/netfs/read_collect.c:441:bool netfs_read_collection(struct netfs_io_request rreq)\nfs/netfs/read_collect.c-442-{\n--\nfs/netfs/read_collect.c-487-\nfs/netfs/read_collect.c:488:void netfs_read_collection_worker(struct work_struct work)\nfs/netfs/read_collect.c-489-{\n--\nfs/netfs/read_collect.c-511- /\nfs/netfs/read_collect.c:512:void netfs_read_subreq_progress(struct netfs_io_subrequest subreq)\nfs/netfs/read_collect.c-513-{\n--\nfs/netfs/read_collect.c=535=EXPORT_SYMBOL(netfs_read_subreq_progress);\n--\nfs/netfs/read_collect.c-552- /\nfs/netfs/read_collect.c:553:void netfs_read_subreq_terminated(struct netfs_io_subrequest subreq)\nfs/netfs/read_collect.c-554-{\n--\nfs/netfs/read_collect.c=615=EXPORT_SYMBOL(netfs_read_subreq_terminated);\n--\nfs/netfs/read_collect.c-619- /\nfs/netfs/read_collect.c:620:void netfs_cancel_read(struct netfs_io_subrequest subreq, int error)\nfs/netfs/read_collect.c-621-{\n--\nfs/netfs/read_collect.c-630- /\nfs/netfs/read_collect.c:631:void netfs_cache_read_terminated(void priv, ssize_t transferred_or_error)\nfs/netfs/read_collect.c-632-{\n--\nfs/netfs/read_pgpriv2.c=98=static struct netfs_io_request netfs_pgpriv2_begin_copy_to_cache(\n--\nfs/netfs/read_pgpriv2.c-132- /\nfs/netfs/read_pgpriv2.c:133:void netfs_pgpriv2_copy_to_cache(struct netfs_io_request rreq, struct folio folio)\nfs/netfs/read_pgpriv2.c-134-{\n--\nfs/netfs/read_pgpriv2.c-149- /\nfs/netfs/read_pgpriv2.c:150:void netfs_pgpriv2_end_copy_to_cache(struct netfs_io_request rreq)\nfs/netfs/read_pgpriv2.c-151-{\n--\nfs/netfs/read_pgpriv2.c-171- /\nfs/netfs/read_pgpriv2.c:172:bool netfs_pgpriv2_unlock_copied_folios(struct netfs_io_request creq)\nfs/netfs/read_pgpriv2.c-173-{\n--\nfs/netfs/read_retry.c=26=static void netfs_retry_read_subrequests(struct netfs_io_request rreq)\n--\nfs/netfs/read_retry.c-269- /\nfs/netfs/read_retry.c:270:void netfs_retry_reads(struct netfs_io_request rreq)\nfs/netfs/read_retry.c-271-{\n--\nfs/netfs/read_retry.c-290- /\nfs/netfs/read_retry.c:291:void netfs_unlock_abandoned_read_pages(struct netfs_io_request rreq)\nfs/netfs/read_retry.c-292-{\n--\nfs/netfs/read_single.c-27- /\nfs/netfs/read_single.c:28:void netfs_single_mark_inode_dirty(struct inode inode)\nfs/netfs/read_single.c-29-{\n--\nfs/netfs/read_single.c=90=static int netfs_single_dispatch_read(struct netfs_io_request rreq)\n--\nfs/netfs/read_single.c-161- /\nfs/netfs/read_single.c:162:ssize_t netfs_read_single(struct inode inode, struct file file, struct iov_iter iter)\nfs/netfs/read_single.c-163-{\n--\nfs/netfs/rolling_buffer.c=43=EXPORT_SYMBOL(netfs_folioq_alloc);\n--\nfs/netfs/rolling_buffer.c-51- /\nfs/netfs/rolling_buffer.c:52:void netfs_folioq_free(struct folio_queue folioq,\nfs/netfs/rolling_buffer.c-53-\t\t unsigned int /enum netfs_trace_folioq/ trace)\n--\nfs/netfs/stats.c=50=atomic_t netfs_n_folioq;\nfs/netfs/stats.c-51-\nfs/netfs/stats.c:52:int netfs_stats_show(struct seq_file m, void v)\nfs/netfs/stats.c-53-{\n--\nfs/netfs/write_collect.c=24=static void netfs_dump_request(const struct netfs_io_request rreq)\n--\nfs/netfs/write_collect.c-56- /\nfs/netfs/write_collect.c:57:int netfs_folio_written_back(struct folio folio)\nfs/netfs/write_collect.c-58-{\n--\nfs/netfs/write_collect.c=200=static void netfs_collect_write_results(struct netfs_io_request wreq)\n--\nfs/netfs/write_collect.c-360- /\nfs/netfs/write_collect.c:361:bool netfs_write_collection(struct netfs_io_request wreq)\nfs/netfs/write_collect.c-362-{\n--\nfs/netfs/write_collect.c-435-\nfs/netfs/write_collect.c:436:void netfs_write_collection_worker(struct work_struct work)\nfs/netfs/write_collect.c-437-{\n--\nfs/netfs/write_collect.c-468- /\nfs/netfs/write_collect.c:469:void netfs_write_subrequest_terminated(void _op, ssize_t transferred_or_error)\nfs/netfs/write_collect.c-470-{\n--\nfs/netfs/write_issue.c=90=struct netfs_io_request netfs_create_write_req(struct address_space mapping,\n--\nfs/netfs/write_issue.c-145- /\nfs/netfs/write_issue.c:146:void netfs_prepare_write_failed(struct netfs_io_subrequest subreq)\nfs/netfs/write_issue.c-147-{\n--\nfs/netfs/write_issue.c=151=EXPORT_SYMBOL(netfs_prepare_write_failed);\n--\nfs/netfs/write_issue.c-156- /\nfs/netfs/write_issue.c:157:void netfs_prepare_write(struct netfs_io_request wreq,\nfs/netfs/write_issue.c-158-\t\t\t struct netfs_io_stream stream,\n--\nfs/netfs/write_issue.c=229=static void netfs_do_issue_write(struct netfs_io_stream stream,\n--\nfs/netfs/write_issue.c-242-\nfs/netfs/write_issue.c:243:void netfs_reissue_write(struct netfs_io_stream stream,\nfs/netfs/write_issue.c-244-\t\t\t struct netfs_io_subrequest subreq,\n--\nfs/netfs/write_issue.c-261-\nfs/netfs/write_issue.c:262:void netfs_issue_write(struct netfs_io_request wreq,\nfs/netfs/write_issue.c-263-\t\t struct netfs_io_stream stream)\n--\nfs/netfs/write_issue.c=524=static void netfs_end_issue_write(struct netfs_io_request wreq)\n--\nfs/netfs/write_issue.c-547- /\nfs/netfs/write_issue.c:548:int netfs_writepages(struct address_space mapping,\nfs/netfs/write_issue.c-549-\t\t struct writeback_control wbc)\n--\nfs/netfs/write_issue.c=619=struct netfs_io_request netfs_begin_writethrough(struct kiocb iocb, size_t len)\n--\nfs/netfs/write_issue.c-644- /\nfs/netfs/write_issue.c:645:int netfs_advance_writethrough(struct netfs_io_request wreq, struct writeback_control wbc,\nfs/netfs/write_issue.c-646-\t\t\t struct folio folio, size_t copied, bool to_page_end,\n--\nfs/netfs/write_issue.c-688- /\nfs/netfs/write_issue.c:689:ssize_t netfs_end_writethrough(struct netfs_io_request wreq, struct writeback_control wbc,\nfs/netfs/write_issue.c-690-\t\t\t struct folio writethrough_cache)\n--\nfs/netfs/write_issue.c=716=static int netfs_write_folio_single(struct netfs_io_request wreq,\n--\nfs/netfs/write_issue.c-842- /\nfs/netfs/write_issue.c:843:int netfs_writeback_single(struct address_space mapping,\nfs/netfs/write_issue.c-844-\t\t\t struct writeback_control wbc,\n--\nfs/netfs/write_retry.c=17=static void netfs_retry_write_stream(struct netfs_io_request wreq,\n--\nfs/netfs/write_retry.c-207- /\nfs/netfs/write_retry.c:208:void netfs_retry_writes(struct netfs_io_request *wreq)\nfs/netfs/write_retry.c-209-{\n" }
13/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28990 output: 40 thoughts: 170 Thoughts: My Initial Assessment of the NetFS Functions Alright, let's see. I've got a good starting set here: `netfs_readahead`, `netfs_read_folio`, `netfs_write_begin`, `netfs_prefetch_for_write`, `netfs_unbuffered_write_iter_locked`, `netfs_wait_for_put_ra_refs`, `netfs_alloc_request`, `netfs_read_set_unlock_at`, `netfs_read_subreq_progress`, `netfs_unlock_abandoned_read_pages`, `netfs_read_single`, and `netfs_prepare_write`. These all look like important pieces of the puzzle when it comes to understanding NetFS's read and write operations. I need to understand how they all fit together. However, hold on a second... `rolling_buffer_bulk_load_from_ra`... that's in `fs/netfs/rolling_buffer.c`, isn't it? And, what's its visibility? Is it exported to other parts of the kernel, or is it a local, static function? I need to know the scope of this one. It seems like it's essential for handling readahead buffers, which could be extremely important. Gotta check that right away.
14/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "ssize_t rolling_buffer_bulk_load_from_ra", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/rolling_buffer.c=84=int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp)\n--\nfs/netfs/rolling_buffer.c-119- /\nfs/netfs/rolling_buffer.c:120:ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll,\nfs/netfs/rolling_buffer.c-121-\t\t\t\t\t struct readahead_control ractl,\n" }
15/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29624 output: 35 thoughts: 35 Thoughts: Okay, here's my interpretation of those thoughts, presented as a first-person expert summary: Assessing the Dynamic Nature of the Situation Alright, the core issue is clearly non-static. No surprises there. Now, given this dynamic nature, the next logical step is to dive into the key functions that likely manage this interaction. I need to understand how the system's managing the attributes of the cached objects. Specifically, I need to check the behavior of `cachefiles_set_object_xattr` and `cachefiles_check_auxdata`. These functions are probably crucial to understanding how the dynamic changes are being handled, whether there are potential race conditions, or if the current implementation accounts for the inherent variability of the data. I'm especially interested in how these functions interact and whether the auxiliary data checks are sufficiently robust to deal with changes.
16/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "int cachefiles_set_object_xattr", "PathPrefix": "fs/cachefiles/" } Results: { "Output": "fs/cachefiles/internal.h=278=void cachefiles_withdraw_volume(struct cachefiles_volume volume);\n--\nfs/cachefiles/internal.h-282- /\nfs/cachefiles/internal.h:283:extern int cachefiles_set_object_xattr(struct cachefiles_object object);\nfs/cachefiles/internal.h-284-extern int cachefiles_check_auxdata(struct cachefiles_object object,\n--\nfs/cachefiles/xattr.c=32=struct cachefiles_vol_xattr {\n--\nfs/cachefiles/xattr.c-39- /\nfs/cachefiles/xattr.c:40:int cachefiles_set_object_xattr(struct cachefiles_object object)\nfs/cachefiles/xattr.c-41-{\n" }
17/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 30087 output: 38 thoughts: 218 Thoughts: Analyzing the Dynamics of These Focus Symbols Okay, so I've confirmed that these elements are indeed non-static, which is an important initial observation. Now, I need to really dig into what's happening. My core focus right now is on these symbols: `cachefiles_set_object_xattr`, `cachefiles_check_auxdata`, `netfs_readahead`, `netfs_read_folio`, `netfs_write_begin`, `netfs_prefetch_for_write`, `netfs_unbuffered_write_iter_locked`, `netfs_wait_for_put_ra_refs`, `netfs_alloc_request`, `netfs_read_set_unlock_at`, `netfs_read_subreq_progress`, `netfs_unlock_abandoned_read_pages`, `netfs_read_single`, `rolling_buffer_bulk_load_from_ra`, and `netfs_prepare_write`. Each one of these needs a thorough examination. I'm going to pay particularly close attention to `netfs_wait_for_put_ra_refs` – that one warrants immediate double-checking; I'm certain there's some nuance in there that I need to clarify.
18/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "void netfs_wait_for_put_ra_refs", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/internal.h=81=void netfs_wait_for_paused_write(struct netfs_io_request rreq);\nfs/netfs/internal.h:82:void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq);\nfs/netfs/internal.h-83-\n--\nfs/netfs/misc.c=562=void netfs_wait_for_paused_write(struct netfs_io_request rreq)\n--\nfs/netfs/misc.c-569- /\nfs/netfs/misc.c:570:void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq)\nfs/netfs/misc.c-571-{\n" }
19/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 30821 output: 36 thoughts: 27 Thoughts: Okay, here's my interpretation of those thoughts, summarized from a first-person expert perspective: Non-Static Context & Verification Right, so we're dealing with something non-static here. That much is clear. My immediate thought is to zero in on a specific function within the networking file system context: `netfs_read_set_unlock_at`. Let's just make sure I'm recalling that correctly and that my understanding of its behavior in a non-static environment is completely sound. It's crucial to have a precise picture of what that function does in this particular context. Verification is key. No assumptions here. Let's dig in and make sure I know the nuance of `netfs_read_set_unlock_at`.
20/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "void netfs_read_set_unlock_at", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/internal.h=103=static inline void netfs_see_subrequest(struct netfs_io_subrequest subreq,\n--\nfs/netfs/internal.h-112- /\nfs/netfs/internal.h:113:void netfs_read_set_unlock_at(struct netfs_io_request rreq);\nfs/netfs/internal.h-114-bool netfs_read_collection(struct netfs_io_request rreq);\n--\nfs/netfs/read_collect.c=42=static void netfs_unlock_read_folio(struct netfs_io_request rreq,\n--\nfs/netfs/read_collect.c-99- /\nfs/netfs/read_collect.c:100:void netfs_read_set_unlock_at(struct netfs_io_request *rreq)\nfs/netfs/read_collect.c-101-{\n" }
21/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 31293 output: 35 thoughts: 26 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: Checking the Non-Static Nature Alright, confirmed. The core point is that this isn't a static situation. Good. Now, given that, let's just make sure we've got the `netfs_read_subreq_progress` function completely nailed down. I need to make absolutely certain there's no misunderstanding of its behavior in this dynamic context. It's a critical function, and a quick double check is always worthwhile.
22/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "void netfs_read_subreq_progress", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/read_collect.c=488=void netfs_read_collection_worker(struct work_struct work)\n--\nfs/netfs/read_collect.c-511- /\nfs/netfs/read_collect.c:512:void netfs_read_subreq_progress(struct netfs_io_subrequest *subreq)\nfs/netfs/read_collect.c-513-{\n" }
23/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 31593 output: 37 thoughts: 28 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Analyzing the Dynamic Nature Okay, so the code in question isn't static, meaning its behavior can change based on conditions. That's a key initial observation. Now, let's zero in on a specific function within the system: `netfs_unlock_abandoned_read_pages`. I need to re-examine that function closely. It's likely involved in handling read pages that are no longer needed, maybe due to an abandoned request or some kind of error. This is where the potential non-static behavior could introduce unexpected results. I need to understand its control flow, especially under various error scenarios or concurrent access situations to see how this impacts my analysis. Time to dig in.
24/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "void netfs_unlock_abandoned_read_pages", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/internal.h=129=void netfs_retry_reads(struct netfs_io_request rreq);\nfs/netfs/internal.h:130:void netfs_unlock_abandoned_read_pages(struct netfs_io_request rreq);\nfs/netfs/internal.h-131-\n--\nfs/netfs/read_retry.c=270=void netfs_retry_reads(struct netfs_io_request rreq)\n--\nfs/netfs/read_retry.c-290- /\nfs/netfs/read_retry.c:291:void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq)\nfs/netfs/read_retry.c-292-{\n" }
25/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 32031 output: 35 thoughts: 23 Thoughts: Here's my take on those thoughts: Analyzing `netfs_read_single` Okay, so the code in question isn't statically defined – that much is clear. Now, I need to drill down and make sure I understand how `netfs_read_single` is handling things. Let's see how it's dealing with the non-static elements. I'll need to go through it carefully. I'm going to pay extra attention to how it's interacting with any dynamic memory allocation or data structures. I want to make sure I understand the read path completely.
26/2	2026/08/25 14:12	tool	grepper	0m Args: { "Expression": "ssize_t netfs_read_single", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/read_single.c=90=static int netfs_single_dispatch_read(struct netfs_io_request rreq)\n--\nfs/netfs/read_single.c-161- /\nfs/netfs/read_single.c:162:ssize_t netfs_read_single(struct inode inode, struct file file, struct iov_iter *iter)\nfs/netfs/read_single.c-163-{\n" }
27/2	2026/08/25 14:12	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 32345 output: 32 thoughts: 23 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Non-Static, Double Check Time Okay, so the architecture definitely isn't static in this region. We're dealing with a dynamic situation, which is what I suspected given the behavior we've been observing. Now, let's just make absolutely certain of this, let's head over and review `netfs_prepare_write`. I need to ensure that dynamic behavior is happening as expected in the method. I need to make certain that our assumptions align. We need to trace from there and make sure we can follow this process.
28/2	2026/08/25 14:13	tool	grepper	0m Args: { "Expression": "void netfs_prepare_write", "PathPrefix": "fs/netfs/" } Results: { "Output": "fs/netfs/internal.h=203=struct netfs_io_request netfs_create_write_req(struct address_space mapping,\n--\nfs/netfs/internal.h-206-\t\t\t\t\t\tenum netfs_io_origin origin);\nfs/netfs/internal.h:207:void netfs_prepare_write(struct netfs_io_request wreq,\nfs/netfs/internal.h-208-\t\t\t struct netfs_io_stream stream,\n--\nfs/netfs/write_issue.c=90=struct netfs_io_request netfs_create_write_req(struct address_space mapping,\n--\nfs/netfs/write_issue.c-145- /\nfs/netfs/write_issue.c:146:void netfs_prepare_write_failed(struct netfs_io_subrequest subreq)\nfs/netfs/write_issue.c-147-{\n--\nfs/netfs/write_issue.c=151=EXPORT_SYMBOL(netfs_prepare_write_failed);\n--\nfs/netfs/write_issue.c-156- /\nfs/netfs/write_issue.c:157:void netfs_prepare_write(struct netfs_io_request wreq,\nfs/netfs/write_issue.c-158-\t\t\t struct netfs_io_stream *stream,\n" }
29/2	2026/08/25 14:13	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 32894 output: 31 thoughts: 60 Thoughts: My Analysis of the Filesystem Configuration Okay, so the context indicates this isn't a static situation – good, that gives us some flexibility. Now, let's see, the configurations involved are: `NETFS_SUPPORT`, `CACHEFILES`, `9P_FS`, `CIFS`, `CEPH_FS`, and `AFS_FS`. Given my expertise, I immediately recognize these as key elements related to network and distributed filesystems. I want to zero in on `9P_FS` – it's a protocol of interest. I'm going to quickly check for any dependencies associated with it; understanding those dependencies will be crucial to determining its overall impact and how it integrates with the other options.
30/2	2026/08/25 14:13	tool	grepper	0m Args: { "Expression": "config 9P_FS", "PathPrefix": "fs/9p/" } Results: { "Output": "fs/9p/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/9p/Kconfig:2:config 9P_FS\nfs/9p/Kconfig-3-\ttristate \"Plan 9 Resource Sharing Support (9P2000)\"\n--\nfs/9p/Kconfig=14=if 9P_FS\nfs/9p/Kconfig:15:config 9P_FSCACHE\nfs/9p/Kconfig-16-\tbool \"Enable 9P client caching support\"\n--\nfs/9p/Kconfig-22-\nfs/9p/Kconfig:23:config 9P_FS_POSIX_ACL\nfs/9p/Kconfig-24-\tbool \"9P POSIX Access Control Lists\"\n--\nfs/9p/Kconfig=32=endif\n--\nfs/9p/Kconfig-34-\nfs/9p/Kconfig:35:config 9P_FS_SECURITY\nfs/9p/Kconfig-36-\tbool \"9P Security Labels\"\n" }
31/2	2026/08/25 14:13	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 33409 output: 30 thoughts: 24 Thoughts: Here's my thought process, as it stands: Dependency Check: 9P\_FS & NET\_9P Okay, so `9P_FS` relies on `NET_9P`. That's a fundamental relationship I need to understand before proceeding. Before I dive any deeper into `9P_FS`, I'm going to quickly verify the state of `NET_9P`. I need to ensure it's properly configured or enabled (depending on the context - is this a configuration file, build system, or runtime environment?). Its status will be key to understanding the validity or potential issues with `9P_FS`. I'm essentially tracing a dependency to make sure the foundation is solid before I build on top of it.
32/2	2026/08/25 14:13	tool	grepper	0m Args: { "Expression": "config NET_9P", "PathPrefix": "net/9p/" } Results: { "Output": "net/9p/Kconfig-5-\nnet/9p/Kconfig:6:menuconfig NET_9P\nnet/9p/Kconfig-7-\ttristate \"Plan 9 Resource Sharing Support (9P2000)\"\n--\nnet/9p/Kconfig=17=if NET_9P\nnet/9p/Kconfig-18-\nnet/9p/Kconfig:19:config NET_9P_FD\nnet/9p/Kconfig-20-\tdefault NET_9P\n--\nnet/9p/Kconfig-27-\nnet/9p/Kconfig:28:config NET_9P_VIRTIO\nnet/9p/Kconfig-29-\tdepends on VIRTIO\n--\nnet/9p/Kconfig-34-\nnet/9p/Kconfig:35:config NET_9P_XEN\nnet/9p/Kconfig-36-\tdepends on XEN\n--\nnet/9p/Kconfig-42-\nnet/9p/Kconfig:43:config NET_9P_USBG\nnet/9p/Kconfig-44-\ttristate \"9P USB Gadget Transport\"\n--\nnet/9p/Kconfig-51-\nnet/9p/Kconfig:52:config NET_9P_RDMA\nnet/9p/Kconfig-53-\tdepends on INET \u0026\u0026 INFINIBAND \u0026\u0026 INFINIBAND_ADDR_TRANS\n--\nnet/9p/Kconfig-57-\nnet/9p/Kconfig:58:config NET_9P_DEBUG\nnet/9p/Kconfig-59-\tbool \"Debug information\"\n" }
33/2	2026/08/25 14:13	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 34035 output: 30 thoughts: 21 Thoughts: Here's my take on those thoughts: Analyzing Network Protocol Requirements Okay, so the project's architecture mandates the presence of `NET_9P`. That's the baseline. Now, before I proceed with any further integration steps, I need to thoroughly understand how `CIFS` dependencies factor into this. I'll take a look at the relationship of `CIFS` to `NET_9P`. Are there any inherent conflicts, or maybe hidden advantages to the coexistence of these two? What assumptions is this system making? Time to dig into the documentation and see what the build system wants.
34/2	2026/08/25 14:13	tool	grepper	0m Args: { "Expression": "config CIFS", "PathPrefix": "fs/smb/client/" } Results: { "Output": "fs/smb/client/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/smb/client/Kconfig:2:config CIFS\nfs/smb/client/Kconfig-3-\ttristate \"SMB3 and CIFS support (advanced network filesystem)\"\n--\nfs/smb/client/Kconfig-53-\nfs/smb/client/Kconfig:54:config CIFS_STATS2\nfs/smb/client/Kconfig-55-\tbool \"Extended statistics\"\n--\nfs/smb/client/Kconfig-67-\nfs/smb/client/Kconfig:68:config CIFS_ALLOW_INSECURE_LEGACY\nfs/smb/client/Kconfig-69-\tbool \"Support legacy servers which use less secure dialects\"\n--\nfs/smb/client/Kconfig-82-\nfs/smb/client/Kconfig:83:config CIFS_UPCALL\nfs/smb/client/Kconfig-84-\tbool \"Kerberos/SPNEGO advanced session setup\"\n--\nfs/smb/client/Kconfig-91-\nfs/smb/client/Kconfig:92:config CIFS_XATTR\nfs/smb/client/Kconfig-93-\tbool \"CIFS extended attributes\"\n--\nfs/smb/client/Kconfig-106-\nfs/smb/client/Kconfig:107:config CIFS_POSIX\nfs/smb/client/Kconfig-108-\tbool \"CIFS POSIX Extensions\"\n--\nfs/smb/client/Kconfig-118-\nfs/smb/client/Kconfig:119:config CIFS_DEBUG\nfs/smb/client/Kconfig-120-\tbool \"Enable CIFS debugging routines\"\n--\nfs/smb/client/Kconfig-127-\nfs/smb/client/Kconfig:128:config CIFS_DEBUG2\nfs/smb/client/Kconfig-129-\tbool \"Enable additional CIFS debugging routines\"\n--\nfs/smb/client/Kconfig-138-\nfs/smb/client/Kconfig:139:config CIFS_DEBUG_DUMP_KEYS\nfs/smb/client/Kconfig-140-\tbool \"Dump encryption keys for offline decryption (Unsafe)\"\n--\nfs/smb/client/Kconfig-148-\nfs/smb/client/Kconfig:149:config CIFS_DFS_UPCALL\nfs/smb/client/Kconfig-150-\tbool \"DFS feature support\"\n--\nfs/smb/client/Kconfig-161-\nfs/smb/client/Kconfig:162:config CIFS_SWN_UPCALL\nfs/smb/client/Kconfig-163-\tbool \"SWN feature support\"\n--\nfs/smb/client/Kconfig-172-\nfs/smb/client/Kconfig:173:config CIFS_NFSD_EXPORT\nfs/smb/client/Kconfig-174-\tbool \"Allow nfsd to export CIFS file system\"\n--\nfs/smb/client/Kconfig=179=if CIFS\nfs/smb/client/Kconfig-180-\nfs/smb/client/Kconfig:181:config CIFS_SMB_DIRECT\nfs/smb/client/Kconfig-182-\tbool \"SMB Direct support\"\n--\nfs/smb/client/Kconfig-190-\nfs/smb/client/Kconfig:191:config CIFS_FSCACHE\nfs/smb/client/Kconfig-192-\tbool \"Provide CIFS client caching support\"\n--\nfs/smb/client/Kconfig-198-\nfs/smb/client/Kconfig:199:config CIFS_ROOT\nfs/smb/client/Kconfig-200-\tbool \"SMB root file system (Experimental)\"\n--\nfs/smb/client/Kconfig-206-\nfs/smb/client/Kconfig:207:config CIFS_COMPRESSION\nfs/smb/client/Kconfig-208-\tbool \"SMB message compression (Experimental)\"\n" }
35/2	2026/08/25 14:13	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35257 output: 29 thoughts: 22 Thoughts: Here's my thought process, as it stands: Dependency Deep Dive Okay, so I'm thinking about file systems and their relationships. Right off the bat, I know that CIFS, the Common Internet File System, leans on INET, which makes perfect sense. I mean, it's inherently a network protocol, so it needs the Internet Protocol. Makes sense, that's basic networking. Now, I'm shifting gears. I need to understand the architecture a little better so now I'm thinking I should really dig into the dependency landscape for CEPH_FS. Where does that stand in relation to everything else? What core components is that built on? I need to figure out it's stack of dependencies.
36/2	2026/08/25 14:13	tool	grepper	0m Args: { "Expression": "config CEPH_FS", "PathPrefix": "fs/ceph/" } Results: { "Output": "fs/ceph/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/ceph/Kconfig:2:config CEPH_FS\nfs/ceph/Kconfig-3-\ttristate \"Ceph distributed file system\"\n--\nfs/ceph/Kconfig=19=if CEPH_FS\nfs/ceph/Kconfig:20:config CEPH_FSCACHE\nfs/ceph/Kconfig-21-\tbool \"Enable Ceph client caching support\"\n--\nfs/ceph/Kconfig=27=endif\nfs/ceph/Kconfig-28-\nfs/ceph/Kconfig:29:config CEPH_FS_POSIX_ACL\nfs/ceph/Kconfig-30-\tbool \"Ceph POSIX Access Control Lists\"\n--\nfs/ceph/Kconfig-38-\nfs/ceph/Kconfig:39:config CEPH_FS_SECURITY_LABEL\nfs/ceph/Kconfig-40-\tbool \"CephFS Security Labels\"\n" }
37/2	2026/08/25 14:13	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35712 output: 29 thoughts: 23 Thoughts: Here's my thought process, as it went: Dependency Deep Dive Okay, so `CEPH_FS` is explicitly reliant on `INET`. That's not surprising, it's a distributed filesystem and needs network connectivity. Now, let's switch gears and investigate the dependencies for `AFS_FS`. Understanding its prerequisites is crucial for figuring out how all of these components integrate. I need to make sure I'm not missing any other implied dependencies.
38/2	2026/08/25 14:13	tool	grepper	0m Args: { "Expression": "config AFS_FS", "PathPrefix": "fs/afs/" } Results: { "Output": "fs/afs/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/afs/Kconfig:2:config AFS_FS\nfs/afs/Kconfig-3-\ttristate \"Andrew File System support (AFS)\"\n--\nfs/afs/Kconfig=17=config AFS_DEBUG\n--\nfs/afs/Kconfig-26-\nfs/afs/Kconfig:27:config AFS_FSCACHE\nfs/afs/Kconfig-28-\tbool \"Provide AFS client caching support\"\n" }
39/2	2026/08/25 14:13	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 36004 output: 30 thoughts: 98 Thoughts: My Configuration Conundrum Right, so I'm tackling these file system configurations. I see that `AFS_FS` is dependent on `INET`, which makes sense. Looking at the list, I have: `NETFS_SUPPORT`, `CACHEFILES`, `9P_FS`, `NET_9P`, `CIFS`, `CEPH_FS`, and that problematic `AFS_FS` to deal with. Aha! `NETFS_SUPPORT` is a common denominator, required by all of them. That simplifies things immensely; enabling `NETFS_SUPPORT` should be the key to getting these net filesystems going. Now that I am at it, I should verify the settings for `NFS_FS` and `NFS_FSCACHE` as well, just to be thorough and ensure the environment is fully accounted for.
40/2	2026/08/25 14:14	tool	grepper	0m Args: { "Expression": "config NFS_FSCACHE", "PathPrefix": "fs/nfs/" } Results: { "Output": "fs/nfs/Kconfig=162=config ROOT_NFS\n--\nfs/nfs/Kconfig-172-\nfs/nfs/Kconfig:173:config NFS_FSCACHE\nfs/nfs/Kconfig-174-\tbool \"Provide NFS client caching support\"\n" }
41/2	2026/08/25 14:14	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 36396 output: 372 thoughts: 537 Thoughts: My Assessment of the NetFS Changes Okay, so I've been looking over these modifications, and it looks like `NFS_FS` and `NFS_FSCACHE` are potentially quite relevant here as well. Let's start with a solid configuration overview, just to keep things straight in my head: `NETFS_SUPPORT`, `CACHEFILES`, `9P_FS`, `NET_9P`, `CIFS`, `CEPH_FS`, `AFS_FS`, `NFS_FS`, and `NFS_FSCACHE`. That's the landscape we're dealing with. Now, let's drill down to the symbols that are specifically impacted and are worth a deeper look: `cachefiles_set_object_xattr`, `cachefiles_check_auxdata`, `netfs_readahead`, `netfs_read_folio`, `netfs_write_begin`, `netfs_prefetch_for_write`, `netfs_unbuffered_write_iter_locked`, `netfs_wait_for_put_ra_refs`, `netfs_alloc_request`, `netfs_read_set_unlock_at`, `netfs_read_subreq_progress`, `netfs_unlock_abandoned_read_pages`, `netfs_read_single`, `rolling_buffer_bulk_load_from_ra`, and `netfs_prepare_write`. Seems comprehensive. I made sure I reviewed all other modified functions, but it looks like `netfs_unbuffered_write_done`, `netfs_unbuffered_write`, `netfs_create_singular_buffer`, `netfs_read_gaps`, `netfs_read_to_pagecache`, `netfs_prepare_read_iterator`, `netfs_bulk_drop_ra_refs`, and `netfs_maybe_bulk_drop_ra_refs` are all static, so those are probably okay. From what I can tell, this patch is introducing some fundamental changes to the `netfs` library. It's touching on how readahead is handled, the mechanics of read iterators, and folio unlocking. The fixes for unaligned memory accesses in `cachefiles` and a potential zero-length iterator issue in `netfs_unbuffered_write` are important, and they address actual issues. These changes touch on core I/O paths, and network file systems like 9p, cifs, ceph, afs, which are all likely to be present in various virtualized environments. Given the breadth of the impact, I'm thinking this is definitely worth some fuzzing.
42/2	2026/08/25 14:14	tool	set-results	0m Args: { "EnableConfigs": [ "NETFS_SUPPORT", "CACHEFILES", "9P_FS", "NET_9P", "CIFS", "CEPH_FS", "AFS_FS", "NFS_FS", "NFS_FSCACHE" ], "FocusSymbols": [ "cachefiles_set_object_xattr", "cachefiles_check_auxdata", "netfs_readahead", "netfs_read_folio", "netfs_write_begin", "netfs_prefetch_for_write", "netfs_unbuffered_write_iter_locked", "netfs_wait_for_put_ra_refs", "netfs_alloc_request", "netfs_read_set_unlock_at", "netfs_read_subreq_progress", "netfs_unlock_abandoned_read_pages", "netfs_read_single", "rolling_buffer_bulk_load_from_ra", "netfs_prepare_write" ], "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "NETFS_SUPPORT", "CACHEFILES", "9P_FS", "NET_9P", "CIFS", "CEPH_FS", "AFS_FS", "NFS_FS", "NFS_FSCACHE" ], "FocusSymbols": [ "cachefiles_set_object_xattr", "cachefiles_check_auxdata", "netfs_readahead", "netfs_read_folio", "netfs_write_begin", "netfs_prefetch_for_write", "netfs_unbuffered_write_iter_locked", "netfs_wait_for_put_ra_refs", "netfs_alloc_request", "netfs_read_set_unlock_at", "netfs_read_subreq_progress", "netfs_unlock_abandoned_read_pages", "netfs_read_single", "rolling_buffer_bulk_load_from_ra", "netfs_prepare_write" ], "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.", "WorthFuzzing": true }
43/1	2026/08/25 14:14	action	If	7m Args: { "WorthFuzzing": true } Results: null
44/2	2026/08/25 14:14	agent	kmsan-evaluator	7m Model: best-expensive Args: null Results: { "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.", "NeedsKMSAN": true } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 973032d62ca4dc98bf40ee8ea0fc4e48fdbf7eb9 Author: syz-cluster <triage@syzkaller.com> Date: Tue Aug 25 14:11:17 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c index f8ae78b3f7b6d..c70bf67e52b01 100644 --- a/fs/cachefiles/xattr.c +++ b/fs/cachefiles/xattr.c @@ -13,6 +13,7 @@ #include <linux/quotaops.h> #include <linux/xattr.h> #include <linux/slab.h> +#include <linux/unaligned.h> #include "internal.h" #define CACHEFILES_COOKIE_TYPE_DATA 1 @@ -50,7 +51,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) _enter("%x,#%d", object->debug_id, len); - buf = kmalloc(sizeof(struct cachefiles_xattr) + len, GFP_KERNEL); + buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL); if (!buf) return -ENOMEM; @@ -60,6 +61,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) buf->content = object->content_info; if (test_bit(FSCACHE_COOKIE_LOCAL_WRITE, &object->cookie->flags)) buf->content = CACHEFILES_CONTENT_DIRTY; + put_unaligned_be64(0, (__be64 )buf->data); if (len > 0) memcpy(buf->data, fscache_get_aux(object->cookie), len); @@ -77,8 +79,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) trace_cachefiles_vfs_error(object, file_inode(file), ret, cachefiles_trace_setxattr_error); trace_cachefiles_coherency(object, file_inode(file)->i_ino, - be64_to_cpup((__be64 )buf->data), - buf->content, + buf->data, buf->content, cachefiles_coherency_set_fail); if (ret != -ENOMEM) cachefiles_io_error_obj( @@ -86,8 +87,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object object) "Failed to set xattr with error %d", ret); } else { trace_cachefiles_coherency(object, file_inode(file)->i_ino, - be64_to_cpup((__be64 )buf->data), - buf->content, + buf->data, buf->content, cachefiles_coherency_set_ok); } @@ -110,9 +110,10 @@ int cachefiles_check_auxdata(struct cachefiles_object object, struct file file int ret = -ESTALE; tlen = sizeof(struct cachefiles_xattr) + len; - buf = kmalloc(tlen, GFP_KERNEL); + buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL); if (!buf) return -ENOMEM; + put_unaligned_be64(0, (__be64 )buf->data); xlen = cachefiles_inject_read_error(); if (xlen == 0) @@ -148,8 +149,7 @@ int cachefiles_check_auxdata(struct cachefiles_object object, struct file file out: trace_cachefiles_coherency(object, file_inode(file)->i_ino, - be64_to_cpup((__be64 )buf->data), - buf->content, why); + buf->data, buf->content, why); kfree(buf); return ret; } diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c index 7fdfa4f27e349..a2a9d8c083f99 100644 --- a/fs/netfs/buffered_read.c +++ b/fs/netfs/buffered_read.c @@ -54,6 +54,42 @@ static void netfs_rreq_expand(struct netfs_io_request rreq, } } +/* + * Drop the folio refs acquired from the readahead API. + / +static void netfs_bulk_drop_ra_refs(struct netfs_io_request rreq) +{ + struct folio_batch fbatch; + struct folio folio; + pgoff_t nr_pages = DIV_ROUND_UP(rreq->len, PAGE_SIZE); + pgoff_t first = rreq->start / PAGE_SIZE; + XA_STATE(xas, &rreq->mapping->i_pages, first); + + folio_batch_init(&fbatch); + + rcu_read_lock(); + + xas_for_each(&xas, folio, first + nr_pages - 1) { + if (xas_retry(&xas, folio)) + continue; + + if (!folio_batch_add(&fbatch, folio)) + folio_batch_release(&fbatch); + } + + rcu_read_unlock(); + folio_batch_release(&fbatch); + trace_netfs_rreq(rreq, netfs_rreq_trace_ra_put_ref); + clear_bit_unlock(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags); + wake_up(&rreq->waitq); +} + +static void netfs_maybe_bulk_drop_ra_refs(struct netfs_io_request rreq) +{ + if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + netfs_bulk_drop_ra_refs(rreq); +} + /* * Begin an operation, and fetch the stored zero point value from the cookie if * available. @@ -74,12 +110,8 @@ static int netfs_begin_cache_read(struct netfs_io_request rreq, struct netfs_in * Returns the limited size if successful and -ENOMEM if insufficient memory * available. - * - * [!] NOTE: This must be run in the same thread as ->issue_read() was called - * in as we access the readahead_control struct. / -static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq, - struct readahead_control ractl) +static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq) { struct netfs_io_request rreq = subreq->rreq; size_t rsize = subreq->len; @@ -87,30 +119,6 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest subreq, if (subreq->source == NETFS_DOWNLOAD_FROM_SERVER) rsize = umin(rsize, rreq->io_streams[0].sreq_max_len); - if (ractl) { - /* If we don't have sufficient folios in the rolling buffer, - * extract a folioq's worth from the readahead region at a time - * into the buffer. Note that this acquires a ref on each page - * that we will need to release later - but we don't want to do - * that until after we've started the I/O. - / - struct folio_batch put_batch; - - folio_batch_init(&put_batch); - while (rreq->submitted < subreq->start + rsize) { - ssize_t added; - - added = rolling_buffer_load_from_ra(&rreq->buffer, ractl, - &put_batch); - if (added < 0) { - folio_batch_release(&put_batch); - return added; - } - rreq->submitted += added; - } - folio_batch_release(&put_batch); - } - subreq->len = rsize; if (unlikely(rreq->io_streams[0].sreq_max_segs)) { size_t limit = netfs_limit_iter(&rreq->buffer.iter, 0, rsize, @@ -208,8 +216,7 @@ static void netfs_issue_read(struct netfs_io_request rreq, * slicing up the region to be read according to available cache blocks and * network rsize. / -static void netfs_read_to_pagecache(struct netfs_io_request rreq, - struct readahead_control ractl) +static void netfs_read_to_pagecache(struct netfs_io_request rreq) { unsigned long long start = rreq->start; ssize_t size = rreq->len; @@ -288,7 +295,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request rreq, break; issue: - slice = netfs_prepare_read_iterator(subreq, ractl); + slice = netfs_prepare_read_iterator(subreq); if (slice < 0) { ret = slice; netfs_cancel_read(subreq, ret); @@ -302,6 +309,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request rreq, } netfs_issue_read(rreq, subreq); + netfs_maybe_bulk_drop_ra_refs(rreq); if (test_bit(NETFS_RREQ_PAUSE, &rreq->flags)) netfs_wait_for_paused_read(rreq); @@ -339,7 +347,8 @@ void netfs_readahead(struct readahead_control ractl) { struct netfs_io_request rreq; struct netfs_inode ictx = netfs_inode(ractl->mapping->host); - unsigned long long start = readahead_pos(ractl); + ssize_t added; + uoff_t start = readahead_pos(ractl); size_t size = readahead_length(ractl); int ret; @@ -360,11 +369,24 @@ void netfs_readahead(struct readahead_control ractl) netfs_rreq_expand(rreq, ractl); - rreq->submitted = rreq->start; - if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST, rreq->gfp) < 0) + /* Load the folios to be read into a bvecq chain. Note that this + * acquires a ref on each folio that we will need to release later - + * but we don't want to do that until after we've started the I/O. + / + added = rolling_buffer_bulk_load_from_ra(&rreq->buffer, ractl, + rreq->debug_id, rreq->gfp); + if (added < 0) { + ret = added; goto cleanup_free; - netfs_read_to_pagecache(rreq, ractl); + } + __set_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags); + + rreq->submitted = rreq->start + added; + rreq->cleaned_to = rreq->start; + netfs_read_set_unlock_at(rreq); + netfs_read_to_pagecache(rreq); + netfs_maybe_bulk_drop_ra_refs(rreq); return netfs_put_request(rreq, netfs_rreq_trace_put_return); cleanup_free: @@ -387,6 +409,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request rreq, struct fo if (added < 0) return added; rreq->submitted = rreq->start + added; + rreq->progress_at = added; return 0; } @@ -457,7 +480,7 @@ static int netfs_read_gaps(struct file file, struct folio folio) iov_iter_bvec(&rreq->buffer.iter, ITER_DEST, bvec, i, rreq->len); rreq->submitted = rreq->start + flen; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); if (ret >= 0) { @@ -532,7 +555,7 @@ int netfs_read_folio(struct file file, struct folio folio) if (ret < 0) goto discard; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); netfs_put_request(rreq, netfs_rreq_trace_put_return); return ret < 0 ? ret : 0; @@ -689,7 +712,7 @@ int netfs_write_begin(struct netfs_inode ctx, if (ret < 0) goto error_put; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); netfs_put_request(rreq, netfs_rreq_trace_put_return); if (ret < 0) @@ -754,7 +777,7 @@ int netfs_prefetch_for_write(struct file file, struct folio folio, if (ret < 0) goto error_put; - netfs_read_to_pagecache(rreq, NULL); + netfs_read_to_pagecache(rreq); ret = netfs_wait_for_read(rreq); netfs_put_request(rreq, netfs_rreq_trace_put_return); return ret < 0 ? ret : 0; diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c index c16fbad286a17..7173ce04bac63 100644 --- a/fs/netfs/direct_write.c +++ b/fs/netfs/direct_write.c @@ -21,7 +21,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request wreq) /* Okay, declare that all I/O is complete. / trace_netfs_rreq(wreq, netfs_rreq_trace_write_done); - if (!wreq->error) + if (wreq->transferred) netfs_update_i_size(ictx, &ictx->inode, wreq->start, wreq->transferred); if (wreq->origin == NETFS_DIO_WRITE && @@ -51,7 +51,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request wreq) wreq->iocb->ki_pos += written; if (wreq->iocb->ki_complete) { trace_netfs_rreq(wreq, netfs_rreq_trace_ki_complete); - wreq->iocb->ki_complete(wreq->iocb, wreq->error ?: written); + wreq->iocb->ki_complete(wreq->iocb, written ?: wreq->error); } wreq->iocb = VFS_PTR_POISON; } @@ -95,7 +95,7 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) { struct netfs_io_subrequest subreq = NULL; struct netfs_io_stream stream = &wreq->io_streams[0]; - int ret; + int ret = 0; _enter("%llx", wreq->len); @@ -110,6 +110,10 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) if (!subreq) { netfs_prepare_write(wreq, stream, wreq->start + wreq->transferred); subreq = stream->construct; + if (!subreq) { + ret = -ENOMEM; + break; + } stream->construct = NULL; } @@ -121,8 +125,14 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) } iov_iter_truncate(&subreq->io_iter, wreq->len - wreq->transferred); - if (!iov_iter_count(&subreq->io_iter)) + if (!iov_iter_count(&subreq->io_iter)) { + pr_warn("netfs: Unexpected zero-length iterator R=%08x\n", + wreq->debug_id); + __set_bit(NETFS_SREQ_FAILED, &subreq->flags); + netfs_write_subrequest_terminated(subreq, -EIO); + wreq->error = -EIO; break; + } subreq->len = netfs_limit_iter(&subreq->io_iter, 0, stream->sreq_max_len, @@ -139,13 +149,11 @@ static int netfs_unbuffered_write(struct netfs_io_request wreq) if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) { retry = true; } else if (test_bit(NETFS_SREQ_FAILED, &subreq->flags)) { - ret = subreq->error; - wreq->error = ret; + wreq->error = subreq->error; netfs_see_subrequest(subreq, netfs_sreq_trace_see_failed); subreq = NULL; break; } - ret = 0; if (!retry) { netfs_unbuffered_write_collect(wreq, stream, subreq); @@ -288,11 +296,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb iocb, struct iov_iter ret = -EIOCBQUEUED; } else { ret = netfs_unbuffered_write(wreq); - if (ret < 0) { - _debug("begin = %zd", ret); - } else { + if (wreq->transferred) { iocb->ki_pos += wreq->transferred; - ret = wreq->transferred ?: wreq->error; + ret = wreq->transferred; + } else if (wreq->error) { + ret = wreq->error; } netfs_put_request(wreq, netfs_rreq_trace_put_complete); diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h index 420ee7b26580f..c734cad7063e5 100644 --- a/fs/netfs/internal.h +++ b/fs/netfs/internal.h @@ -79,6 +79,7 @@ ssize_t netfs_wait_for_read(struct netfs_io_request rreq); ssize_t netfs_wait_for_write(struct netfs_io_request rreq); void netfs_wait_for_paused_read(struct netfs_io_request rreq); void netfs_wait_for_paused_write(struct netfs_io_request rreq); +void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq); / * objects.c @@ -109,6 +110,7 @@ static inline void netfs_see_subrequest(struct netfs_io_subrequest subreq, / * read_collect.c / +void netfs_read_set_unlock_at(struct netfs_io_request rreq); bool netfs_read_collection(struct netfs_io_request rreq); void netfs_read_collection_worker(struct work_struct work); void netfs_cancel_read(struct netfs_io_subrequest subreq, int error); diff --git a/fs/netfs/misc.c b/fs/netfs/misc.c index 5d554512ed23a..f5c1c463f4ff7 100644 --- a/fs/netfs/misc.c +++ b/fs/netfs/misc.c @@ -563,3 +563,22 @@ void netfs_wait_for_paused_write(struct netfs_io_request rreq) { return netfs_wait_for_pause(rreq, netfs_write_collection); } + +/* + * Wait for the readahead-acquired refs to be put. + / +void netfs_wait_for_put_ra_refs(struct netfs_io_request rreq) +{ + DEFINE_WAIT(myself); + + for (;;) { + trace_netfs_rreq(rreq, netfs_rreq_trace_wait_put_ra_refs); + prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE); + if (!test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + break; + schedule(); + } + + trace_netfs_rreq(rreq, netfs_rreq_trace_waited_put_ra_refs); + finish_wait(&rreq->waitq, &myself); +} diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c index 01461a74642d6..7f6a3e912602e 100644 --- a/fs/netfs/objects.c +++ b/fs/netfs/objects.c @@ -41,24 +41,32 @@ struct netfs_io_request netfs_alloc_request(struct address_space mapping, memset(rreq, 0, kmem_cache_size(cache)); INIT_WORK(&rreq->cleanup_work, netfs_free_request); - rreq->gfp = gfp; - rreq->start = start; - rreq->len = len; - rreq->origin = origin; - rreq->netfs_ops = ctx->ops; - rreq->mapping = mapping; - rreq->inode = inode; - rreq->i_size = i_size_read(inode); - rreq->debug_id = atomic_inc_return(&debug_ids); - rreq->wsize = INT_MAX; + rreq->gfp = gfp; + rreq->start = start; + rreq->collected_to = start; + rreq->cleaned_to = start; + rreq->len = len; + rreq->progress_at = 0; + rreq->origin = origin; + rreq->netfs_ops = ctx->ops; + rreq->mapping = mapping; + rreq->inode = inode; + rreq->i_size = i_size_read(inode); + rreq->debug_id = atomic_inc_return(&debug_ids); + rreq->wsize = INT_MAX; rreq->io_streams[0].sreq_max_len = ULONG_MAX; rreq->io_streams[0].sreq_max_segs = 0; spin_lock_init(&rreq->lock); - INIT_LIST_HEAD(&rreq->io_streams[0].subrequests); - INIT_LIST_HEAD(&rreq->io_streams[1].subrequests); init_waitqueue_head(&rreq->waitq); refcount_set(&rreq->ref, 2); + for (int s = 0; s < NR_IO_STREAMS; s++) { + struct netfs_io_stream stream = &rreq->io_streams[s]; + + INIT_LIST_HEAD(&stream->subrequests); + stream->collected_to = rreq->start; + } + if (origin == NETFS_READAHEAD \|\| origin == NETFS_READPAGE \|\| origin == NETFS_READ_GAPS \|\| diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c index 23660a5901246..8ba162cf568b2 100644 --- a/fs/netfs/read_collect.c +++ b/fs/netfs/read_collect.c @@ -94,6 +94,35 @@ static void netfs_unlock_read_folio(struct netfs_io_request rreq, folioq_clear(folioq, slot); } +/* + * Determine how much to gather before unlocking more folios. + / +void netfs_read_set_unlock_at(struct netfs_io_request rreq) +{ + struct folio_queue folioq = rreq->buffer.tail; + unsigned int slot = rreq->buffer.first_tail_slot; + size_t cleaned_to = rreq->cleaned_to - rreq->start; + size_t progress_at = cleaned_to; + size_t minimum = 256 1024; + + while (progress_at < rreq->len) { + if (slot >= folioq_count(folioq)) { + folioq = folioq->next; + if (!folioq) + break; + slot = 0; + } + + progress_at += folioq_folio_size(folioq, slot); + if (progress_at - cleaned_to >= minimum) + break; + slot++; + } + + WRITE_ONCE(rreq->progress_at, progress_at); + trace_netfs_read_progress_at(rreq); +} + /* * Unlock any folios we've finished with. / @@ -112,16 +141,22 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, if (slot >= folioq_nr_slots(folioq)) { folioq = rolling_buffer_delete_spent(&rreq->buffer); if (!folioq) { - rreq->front_folio_order = 0; + WRITE_ONCE(rreq->progress_at, ULONG_MAX); return; } slot = 0; } + /* We have to wait for readahead refs to have been released before we + * can unlock any folios as the ref-dropper walks i_pages and the only + * thing preventing these folios from being removed is the folio lock. + / + if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + netfs_wait_for_put_ra_refs(rreq); + for (;;) { struct folio folio; - unsigned long long fpos, fend; - unsigned int order; + unsigned long long fpos = rreq->cleaned_to, fend; size_t fsize; if (notes & COPY_TO_CACHE) @@ -133,9 +168,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, rreq->debug_id, folio->index)) trace_netfs_folio(folio, netfs_folio_trace_not_locked); - order = folioq_folio_order(folioq, slot); - rreq->front_folio_order = order; - fsize = PAGE_SIZE << order; + fsize = folioq_folio_size(folioq, slot); fpos = folio_pos(folio); fend = fpos + fsize; @@ -146,7 +179,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, break; netfs_unlock_read_folio(rreq, folioq, slot); - WRITE_ONCE(rreq->cleaned_to, fpos + fsize); + WRITE_ONCE(rreq->cleaned_to, fend); notes \|= MADE_PROGRESS; clear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, &rreq->flags); @@ -172,6 +205,8 @@ static void netfs_read_unlock_folios(struct netfs_io_request rreq, rreq->buffer.tail = folioq; done: rreq->buffer.first_tail_slot = slot; + + netfs_read_set_unlock_at(rreq); } / @@ -232,7 +267,7 @@ static void netfs_collect_read_results(struct netfs_io_request rreq) subreqs. / if (notes & BUFFERED) { - size_t fsize = PAGE_SIZE << rreq->front_folio_order; + uoff_t unlock_at = rreq->start + rreq->progress_at; / Clear the tail of a short read. / if (!(notes & HIT_PENDING) && @@ -257,7 +292,7 @@ static void netfs_collect_read_results(struct netfs_io_request rreq) transferred = front->len; trace_netfs_rreq(rreq, netfs_rreq_trace_set_abandon); } - if (front->start + transferred >= rreq->cleaned_to + fsize \|\| + if (front->start + transferred >= unlock_at \|\| test_bit(NETFS_SREQ_HIT_EOF, &front->flags)) netfs_read_unlock_folios(rreq, &notes); } else { @@ -477,20 +512,22 @@ void netfs_read_collection_worker(struct work_struct work) void netfs_read_subreq_progress(struct netfs_io_subrequest subreq) { struct netfs_io_request rreq = subreq->rreq; - struct netfs_io_stream stream = &rreq->io_streams[0]; - size_t fsize = PAGE_SIZE << rreq->front_folio_order; - - trace_netfs_sreq(subreq, netfs_sreq_trace_progress); + struct netfs_io_stream stream = &rreq->io_streams[subreq->stream_nr]; + size_t progress_at = READ_ONCE(rreq->progress_at); + uoff_t update_at = rreq->start + progress_at; + uoff_t transferred_to = subreq->start + subreq->transferred; / If we are at the head of the queue, wake up the collector, * getting a ref to it if we were the ones to do so. / - if (subreq->start + subreq->transferred > rreq->cleaned_to + fsize && + if (progress_at != ULONG_MAX && + transferred_to >= update_at && (rreq->origin == NETFS_READAHEAD \|\| rreq->origin == NETFS_READPAGE \|\| rreq->origin == NETFS_READ_FOR_WRITE) && list_is_first(&subreq->rreq_link, &stream->subrequests) ) { + trace_netfs_sreq(subreq, netfs_sreq_trace_progress); __set_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags); netfs_wake_collector(rreq); } diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c index 2b42758e01ec9..dd463a485139c 100644 --- a/fs/netfs/read_retry.c +++ b/fs/netfs/read_retry.c @@ -292,6 +292,13 @@ void netfs_unlock_abandoned_read_pages(struct netfs_io_request rreq) { struct folio_queue p; + / We have to wait for readahead refs to have been released before we + * can unlock any folios as the ref-dropper walks i_pages and the only + * thing preventing these folios from being removed is the folio lock. + / + if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags)) + netfs_wait_for_put_ra_refs(rreq); + for (p = rreq->buffer.tail; p; p = p->next) { for (int slot = 0; slot < folioq_count(p); slot++) { struct folio folio = folioq_folio(p, slot); diff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c index 8833550d2eb60..de67ac41548d1 100644 --- a/fs/netfs/read_single.c +++ b/fs/netfs/read_single.c @@ -170,6 +170,8 @@ ssize_t netfs_read_single(struct inode inode, struct file file, struct iov_ite if (IS_ERR(rreq)) return PTR_ERR(rreq); + rreq->progress_at = rreq->len; + ret = netfs_single_begin_cache_read(rreq, ictx); if (ret == -ENOMEM \|\| ret == -EINTR \|\| ret == -ERESTARTSYS) goto cleanup_free; diff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c index 8c0026836f9c1..424e77a9a1098 100644 --- a/fs/netfs/rolling_buffer.c +++ b/fs/netfs/rolling_buffer.c @@ -115,42 +115,65 @@ int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp) } / - * Decant the list of folios to read into a rolling buffer. + * Decant the entire list of folios to read into a rolling buffer. / -ssize_t rolling_buffer_load_from_ra(struct rolling_buffer roll, - struct readahead_control ractl, - struct folio_batch put_batch) +ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll, + struct readahead_control ractl, + unsigned int rreq_id, gfp_t gfp) { struct folio_queue fq; - struct page vec; - int nr, ix, to; - ssize_t size = 0; + ssize_t loaded = 0; - if (rolling_buffer_make_space(roll, GFP_KERNEL) < 0) - return -ENOMEM; + while (ractl->_nr_pages - ractl->_batch_count > 0) { + unsigned int nr; - fq = roll->head; - vec = (struct page )fq->vec.folios; - nr = __readahead_batch(ractl, vec + folio_batch_count(&fq->vec), - folio_batch_space(&fq->vec)); - ix = fq->vec.nr; - to = ix + nr; - fq->vec.nr = to; - for (; ix < to; ix++) { - struct folio folio = folioq_folio(fq, ix); - unsigned int order = folio_order(folio); - - fq->orders[ix] = order; - size += PAGE_SIZE << order; - trace_netfs_folio(folio, netfs_folio_trace_read); - if (!folio_batch_add(put_batch, folio)) - folio_batch_release(put_batch); + /* Allocate a folioq to put some folios into and attach it to + * the rolling buffer. + / + fq = netfs_folioq_alloc(rreq_id, gfp, + netfs_trace_folioq_make_space); + if (!fq) + goto nomem_unlock; + fq->prev = roll->head; + if (!roll->tail) + roll->tail = fq; + else + roll->head->next = fq; + roll->head = fq; + + / Get a batch of folios and note their orders. / + nr = __readahead_batch(ractl, (struct page )fq->vec.folios, + folioq_nr_slots(fq)); + if (WARN_ON_ONCE(!nr)) + break; + fq->vec.nr = nr; + + for (int slot = 0; slot < nr; slot++) { + struct folio folio = folioq_folio(fq, slot); + unsigned int order; + + order = folio_order(folio); + fq->orders[slot] = order; + loaded += PAGE_SIZE << order; + trace_netfs_folio(folio, netfs_folio_trace_read); + } } - WRITE_ONCE(roll->iter.count, roll->iter.count + size); - /* Store the counter after setting the slot. / - smp_store_release(&roll->next_head_slot, to); - return size; + WRITE_ONCE(roll->iter.count, loaded); + iov_iter_folio_queue(&roll->iter, ITER_DEST, roll->tail, 0, 0, loaded); + return loaded; + +nomem_unlock: + for (fq = roll->tail; fq; fq = fq->next) { + for (int slot = 0; slot < folioq_count(fq); slot++) { + folio_unlock(fq->vec.folios[slot]); + folioq_mark(fq, slot); + } + } + rolling_buffer_clear(roll); + roll->head = NULL; + roll->tail = NULL; + return -ENOMEM; } / diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c index 2d9cfcd43658f..851f6f93ad45a 100644 --- a/fs/netfs/write_issue.c +++ b/fs/netfs/write_issue.c @@ -170,6 +170,8 @@ void netfs_prepare_write(struct netfs_io_request wreq, rolling_buffer_make_space(&wreq->buffer, wreq->gfp); subreq = netfs_alloc_subrequest(wreq); + if (!subreq) + return; subreq->source = stream->source; subreq->start = start; subreq->stream_nr = stream->stream_nr; diff --git a/include/linux/netfs.h b/include/linux/netfs.h index f837a501008c9..1cf2ef3ce18b8 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -246,6 +246,7 @@ struct netfs_io_request { unsigned long long submitted; / Amount submitted for I/O so far / unsigned long long len; / Length of the request / size_t transferred; / Amount to be indicated as transferred / + size_t progress_at; / Report read progress when hit this much read / long error; / 0 or error that occurred / unsigned long long i_size; / Size of the file / unsigned long long start; / Start position / @@ -262,7 +263,6 @@ struct netfs_io_request { atomic_t subreq_counter; / Next subreq->debug_index / unsigned int nr_group_rel; / Number of refs to release on ->group / spinlock_t lock; / Lock for queuing subreqs / - unsigned char front_folio_order; / Order (size) of front folio / enum netfs_io_origin origin; / Origin of the request / bool direct_bv_unpin; / T if direct_bv[] must be unpinned / refcount_t ref; @@ -278,6 +278,7 @@ struct netfs_io_request { #define NETFS_RREQ_FOLIO_COPY_TO_CACHE 10 / Copy current folio to cache from read / #define NETFS_RREQ_UPLOAD_TO_SERVER 11 / Need to write to the server / #define NETFS_RREQ_USE_IO_ITER 12 / Use ->io_iter rather than ->i_pages / +#define NETFS_RREQ_NEED_PUT_RA_REFS 17 / Need to put the folio refs RA gave us / #define NETFS_RREQ_USE_PGPRIV2 31 / [DEPRECATED] Use PG_private_2 to mark * write to cache on read / const struct netfs_request_ops netfs_ops; diff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h index 9e5dad29669cf..a97f7cfaacaad 100644 --- a/include/linux/rolling_buffer.h +++ b/include/linux/rolling_buffer.h @@ -45,9 +45,9 @@ struct rolling_buffer_snapshot { int rolling_buffer_init(struct rolling_buffer roll, unsigned int rreq_id, unsigned int direction, gfp_t gfp); int rolling_buffer_make_space(struct rolling_buffer roll, gfp_t gfp); -ssize_t rolling_buffer_load_from_ra(struct rolling_buffer roll, - struct readahead_control ractl, - struct folio_batch put_batch); +ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer roll, + struct readahead_control ractl, + unsigned int rreq_id, gfp_t gfp); ssize_t rolling_buffer_append(struct rolling_buffer roll, struct folio folio, unsigned int flags, gfp_t gfp); struct folio_queue rolling_buffer_delete_spent(struct rolling_buffer roll); diff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h index 9259bc71049e0..e3101410e8b2d 100644 --- a/include/trace/events/cachefiles.h +++ b/include/trace/events/cachefiles.h @@ -372,7 +372,7 @@ TRACE_EVENT(cachefiles_rename, TRACE_EVENT(cachefiles_coherency, TP_PROTO(struct cachefiles_object obj, ino_t ino, - u64 disk_aux, + const void disk_aux, enum cachefiles_content content, enum cachefiles_coherency_trace why), @@ -389,12 +389,27 @@ TRACE_EVENT(cachefiles_coherency, ), TP_fast_assign( + union { + __be16 s[4]; + __be64 ll; + } x; + __entry->obj = obj->debug_id; __entry->why = why; __entry->content = content; __entry->ino = ino; __entry->aux = be64_to_cpup((__be64 )obj->cookie->inline_aux); - __entry->disk_aux = disk_aux; + + /* cachefiles_xattr::data is 2-byte aligned but not 8-byte aligned. / + if (disk_aux) { + x.s[0] = ((__be16 )disk_aux)[0]; + x.s[1] = ((__be16 )disk_aux)[1]; + x.s[2] = ((__be16 )disk_aux)[2]; + x.s[3] = ((__be16 )disk_aux)[3]; + __entry->disk_aux = be64_to_cpu(x.ll); + } else { + __entry->disk_aux = 0; + } ), TP_printk("o=%08x %s B=%llx c=%u aux=%llx dsk=%llx", diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h index 082cb03c61316..b5da315274ad5 100644 --- a/include/trace/events/netfs.h +++ b/include/trace/events/netfs.h @@ -59,6 +59,7 @@ EM(netfs_rreq_trace_free, "FREE ") \ EM(netfs_rreq_trace_intr, "INTR ") \ EM(netfs_rreq_trace_ki_complete, "KI-CMPL") \ + EM(netfs_rreq_trace_ra_put_ref, "RA-PUT ") \ EM(netfs_rreq_trace_recollect, "RECLLCT") \ EM(netfs_rreq_trace_redirty, "REDIRTY") \ EM(netfs_rreq_trace_resubmit, "RESUBMT") \ @@ -70,9 +71,11 @@ EM(netfs_rreq_trace_unpause, "UNPAUSE") \ EM(netfs_rreq_trace_wait_ip, "WAIT-IP") \ EM(netfs_rreq_trace_wait_pause, "--PAUSED--") \ + EM(netfs_rreq_trace_wait_put_ra_refs, "WAIT-P-RA") \ EM(netfs_rreq_trace_wait_quiesce, "WAIT-QUIESCE") \ EM(netfs_rreq_trace_waited_ip, "DONE-IP") \ EM(netfs_rreq_trace_waited_pause, "--UNPAUSED--") \ + EM(netfs_rreq_trace_waited_put_ra_refs, "DONE-P-RA") \ EM(netfs_rreq_trace_waited_quiesce, "DONE-QUIESCE") \ EM(netfs_rreq_trace_wake_ip, "WAKE-IP") \ EM(netfs_rreq_trace_wake_queue, "WAKE-Q ") \ @@ -786,6 +789,27 @@ TRACE_EVENT(netfs_folioq, __print_symbolic(__entry->trace, netfs_folioq_traces)) ); +TRACE_EVENT(netfs_read_progress_at, + TP_PROTO(const struct netfs_io_request rreq), + + TP_ARGS(rreq), + + TP_STRUCT__entry( + __field(unsigned int, rreq) + __field(size_t, progress_at) + __field(size_t, cleaned_to) + ), + + TP_fast_assign( + __entry->rreq = rreq->debug_id; + __entry->cleaned_to = rreq->cleaned_to - rreq->start; + __entry->progress_at = rreq->progress_at; + ), + + TP_printk("R=%08x cln=%zx prg=%zx", + __entry->rreq, __entry->cleaned_to, __entry->progress_at) + ); + #undef EM #undef E_ #endif /* _TRACE_NETFS_H */
45/3	2026/08/25 14:14	llm	kmsan-evaluator	7m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 14829 output: 321 thoughts: 11323 Thoughts: KMSAN Justification for Cachefiles Patch Okay, so I've been digging into this patch, and it looks like it modifies `fs/cachefiles/xattr.c` and some `fs/netfs/` files. Let's start with `fs/cachefiles/xattr.c`. The core of the issue revolves around handling extended attributes (xattrs) for the cache. The patch is fixing a problem where the buffer allocated for storing the xattr data, specifically within `cachefiles_set_object_xattr` and `cachefiles_check_auxdata`, wasn't properly initialized. Before this, if `vfs_getxattr` failed (e.g., if the requested xattr didn't exist), the `buf` allocated with `kmalloc` remained uninitialized. Because of this, when `trace_cachefiles_coherency` was called, it could read data from `buf->data` and `buf->content` that hadn't been written to. I initially thought KASAN would catch this, because of potential OOB reads, but that's not the case. The patch ensures that if `len` is smaller than 8 bytes, `put_unaligned_be64` ensures that 8 bytes are initialized. While KASAN may find OOBs for lengths under 8, it won't trigger if the allocated buffer is large enough to contain the 8 byte read because KASAN only protects memory beyond the allocated size. The problem lies with how this uninitialized data can be accessed. Specifically, `trace_cachefiles_coherency` is a tracepoint that accesses the allocated buffer for the xattr. If the xattr does not exist, `vfs_getxattr` returns an error. The allocated buffer contains uninitialized memory. `buf->content` is 8 bytes, and it remains uninitialized. This patch addresses it with the `put_unaligned_be64(0, (__be64 )buf->data);` call, which zeroes `buf->data`. Before this, if the code went down a failure path, the tracepoint would be reading uninitialized memory. However, it still does not initialize `buf->content`. If we allocate `buf` with `kmalloc`, the contents are uninitialized. `trace_cachefiles_coherency` and tracepoints are great for catching bugs like these, but they are not the only places where the bug could be triggered. Now, why KMSAN? KASAN vs. KMSAN: KASAN is all about detecting out-of-bounds memory accesses. KMSAN, on the other hand, is specifically for detecting reads of uninitialized memory. The critical point here is that if the `vfs_getxattr` call fails, we read a value in `trace_cachefiles_coherency` that never had a value assigned to it, which is exactly the kind of thing KMSAN is designed to catch. This happens if `len >= 8` where KASAN doesn't report it since it's within bounds. * Uninitialized Read: The key to this is the uninitialized state. The problem is that, without the patch, the `buf` is allocated but might not be fully initialized if the read xattr fails. This, then, can cause the KMSAN fuzzer to report bugs. Therefore, KMSAN is required here, because it will report a bug that other tools, such as KASAN, do not catch.
46/3	2026/08/25 14:21	tool	set-results	0m Args: { "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.", "NeedsKMSAN": true } Results: { "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.", "NeedsKMSAN": true }

{
  "EnableConfigs": [
    "NETFS_SUPPORT",
    "CACHEFILES",
    "9P_FS",
    "NET_9P",
    "CIFS",
    "CEPH_FS",
    "AFS_FS",
    "NFS_FS",
    "NFS_FSCACHE"
  ],
  "FocusSymbols": [
    "cachefiles_set_object_xattr",
    "cachefiles_check_auxdata",
    "netfs_readahead",
    "netfs_read_folio",
    "netfs_write_begin",
    "netfs_prefetch_for_write",
    "netfs_unbuffered_write_iter_locked",
    "netfs_wait_for_put_ra_refs",
    "netfs_alloc_request",
    "netfs_read_set_unlock_at",
    "netfs_read_subreq_progress",
    "netfs_unlock_abandoned_read_pages",
    "netfs_read_single",
    "rolling_buffer_bulk_load_from_ra",
    "netfs_prepare_write"
  ],
  "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.",
  "NeedsKMSAN": true,
  "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 973032d62ca4dc98bf40ee8ea0fc4e48fdbf7eb9\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Aug 25 14:11:17 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c\nindex f8ae78b3f7b6d..c70bf67e52b01 100644\n--- a/fs/cachefiles/xattr.c\n+++ b/fs/cachefiles/xattr.c\n@@ -13,6 +13,7 @@\n #include \u003clinux/quotaops.h\u003e\n #include \u003clinux/xattr.h\u003e\n #include \u003clinux/slab.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n #include \"internal.h\"\n \n #define CACHEFILES_COOKIE_TYPE_DATA 1\n@@ -50,7 +51,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)\n \n \t_enter(\"%x,#%d\", object-\u003edebug_id, len);\n \n-\tbuf = kmalloc(sizeof(struct cachefiles_xattr) + len, GFP_KERNEL);\n+\tbuf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);\n \tif (!buf)\n \t\treturn -ENOMEM;\n \n@@ -60,6 +61,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)\n \tbuf-\u003econtent\t\t= object-\u003econtent_info;\n \tif (test_bit(FSCACHE_COOKIE_LOCAL_WRITE, \u0026object-\u003ecookie-\u003eflags))\n \t\tbuf-\u003econtent\t= CACHEFILES_CONTENT_DIRTY;\n+\tput_unaligned_be64(0, (__be64 *)buf-\u003edata);\n \tif (len \u003e 0)\n \t\tmemcpy(buf-\u003edata, fscache_get_aux(object-\u003ecookie), len);\n \n@@ -77,8 +79,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)\n \t\ttrace_cachefiles_vfs_error(object, file_inode(file), ret,\n \t\t\t\t\t   cachefiles_trace_setxattr_error);\n \t\ttrace_cachefiles_coherency(object, file_inode(file)-\u003ei_ino,\n-\t\t\t\t\t   be64_to_cpup((__be64 *)buf-\u003edata),\n-\t\t\t\t\t   buf-\u003econtent,\n+\t\t\t\t\t   buf-\u003edata, buf-\u003econtent,\n \t\t\t\t\t   cachefiles_coherency_set_fail);\n \t\tif (ret != -ENOMEM)\n \t\t\tcachefiles_io_error_obj(\n@@ -86,8 +87,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)\n \t\t\t\t\"Failed to set xattr with error %d\", ret);\n \t} else {\n \t\ttrace_cachefiles_coherency(object, file_inode(file)-\u003ei_ino,\n-\t\t\t\t\t   be64_to_cpup((__be64 *)buf-\u003edata),\n-\t\t\t\t\t   buf-\u003econtent,\n+\t\t\t\t\t   buf-\u003edata, buf-\u003econtent,\n \t\t\t\t\t   cachefiles_coherency_set_ok);\n \t}\n \n@@ -110,9 +110,10 @@ int cachefiles_check_auxdata(struct cachefiles_object *object, struct file *file\n \tint ret = -ESTALE;\n \n \ttlen = sizeof(struct cachefiles_xattr) + len;\n-\tbuf = kmalloc(tlen, GFP_KERNEL);\n+\tbuf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);\n \tif (!buf)\n \t\treturn -ENOMEM;\n+\tput_unaligned_be64(0, (__be64 *)buf-\u003edata);\n \n \txlen = cachefiles_inject_read_error();\n \tif (xlen == 0)\n@@ -148,8 +149,7 @@ int cachefiles_check_auxdata(struct cachefiles_object *object, struct file *file\n \n out:\n \ttrace_cachefiles_coherency(object, file_inode(file)-\u003ei_ino,\n-\t\t\t\t   be64_to_cpup((__be64 *)buf-\u003edata),\n-\t\t\t\t   buf-\u003econtent, why);\n+\t\t\t\t   buf-\u003edata, buf-\u003econtent, why);\n \tkfree(buf);\n \treturn ret;\n }\ndiff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c\nindex 7fdfa4f27e349..a2a9d8c083f99 100644\n--- a/fs/netfs/buffered_read.c\n+++ b/fs/netfs/buffered_read.c\n@@ -54,6 +54,42 @@ static void netfs_rreq_expand(struct netfs_io_request *rreq,\n \t}\n }\n \n+/*\n+ * Drop the folio refs acquired from the readahead API.\n+ */\n+static void netfs_bulk_drop_ra_refs(struct netfs_io_request *rreq)\n+{\n+\tstruct folio_batch fbatch;\n+\tstruct folio *folio;\n+\tpgoff_t nr_pages = DIV_ROUND_UP(rreq-\u003elen, PAGE_SIZE);\n+\tpgoff_t first = rreq-\u003estart / PAGE_SIZE;\n+\tXA_STATE(xas, \u0026rreq-\u003emapping-\u003ei_pages, first);\n+\n+\tfolio_batch_init(\u0026fbatch);\n+\n+\trcu_read_lock();\n+\n+\txas_for_each(\u0026xas, folio,  first + nr_pages - 1) {\n+\t\tif (xas_retry(\u0026xas, folio))\n+\t\t\tcontinue;\n+\n+\t\tif (!folio_batch_add(\u0026fbatch, folio))\n+\t\t\tfolio_batch_release(\u0026fbatch);\n+\t}\n+\n+\trcu_read_unlock();\n+\tfolio_batch_release(\u0026fbatch);\n+\ttrace_netfs_rreq(rreq, netfs_rreq_trace_ra_put_ref);\n+\tclear_bit_unlock(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags);\n+\twake_up(\u0026rreq-\u003ewaitq);\n+}\n+\n+static void netfs_maybe_bulk_drop_ra_refs(struct netfs_io_request *rreq)\n+{\n+\tif (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\tnetfs_bulk_drop_ra_refs(rreq);\n+}\n+\n /*\n  * Begin an operation, and fetch the stored zero point value from the cookie if\n  * available.\n@@ -74,12 +110,8 @@ static int netfs_begin_cache_read(struct netfs_io_request *rreq, struct netfs_in\n  *\n  * Returns the limited size if successful and -ENOMEM if insufficient memory\n  * available.\n- *\n- * [!] NOTE: This must be run in the same thread as -\u003eissue_read() was called\n- * in as we access the readahead_control struct.\n  */\n-static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq,\n-\t\t\t\t\t   struct readahead_control *ractl)\n+static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq)\n {\n \tstruct netfs_io_request *rreq = subreq-\u003erreq;\n \tsize_t rsize = subreq-\u003elen;\n@@ -87,30 +119,6 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq,\n \tif (subreq-\u003esource == NETFS_DOWNLOAD_FROM_SERVER)\n \t\trsize = umin(rsize, rreq-\u003eio_streams[0].sreq_max_len);\n \n-\tif (ractl) {\n-\t\t/* If we don't have sufficient folios in the rolling buffer,\n-\t\t * extract a folioq's worth from the readahead region at a time\n-\t\t * into the buffer.  Note that this acquires a ref on each page\n-\t\t * that we will need to release later - but we don't want to do\n-\t\t * that until after we've started the I/O.\n-\t\t */\n-\t\tstruct folio_batch put_batch;\n-\n-\t\tfolio_batch_init(\u0026put_batch);\n-\t\twhile (rreq-\u003esubmitted \u003c subreq-\u003estart + rsize) {\n-\t\t\tssize_t added;\n-\n-\t\t\tadded = rolling_buffer_load_from_ra(\u0026rreq-\u003ebuffer, ractl,\n-\t\t\t\t\t\t\t    \u0026put_batch);\n-\t\t\tif (added \u003c 0) {\n-\t\t\t\tfolio_batch_release(\u0026put_batch);\n-\t\t\t\treturn added;\n-\t\t\t}\n-\t\t\trreq-\u003esubmitted += added;\n-\t\t}\n-\t\tfolio_batch_release(\u0026put_batch);\n-\t}\n-\n \tsubreq-\u003elen = rsize;\n \tif (unlikely(rreq-\u003eio_streams[0].sreq_max_segs)) {\n \t\tsize_t limit = netfs_limit_iter(\u0026rreq-\u003ebuffer.iter, 0, rsize,\n@@ -208,8 +216,7 @@ static void netfs_issue_read(struct netfs_io_request *rreq,\n  * slicing up the region to be read according to available cache blocks and\n  * network rsize.\n  */\n-static void netfs_read_to_pagecache(struct netfs_io_request *rreq,\n-\t\t\t\t    struct readahead_control *ractl)\n+static void netfs_read_to_pagecache(struct netfs_io_request *rreq)\n {\n \tunsigned long long start = rreq-\u003estart;\n \tssize_t size = rreq-\u003elen;\n@@ -288,7 +295,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq,\n \t\tbreak;\n \n \tissue:\n-\t\tslice = netfs_prepare_read_iterator(subreq, ractl);\n+\t\tslice = netfs_prepare_read_iterator(subreq);\n \t\tif (slice \u003c 0) {\n \t\t\tret = slice;\n \t\t\tnetfs_cancel_read(subreq, ret);\n@@ -302,6 +309,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq,\n \t\t}\n \n \t\tnetfs_issue_read(rreq, subreq);\n+\t\tnetfs_maybe_bulk_drop_ra_refs(rreq);\n \n \t\tif (test_bit(NETFS_RREQ_PAUSE, \u0026rreq-\u003eflags))\n \t\t\tnetfs_wait_for_paused_read(rreq);\n@@ -339,7 +347,8 @@ void netfs_readahead(struct readahead_control *ractl)\n {\n \tstruct netfs_io_request *rreq;\n \tstruct netfs_inode *ictx = netfs_inode(ractl-\u003emapping-\u003ehost);\n-\tunsigned long long start = readahead_pos(ractl);\n+\tssize_t added;\n+\tuoff_t start = readahead_pos(ractl);\n \tsize_t size = readahead_length(ractl);\n \tint ret;\n \n@@ -360,11 +369,24 @@ void netfs_readahead(struct readahead_control *ractl)\n \n \tnetfs_rreq_expand(rreq, ractl);\n \n-\trreq-\u003esubmitted = rreq-\u003estart;\n-\tif (rolling_buffer_init(\u0026rreq-\u003ebuffer, rreq-\u003edebug_id, ITER_DEST, rreq-\u003egfp) \u003c 0)\n+\t/* Load the folios to be read into a bvecq chain.  Note that this\n+\t * acquires a ref on each folio that we will need to release later -\n+\t * but we don't want to do that until after we've started the I/O.\n+\t */\n+\tadded = rolling_buffer_bulk_load_from_ra(\u0026rreq-\u003ebuffer, ractl,\n+\t\t\t\t\t\t rreq-\u003edebug_id, rreq-\u003egfp);\n+\tif (added \u003c 0) {\n+\t\tret = added;\n \t\tgoto cleanup_free;\n-\tnetfs_read_to_pagecache(rreq, ractl);\n+\t}\n+\t__set_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags);\n+\n+\trreq-\u003esubmitted = rreq-\u003estart + added;\n+\trreq-\u003ecleaned_to = rreq-\u003estart;\n+\tnetfs_read_set_unlock_at(rreq);\n \n+\tnetfs_read_to_pagecache(rreq);\n+\tnetfs_maybe_bulk_drop_ra_refs(rreq);\n \treturn netfs_put_request(rreq, netfs_rreq_trace_put_return);\n \n cleanup_free:\n@@ -387,6 +409,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request *rreq, struct fo\n \tif (added \u003c 0)\n \t\treturn added;\n \trreq-\u003esubmitted = rreq-\u003estart + added;\n+\trreq-\u003eprogress_at = added;\n \treturn 0;\n }\n \n@@ -457,7 +480,7 @@ static int netfs_read_gaps(struct file *file, struct folio *folio)\n \tiov_iter_bvec(\u0026rreq-\u003ebuffer.iter, ITER_DEST, bvec, i, rreq-\u003elen);\n \trreq-\u003esubmitted = rreq-\u003estart + flen;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \n \tret = netfs_wait_for_read(rreq);\n \tif (ret \u003e= 0) {\n@@ -532,7 +555,7 @@ int netfs_read_folio(struct file *file, struct folio *folio)\n \tif (ret \u003c 0)\n \t\tgoto discard;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \tret = netfs_wait_for_read(rreq);\n \tnetfs_put_request(rreq, netfs_rreq_trace_put_return);\n \treturn ret \u003c 0 ? ret : 0;\n@@ -689,7 +712,7 @@ int netfs_write_begin(struct netfs_inode *ctx,\n \tif (ret \u003c 0)\n \t\tgoto error_put;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \tret = netfs_wait_for_read(rreq);\n \tnetfs_put_request(rreq, netfs_rreq_trace_put_return);\n \tif (ret \u003c 0)\n@@ -754,7 +777,7 @@ int netfs_prefetch_for_write(struct file *file, struct folio *folio,\n \tif (ret \u003c 0)\n \t\tgoto error_put;\n \n-\tnetfs_read_to_pagecache(rreq, NULL);\n+\tnetfs_read_to_pagecache(rreq);\n \tret = netfs_wait_for_read(rreq);\n \tnetfs_put_request(rreq, netfs_rreq_trace_put_return);\n \treturn ret \u003c 0 ? ret : 0;\ndiff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c\nindex c16fbad286a17..7173ce04bac63 100644\n--- a/fs/netfs/direct_write.c\n+++ b/fs/netfs/direct_write.c\n@@ -21,7 +21,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request *wreq)\n \t/* Okay, declare that all I/O is complete. */\n \ttrace_netfs_rreq(wreq, netfs_rreq_trace_write_done);\n \n-\tif (!wreq-\u003eerror)\n+\tif (wreq-\u003etransferred)\n \t\tnetfs_update_i_size(ictx, \u0026ictx-\u003einode, wreq-\u003estart, wreq-\u003etransferred);\n \n \tif (wreq-\u003eorigin == NETFS_DIO_WRITE \u0026\u0026\n@@ -51,7 +51,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request *wreq)\n \t\twreq-\u003eiocb-\u003eki_pos += written;\n \t\tif (wreq-\u003eiocb-\u003eki_complete) {\n \t\t\ttrace_netfs_rreq(wreq, netfs_rreq_trace_ki_complete);\n-\t\t\twreq-\u003eiocb-\u003eki_complete(wreq-\u003eiocb, wreq-\u003eerror ?: written);\n+\t\t\twreq-\u003eiocb-\u003eki_complete(wreq-\u003eiocb, written ?: wreq-\u003eerror);\n \t\t}\n \t\twreq-\u003eiocb = VFS_PTR_POISON;\n \t}\n@@ -95,7 +95,7 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)\n {\n \tstruct netfs_io_subrequest *subreq = NULL;\n \tstruct netfs_io_stream *stream = \u0026wreq-\u003eio_streams[0];\n-\tint ret;\n+\tint ret = 0;\n \n \t_enter(\"%llx\", wreq-\u003elen);\n \n@@ -110,6 +110,10 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)\n \t\tif (!subreq) {\n \t\t\tnetfs_prepare_write(wreq, stream, wreq-\u003estart + wreq-\u003etransferred);\n \t\t\tsubreq = stream-\u003econstruct;\n+\t\t\tif (!subreq) {\n+\t\t\t\tret = -ENOMEM;\n+\t\t\t\tbreak;\n+\t\t\t}\n \t\t\tstream-\u003econstruct = NULL;\n \t\t}\n \n@@ -121,8 +125,14 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)\n \t\t}\n \n \t\tiov_iter_truncate(\u0026subreq-\u003eio_iter, wreq-\u003elen - wreq-\u003etransferred);\n-\t\tif (!iov_iter_count(\u0026subreq-\u003eio_iter))\n+\t\tif (!iov_iter_count(\u0026subreq-\u003eio_iter)) {\n+\t\t\tpr_warn(\"netfs: Unexpected zero-length iterator R=%08x\\n\",\n+\t\t\t\twreq-\u003edebug_id);\n+\t\t\t__set_bit(NETFS_SREQ_FAILED, \u0026subreq-\u003eflags);\n+\t\t\tnetfs_write_subrequest_terminated(subreq, -EIO);\n+\t\t\twreq-\u003eerror = -EIO;\n \t\t\tbreak;\n+\t\t}\n \n \t\tsubreq-\u003elen = netfs_limit_iter(\u0026subreq-\u003eio_iter, 0,\n \t\t\t\t\t       stream-\u003esreq_max_len,\n@@ -139,13 +149,11 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)\n \t\tif (test_bit(NETFS_SREQ_NEED_RETRY, \u0026subreq-\u003eflags)) {\n \t\t\tretry = true;\n \t\t} else if (test_bit(NETFS_SREQ_FAILED, \u0026subreq-\u003eflags)) {\n-\t\t\tret = subreq-\u003eerror;\n-\t\t\twreq-\u003eerror = ret;\n+\t\t\twreq-\u003eerror = subreq-\u003eerror;\n \t\t\tnetfs_see_subrequest(subreq, netfs_sreq_trace_see_failed);\n \t\t\tsubreq = NULL;\n \t\t\tbreak;\n \t\t}\n-\t\tret = 0;\n \n \t\tif (!retry) {\n \t\t\tnetfs_unbuffered_write_collect(wreq, stream, subreq);\n@@ -288,11 +296,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *\n \t\tret = -EIOCBQUEUED;\n \t} else {\n \t\tret = netfs_unbuffered_write(wreq);\n-\t\tif (ret \u003c 0) {\n-\t\t\t_debug(\"begin = %zd\", ret);\n-\t\t} else {\n+\t\tif (wreq-\u003etransferred) {\n \t\t\tiocb-\u003eki_pos += wreq-\u003etransferred;\n-\t\t\tret = wreq-\u003etransferred ?: wreq-\u003eerror;\n+\t\t\tret = wreq-\u003etransferred;\n+\t\t} else if (wreq-\u003eerror) {\n+\t\t\tret = wreq-\u003eerror;\n \t\t}\n \n \t\tnetfs_put_request(wreq, netfs_rreq_trace_put_complete);\ndiff --git a/fs/netfs/internal.h b/fs/netfs/internal.h\nindex 420ee7b26580f..c734cad7063e5 100644\n--- a/fs/netfs/internal.h\n+++ b/fs/netfs/internal.h\n@@ -79,6 +79,7 @@ ssize_t netfs_wait_for_read(struct netfs_io_request *rreq);\n ssize_t netfs_wait_for_write(struct netfs_io_request *rreq);\n void netfs_wait_for_paused_read(struct netfs_io_request *rreq);\n void netfs_wait_for_paused_write(struct netfs_io_request *rreq);\n+void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq);\n \n /*\n  * objects.c\n@@ -109,6 +110,7 @@ static inline void netfs_see_subrequest(struct netfs_io_subrequest *subreq,\n /*\n  * read_collect.c\n  */\n+void netfs_read_set_unlock_at(struct netfs_io_request *rreq);\n bool netfs_read_collection(struct netfs_io_request *rreq);\n void netfs_read_collection_worker(struct work_struct *work);\n void netfs_cancel_read(struct netfs_io_subrequest *subreq, int error);\ndiff --git a/fs/netfs/misc.c b/fs/netfs/misc.c\nindex 5d554512ed23a..f5c1c463f4ff7 100644\n--- a/fs/netfs/misc.c\n+++ b/fs/netfs/misc.c\n@@ -563,3 +563,22 @@ void netfs_wait_for_paused_write(struct netfs_io_request *rreq)\n {\n \treturn netfs_wait_for_pause(rreq, netfs_write_collection);\n }\n+\n+/*\n+ * Wait for the readahead-acquired refs to be put.\n+ */\n+void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq)\n+{\n+\tDEFINE_WAIT(myself);\n+\n+\tfor (;;) {\n+\t\ttrace_netfs_rreq(rreq, netfs_rreq_trace_wait_put_ra_refs);\n+\t\tprepare_to_wait(\u0026rreq-\u003ewaitq, \u0026myself, TASK_UNINTERRUPTIBLE);\n+\t\tif (!test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\t\tbreak;\n+\t\tschedule();\n+\t}\n+\n+\ttrace_netfs_rreq(rreq, netfs_rreq_trace_waited_put_ra_refs);\n+\tfinish_wait(\u0026rreq-\u003ewaitq, \u0026myself);\n+}\ndiff --git a/fs/netfs/objects.c b/fs/netfs/objects.c\nindex 01461a74642d6..7f6a3e912602e 100644\n--- a/fs/netfs/objects.c\n+++ b/fs/netfs/objects.c\n@@ -41,24 +41,32 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,\n \n \tmemset(rreq, 0, kmem_cache_size(cache));\n \tINIT_WORK(\u0026rreq-\u003ecleanup_work, netfs_free_request);\n-\trreq-\u003egfp\t= gfp;\n-\trreq-\u003estart\t= start;\n-\trreq-\u003elen\t= len;\n-\trreq-\u003eorigin\t= origin;\n-\trreq-\u003enetfs_ops\t= ctx-\u003eops;\n-\trreq-\u003emapping\t= mapping;\n-\trreq-\u003einode\t= inode;\n-\trreq-\u003ei_size\t= i_size_read(inode);\n-\trreq-\u003edebug_id\t= atomic_inc_return(\u0026debug_ids);\n-\trreq-\u003ewsize\t= INT_MAX;\n+\trreq-\u003egfp\t\t= gfp;\n+\trreq-\u003estart\t\t= start;\n+\trreq-\u003ecollected_to\t= start;\n+\trreq-\u003ecleaned_to\t= start;\n+\trreq-\u003elen\t\t= len;\n+\trreq-\u003eprogress_at\t= 0;\n+\trreq-\u003eorigin\t\t= origin;\n+\trreq-\u003enetfs_ops\t\t= ctx-\u003eops;\n+\trreq-\u003emapping\t\t= mapping;\n+\trreq-\u003einode\t\t= inode;\n+\trreq-\u003ei_size\t\t= i_size_read(inode);\n+\trreq-\u003edebug_id\t\t= atomic_inc_return(\u0026debug_ids);\n+\trreq-\u003ewsize\t\t= INT_MAX;\n \trreq-\u003eio_streams[0].sreq_max_len = ULONG_MAX;\n \trreq-\u003eio_streams[0].sreq_max_segs = 0;\n \tspin_lock_init(\u0026rreq-\u003elock);\n-\tINIT_LIST_HEAD(\u0026rreq-\u003eio_streams[0].subrequests);\n-\tINIT_LIST_HEAD(\u0026rreq-\u003eio_streams[1].subrequests);\n \tinit_waitqueue_head(\u0026rreq-\u003ewaitq);\n \trefcount_set(\u0026rreq-\u003eref, 2);\n \n+\tfor (int s = 0; s \u003c NR_IO_STREAMS; s++) {\n+\t\tstruct netfs_io_stream *stream = \u0026rreq-\u003eio_streams[s];\n+\n+\t\tINIT_LIST_HEAD(\u0026stream-\u003esubrequests);\n+\t\tstream-\u003ecollected_to = rreq-\u003estart;\n+\t}\n+\n \tif (origin == NETFS_READAHEAD ||\n \t    origin == NETFS_READPAGE ||\n \t    origin == NETFS_READ_GAPS ||\ndiff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c\nindex 23660a5901246..8ba162cf568b2 100644\n--- a/fs/netfs/read_collect.c\n+++ b/fs/netfs/read_collect.c\n@@ -94,6 +94,35 @@ static void netfs_unlock_read_folio(struct netfs_io_request *rreq,\n \tfolioq_clear(folioq, slot);\n }\n \n+/*\n+ * Determine how much to gather before unlocking more folios.\n+ */\n+void netfs_read_set_unlock_at(struct netfs_io_request *rreq)\n+{\n+\tstruct folio_queue *folioq = rreq-\u003ebuffer.tail;\n+\tunsigned int slot = rreq-\u003ebuffer.first_tail_slot;\n+\tsize_t cleaned_to = rreq-\u003ecleaned_to - rreq-\u003estart;\n+\tsize_t progress_at = cleaned_to;\n+\tsize_t minimum = 256 * 1024;\n+\n+\twhile (progress_at \u003c rreq-\u003elen) {\n+\t\tif (slot \u003e= folioq_count(folioq)) {\n+\t\t\tfolioq = folioq-\u003enext;\n+\t\t\tif (!folioq)\n+\t\t\t\tbreak;\n+\t\t\tslot = 0;\n+\t\t}\n+\n+\t\tprogress_at += folioq_folio_size(folioq, slot);\n+\t\tif (progress_at - cleaned_to \u003e= minimum)\n+\t\t\tbreak;\n+\t\tslot++;\n+\t}\n+\n+\tWRITE_ONCE(rreq-\u003eprogress_at, progress_at);\n+\ttrace_netfs_read_progress_at(rreq);\n+}\n+\n /*\n  * Unlock any folios we've finished with.\n  */\n@@ -112,16 +141,22 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,\n \tif (slot \u003e= folioq_nr_slots(folioq)) {\n \t\tfolioq = rolling_buffer_delete_spent(\u0026rreq-\u003ebuffer);\n \t\tif (!folioq) {\n-\t\t\trreq-\u003efront_folio_order = 0;\n+\t\t\tWRITE_ONCE(rreq-\u003eprogress_at, ULONG_MAX);\n \t\t\treturn;\n \t\t}\n \t\tslot = 0;\n \t}\n \n+\t/* We have to wait for readahead refs to have been released before we\n+\t * can unlock any folios as the ref-dropper walks i_pages and the only\n+\t * thing preventing these folios from being removed is the folio lock.\n+\t */\n+\tif (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\tnetfs_wait_for_put_ra_refs(rreq);\n+\n \tfor (;;) {\n \t\tstruct folio *folio;\n-\t\tunsigned long long fpos, fend;\n-\t\tunsigned int order;\n+\t\tunsigned long long fpos = rreq-\u003ecleaned_to, fend;\n \t\tsize_t fsize;\n \n \t\tif (*notes \u0026 COPY_TO_CACHE)\n@@ -133,9 +168,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,\n \t\t\t      rreq-\u003edebug_id, folio-\u003eindex))\n \t\t\ttrace_netfs_folio(folio, netfs_folio_trace_not_locked);\n \n-\t\torder = folioq_folio_order(folioq, slot);\n-\t\trreq-\u003efront_folio_order = order;\n-\t\tfsize = PAGE_SIZE \u003c\u003c order;\n+\t\tfsize = folioq_folio_size(folioq, slot);\n \t\tfpos = folio_pos(folio);\n \t\tfend = fpos + fsize;\n \n@@ -146,7 +179,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,\n \t\t\tbreak;\n \n \t\tnetfs_unlock_read_folio(rreq, folioq, slot);\n-\t\tWRITE_ONCE(rreq-\u003ecleaned_to, fpos + fsize);\n+\t\tWRITE_ONCE(rreq-\u003ecleaned_to, fend);\n \t\t*notes |= MADE_PROGRESS;\n \n \t\tclear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, \u0026rreq-\u003eflags);\n@@ -172,6 +205,8 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,\n \trreq-\u003ebuffer.tail = folioq;\n done:\n \trreq-\u003ebuffer.first_tail_slot = slot;\n+\n+\tnetfs_read_set_unlock_at(rreq);\n }\n \n /*\n@@ -232,7 +267,7 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq)\n \t\t * subreqs.\n \t\t */\n \t\tif (notes \u0026 BUFFERED) {\n-\t\t\tsize_t fsize = PAGE_SIZE \u003c\u003c rreq-\u003efront_folio_order;\n+\t\t\tuoff_t unlock_at = rreq-\u003estart + rreq-\u003eprogress_at;\n \n \t\t\t/* Clear the tail of a short read. */\n \t\t\tif (!(notes \u0026 HIT_PENDING) \u0026\u0026\n@@ -257,7 +292,7 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq)\n \t\t\t\ttransferred = front-\u003elen;\n \t\t\t\ttrace_netfs_rreq(rreq, netfs_rreq_trace_set_abandon);\n \t\t\t}\n-\t\t\tif (front-\u003estart + transferred \u003e= rreq-\u003ecleaned_to + fsize ||\n+\t\t\tif (front-\u003estart + transferred \u003e= unlock_at ||\n \t\t\t    test_bit(NETFS_SREQ_HIT_EOF, \u0026front-\u003eflags))\n \t\t\t\tnetfs_read_unlock_folios(rreq, \u0026notes);\n \t\t} else {\n@@ -477,20 +512,22 @@ void netfs_read_collection_worker(struct work_struct *work)\n void netfs_read_subreq_progress(struct netfs_io_subrequest *subreq)\n {\n \tstruct netfs_io_request *rreq = subreq-\u003erreq;\n-\tstruct netfs_io_stream *stream = \u0026rreq-\u003eio_streams[0];\n-\tsize_t fsize = PAGE_SIZE \u003c\u003c rreq-\u003efront_folio_order;\n-\n-\ttrace_netfs_sreq(subreq, netfs_sreq_trace_progress);\n+\tstruct netfs_io_stream *stream = \u0026rreq-\u003eio_streams[subreq-\u003estream_nr];\n+\tsize_t progress_at = READ_ONCE(rreq-\u003eprogress_at);\n+\tuoff_t update_at = rreq-\u003estart + progress_at;\n+\tuoff_t transferred_to = subreq-\u003estart + subreq-\u003etransferred;\n \n \t/* If we are at the head of the queue, wake up the collector,\n \t * getting a ref to it if we were the ones to do so.\n \t */\n-\tif (subreq-\u003estart + subreq-\u003etransferred \u003e rreq-\u003ecleaned_to + fsize \u0026\u0026\n+\tif (progress_at != ULONG_MAX \u0026\u0026\n+\t    transferred_to \u003e= update_at \u0026\u0026\n \t    (rreq-\u003eorigin == NETFS_READAHEAD ||\n \t     rreq-\u003eorigin == NETFS_READPAGE ||\n \t     rreq-\u003eorigin == NETFS_READ_FOR_WRITE) \u0026\u0026\n \t    list_is_first(\u0026subreq-\u003erreq_link, \u0026stream-\u003esubrequests)\n \t    ) {\n+\t\ttrace_netfs_sreq(subreq, netfs_sreq_trace_progress);\n \t\t__set_bit(NETFS_SREQ_MADE_PROGRESS, \u0026subreq-\u003eflags);\n \t\tnetfs_wake_collector(rreq);\n \t}\ndiff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c\nindex 2b42758e01ec9..dd463a485139c 100644\n--- a/fs/netfs/read_retry.c\n+++ b/fs/netfs/read_retry.c\n@@ -292,6 +292,13 @@ void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq)\n {\n \tstruct folio_queue *p;\n \n+\t/* We have to wait for readahead refs to have been released before we\n+\t * can unlock any folios as the ref-dropper walks i_pages and the only\n+\t * thing preventing these folios from being removed is the folio lock.\n+\t */\n+\tif (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, \u0026rreq-\u003eflags))\n+\t\tnetfs_wait_for_put_ra_refs(rreq);\n+\n \tfor (p = rreq-\u003ebuffer.tail; p; p = p-\u003enext) {\n \t\tfor (int slot = 0; slot \u003c folioq_count(p); slot++) {\n \t\t\tstruct folio *folio = folioq_folio(p, slot);\ndiff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c\nindex 8833550d2eb60..de67ac41548d1 100644\n--- a/fs/netfs/read_single.c\n+++ b/fs/netfs/read_single.c\n@@ -170,6 +170,8 @@ ssize_t netfs_read_single(struct inode *inode, struct file *file, struct iov_ite\n \tif (IS_ERR(rreq))\n \t\treturn PTR_ERR(rreq);\n \n+\trreq-\u003eprogress_at = rreq-\u003elen;\n+\n \tret = netfs_single_begin_cache_read(rreq, ictx);\n \tif (ret == -ENOMEM || ret == -EINTR || ret == -ERESTARTSYS)\n \t\tgoto cleanup_free;\ndiff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c\nindex 8c0026836f9c1..424e77a9a1098 100644\n--- a/fs/netfs/rolling_buffer.c\n+++ b/fs/netfs/rolling_buffer.c\n@@ -115,42 +115,65 @@ int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp)\n }\n \n /*\n- * Decant the list of folios to read into a rolling buffer.\n+ * Decant the entire list of folios to read into a rolling buffer.\n  */\n-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,\n-\t\t\t\t    struct readahead_control *ractl,\n-\t\t\t\t    struct folio_batch *put_batch)\n+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,\n+\t\t\t\t\t struct readahead_control *ractl,\n+\t\t\t\t\t unsigned int rreq_id, gfp_t gfp)\n {\n \tstruct folio_queue *fq;\n-\tstruct page **vec;\n-\tint nr, ix, to;\n-\tssize_t size = 0;\n+\tssize_t loaded = 0;\n \n-\tif (rolling_buffer_make_space(roll, GFP_KERNEL) \u003c 0)\n-\t\treturn -ENOMEM;\n+\twhile (ractl-\u003e_nr_pages - ractl-\u003e_batch_count \u003e 0) {\n+\t\tunsigned int nr;\n \n-\tfq = roll-\u003ehead;\n-\tvec = (struct page **)fq-\u003evec.folios;\n-\tnr = __readahead_batch(ractl, vec + folio_batch_count(\u0026fq-\u003evec),\n-\t\t\t       folio_batch_space(\u0026fq-\u003evec));\n-\tix = fq-\u003evec.nr;\n-\tto = ix + nr;\n-\tfq-\u003evec.nr = to;\n-\tfor (; ix \u003c to; ix++) {\n-\t\tstruct folio *folio = folioq_folio(fq, ix);\n-\t\tunsigned int order = folio_order(folio);\n-\n-\t\tfq-\u003eorders[ix] = order;\n-\t\tsize += PAGE_SIZE \u003c\u003c order;\n-\t\ttrace_netfs_folio(folio, netfs_folio_trace_read);\n-\t\tif (!folio_batch_add(put_batch, folio))\n-\t\t\tfolio_batch_release(put_batch);\n+\t\t/* Allocate a folioq to put some folios into and attach it to\n+\t\t * the rolling buffer.\n+\t\t */\n+\t\tfq = netfs_folioq_alloc(rreq_id, gfp,\n+\t\t\t\t\tnetfs_trace_folioq_make_space);\n+\t\tif (!fq)\n+\t\t\tgoto nomem_unlock;\n+\t\tfq-\u003eprev = roll-\u003ehead;\n+\t\tif (!roll-\u003etail)\n+\t\t\troll-\u003etail = fq;\n+\t\telse\n+\t\t\troll-\u003ehead-\u003enext = fq;\n+\t\troll-\u003ehead = fq;\n+\n+\t\t/* Get a batch of folios and note their orders. */\n+\t\tnr = __readahead_batch(ractl, (struct page **)fq-\u003evec.folios,\n+\t\t\t\t       folioq_nr_slots(fq));\n+\t\tif (WARN_ON_ONCE(!nr))\n+\t\t\tbreak;\n+\t\tfq-\u003evec.nr = nr;\n+\n+\t\tfor (int slot = 0; slot \u003c nr; slot++) {\n+\t\t\tstruct folio *folio = folioq_folio(fq, slot);\n+\t\t\tunsigned int order;\n+\n+\t\t\torder = folio_order(folio);\n+\t\t\tfq-\u003eorders[slot] = order;\n+\t\t\tloaded += PAGE_SIZE \u003c\u003c order;\n+\t\t\ttrace_netfs_folio(folio, netfs_folio_trace_read);\n+\t\t}\n \t}\n-\tWRITE_ONCE(roll-\u003eiter.count, roll-\u003eiter.count + size);\n \n-\t/* Store the counter after setting the slot. */\n-\tsmp_store_release(\u0026roll-\u003enext_head_slot, to);\n-\treturn size;\n+\tWRITE_ONCE(roll-\u003eiter.count, loaded);\n+\tiov_iter_folio_queue(\u0026roll-\u003eiter, ITER_DEST, roll-\u003etail, 0, 0, loaded);\n+\treturn loaded;\n+\n+nomem_unlock:\n+\tfor (fq = roll-\u003etail; fq; fq = fq-\u003enext) {\n+\t\tfor (int slot = 0; slot \u003c folioq_count(fq); slot++) {\n+\t\t\tfolio_unlock(fq-\u003evec.folios[slot]);\n+\t\t\tfolioq_mark(fq, slot);\n+\t\t}\n+\t}\n+\trolling_buffer_clear(roll);\n+\troll-\u003ehead = NULL;\n+\troll-\u003etail = NULL;\n+\treturn -ENOMEM;\n }\n \n /*\ndiff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c\nindex 2d9cfcd43658f..851f6f93ad45a 100644\n--- a/fs/netfs/write_issue.c\n+++ b/fs/netfs/write_issue.c\n@@ -170,6 +170,8 @@ void netfs_prepare_write(struct netfs_io_request *wreq,\n \t\trolling_buffer_make_space(\u0026wreq-\u003ebuffer, wreq-\u003egfp);\n \n \tsubreq = netfs_alloc_subrequest(wreq);\n+\tif (!subreq)\n+\t\treturn;\n \tsubreq-\u003esource\t\t= stream-\u003esource;\n \tsubreq-\u003estart\t\t= start;\n \tsubreq-\u003estream_nr\t= stream-\u003estream_nr;\ndiff --git a/include/linux/netfs.h b/include/linux/netfs.h\nindex f837a501008c9..1cf2ef3ce18b8 100644\n--- a/include/linux/netfs.h\n+++ b/include/linux/netfs.h\n@@ -246,6 +246,7 @@ struct netfs_io_request {\n \tunsigned long long\tsubmitted;\t/* Amount submitted for I/O so far */\n \tunsigned long long\tlen;\t\t/* Length of the request */\n \tsize_t\t\t\ttransferred;\t/* Amount to be indicated as transferred */\n+\tsize_t\t\t\tprogress_at;\t/* Report read progress when hit this much read */\n \tlong\t\t\terror;\t\t/* 0 or error that occurred */\n \tunsigned long long\ti_size;\t\t/* Size of the file */\n \tunsigned long long\tstart;\t\t/* Start position */\n@@ -262,7 +263,6 @@ struct netfs_io_request {\n \tatomic_t\t\tsubreq_counter;\t/* Next subreq-\u003edebug_index */\n \tunsigned int\t\tnr_group_rel;\t/* Number of refs to release on -\u003egroup */\n \tspinlock_t\t\tlock;\t\t/* Lock for queuing subreqs */\n-\tunsigned char\t\tfront_folio_order; /* Order (size) of front folio */\n \tenum netfs_io_origin\torigin;\t\t/* Origin of the request */\n \tbool\t\t\tdirect_bv_unpin; /* T if direct_bv[] must be unpinned */\n \trefcount_t\t\tref;\n@@ -278,6 +278,7 @@ struct netfs_io_request {\n #define NETFS_RREQ_FOLIO_COPY_TO_CACHE\t10\t/* Copy current folio to cache from read */\n #define NETFS_RREQ_UPLOAD_TO_SERVER\t11\t/* Need to write to the server */\n #define NETFS_RREQ_USE_IO_ITER\t\t12\t/* Use -\u003eio_iter rather than -\u003ei_pages */\n+#define NETFS_RREQ_NEED_PUT_RA_REFS\t17\t/* Need to put the folio refs RA gave us */\n #define NETFS_RREQ_USE_PGPRIV2\t\t31\t/* [DEPRECATED] Use PG_private_2 to mark\n \t\t\t\t\t\t * write to cache on read */\n \tconst struct netfs_request_ops *netfs_ops;\ndiff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h\nindex 9e5dad29669cf..a97f7cfaacaad 100644\n--- a/include/linux/rolling_buffer.h\n+++ b/include/linux/rolling_buffer.h\n@@ -45,9 +45,9 @@ struct rolling_buffer_snapshot {\n int rolling_buffer_init(struct rolling_buffer *roll, unsigned int rreq_id,\n \t\t\tunsigned int direction, gfp_t gfp);\n int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp);\n-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,\n-\t\t\t\t    struct readahead_control *ractl,\n-\t\t\t\t    struct folio_batch *put_batch);\n+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,\n+\t\t\t\t\t struct readahead_control *ractl,\n+\t\t\t\t\t unsigned int rreq_id, gfp_t gfp);\n ssize_t rolling_buffer_append(struct rolling_buffer *roll, struct folio *folio,\n \t\t\t      unsigned int flags, gfp_t gfp);\n struct folio_queue *rolling_buffer_delete_spent(struct rolling_buffer *roll);\ndiff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h\nindex 9259bc71049e0..e3101410e8b2d 100644\n--- a/include/trace/events/cachefiles.h\n+++ b/include/trace/events/cachefiles.h\n@@ -372,7 +372,7 @@ TRACE_EVENT(cachefiles_rename,\n TRACE_EVENT(cachefiles_coherency,\n \t    TP_PROTO(struct cachefiles_object *obj,\n \t\t     ino_t ino,\n-\t\t     u64 disk_aux,\n+\t\t     const void *disk_aux,\n \t\t     enum cachefiles_content content,\n \t\t     enum cachefiles_coherency_trace why),\n \n@@ -389,12 +389,27 @@ TRACE_EVENT(cachefiles_coherency,\n \t\t\t     ),\n \n \t    TP_fast_assign(\n+\t\t    union {\n+\t\t\t    __be16 s[4];\n+\t\t\t    __be64 ll;\n+\t\t    } x;\n+\n \t\t    __entry-\u003eobj\t= obj-\u003edebug_id;\n \t\t    __entry-\u003ewhy\t= why;\n \t\t    __entry-\u003econtent\t= content;\n \t\t    __entry-\u003eino\t= ino;\n \t\t    __entry-\u003eaux\t= be64_to_cpup((__be64 *)obj-\u003ecookie-\u003einline_aux);\n-\t\t    __entry-\u003edisk_aux\t= disk_aux;\n+\n+\t\t    /* cachefiles_xattr::data is 2-byte aligned but not 8-byte aligned. */\n+\t\t    if (disk_aux) {\n+\t\t\t    x.s[0] = ((__be16 *)disk_aux)[0];\n+\t\t\t    x.s[1] = ((__be16 *)disk_aux)[1];\n+\t\t\t    x.s[2] = ((__be16 *)disk_aux)[2];\n+\t\t\t    x.s[3] = ((__be16 *)disk_aux)[3];\n+\t\t\t    __entry-\u003edisk_aux = be64_to_cpu(x.ll);\n+\t\t    } else {\n+\t\t\t    __entry-\u003edisk_aux = 0;\n+\t\t    }\n \t\t\t   ),\n \n \t    TP_printk(\"o=%08x %s B=%llx c=%u aux=%llx dsk=%llx\",\ndiff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h\nindex 082cb03c61316..b5da315274ad5 100644\n--- a/include/trace/events/netfs.h\n+++ b/include/trace/events/netfs.h\n@@ -59,6 +59,7 @@\n \tEM(netfs_rreq_trace_free,\t\t\"FREE   \")\t\\\n \tEM(netfs_rreq_trace_intr,\t\t\"INTR   \")\t\\\n \tEM(netfs_rreq_trace_ki_complete,\t\"KI-CMPL\")\t\\\n+\tEM(netfs_rreq_trace_ra_put_ref,\t\t\"RA-PUT \")\t\\\n \tEM(netfs_rreq_trace_recollect,\t\t\"RECLLCT\")\t\\\n \tEM(netfs_rreq_trace_redirty,\t\t\"REDIRTY\")\t\\\n \tEM(netfs_rreq_trace_resubmit,\t\t\"RESUBMT\")\t\\\n@@ -70,9 +71,11 @@\n \tEM(netfs_rreq_trace_unpause,\t\t\"UNPAUSE\")\t\\\n \tEM(netfs_rreq_trace_wait_ip,\t\t\"WAIT-IP\")\t\\\n \tEM(netfs_rreq_trace_wait_pause,\t\t\"--PAUSED--\")\t\\\n+\tEM(netfs_rreq_trace_wait_put_ra_refs,\t\"WAIT-P-RA\")\t\\\n \tEM(netfs_rreq_trace_wait_quiesce,\t\"WAIT-QUIESCE\")\t\\\n \tEM(netfs_rreq_trace_waited_ip,\t\t\"DONE-IP\")\t\\\n \tEM(netfs_rreq_trace_waited_pause,\t\"--UNPAUSED--\")\t\\\n+\tEM(netfs_rreq_trace_waited_put_ra_refs,\t\"DONE-P-RA\")\t\\\n \tEM(netfs_rreq_trace_waited_quiesce,\t\"DONE-QUIESCE\")\t\\\n \tEM(netfs_rreq_trace_wake_ip,\t\t\"WAKE-IP\")\t\\\n \tEM(netfs_rreq_trace_wake_queue,\t\t\"WAKE-Q \")\t\\\n@@ -786,6 +789,27 @@ TRACE_EVENT(netfs_folioq,\n \t\t      __print_symbolic(__entry-\u003etrace, netfs_folioq_traces))\n \t    );\n \n+TRACE_EVENT(netfs_read_progress_at,\n+\t    TP_PROTO(const struct netfs_io_request *rreq),\n+\n+\t    TP_ARGS(rreq),\n+\n+\t    TP_STRUCT__entry(\n+\t\t    __field(unsigned int,\trreq)\n+\t\t    __field(size_t,\t\tprogress_at)\n+\t\t    __field(size_t,\t\tcleaned_to)\n+\t\t\t     ),\n+\n+\t    TP_fast_assign(\n+\t\t    __entry-\u003erreq\t= rreq-\u003edebug_id;\n+\t\t    __entry-\u003ecleaned_to\t= rreq-\u003ecleaned_to - rreq-\u003estart;\n+\t\t    __entry-\u003eprogress_at = rreq-\u003eprogress_at;\n+\t\t\t   ),\n+\n+\t    TP_printk(\"R=%08x cln=%zx prg=%zx\",\n+\t\t      __entry-\u003erreq, __entry-\u003ecleaned_to, __entry-\u003eprogress_at)\n+\t    );\n+\n #undef EM\n #undef E_\n #endif /* _TRACE_NETFS_H */\n"
}

{
  "EnableConfigs": [
    "NETFS_SUPPORT",
    "CACHEFILES",
    "9P_FS",
    "NET_9P",
    "CIFS",
    "CEPH_FS",
    "AFS_FS",
    "NFS_FS",
    "NFS_FSCACHE"
  ],
  "FocusSymbols": [
    "cachefiles_set_object_xattr",
    "cachefiles_check_auxdata",
    "netfs_readahead",
    "netfs_read_folio",
    "netfs_write_begin",
    "netfs_prefetch_for_write",
    "netfs_unbuffered_write_iter_locked",
    "netfs_wait_for_put_ra_refs",
    "netfs_alloc_request",
    "netfs_read_set_unlock_at",
    "netfs_read_subreq_progress",
    "netfs_unlock_abandoned_read_pages",
    "netfs_read_single",
    "rolling_buffer_bulk_load_from_ra",
    "netfs_prepare_write"
  ],
  "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 973032d62ca4dc98bf40ee8ea0fc4e48fdbf7eb9
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 25 14:11:17 2026 +0000

    syz-cluster: applied patch under review

diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index f8ae78b3f7b6d..c70bf67e52b01 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -13,6 +13,7 @@
 #include <linux/quotaops.h>
 #include <linux/xattr.h>
 #include <linux/slab.h>
+#include <linux/unaligned.h>
 #include "internal.h"
 
 #define CACHEFILES_COOKIE_TYPE_DATA 1
@@ -50,7 +51,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 
 	_enter("%x,#%d", object->debug_id, len);
 
-	buf = kmalloc(sizeof(struct cachefiles_xattr) + len, GFP_KERNEL);
+	buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
@@ -60,6 +61,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 	buf->content		= object->content_info;
 	if (test_bit(FSCACHE_COOKIE_LOCAL_WRITE, &object->cookie->flags))
 		buf->content	= CACHEFILES_CONTENT_DIRTY;
+	put_unaligned_be64(0, (__be64 *)buf->data);
 	if (len > 0)
 		memcpy(buf->data, fscache_get_aux(object->cookie), len);
 
@@ -77,8 +79,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 		trace_cachefiles_vfs_error(object, file_inode(file), ret,
 					   cachefiles_trace_setxattr_error);
 		trace_cachefiles_coherency(object, file_inode(file)->i_ino,
-					   be64_to_cpup((__be64 *)buf->data),
-					   buf->content,
+					   buf->data, buf->content,
 					   cachefiles_coherency_set_fail);
 		if (ret != -ENOMEM)
 			cachefiles_io_error_obj(
@@ -86,8 +87,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 				"Failed to set xattr with error %d", ret);
 	} else {
 		trace_cachefiles_coherency(object, file_inode(file)->i_ino,
-					   be64_to_cpup((__be64 *)buf->data),
-					   buf->content,
+					   buf->data, buf->content,
 					   cachefiles_coherency_set_ok);
 	}
 
@@ -110,9 +110,10 @@ int cachefiles_check_auxdata(struct cachefiles_object *object, struct file *file
 	int ret = -ESTALE;
 
 	tlen = sizeof(struct cachefiles_xattr) + len;
-	buf = kmalloc(tlen, GFP_KERNEL);
+	buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
+	put_unaligned_be64(0, (__be64 *)buf->data);
 
 	xlen = cachefiles_inject_read_error();
 	if (xlen == 0)
@@ -148,8 +149,7 @@ int cachefiles_check_auxdata(struct cachefiles_object *object, struct file *file
 
 out:
 	trace_cachefiles_coherency(object, file_inode(file)->i_ino,
-				   be64_to_cpup((__be64 *)buf->data),
-				   buf->content, why);
+				   buf->data, buf->content, why);
 	kfree(buf);
 	return ret;
 }
diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
index 7fdfa4f27e349..a2a9d8c083f99 100644
--- a/fs/netfs/buffered_read.c
+++ b/fs/netfs/buffered_read.c
@@ -54,6 +54,42 @@ static void netfs_rreq_expand(struct netfs_io_request *rreq,
 	}
 }
 
+/*
+ * Drop the folio refs acquired from the readahead API.
+ */
+static void netfs_bulk_drop_ra_refs(struct netfs_io_request *rreq)
+{
+	struct folio_batch fbatch;
+	struct folio *folio;
+	pgoff_t nr_pages = DIV_ROUND_UP(rreq->len, PAGE_SIZE);
+	pgoff_t first = rreq->start / PAGE_SIZE;
+	XA_STATE(xas, &rreq->mapping->i_pages, first);
+
+	folio_batch_init(&fbatch);
+
+	rcu_read_lock();
+
+	xas_for_each(&xas, folio,  first + nr_pages - 1) {
+		if (xas_retry(&xas, folio))
+			continue;
+
+		if (!folio_batch_add(&fbatch, folio))
+			folio_batch_release(&fbatch);
+	}
+
+	rcu_read_unlock();
+	folio_batch_release(&fbatch);
+	trace_netfs_rreq(rreq, netfs_rreq_trace_ra_put_ref);
+	clear_bit_unlock(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags);
+	wake_up(&rreq->waitq);
+}
+
+static void netfs_maybe_bulk_drop_ra_refs(struct netfs_io_request *rreq)
+{
+	if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+		netfs_bulk_drop_ra_refs(rreq);
+}
+
 /*
  * Begin an operation, and fetch the stored zero point value from the cookie if
  * available.
@@ -74,12 +110,8 @@ static int netfs_begin_cache_read(struct netfs_io_request *rreq, struct netfs_in
  *
  * Returns the limited size if successful and -ENOMEM if insufficient memory
  * available.
- *
- * [!] NOTE: This must be run in the same thread as ->issue_read() was called
- * in as we access the readahead_control struct.
  */
-static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq,
-					   struct readahead_control *ractl)
+static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq)
 {
 	struct netfs_io_request *rreq = subreq->rreq;
 	size_t rsize = subreq->len;
@@ -87,30 +119,6 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq,
 	if (subreq->source == NETFS_DOWNLOAD_FROM_SERVER)
 		rsize = umin(rsize, rreq->io_streams[0].sreq_max_len);
 
-	if (ractl) {
-		/* If we don't have sufficient folios in the rolling buffer,
-		 * extract a folioq's worth from the readahead region at a time
-		 * into the buffer.  Note that this acquires a ref on each page
-		 * that we will need to release later - but we don't want to do
-		 * that until after we've started the I/O.
-		 */
-		struct folio_batch put_batch;
-
-		folio_batch_init(&put_batch);
-		while (rreq->submitted < subreq->start + rsize) {
-			ssize_t added;
-
-			added = rolling_buffer_load_from_ra(&rreq->buffer, ractl,
-							    &put_batch);
-			if (added < 0) {
-				folio_batch_release(&put_batch);
-				return added;
-			}
-			rreq->submitted += added;
-		}
-		folio_batch_release(&put_batch);
-	}
-
 	subreq->len = rsize;
 	if (unlikely(rreq->io_streams[0].sreq_max_segs)) {
 		size_t limit = netfs_limit_iter(&rreq->buffer.iter, 0, rsize,
@@ -208,8 +216,7 @@ static void netfs_issue_read(struct netfs_io_request *rreq,
  * slicing up the region to be read according to available cache blocks and
  * network rsize.
  */
-static void netfs_read_to_pagecache(struct netfs_io_request *rreq,
-				    struct readahead_control *ractl)
+static void netfs_read_to_pagecache(struct netfs_io_request *rreq)
 {
 	unsigned long long start = rreq->start;
 	ssize_t size = rreq->len;
@@ -288,7 +295,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq,
 		break;
 
 	issue:
-		slice = netfs_prepare_read_iterator(subreq, ractl);
+		slice = netfs_prepare_read_iterator(subreq);
 		if (slice < 0) {
 			ret = slice;
 			netfs_cancel_read(subreq, ret);
@@ -302,6 +309,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq,
 		}
 
 		netfs_issue_read(rreq, subreq);
+		netfs_maybe_bulk_drop_ra_refs(rreq);
 
 		if (test_bit(NETFS_RREQ_PAUSE, &rreq->flags))
 			netfs_wait_for_paused_read(rreq);
@@ -339,7 +347,8 @@ void netfs_readahead(struct readahead_control *ractl)
 {
 	struct netfs_io_request *rreq;
 	struct netfs_inode *ictx = netfs_inode(ractl->mapping->host);
-	unsigned long long start = readahead_pos(ractl);
+	ssize_t added;
+	uoff_t start = readahead_pos(ractl);
 	size_t size = readahead_length(ractl);
 	int ret;
 
@@ -360,11 +369,24 @@ void netfs_readahead(struct readahead_control *ractl)
 
 	netfs_rreq_expand(rreq, ractl);
 
-	rreq->submitted = rreq->start;
-	if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST, rreq->gfp) < 0)
+	/* Load the folios to be read into a bvecq chain.  Note that this
+	 * acquires a ref on each folio that we will need to release later -
+	 * but we don't want to do that until after we've started the I/O.
+	 */
+	added = rolling_buffer_bulk_load_from_ra(&rreq->buffer, ractl,
+						 rreq->debug_id, rreq->gfp);
+	if (added < 0) {
+		ret = added;
 		goto cleanup_free;
-	netfs_read_to_pagecache(rreq, ractl);
+	}
+	__set_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags);
+
+	rreq->submitted = rreq->start + added;
+	rreq->cleaned_to = rreq->start;
+	netfs_read_set_unlock_at(rreq);
 
+	netfs_read_to_pagecache(rreq);
+	netfs_maybe_bulk_drop_ra_refs(rreq);
 	return netfs_put_request(rreq, netfs_rreq_trace_put_return);
 
 cleanup_free:
@@ -387,6 +409,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request *rreq, struct fo
 	if (added < 0)
 		return added;
 	rreq->submitted = rreq->start + added;
+	rreq->progress_at = added;
 	return 0;
 }
 
@@ -457,7 +480,7 @@ static int netfs_read_gaps(struct file *file, struct folio *folio)
 	iov_iter_bvec(&rreq->buffer.iter, ITER_DEST, bvec, i, rreq->len);
 	rreq->submitted = rreq->start + flen;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 
 	ret = netfs_wait_for_read(rreq);
 	if (ret >= 0) {
@@ -532,7 +555,7 @@ int netfs_read_folio(struct file *file, struct folio *folio)
 	if (ret < 0)
 		goto discard;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 	ret = netfs_wait_for_read(rreq);
 	netfs_put_request(rreq, netfs_rreq_trace_put_return);
 	return ret < 0 ? ret : 0;
@@ -689,7 +712,7 @@ int netfs_write_begin(struct netfs_inode *ctx,
 	if (ret < 0)
 		goto error_put;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 	ret = netfs_wait_for_read(rreq);
 	netfs_put_request(rreq, netfs_rreq_trace_put_return);
 	if (ret < 0)
@@ -754,7 +777,7 @@ int netfs_prefetch_for_write(struct file *file, struct folio *folio,
 	if (ret < 0)
 		goto error_put;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 	ret = netfs_wait_for_read(rreq);
 	netfs_put_request(rreq, netfs_rreq_trace_put_return);
 	return ret < 0 ? ret : 0;
diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c
index c16fbad286a17..7173ce04bac63 100644
--- a/fs/netfs/direct_write.c
+++ b/fs/netfs/direct_write.c
@@ -21,7 +21,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request *wreq)
 	/* Okay, declare that all I/O is complete. */
 	trace_netfs_rreq(wreq, netfs_rreq_trace_write_done);
 
-	if (!wreq->error)
+	if (wreq->transferred)
 		netfs_update_i_size(ictx, &ictx->inode, wreq->start, wreq->transferred);
 
 	if (wreq->origin == NETFS_DIO_WRITE &&
@@ -51,7 +51,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request *wreq)
 		wreq->iocb->ki_pos += written;
 		if (wreq->iocb->ki_complete) {
 			trace_netfs_rreq(wreq, netfs_rreq_trace_ki_complete);
-			wreq->iocb->ki_complete(wreq->iocb, wreq->error ?: written);
+			wreq->iocb->ki_complete(wreq->iocb, written ?: wreq->error);
 		}
 		wreq->iocb = VFS_PTR_POISON;
 	}
@@ -95,7 +95,7 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 {
 	struct netfs_io_subrequest *subreq = NULL;
 	struct netfs_io_stream *stream = &wreq->io_streams[0];
-	int ret;
+	int ret = 0;
 
 	_enter("%llx", wreq->len);
 
@@ -110,6 +110,10 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 		if (!subreq) {
 			netfs_prepare_write(wreq, stream, wreq->start + wreq->transferred);
 			subreq = stream->construct;
+			if (!subreq) {
+				ret = -ENOMEM;
+				break;
+			}
 			stream->construct = NULL;
 		}
 
@@ -121,8 +125,14 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 		}
 
 		iov_iter_truncate(&subreq->io_iter, wreq->len - wreq->transferred);
-		if (!iov_iter_count(&subreq->io_iter))
+		if (!iov_iter_count(&subreq->io_iter)) {
+			pr_warn("netfs: Unexpected zero-length iterator R=%08x\n",
+				wreq->debug_id);
+			__set_bit(NETFS_SREQ_FAILED, &subreq->flags);
+			netfs_write_subrequest_terminated(subreq, -EIO);
+			wreq->error = -EIO;
 			break;
+		}
 
 		subreq->len = netfs_limit_iter(&subreq->io_iter, 0,
 					       stream->sreq_max_len,
@@ -139,13 +149,11 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 		if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
 			retry = true;
 		} else if (test_bit(NETFS_SREQ_FAILED, &subreq->flags)) {
-			ret = subreq->error;
-			wreq->error = ret;
+			wreq->error = subreq->error;
 			netfs_see_subrequest(subreq, netfs_sreq_trace_see_failed);
 			subreq = NULL;
 			break;
 		}
-		ret = 0;
 
 		if (!retry) {
 			netfs_unbuffered_write_collect(wreq, stream, subreq);
@@ -288,11 +296,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *
 		ret = -EIOCBQUEUED;
 	} else {
 		ret = netfs_unbuffered_write(wreq);
-		if (ret < 0) {
-			_debug("begin = %zd", ret);
-		} else {
+		if (wreq->transferred) {
 			iocb->ki_pos += wreq->transferred;
-			ret = wreq->transferred ?: wreq->error;
+			ret = wreq->transferred;
+		} else if (wreq->error) {
+			ret = wreq->error;
 		}
 
 		netfs_put_request(wreq, netfs_rreq_trace_put_complete);
diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h
index 420ee7b26580f..c734cad7063e5 100644
--- a/fs/netfs/internal.h
+++ b/fs/netfs/internal.h
@@ -79,6 +79,7 @@ ssize_t netfs_wait_for_read(struct netfs_io_request *rreq);
 ssize_t netfs_wait_for_write(struct netfs_io_request *rreq);
 void netfs_wait_for_paused_read(struct netfs_io_request *rreq);
 void netfs_wait_for_paused_write(struct netfs_io_request *rreq);
+void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq);
 
 /*
  * objects.c
@@ -109,6 +110,7 @@ static inline void netfs_see_subrequest(struct netfs_io_subrequest *subreq,
 /*
  * read_collect.c
  */
+void netfs_read_set_unlock_at(struct netfs_io_request *rreq);
 bool netfs_read_collection(struct netfs_io_request *rreq);
 void netfs_read_collection_worker(struct work_struct *work);
 void netfs_cancel_read(struct netfs_io_subrequest *subreq, int error);
diff --git a/fs/netfs/misc.c b/fs/netfs/misc.c
index 5d554512ed23a..f5c1c463f4ff7 100644
--- a/fs/netfs/misc.c
+++ b/fs/netfs/misc.c
@@ -563,3 +563,22 @@ void netfs_wait_for_paused_write(struct netfs_io_request *rreq)
 {
 	return netfs_wait_for_pause(rreq, netfs_write_collection);
 }
+
+/*
+ * Wait for the readahead-acquired refs to be put.
+ */
+void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq)
+{
+	DEFINE_WAIT(myself);
+
+	for (;;) {
+		trace_netfs_rreq(rreq, netfs_rreq_trace_wait_put_ra_refs);
+		prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE);
+		if (!test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+			break;
+		schedule();
+	}
+
+	trace_netfs_rreq(rreq, netfs_rreq_trace_waited_put_ra_refs);
+	finish_wait(&rreq->waitq, &myself);
+}
diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
index 01461a74642d6..7f6a3e912602e 100644
--- a/fs/netfs/objects.c
+++ b/fs/netfs/objects.c
@@ -41,24 +41,32 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
 
 	memset(rreq, 0, kmem_cache_size(cache));
 	INIT_WORK(&rreq->cleanup_work, netfs_free_request);
-	rreq->gfp	= gfp;
-	rreq->start	= start;
-	rreq->len	= len;
-	rreq->origin	= origin;
-	rreq->netfs_ops	= ctx->ops;
-	rreq->mapping	= mapping;
-	rreq->inode	= inode;
-	rreq->i_size	= i_size_read(inode);
-	rreq->debug_id	= atomic_inc_return(&debug_ids);
-	rreq->wsize	= INT_MAX;
+	rreq->gfp		= gfp;
+	rreq->start		= start;
+	rreq->collected_to	= start;
+	rreq->cleaned_to	= start;
+	rreq->len		= len;
+	rreq->progress_at	= 0;
+	rreq->origin		= origin;
+	rreq->netfs_ops		= ctx->ops;
+	rreq->mapping		= mapping;
+	rreq->inode		= inode;
+	rreq->i_size		= i_size_read(inode);
+	rreq->debug_id		= atomic_inc_return(&debug_ids);
+	rreq->wsize		= INT_MAX;
 	rreq->io_streams[0].sreq_max_len = ULONG_MAX;
 	rreq->io_streams[0].sreq_max_segs = 0;
 	spin_lock_init(&rreq->lock);
-	INIT_LIST_HEAD(&rreq->io_streams[0].subrequests);
-	INIT_LIST_HEAD(&rreq->io_streams[1].subrequests);
 	init_waitqueue_head(&rreq->waitq);
 	refcount_set(&rreq->ref, 2);
 
+	for (int s = 0; s < NR_IO_STREAMS; s++) {
+		struct netfs_io_stream *stream = &rreq->io_streams[s];
+
+		INIT_LIST_HEAD(&stream->subrequests);
+		stream->collected_to = rreq->start;
+	}
+
 	if (origin == NETFS_READAHEAD ||
 	    origin == NETFS_READPAGE ||
 	    origin == NETFS_READ_GAPS ||
diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
index 23660a5901246..8ba162cf568b2 100644
--- a/fs/netfs/read_collect.c
+++ b/fs/netfs/read_collect.c
@@ -94,6 +94,35 @@ static void netfs_unlock_read_folio(struct netfs_io_request *rreq,
 	folioq_clear(folioq, slot);
 }
 
+/*
+ * Determine how much to gather before unlocking more folios.
+ */
+void netfs_read_set_unlock_at(struct netfs_io_request *rreq)
+{
+	struct folio_queue *folioq = rreq->buffer.tail;
+	unsigned int slot = rreq->buffer.first_tail_slot;
+	size_t cleaned_to = rreq->cleaned_to - rreq->start;
+	size_t progress_at = cleaned_to;
+	size_t minimum = 256 * 1024;
+
+	while (progress_at < rreq->len) {
+		if (slot >= folioq_count(folioq)) {
+			folioq = folioq->next;
+			if (!folioq)
+				break;
+			slot = 0;
+		}
+
+		progress_at += folioq_folio_size(folioq, slot);
+		if (progress_at - cleaned_to >= minimum)
+			break;
+		slot++;
+	}
+
+	WRITE_ONCE(rreq->progress_at, progress_at);
+	trace_netfs_read_progress_at(rreq);
+}
+
 /*
  * Unlock any folios we've finished with.
  */
@@ -112,16 +141,22 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 	if (slot >= folioq_nr_slots(folioq)) {
 		folioq = rolling_buffer_delete_spent(&rreq->buffer);
 		if (!folioq) {
-			rreq->front_folio_order = 0;
+			WRITE_ONCE(rreq->progress_at, ULONG_MAX);
 			return;
 		}
 		slot = 0;
 	}
 
+	/* We have to wait for readahead refs to have been released before we
+	 * can unlock any folios as the ref-dropper walks i_pages and the only
+	 * thing preventing these folios from being removed is the folio lock.
+	 */
+	if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+		netfs_wait_for_put_ra_refs(rreq);
+
 	for (;;) {
 		struct folio *folio;
-		unsigned long long fpos, fend;
-		unsigned int order;
+		unsigned long long fpos = rreq->cleaned_to, fend;
 		size_t fsize;
 
 		if (*notes & COPY_TO_CACHE)
@@ -133,9 +168,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 			      rreq->debug_id, folio->index))
 			trace_netfs_folio(folio, netfs_folio_trace_not_locked);
 
-		order = folioq_folio_order(folioq, slot);
-		rreq->front_folio_order = order;
-		fsize = PAGE_SIZE << order;
+		fsize = folioq_folio_size(folioq, slot);
 		fpos = folio_pos(folio);
 		fend = fpos + fsize;
 
@@ -146,7 +179,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 			break;
 
 		netfs_unlock_read_folio(rreq, folioq, slot);
-		WRITE_ONCE(rreq->cleaned_to, fpos + fsize);
+		WRITE_ONCE(rreq->cleaned_to, fend);
 		*notes |= MADE_PROGRESS;
 
 		clear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, &rreq->flags);
@@ -172,6 +205,8 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 	rreq->buffer.tail = folioq;
 done:
 	rreq->buffer.first_tail_slot = slot;
+
+	netfs_read_set_unlock_at(rreq);
 }
 
 /*
@@ -232,7 +267,7 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq)
 		 * subreqs.
 		 */
 		if (notes & BUFFERED) {
-			size_t fsize = PAGE_SIZE << rreq->front_folio_order;
+			uoff_t unlock_at = rreq->start + rreq->progress_at;
 
 			/* Clear the tail of a short read. */
 			if (!(notes & HIT_PENDING) &&
@@ -257,7 +292,7 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq)
 				transferred = front->len;
 				trace_netfs_rreq(rreq, netfs_rreq_trace_set_abandon);
 			}
-			if (front->start + transferred >= rreq->cleaned_to + fsize ||
+			if (front->start + transferred >= unlock_at ||
 			    test_bit(NETFS_SREQ_HIT_EOF, &front->flags))
 				netfs_read_unlock_folios(rreq, &notes);
 		} else {
@@ -477,20 +512,22 @@ void netfs_read_collection_worker(struct work_struct *work)
 void netfs_read_subreq_progress(struct netfs_io_subrequest *subreq)
 {
 	struct netfs_io_request *rreq = subreq->rreq;
-	struct netfs_io_stream *stream = &rreq->io_streams[0];
-	size_t fsize = PAGE_SIZE << rreq->front_folio_order;
-
-	trace_netfs_sreq(subreq, netfs_sreq_trace_progress);
+	struct netfs_io_stream *stream = &rreq->io_streams[subreq->stream_nr];
+	size_t progress_at = READ_ONCE(rreq->progress_at);
+	uoff_t update_at = rreq->start + progress_at;
+	uoff_t transferred_to = subreq->start + subreq->transferred;
 
 	/* If we are at the head of the queue, wake up the collector,
 	 * getting a ref to it if we were the ones to do so.
 	 */
-	if (subreq->start + subreq->transferred > rreq->cleaned_to + fsize &&
+	if (progress_at != ULONG_MAX &&
+	    transferred_to >= update_at &&
 	    (rreq->origin == NETFS_READAHEAD ||
 	     rreq->origin == NETFS_READPAGE ||
 	     rreq->origin == NETFS_READ_FOR_WRITE) &&
 	    list_is_first(&subreq->rreq_link, &stream->subrequests)
 	    ) {
+		trace_netfs_sreq(subreq, netfs_sreq_trace_progress);
 		__set_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
 		netfs_wake_collector(rreq);
 	}
diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c
index 2b42758e01ec9..dd463a485139c 100644
--- a/fs/netfs/read_retry.c
+++ b/fs/netfs/read_retry.c
@@ -292,6 +292,13 @@ void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq)
 {
 	struct folio_queue *p;
 
+	/* We have to wait for readahead refs to have been released before we
+	 * can unlock any folios as the ref-dropper walks i_pages and the only
+	 * thing preventing these folios from being removed is the folio lock.
+	 */
+	if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+		netfs_wait_for_put_ra_refs(rreq);
+
 	for (p = rreq->buffer.tail; p; p = p->next) {
 		for (int slot = 0; slot < folioq_count(p); slot++) {
 			struct folio *folio = folioq_folio(p, slot);
diff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c
index 8833550d2eb60..de67ac41548d1 100644
--- a/fs/netfs/read_single.c
+++ b/fs/netfs/read_single.c
@@ -170,6 +170,8 @@ ssize_t netfs_read_single(struct inode *inode, struct file *file, struct iov_ite
 	if (IS_ERR(rreq))
 		return PTR_ERR(rreq);
 
+	rreq->progress_at = rreq->len;
+
 	ret = netfs_single_begin_cache_read(rreq, ictx);
 	if (ret == -ENOMEM || ret == -EINTR || ret == -ERESTARTSYS)
 		goto cleanup_free;
diff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c
index 8c0026836f9c1..424e77a9a1098 100644
--- a/fs/netfs/rolling_buffer.c
+++ b/fs/netfs/rolling_buffer.c
@@ -115,42 +115,65 @@ int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp)
 }
 
 /*
- * Decant the list of folios to read into a rolling buffer.
+ * Decant the entire list of folios to read into a rolling buffer.
  */
-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,
-				    struct readahead_control *ractl,
-				    struct folio_batch *put_batch)
+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,
+					 struct readahead_control *ractl,
+					 unsigned int rreq_id, gfp_t gfp)
 {
 	struct folio_queue *fq;
-	struct page **vec;
-	int nr, ix, to;
-	ssize_t size = 0;
+	ssize_t loaded = 0;
 
-	if (rolling_buffer_make_space(roll, GFP_KERNEL) < 0)
-		return -ENOMEM;
+	while (ractl->_nr_pages - ractl->_batch_count > 0) {
+		unsigned int nr;
 
-	fq = roll->head;
-	vec = (struct page **)fq->vec.folios;
-	nr = __readahead_batch(ractl, vec + folio_batch_count(&fq->vec),
-			       folio_batch_space(&fq->vec));
-	ix = fq->vec.nr;
-	to = ix + nr;
-	fq->vec.nr = to;
-	for (; ix < to; ix++) {
-		struct folio *folio = folioq_folio(fq, ix);
-		unsigned int order = folio_order(folio);
-
-		fq->orders[ix] = order;
-		size += PAGE_SIZE << order;
-		trace_netfs_folio(folio, netfs_folio_trace_read);
-		if (!folio_batch_add(put_batch, folio))
-			folio_batch_release(put_batch);
+		/* Allocate a folioq to put some folios into and attach it to
+		 * the rolling buffer.
+		 */
+		fq = netfs_folioq_alloc(rreq_id, gfp,
+					netfs_trace_folioq_make_space);
+		if (!fq)
+			goto nomem_unlock;
+		fq->prev = roll->head;
+		if (!roll->tail)
+			roll->tail = fq;
+		else
+			roll->head->next = fq;
+		roll->head = fq;
+
+		/* Get a batch of folios and note their orders. */
+		nr = __readahead_batch(ractl, (struct page **)fq->vec.folios,
+				       folioq_nr_slots(fq));
+		if (WARN_ON_ONCE(!nr))
+			break;
+		fq->vec.nr = nr;
+
+		for (int slot = 0; slot < nr; slot++) {
+			struct folio *folio = folioq_folio(fq, slot);
+			unsigned int order;
+
+			order = folio_order(folio);
+			fq->orders[slot] = order;
+			loaded += PAGE_SIZE << order;
+			trace_netfs_folio(folio, netfs_folio_trace_read);
+		}
 	}
-	WRITE_ONCE(roll->iter.count, roll->iter.count + size);
 
-	/* Store the counter after setting the slot. */
-	smp_store_release(&roll->next_head_slot, to);
-	return size;
+	WRITE_ONCE(roll->iter.count, loaded);
+	iov_iter_folio_queue(&roll->iter, ITER_DEST, roll->tail, 0, 0, loaded);
+	return loaded;
+
+nomem_unlock:
+	for (fq = roll->tail; fq; fq = fq->next) {
+		for (int slot = 0; slot < folioq_count(fq); slot++) {
+			folio_unlock(fq->vec.folios[slot]);
+			folioq_mark(fq, slot);
+		}
+	}
+	rolling_buffer_clear(roll);
+	roll->head = NULL;
+	roll->tail = NULL;
+	return -ENOMEM;
 }
 
 /*
diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index 2d9cfcd43658f..851f6f93ad45a 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -170,6 +170,8 @@ void netfs_prepare_write(struct netfs_io_request *wreq,
 		rolling_buffer_make_space(&wreq->buffer, wreq->gfp);
 
 	subreq = netfs_alloc_subrequest(wreq);
+	if (!subreq)
+		return;
 	subreq->source		= stream->source;
 	subreq->start		= start;
 	subreq->stream_nr	= stream->stream_nr;
diff --git a/include/linux/netfs.h b/include/linux/netfs.h
index f837a501008c9..1cf2ef3ce18b8 100644
--- a/include/linux/netfs.h
+++ b/include/linux/netfs.h
@@ -246,6 +246,7 @@ struct netfs_io_request {
 	unsigned long long	submitted;	/* Amount submitted for I/O so far */
 	unsigned long long	len;		/* Length of the request */
 	size_t			transferred;	/* Amount to be indicated as transferred */
+	size_t			progress_at;	/* Report read progress when hit this much read */
 	long			error;		/* 0 or error that occurred */
 	unsigned long long	i_size;		/* Size of the file */
 	unsigned long long	start;		/* Start position */
@@ -262,7 +263,6 @@ struct netfs_io_request {
 	atomic_t		subreq_counter;	/* Next subreq->debug_index */
 	unsigned int		nr_group_rel;	/* Number of refs to release on ->group */
 	spinlock_t		lock;		/* Lock for queuing subreqs */
-	unsigned char		front_folio_order; /* Order (size) of front folio */
 	enum netfs_io_origin	origin;		/* Origin of the request */
 	bool			direct_bv_unpin; /* T if direct_bv[] must be unpinned */
 	refcount_t		ref;
@@ -278,6 +278,7 @@ struct netfs_io_request {
 #define NETFS_RREQ_FOLIO_COPY_TO_CACHE	10	/* Copy current folio to cache from read */
 #define NETFS_RREQ_UPLOAD_TO_SERVER	11	/* Need to write to the server */
 #define NETFS_RREQ_USE_IO_ITER		12	/* Use ->io_iter rather than ->i_pages */
+#define NETFS_RREQ_NEED_PUT_RA_REFS	17	/* Need to put the folio refs RA gave us */
 #define NETFS_RREQ_USE_PGPRIV2		31	/* [DEPRECATED] Use PG_private_2 to mark
 						 * write to cache on read */
 	const struct netfs_request_ops *netfs_ops;
diff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h
index 9e5dad29669cf..a97f7cfaacaad 100644
--- a/include/linux/rolling_buffer.h
+++ b/include/linux/rolling_buffer.h
@@ -45,9 +45,9 @@ struct rolling_buffer_snapshot {
 int rolling_buffer_init(struct rolling_buffer *roll, unsigned int rreq_id,
 			unsigned int direction, gfp_t gfp);
 int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp);
-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,
-				    struct readahead_control *ractl,
-				    struct folio_batch *put_batch);
+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,
+					 struct readahead_control *ractl,
+					 unsigned int rreq_id, gfp_t gfp);
 ssize_t rolling_buffer_append(struct rolling_buffer *roll, struct folio *folio,
 			      unsigned int flags, gfp_t gfp);
 struct folio_queue *rolling_buffer_delete_spent(struct rolling_buffer *roll);
diff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h
index 9259bc71049e0..e3101410e8b2d 100644
--- a/include/trace/events/cachefiles.h
+++ b/include/trace/events/cachefiles.h
@@ -372,7 +372,7 @@ TRACE_EVENT(cachefiles_rename,
 TRACE_EVENT(cachefiles_coherency,
 	    TP_PROTO(struct cachefiles_object *obj,
 		     ino_t ino,
-		     u64 disk_aux,
+		     const void *disk_aux,
 		     enum cachefiles_content content,
 		     enum cachefiles_coherency_trace why),
 
@@ -389,12 +389,27 @@ TRACE_EVENT(cachefiles_coherency,
 			     ),
 
 	    TP_fast_assign(
+		    union {
+			    __be16 s[4];
+			    __be64 ll;
+		    } x;
+
 		    __entry->obj	= obj->debug_id;
 		    __entry->why	= why;
 		    __entry->content	= content;
 		    __entry->ino	= ino;
 		    __entry->aux	= be64_to_cpup((__be64 *)obj->cookie->inline_aux);
-		    __entry->disk_aux	= disk_aux;
+
+		    /* cachefiles_xattr::data is 2-byte aligned but not 8-byte aligned. */
+		    if (disk_aux) {
+			    x.s[0] = ((__be16 *)disk_aux)[0];
+			    x.s[1] = ((__be16 *)disk_aux)[1];
+			    x.s[2] = ((__be16 *)disk_aux)[2];
+			    x.s[3] = ((__be16 *)disk_aux)[3];
+			    __entry->disk_aux = be64_to_cpu(x.ll);
+		    } else {
+			    __entry->disk_aux = 0;
+		    }
 			   ),
 
 	    TP_printk("o=%08x %s B=%llx c=%u aux=%llx dsk=%llx",
diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h
index 082cb03c61316..b5da315274ad5 100644
--- a/include/trace/events/netfs.h
+++ b/include/trace/events/netfs.h
@@ -59,6 +59,7 @@
 	EM(netfs_rreq_trace_free,		"FREE   ")	\
 	EM(netfs_rreq_trace_intr,		"INTR   ")	\
 	EM(netfs_rreq_trace_ki_complete,	"KI-CMPL")	\
+	EM(netfs_rreq_trace_ra_put_ref,		"RA-PUT ")	\
 	EM(netfs_rreq_trace_recollect,		"RECLLCT")	\
 	EM(netfs_rreq_trace_redirty,		"REDIRTY")	\
 	EM(netfs_rreq_trace_resubmit,		"RESUBMT")	\
@@ -70,9 +71,11 @@
 	EM(netfs_rreq_trace_unpause,		"UNPAUSE")	\
 	EM(netfs_rreq_trace_wait_ip,		"WAIT-IP")	\
 	EM(netfs_rreq_trace_wait_pause,		"--PAUSED--")	\
+	EM(netfs_rreq_trace_wait_put_ra_refs,	"WAIT-P-RA")	\
 	EM(netfs_rreq_trace_wait_quiesce,	"WAIT-QUIESCE")	\
 	EM(netfs_rreq_trace_waited_ip,		"DONE-IP")	\
 	EM(netfs_rreq_trace_waited_pause,	"--UNPAUSED--")	\
+	EM(netfs_rreq_trace_waited_put_ra_refs,	"DONE-P-RA")	\
 	EM(netfs_rreq_trace_waited_quiesce,	"DONE-QUIESCE")	\
 	EM(netfs_rreq_trace_wake_ip,		"WAKE-IP")	\
 	EM(netfs_rreq_trace_wake_queue,		"WAKE-Q ")	\
@@ -786,6 +789,27 @@ TRACE_EVENT(netfs_folioq,
 		      __print_symbolic(__entry->trace, netfs_folioq_traces))
 	    );
 
+TRACE_EVENT(netfs_read_progress_at,
+	    TP_PROTO(const struct netfs_io_request *rreq),
+
+	    TP_ARGS(rreq),
+
+	    TP_STRUCT__entry(
+		    __field(unsigned int,	rreq)
+		    __field(size_t,		progress_at)
+		    __field(size_t,		cleaned_to)
+			     ),
+
+	    TP_fast_assign(
+		    __entry->rreq	= rreq->debug_id;
+		    __entry->cleaned_to	= rreq->cleaned_to - rreq->start;
+		    __entry->progress_at = rreq->progress_at;
+			   ),
+
+	    TP_printk("R=%08x cln=%zx prg=%zx",
+		      __entry->rreq, __entry->cleaned_to, __entry->progress_at)
+	    );
+
 #undef EM
 #undef E_
 #endif /* _TRACE_NETFS_H */

gemini-3.1-pro-preview

							input: 14832
							output: 30
							thoughts: 808

**My Initial Assessment of this Patch**

Okay, so I'm looking at a patch here, and it looks like we've got some changes touching `fs/cachefiles/xattr.c` and a whole bunch of stuff in `fs/netfs/`.  The `cachefiles` bit is straightforward enough; it's fixing some memory alignment and out-of-bounds issues.  Specifically, it seems like we're correctly using `put_unaligned_be64` to deal with these tracepoint issues. Good catch.

Now, the `netfs` changes, that's where things get interesting.  This is a *substantial* rewrite. It's a broad touch across `buffered_read`, `direct_write`, `internal.h`, `misc.c`, `objects.c`, `read_collect.c`, `read_retry.c`, `read_single.c`, `rolling_buffer.c`, and `write_issue.c`!  We're talking about almost everything. Seems like it alters how readahead refs are managed, read iterators are prepared and folios are unlocked. I'm also seeing a fix for potential zero-length iterator issues in `netfs_unbuffered_write`. A significant rewrite.

Given that `netfs` is used by a range of network filesystems – cifs, afs, 9p, ceph, etc. – this is definitely something to pay attention to. Since these filesystems can be mounted locally or over a network (even within a virtualized environment like QEMU), this is clearly `WorthFuzzing=true`.

Now I need to zero in on the relevant CONFIG options.  Clearly, `CONFIG_NETFS_SUPPORT` is the main one. We also need `CONFIG_CACHEFILES` since `fs/cachefiles/` is being touched. To actually *use* netfs, I'll need to check if things like `CONFIG_9P_FS`, `CONFIG_CIFS`, `CONFIG_CEPH_FS`, or `CONFIG_AFS_FS` are enabled. I'll take a look at the `Kconfig` files in both `fs/netfs/` and `fs/cachefiles/` to confirm.

{
  "Expression": "config NETFS_SUPPORT",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/Kconfig-2-\nfs/netfs/Kconfig:3:config NETFS_SUPPORT\nfs/netfs/Kconfig-4-\ttristate\n"
}

gemini-3.1-pro-preview

							input: 16206
							output: 29
							thoughts: 13

Here's a summary of my thought process, as requested:

**Kconfig Inspection: File System Caching Configuration**

Okay, so I'm thinking I need to delve into how the caching for the file system is configured. My initial instinct is to go straight to `fs/cachefiles/Kconfig`. That's where I'd expect to find the settings that control whether or not the caching functionality is enabled, and if so, how it's parameterized. I'm assuming that it will offer various options - perhaps related to the caching strategy, maximum cache size, eviction policies, or even the underlying storage devices used for the cache. The Kconfig file should define the dependencies and default values as well, giving me a solid understanding of how this caching system is integrated within the kernel build process. I'm expecting to see things like `CONFIG_CACHEFILES`, `CONFIG_CACHEFILES_FS`, `CONFIG_CACHEFILES_MAX_SIZE`, etc. within. Let's see what's in there...

{
  "Expression": "config CACHEFILES",
  "PathPrefix": "fs/cachefiles/"
}

{
  "Output": "fs/cachefiles/Kconfig-2-\nfs/cachefiles/Kconfig:3:config CACHEFILES\nfs/cachefiles/Kconfig-4-\ttristate \"Filesystem caching on files\"\n--\nfs/cachefiles/Kconfig-13-\nfs/cachefiles/Kconfig:14:config CACHEFILES_DEBUG\nfs/cachefiles/Kconfig-15-\tbool \"Debug CacheFiles\"\n--\nfs/cachefiles/Kconfig-22-\nfs/cachefiles/Kconfig:23:config CACHEFILES_ERROR_INJECTION\nfs/cachefiles/Kconfig-24-\tbool \"Provide error injection for cachefiles\"\n"
}

gemini-3.1-pro-preview

							input: 16629
							output: 33
							thoughts: 16

Here's my take on those thoughts, from my perspective as an expert:

**Kconfig Dependency Deep Dive**

Okay, so I need to get a handle on the build configuration dependencies. My instinct says to start digging into the `fs/netfs/Kconfig` file. I'm assuming that's where the core configuration options for the network filesystem are defined. The goal is to understand what other kernel components or options *must* be enabled or are logically related to `netfs`. I'm expecting to see things like, "if NETWORKING is enabled, then this option is available," or perhaps dependencies on specific network protocol stacks, crypto libraries, or even specific hardware drivers. I need to understand the full web of connections this subsystem has within the kernel's build system so I don't introduce problems with other parts of the system. Let's see what Kconfig reveals.

{
  "File": "fs/netfs/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t\n   3:\tconfig NETFS_SUPPORT\n   4:\t\ttristate\n   5:\t\thelp\n   6:\t\t  This option enables support for network filesystems, including\n   7:\t\t  helpers for high-level buffered I/O, abstracting out read\n   8:\t\t  segmentation, local caching and transparent huge page support.\n   9:\t\n  10:\tconfig NETFS_STATS\n  11:\t\tbool \"Gather statistical information on local caching\"\n  12:\t\tdepends on NETFS_SUPPORT \u0026\u0026 PROC_FS\n  13:\t\thelp\n  14:\t\t  This option causes statistical information to be gathered on local\n  15:\t\t  caching and exported through file:\n  16:\t\n  17:\t\t\t/proc/fs/fscache/stats\n  18:\t\n  19:\t\t  The gathering of statistics adds a certain amount of overhead to\n  20:\t\t  execution as there are a quite a few stats gathered, and on a\n  21:\t\t  multi-CPU system these may be on cachelines that keep bouncing\n  22:\t\t  between CPUs.  On the other hand, the stats are very useful for\n  23:\t\t  debugging purposes.  Saying 'Y' here is recommended.\n  24:\t\n  25:\tconfig NETFS_DEBUG\n  26:\t\tbool \"Enable dynamic debugging netfslib and FS-Cache\"\n  27:\t\tdepends on NETFS_SUPPORT\n  28:\t\thelp\n  29:\t\t  This permits debugging to be dynamically enabled in the local caching\n  30:\t\t  management module.  If this is set, the debugging output may be\n  31:\t\t  enabled by setting bits in /sys/module/netfs/parameters/debug.\n  32:\t\n  33:\tconfig FSCACHE\n  34:\t\tbool \"General filesystem local caching manager\"\n  35:\t\tdepends on NETFS_SUPPORT\n  36:\t\thelp\n  37:\t\t  This option enables a generic filesystem caching manager that can be\n  38:\t\t  used by various network and other filesystems to cache data locally.\n  39:\t\t  Different sorts of caches can be plugged in, depending on the\n  40:\t\t  resources available.\n  41:\t\n  42:\t\t  See Documentation/filesystems/caching/fscache.rst for more information.\n  43:\t\n  44:\tconfig FSCACHE_STATS\n  45:\t\tbool \"Gather statistical information on local caching\"\n  46:\t\tdepends on FSCACHE \u0026\u0026 PROC_FS\n  47:\t\tselect NETFS_STATS\n  48:\t\thelp\n  49:\t\t  This option causes statistical information to be gathered on local\n  50:\t\t  caching and exported through file:\n"
}

gemini-3.1-pro-preview

							input: 17552
							output: 27
							thoughts: 37

Okay, here's my take on those thoughts, tailored for an expert audience, and written as if they were my own:

**Digging into NETFS_SUPPORT**

Alright, so `NETFS_SUPPORT`. It's a tristate option, completely self-contained, no direct dependencies. Interesting. Usually, these sorts of things are picked up as a supporting component for various other filesystems. Let's dig in and figure out the upstream logic. Time to track down *who* is actually selecting `NETFS_SUPPORT`. I need to understand the architectural picture and identify the key configurations that drive its inclusion. This could reveal interesting patterns in how network filesystems are being designed and utilized within the kernel. Let's see what the select statements tell us.

{
  "Expression": "select NETFS_SUPPORT",
  "PathPrefix": "fs/"
}

{
  "Output": "fs/9p/Kconfig=2=config 9P_FS\n--\nfs/9p/Kconfig-4-\tdepends on NET_9P\nfs/9p/Kconfig:5:\tselect NETFS_SUPPORT\nfs/9p/Kconfig-6-\thelp\n--\nfs/afs/Kconfig=2=config AFS_FS\n--\nfs/afs/Kconfig-6-\tselect DNS_RESOLVER\nfs/afs/Kconfig:7:\tselect NETFS_SUPPORT\nfs/afs/Kconfig-8-\tselect CRYPTO_KRB5\n--\nfs/ceph/Kconfig=2=config CEPH_FS\n--\nfs/ceph/Kconfig-5-\tselect CEPH_LIB\nfs/ceph/Kconfig:6:\tselect NETFS_SUPPORT\nfs/ceph/Kconfig-7-\tselect FS_ENCRYPTION_ALGS if FS_ENCRYPTION\n--\nfs/nfs/Kconfig=173=config NFS_FSCACHE\n--\nfs/nfs/Kconfig-175-\tdepends on NFS_FS\nfs/nfs/Kconfig:176:\tselect NETFS_SUPPORT\nfs/nfs/Kconfig-177-\tselect FSCACHE\n--\nfs/smb/client/Kconfig=2=config CIFS\n--\nfs/smb/client/Kconfig-20-\tselect OID_REGISTRY\nfs/smb/client/Kconfig:21:\tselect NETFS_SUPPORT\nfs/smb/client/Kconfig-22-\thelp\n"
}

gemini-3.1-pro-preview

							input: 18155
							output: 49
							thoughts: 662

**Fuzzing Target Identification**

Okay, so I need to identify good targets for fuzzing. First, I need to make sure I'm covering the right filesystem support in the build. I'll definitely include `NETFS_SUPPORT`, then `CACHEFILES`, `9P_FS`, `CIFS`, `CEPH_FS`, and `AFS_FS` since those all seem relevant to this area of the kernel.

Now, let's look at what the patch actually modifies. I see a lot of functions, and I need to hone in on the important ones. My initial thought is to exclude static functions, as they are less likely to be good entry points for fuzzing, and focus on the functions that are exported or at least used across multiple files. So, here's the list of non-static functions this patch touches:

*   `cachefiles_set_object_xattr`
*   `cachefiles_check_auxdata`
*   `netfs_readahead`
*   `netfs_read_folio`
*   `netfs_write_begin`
*   `netfs_prefetch_for_write`
*   `netfs_unbuffered_write_iter_locked`
*   `netfs_wait_for_put_ra_refs`
*   `netfs_alloc_request`
*   `netfs_read_set_unlock_at`
*   `netfs_read_subreq_progress`
*   `netfs_unlock_abandoned_read_pages`
*   `netfs_read_single`
*   `rolling_buffer_bulk_load_from_ra`
*   `netfs_prepare_write`

Next, I need to make sure my initial assessment is correct. I should confirm that `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` are actually non-static and exposed somehow; a quick check of the source code confirms they are. The same will be done for `netfs_readahead` and the others to finalize the selection of targets.

{
  "Expression": "^(int|void|ssize_t|struct netfs_io_request \\*|bool) netfs_",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/buffered_read.c=159=static void netfs_read_cache_to_pagecache(struct netfs_io_request *rreq,\n--\nfs/netfs/buffered_read.c-168-\nfs/netfs/buffered_read.c:169:void netfs_queue_read(struct netfs_io_request *rreq,\nfs/netfs/buffered_read.c-170-\t\t      struct netfs_io_subrequest *subreq)\n--\nfs/netfs/buffered_read.c=219=static void netfs_read_to_pagecache(struct netfs_io_request *rreq)\n--\nfs/netfs/buffered_read.c-345- */\nfs/netfs/buffered_read.c:346:void netfs_readahead(struct readahead_control *ractl)\nfs/netfs/buffered_read.c-347-{\n--\nfs/netfs/buffered_read.c=419=static int netfs_read_gaps(struct file *file, struct folio *folio)\n--\nfs/netfs/buffered_read.c-523- */\nfs/netfs/buffered_read.c:524:int netfs_read_folio(struct file *file, struct folio *folio)\nfs/netfs/buffered_read.c-525-{\n--\nfs/netfs/buffered_read.c=586=static bool netfs_skip_folio_read(struct folio *folio, loff_t pos, size_t len,\n--\nfs/netfs/buffered_read.c-652- */\nfs/netfs/buffered_read.c:653:int netfs_write_begin(struct netfs_inode *ctx,\nfs/netfs/buffered_read.c-654-\t\t      struct file *file, struct address_space *mapping,\n--\nfs/netfs/buffered_read.c=740=EXPORT_SYMBOL(netfs_write_begin);\n--\nfs/netfs/buffered_read.c-744- */\nfs/netfs/buffered_read.c:745:int netfs_prefetch_for_write(struct file *file, struct folio *folio,\nfs/netfs/buffered_read.c-746-\t\t\t     size_t offset, size_t len)\n--\nfs/netfs/buffered_read.c-812- */\nfs/netfs/buffered_read.c:813:ssize_t netfs_buffered_read_iter(struct kiocb *iocb, struct iov_iter *iter)\nfs/netfs/buffered_read.c-814-{\n--\nfs/netfs/buffered_read.c=830=EXPORT_SYMBOL(netfs_buffered_read_iter);\n--\nfs/netfs/buffered_read.c-852- */\nfs/netfs/buffered_read.c:853:ssize_t netfs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)\nfs/netfs/buffered_read.c-854-{\n--\nfs/netfs/buffered_write.c=19=static struct folio *netfs_grab_folio_for_write(struct address_space *mapping,\n--\nfs/netfs/buffered_write.c-36- */\nfs/netfs/buffered_write.c:37:void netfs_update_i_size(struct netfs_inode *ctx, struct inode *inode,\nfs/netfs/buffered_write.c-38-\t\t\t loff_t pos, size_t copied)\n--\nfs/netfs/buffered_write.c-86- */\nfs/netfs/buffered_write.c:87:ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter,\nfs/netfs/buffered_write.c-88-\t\t\t    struct netfs_group *netfs_group)\n--\nfs/netfs/buffered_write.c=443=EXPORT_SYMBOL(netfs_perform_write);\n--\nfs/netfs/buffered_write.c-467- */\nfs/netfs/buffered_write.c:468:ssize_t netfs_buffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *from,\nfs/netfs/buffered_write.c-469-\t\t\t\t\t struct netfs_group *netfs_group)\n--\nfs/netfs/buffered_write.c=486=EXPORT_SYMBOL(netfs_buffered_write_iter_locked);\n--\nfs/netfs/buffered_write.c-500- */\nfs/netfs/buffered_write.c:501:ssize_t netfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)\nfs/netfs/buffered_write.c-502-{\n--\nfs/netfs/direct_read.c=112=static ssize_t netfs_unbuffered_read(struct netfs_io_request *rreq, bool sync)\n--\nfs/netfs/direct_read.c-152- */\nfs/netfs/direct_read.c:153:ssize_t netfs_unbuffered_read_iter_locked(struct kiocb *iocb, struct iov_iter *iter)\nfs/netfs/direct_read.c-154-{\n--\nfs/netfs/direct_read.c=230=EXPORT_SYMBOL(netfs_unbuffered_read_iter_locked);\n--\nfs/netfs/direct_read.c-239- */\nfs/netfs/direct_read.c:240:ssize_t netfs_unbuffered_read_iter(struct kiocb *iocb, struct iov_iter *iter)\nfs/netfs/direct_read.c-241-{\n--\nfs/netfs/direct_write.c=211=static void netfs_unbuffered_write_async(struct work_struct *work)\n--\nfs/netfs/direct_write.c-222- */\nfs/netfs/direct_write.c:223:ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *iter,\nfs/netfs/direct_write.c-224-\t\t\t\t\t\t  struct netfs_group *netfs_group)\n--\nfs/netfs/direct_write.c=316=EXPORT_SYMBOL(netfs_unbuffered_write_iter_locked);\n--\nfs/netfs/direct_write.c-330- */\nfs/netfs/direct_write.c:331:ssize_t netfs_unbuffered_write_iter(struct kiocb *iocb, struct iov_iter *from)\nfs/netfs/direct_write.c-332-{\n--\nfs/netfs/internal.h-25- */\nfs/netfs/internal.h:26:void netfs_queue_read(struct netfs_io_request *rreq,\nfs/netfs/internal.h-27-\t\t      struct netfs_io_subrequest *subreq);\nfs/netfs/internal.h:28:void netfs_cache_read_terminated(void *priv, ssize_t transferred_or_error);\nfs/netfs/internal.h:29:int netfs_prefetch_for_write(struct file *file, struct folio *folio,\nfs/netfs/internal.h-30-\t\t\t     size_t offset, size_t len);\n--\nfs/netfs/internal.h-34- */\nfs/netfs/internal.h:35:void netfs_update_i_size(struct netfs_inode *ctx, struct inode *inode,\nfs/netfs/internal.h-36-\t\t\t loff_t pos, size_t copied);\n--\nfs/netfs/internal.h=71=struct folio_queue *netfs_buffer_make_space(struct netfs_io_request *rreq,\nfs/netfs/internal.h-72-\t\t\t\t\t    enum netfs_folioq_trace trace);\nfs/netfs/internal.h:73:void netfs_reset_iter(struct netfs_io_subrequest *subreq);\nfs/netfs/internal.h:74:void netfs_wake_collector(struct netfs_io_request *rreq);\nfs/netfs/internal.h:75:void netfs_subreq_clear_in_progress(struct netfs_io_subrequest *subreq);\nfs/netfs/internal.h:76:void netfs_wait_for_in_progress_stream(struct netfs_io_request *rreq,\nfs/netfs/internal.h-77-\t\t\t\t       struct netfs_io_stream *stream);\nfs/netfs/internal.h:78:ssize_t netfs_wait_for_read(struct netfs_io_request *rreq);\nfs/netfs/internal.h:79:ssize_t netfs_wait_for_write(struct netfs_io_request *rreq);\nfs/netfs/internal.h:80:void netfs_wait_for_paused_read(struct netfs_io_request *rreq);\nfs/netfs/internal.h:81:void netfs_wait_for_paused_write(struct netfs_io_request *rreq);\nfs/netfs/internal.h:82:void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq);\nfs/netfs/internal.h-83-\n--\nfs/netfs/internal.h=87=struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,\n--\nfs/netfs/internal.h-90-\t\t\t\t\t     enum netfs_io_origin origin);\nfs/netfs/internal.h:91:void netfs_get_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace what);\nfs/netfs/internal.h:92:void netfs_clear_subrequests(struct netfs_io_request *rreq);\nfs/netfs/internal.h:93:void netfs_put_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace what);\nfs/netfs/internal.h:94:void netfs_put_failed_request(struct netfs_io_request *rreq);\nfs/netfs/internal.h-95-struct netfs_io_subrequest *netfs_alloc_subrequest(struct netfs_io_request *rreq);\n--\nfs/netfs/internal.h=103=static inline void netfs_see_subrequest(struct netfs_io_subrequest *subreq,\n--\nfs/netfs/internal.h-112- */\nfs/netfs/internal.h:113:void netfs_read_set_unlock_at(struct netfs_io_request *rreq);\nfs/netfs/internal.h:114:bool netfs_read_collection(struct netfs_io_request *rreq);\nfs/netfs/internal.h:115:void netfs_read_collection_worker(struct work_struct *work);\nfs/netfs/internal.h:116:void netfs_cancel_read(struct netfs_io_subrequest *subreq, int error);\nfs/netfs/internal.h:117:void netfs_cache_read_terminated(void *priv, ssize_t transferred_or_error);\nfs/netfs/internal.h-118-\n--\nfs/netfs/internal.h-121- */\nfs/netfs/internal.h:122:void netfs_pgpriv2_copy_to_cache(struct netfs_io_request *rreq, struct folio *folio);\nfs/netfs/internal.h:123:void netfs_pgpriv2_end_copy_to_cache(struct netfs_io_request *rreq);\nfs/netfs/internal.h:124:bool netfs_pgpriv2_unlock_copied_folios(struct netfs_io_request *wreq);\nfs/netfs/internal.h-125-\n--\nfs/netfs/internal.h-128- */\nfs/netfs/internal.h:129:void netfs_retry_reads(struct netfs_io_request *rreq);\nfs/netfs/internal.h:130:void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq);\nfs/netfs/internal.h-131-\n--\nfs/netfs/internal.h=174=extern atomic_t netfs_n_folioq;\nfs/netfs/internal.h-175-\nfs/netfs/internal.h:176:int netfs_stats_show(struct seq_file *m, void *v);\nfs/netfs/internal.h-177-\n--\nfs/netfs/internal.h=183=static inline void netfs_stat_d(atomic_t *stat)\n--\nfs/netfs/internal.h-195- */\nfs/netfs/internal.h:196:int netfs_folio_written_back(struct folio *folio);\nfs/netfs/internal.h:197:bool netfs_write_collection(struct netfs_io_request *wreq);\nfs/netfs/internal.h:198:void netfs_write_collection_worker(struct work_struct *work);\nfs/netfs/internal.h-199-\n--\nfs/netfs/internal.h=203=struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,\n--\nfs/netfs/internal.h-206-\t\t\t\t\t\tenum netfs_io_origin origin);\nfs/netfs/internal.h:207:void netfs_prepare_write(struct netfs_io_request *wreq,\nfs/netfs/internal.h-208-\t\t\t struct netfs_io_stream *stream,\nfs/netfs/internal.h-209-\t\t\t loff_t start);\nfs/netfs/internal.h:210:void netfs_reissue_write(struct netfs_io_stream *stream,\nfs/netfs/internal.h-211-\t\t\t struct netfs_io_subrequest *subreq,\nfs/netfs/internal.h-212-\t\t\t struct iov_iter *source);\nfs/netfs/internal.h:213:void netfs_issue_write(struct netfs_io_request *wreq,\nfs/netfs/internal.h-214-\t\t       struct netfs_io_stream *stream);\n--\nfs/netfs/internal.h=218=struct netfs_io_request *netfs_begin_writethrough(struct kiocb *iocb, size_t len);\nfs/netfs/internal.h:219:int netfs_advance_writethrough(struct netfs_io_request *wreq, struct writeback_control *wbc,\nfs/netfs/internal.h-220-\t\t\t       struct folio *folio, size_t copied, bool to_page_end,\nfs/netfs/internal.h-221-\t\t\t       struct folio **writethrough_cache);\nfs/netfs/internal.h:222:ssize_t netfs_end_writethrough(struct netfs_io_request *wreq, struct writeback_control *wbc,\nfs/netfs/internal.h-223-\t\t\t       struct folio *writethrough_cache);\n--\nfs/netfs/internal.h-227- */\nfs/netfs/internal.h:228:void netfs_retry_writes(struct netfs_io_request *wreq);\nfs/netfs/internal.h-229-\n--\nfs/netfs/iterator.c-35- */\nfs/netfs/iterator.c:36:ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,\nfs/netfs/iterator.c-37-\t\t\t\tstruct iov_iter *new,\n--\nfs/netfs/locking.c=37=static int netfs_block_o_direct(struct netfs_inode *ictx)\n--\nfs/netfs/locking.c-60- */\nfs/netfs/locking.c:61:int netfs_start_io_read(struct inode *inode)\nfs/netfs/locking.c-62-\t__acquires(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=83=EXPORT_SYMBOL(netfs_start_io_read);\n--\nfs/netfs/locking.c-91- */\nfs/netfs/locking.c:92:void netfs_end_io_read(struct inode *inode)\nfs/netfs/locking.c-93-\t__releases(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=97=EXPORT_SYMBOL(netfs_end_io_read);\n--\nfs/netfs/locking.c-105- */\nfs/netfs/locking.c:106:int netfs_start_io_write(struct inode *inode)\nfs/netfs/locking.c-107-\t__acquires(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=120=EXPORT_SYMBOL(netfs_start_io_write);\n--\nfs/netfs/locking.c-128- */\nfs/netfs/locking.c:129:void netfs_end_io_write(struct inode *inode)\nfs/netfs/locking.c-130-\t__releases(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=137=static int netfs_block_buffered(struct inode *inode)\n--\nfs/netfs/locking.c-171- */\nfs/netfs/locking.c:172:int netfs_start_io_direct(struct inode *inode)\nfs/netfs/locking.c-173-\t__acquires(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=196=EXPORT_SYMBOL(netfs_start_io_direct);\n--\nfs/netfs/locking.c-204- */\nfs/netfs/locking.c:205:void netfs_end_io_direct(struct inode *inode)\nfs/netfs/locking.c-206-\t__releases(inode-\u003ei_rwsem)\n--\nfs/netfs/locking.c=215=static bool netfs_wb_begin_wait(struct netfs_inode *ictx)\n--\nfs/netfs/locking.c-258- */\nfs/netfs/locking.c:259:bool netfs_wb_begin(struct netfs_inode *ictx, bool nowait)\nfs/netfs/locking.c-260-{\n--\nfs/netfs/locking.c=270=EXPORT_SYMBOL(netfs_wb_begin);\n--\nfs/netfs/locking.c-276- */\nfs/netfs/locking.c:277:void netfs_wb_end(struct netfs_inode *ictx)\nfs/netfs/locking.c-278-{\n--\nfs/netfs/misc.c-18- */\nfs/netfs/misc.c:19:int netfs_alloc_folioq_buffer(struct address_space *mapping,\nfs/netfs/misc.c-20-\t\t\t      struct folio_queue **_buffer,\n--\nfs/netfs/misc.c=69=EXPORT_SYMBOL(netfs_alloc_folioq_buffer);\n--\nfs/netfs/misc.c-77- */\nfs/netfs/misc.c:78:void netfs_free_folioq_buffer(struct folio_queue *fq)\nfs/netfs/misc.c-79-{\n--\nfs/netfs/misc.c=105=EXPORT_SYMBOL(netfs_free_folioq_buffer);\n--\nfs/netfs/misc.c-112- */\nfs/netfs/misc.c:113:void netfs_reset_iter(struct netfs_io_subrequest *subreq)\nfs/netfs/misc.c-114-{\n--\nfs/netfs/misc.c-135- */\nfs/netfs/misc.c:136:bool netfs_dirty_folio(struct address_space *mapping, struct folio *folio)\nfs/netfs/misc.c-137-{\n--\nfs/netfs/misc.c=163=EXPORT_SYMBOL(netfs_dirty_folio);\n--\nfs/netfs/misc.c-172- */\nfs/netfs/misc.c:173:int netfs_unpin_writeback(struct inode *inode, struct writeback_control *wbc)\nfs/netfs/misc.c-174-{\n--\nfs/netfs/misc.c=181=EXPORT_SYMBOL(netfs_unpin_writeback);\n--\nfs/netfs/misc.c-190- */\nfs/netfs/misc.c:191:void netfs_clear_inode_writeback(struct inode *inode, const void *aux)\nfs/netfs/misc.c-192-{\n--\nfs/netfs/misc.c=200=EXPORT_SYMBOL(netfs_clear_inode_writeback);\n--\nfs/netfs/misc.c-210- */\nfs/netfs/misc.c:211:void netfs_invalidate_folio(struct folio *folio, size_t offset, size_t length)\nfs/netfs/misc.c-212-{\n--\nfs/netfs/misc.c=294=EXPORT_SYMBOL(netfs_invalidate_folio);\n--\nfs/netfs/misc.c-303- */\nfs/netfs/misc.c:304:bool netfs_release_folio(struct folio *folio, gfp_t gfp)\nfs/netfs/misc.c-305-{\n--\nfs/netfs/misc.c=333=EXPORT_SYMBOL(netfs_release_folio);\n--\nfs/netfs/misc.c-337- */\nfs/netfs/misc.c:338:void netfs_wake_collector(struct netfs_io_request *rreq)\nfs/netfs/misc.c-339-{\n--\nfs/netfs/misc.c-352- */\nfs/netfs/misc.c:353:void netfs_subreq_clear_in_progress(struct netfs_io_subrequest *subreq)\nfs/netfs/misc.c-354-{\n--\nfs/netfs/misc.c-369- */\nfs/netfs/misc.c:370:void netfs_wait_for_in_progress_stream(struct netfs_io_request *rreq,\nfs/netfs/misc.c-371-\t\t\t\t       struct netfs_io_stream *stream)\n--\nfs/netfs/misc.c=452=static ssize_t netfs_wait_for_in_progress(struct netfs_io_request *rreq,\n--\nfs/netfs/misc.c-507-\nfs/netfs/misc.c:508:ssize_t netfs_wait_for_read(struct netfs_io_request *rreq)\nfs/netfs/misc.c-509-{\n--\nfs/netfs/misc.c-512-\nfs/netfs/misc.c:513:ssize_t netfs_wait_for_write(struct netfs_io_request *rreq)\nfs/netfs/misc.c-514-{\n--\nfs/netfs/misc.c=521=static void netfs_wait_for_pause(struct netfs_io_request *rreq,\n--\nfs/netfs/misc.c-556-\nfs/netfs/misc.c:557:void netfs_wait_for_paused_read(struct netfs_io_request *rreq)\nfs/netfs/misc.c-558-{\n--\nfs/netfs/misc.c-561-\nfs/netfs/misc.c:562:void netfs_wait_for_paused_write(struct netfs_io_request *rreq)\nfs/netfs/misc.c-563-{\n--\nfs/netfs/misc.c-569- */\nfs/netfs/misc.c:570:void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq)\nfs/netfs/misc.c-571-{\n--\nfs/netfs/objects.c=17=struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,\n--\nfs/netfs/objects.c-98-\nfs/netfs/objects.c:99:void netfs_get_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace what)\nfs/netfs/objects.c-100-{\n--\nfs/netfs/objects.c-106-\nfs/netfs/objects.c:107:void netfs_clear_subrequests(struct netfs_io_request *rreq)\nfs/netfs/objects.c-108-{\n--\nfs/netfs/objects.c=165=static void netfs_free_request(struct work_struct *work)\n--\nfs/netfs/objects.c-173-\nfs/netfs/objects.c:174:void netfs_put_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace what)\nfs/netfs/objects.c-175-{\n--\nfs/netfs/objects.c-192- */\nfs/netfs/objects.c:193:void netfs_put_failed_request(struct netfs_io_request *rreq)\nfs/netfs/objects.c-194-{\n--\nfs/netfs/objects.c=210=struct netfs_io_subrequest *netfs_alloc_subrequest(struct netfs_io_request *rreq)\n--\nfs/netfs/objects.c-233-\nfs/netfs/objects.c:234:void netfs_get_subrequest(struct netfs_io_subrequest *subreq,\nfs/netfs/objects.c-235-\t\t\t  enum netfs_sreq_ref_trace what)\n--\nfs/netfs/objects.c=244=static void netfs_free_subrequest(struct netfs_io_subrequest *subreq)\n--\nfs/netfs/objects.c-255-\nfs/netfs/objects.c:256:void netfs_put_subrequest(struct netfs_io_subrequest *subreq,\nfs/netfs/objects.c-257-\t\t\t  enum netfs_sreq_ref_trace what)\n--\nfs/netfs/read_collect.c=42=static void netfs_unlock_read_folio(struct netfs_io_request *rreq,\n--\nfs/netfs/read_collect.c-99- */\nfs/netfs/read_collect.c:100:void netfs_read_set_unlock_at(struct netfs_io_request *rreq)\nfs/netfs/read_collect.c-101-{\n--\nfs/netfs/read_collect.c=413=static void netfs_rreq_assess_single(struct netfs_io_request *rreq)\n--\nfs/netfs/read_collect.c-440- */\nfs/netfs/read_collect.c:441:bool netfs_read_collection(struct netfs_io_request *rreq)\nfs/netfs/read_collect.c-442-{\n--\nfs/netfs/read_collect.c-487-\nfs/netfs/read_collect.c:488:void netfs_read_collection_worker(struct work_struct *work)\nfs/netfs/read_collect.c-489-{\n--\nfs/netfs/read_collect.c-511- */\nfs/netfs/read_collect.c:512:void netfs_read_subreq_progress(struct netfs_io_subrequest *subreq)\nfs/netfs/read_collect.c-513-{\n--\nfs/netfs/read_collect.c=535=EXPORT_SYMBOL(netfs_read_subreq_progress);\n--\nfs/netfs/read_collect.c-552- */\nfs/netfs/read_collect.c:553:void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)\nfs/netfs/read_collect.c-554-{\n--\nfs/netfs/read_collect.c=615=EXPORT_SYMBOL(netfs_read_subreq_terminated);\n--\nfs/netfs/read_collect.c-619- */\nfs/netfs/read_collect.c:620:void netfs_cancel_read(struct netfs_io_subrequest *subreq, int error)\nfs/netfs/read_collect.c-621-{\n--\nfs/netfs/read_collect.c-630- */\nfs/netfs/read_collect.c:631:void netfs_cache_read_terminated(void *priv, ssize_t transferred_or_error)\nfs/netfs/read_collect.c-632-{\n--\nfs/netfs/read_pgpriv2.c=98=static struct netfs_io_request *netfs_pgpriv2_begin_copy_to_cache(\n--\nfs/netfs/read_pgpriv2.c-132- */\nfs/netfs/read_pgpriv2.c:133:void netfs_pgpriv2_copy_to_cache(struct netfs_io_request *rreq, struct folio *folio)\nfs/netfs/read_pgpriv2.c-134-{\n--\nfs/netfs/read_pgpriv2.c-149- */\nfs/netfs/read_pgpriv2.c:150:void netfs_pgpriv2_end_copy_to_cache(struct netfs_io_request *rreq)\nfs/netfs/read_pgpriv2.c-151-{\n--\nfs/netfs/read_pgpriv2.c-171- */\nfs/netfs/read_pgpriv2.c:172:bool netfs_pgpriv2_unlock_copied_folios(struct netfs_io_request *creq)\nfs/netfs/read_pgpriv2.c-173-{\n--\nfs/netfs/read_retry.c=26=static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)\n--\nfs/netfs/read_retry.c-269- */\nfs/netfs/read_retry.c:270:void netfs_retry_reads(struct netfs_io_request *rreq)\nfs/netfs/read_retry.c-271-{\n--\nfs/netfs/read_retry.c-290- */\nfs/netfs/read_retry.c:291:void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq)\nfs/netfs/read_retry.c-292-{\n--\nfs/netfs/read_single.c-27- */\nfs/netfs/read_single.c:28:void netfs_single_mark_inode_dirty(struct inode *inode)\nfs/netfs/read_single.c-29-{\n--\nfs/netfs/read_single.c=90=static int netfs_single_dispatch_read(struct netfs_io_request *rreq)\n--\nfs/netfs/read_single.c-161- */\nfs/netfs/read_single.c:162:ssize_t netfs_read_single(struct inode *inode, struct file *file, struct iov_iter *iter)\nfs/netfs/read_single.c-163-{\n--\nfs/netfs/rolling_buffer.c=43=EXPORT_SYMBOL(netfs_folioq_alloc);\n--\nfs/netfs/rolling_buffer.c-51- */\nfs/netfs/rolling_buffer.c:52:void netfs_folioq_free(struct folio_queue *folioq,\nfs/netfs/rolling_buffer.c-53-\t\t       unsigned int /*enum netfs_trace_folioq*/ trace)\n--\nfs/netfs/stats.c=50=atomic_t netfs_n_folioq;\nfs/netfs/stats.c-51-\nfs/netfs/stats.c:52:int netfs_stats_show(struct seq_file *m, void *v)\nfs/netfs/stats.c-53-{\n--\nfs/netfs/write_collect.c=24=static void netfs_dump_request(const struct netfs_io_request *rreq)\n--\nfs/netfs/write_collect.c-56- */\nfs/netfs/write_collect.c:57:int netfs_folio_written_back(struct folio *folio)\nfs/netfs/write_collect.c-58-{\n--\nfs/netfs/write_collect.c=200=static void netfs_collect_write_results(struct netfs_io_request *wreq)\n--\nfs/netfs/write_collect.c-360- */\nfs/netfs/write_collect.c:361:bool netfs_write_collection(struct netfs_io_request *wreq)\nfs/netfs/write_collect.c-362-{\n--\nfs/netfs/write_collect.c-435-\nfs/netfs/write_collect.c:436:void netfs_write_collection_worker(struct work_struct *work)\nfs/netfs/write_collect.c-437-{\n--\nfs/netfs/write_collect.c-468- */\nfs/netfs/write_collect.c:469:void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error)\nfs/netfs/write_collect.c-470-{\n--\nfs/netfs/write_issue.c=90=struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,\n--\nfs/netfs/write_issue.c-145- */\nfs/netfs/write_issue.c:146:void netfs_prepare_write_failed(struct netfs_io_subrequest *subreq)\nfs/netfs/write_issue.c-147-{\n--\nfs/netfs/write_issue.c=151=EXPORT_SYMBOL(netfs_prepare_write_failed);\n--\nfs/netfs/write_issue.c-156- */\nfs/netfs/write_issue.c:157:void netfs_prepare_write(struct netfs_io_request *wreq,\nfs/netfs/write_issue.c-158-\t\t\t struct netfs_io_stream *stream,\n--\nfs/netfs/write_issue.c=229=static void netfs_do_issue_write(struct netfs_io_stream *stream,\n--\nfs/netfs/write_issue.c-242-\nfs/netfs/write_issue.c:243:void netfs_reissue_write(struct netfs_io_stream *stream,\nfs/netfs/write_issue.c-244-\t\t\t struct netfs_io_subrequest *subreq,\n--\nfs/netfs/write_issue.c-261-\nfs/netfs/write_issue.c:262:void netfs_issue_write(struct netfs_io_request *wreq,\nfs/netfs/write_issue.c-263-\t\t       struct netfs_io_stream *stream)\n--\nfs/netfs/write_issue.c=524=static void netfs_end_issue_write(struct netfs_io_request *wreq)\n--\nfs/netfs/write_issue.c-547- */\nfs/netfs/write_issue.c:548:int netfs_writepages(struct address_space *mapping,\nfs/netfs/write_issue.c-549-\t\t     struct writeback_control *wbc)\n--\nfs/netfs/write_issue.c=619=struct netfs_io_request *netfs_begin_writethrough(struct kiocb *iocb, size_t len)\n--\nfs/netfs/write_issue.c-644- */\nfs/netfs/write_issue.c:645:int netfs_advance_writethrough(struct netfs_io_request *wreq, struct writeback_control *wbc,\nfs/netfs/write_issue.c-646-\t\t\t       struct folio *folio, size_t copied, bool to_page_end,\n--\nfs/netfs/write_issue.c-688- */\nfs/netfs/write_issue.c:689:ssize_t netfs_end_writethrough(struct netfs_io_request *wreq, struct writeback_control *wbc,\nfs/netfs/write_issue.c-690-\t\t\t       struct folio *writethrough_cache)\n--\nfs/netfs/write_issue.c=716=static int netfs_write_folio_single(struct netfs_io_request *wreq,\n--\nfs/netfs/write_issue.c-842- */\nfs/netfs/write_issue.c:843:int netfs_writeback_single(struct address_space *mapping,\nfs/netfs/write_issue.c-844-\t\t\t   struct writeback_control *wbc,\n--\nfs/netfs/write_retry.c=17=static void netfs_retry_write_stream(struct netfs_io_request *wreq,\n--\nfs/netfs/write_retry.c-207- */\nfs/netfs/write_retry.c:208:void netfs_retry_writes(struct netfs_io_request *wreq)\nfs/netfs/write_retry.c-209-{\n"
}

gemini-3.1-pro-preview

							input: 28990
							output: 40
							thoughts: 170

**My Initial Assessment of the NetFS Functions**

Alright, let's see. I've got a good starting set here: `netfs_readahead`, `netfs_read_folio`, `netfs_write_begin`, `netfs_prefetch_for_write`, `netfs_unbuffered_write_iter_locked`, `netfs_wait_for_put_ra_refs`, `netfs_alloc_request`, `netfs_read_set_unlock_at`, `netfs_read_subreq_progress`, `netfs_unlock_abandoned_read_pages`, `netfs_read_single`, and `netfs_prepare_write`. These all look like important pieces of the puzzle when it comes to understanding NetFS's read and write operations. I need to understand how they all fit together.

However, hold on a second... `rolling_buffer_bulk_load_from_ra`... that's in `fs/netfs/rolling_buffer.c`, isn't it? And, what's its visibility? Is it exported to other parts of the kernel, or is it a local, static function? I need to know the scope of this one. It seems like it's essential for handling readahead buffers, which could be extremely important. Gotta check that right away.

{
  "Expression": "ssize_t rolling_buffer_bulk_load_from_ra",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/rolling_buffer.c=84=int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp)\n--\nfs/netfs/rolling_buffer.c-119- */\nfs/netfs/rolling_buffer.c:120:ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,\nfs/netfs/rolling_buffer.c-121-\t\t\t\t\t struct readahead_control *ractl,\n"
}

gemini-3.1-pro-preview

							input: 29624
							output: 35
							thoughts: 35

Okay, here's my interpretation of those thoughts, presented as a first-person expert summary:

**Assessing the Dynamic Nature of the Situation**

Alright, the core issue is clearly non-static. No surprises there. Now, given this dynamic nature, the next logical step is to dive into the key functions that likely manage this interaction. I need to understand how the system's managing the attributes of the cached objects. Specifically, I need to check the behavior of `cachefiles_set_object_xattr` and `cachefiles_check_auxdata`. These functions are probably crucial to understanding how the dynamic changes are being handled, whether there are potential race conditions, or if the current implementation accounts for the inherent variability of the data. I'm especially interested in how these functions interact and whether the auxiliary data checks are sufficiently robust to deal with changes.

{
  "Expression": "int cachefiles_set_object_xattr",
  "PathPrefix": "fs/cachefiles/"
}

{
  "Output": "fs/cachefiles/internal.h=278=void cachefiles_withdraw_volume(struct cachefiles_volume *volume);\n--\nfs/cachefiles/internal.h-282- */\nfs/cachefiles/internal.h:283:extern int cachefiles_set_object_xattr(struct cachefiles_object *object);\nfs/cachefiles/internal.h-284-extern int cachefiles_check_auxdata(struct cachefiles_object *object,\n--\nfs/cachefiles/xattr.c=32=struct cachefiles_vol_xattr {\n--\nfs/cachefiles/xattr.c-39- */\nfs/cachefiles/xattr.c:40:int cachefiles_set_object_xattr(struct cachefiles_object *object)\nfs/cachefiles/xattr.c-41-{\n"
}

gemini-3.1-pro-preview

							input: 30087
							output: 38
							thoughts: 218

**Analyzing the Dynamics of These Focus Symbols**

Okay, so I've confirmed that these elements are indeed non-static, which is an important initial observation. Now, I need to really dig into what's happening. My core focus right now is on these symbols: `cachefiles_set_object_xattr`, `cachefiles_check_auxdata`, `netfs_readahead`, `netfs_read_folio`, `netfs_write_begin`, `netfs_prefetch_for_write`, `netfs_unbuffered_write_iter_locked`, `netfs_wait_for_put_ra_refs`, `netfs_alloc_request`, `netfs_read_set_unlock_at`, `netfs_read_subreq_progress`, `netfs_unlock_abandoned_read_pages`, `netfs_read_single`, `rolling_buffer_bulk_load_from_ra`, and `netfs_prepare_write`. Each one of these needs a thorough examination. I'm going to pay particularly close attention to `netfs_wait_for_put_ra_refs` – that one warrants immediate double-checking; I'm certain there's some nuance in there that I need to clarify.

{
  "Expression": "void netfs_wait_for_put_ra_refs",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/internal.h=81=void netfs_wait_for_paused_write(struct netfs_io_request *rreq);\nfs/netfs/internal.h:82:void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq);\nfs/netfs/internal.h-83-\n--\nfs/netfs/misc.c=562=void netfs_wait_for_paused_write(struct netfs_io_request *rreq)\n--\nfs/netfs/misc.c-569- */\nfs/netfs/misc.c:570:void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq)\nfs/netfs/misc.c-571-{\n"
}

gemini-3.1-pro-preview

							input: 30821
							output: 36
							thoughts: 27

Okay, here's my interpretation of those thoughts, summarized from a first-person expert perspective:

**Non-Static Context & Verification**

Right, so we're dealing with something non-static here. That much is clear. My immediate thought is to zero in on a specific function within the networking file system context: `netfs_read_set_unlock_at`. Let's just make sure I'm recalling that correctly and that my understanding of its behavior in a non-static environment is completely sound. It's crucial to have a precise picture of what that function does in this particular context. Verification is key. No assumptions here. Let's dig in and make sure I know the nuance of `netfs_read_set_unlock_at`.

{
  "Expression": "void netfs_read_set_unlock_at",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/internal.h=103=static inline void netfs_see_subrequest(struct netfs_io_subrequest *subreq,\n--\nfs/netfs/internal.h-112- */\nfs/netfs/internal.h:113:void netfs_read_set_unlock_at(struct netfs_io_request *rreq);\nfs/netfs/internal.h-114-bool netfs_read_collection(struct netfs_io_request *rreq);\n--\nfs/netfs/read_collect.c=42=static void netfs_unlock_read_folio(struct netfs_io_request *rreq,\n--\nfs/netfs/read_collect.c-99- */\nfs/netfs/read_collect.c:100:void netfs_read_set_unlock_at(struct netfs_io_request *rreq)\nfs/netfs/read_collect.c-101-{\n"
}

gemini-3.1-pro-preview

							input: 31293
							output: 35
							thoughts: 26

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Checking the Non-Static Nature**

Alright, confirmed. The core point is that this isn't a static situation. Good. Now, given that, let's just make sure we've got the `netfs_read_subreq_progress` function completely nailed down. I need to make *absolutely* certain there's no misunderstanding of its behavior in this dynamic context. It's a critical function, and a quick double check is always worthwhile.

{
  "Expression": "void netfs_read_subreq_progress",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/read_collect.c=488=void netfs_read_collection_worker(struct work_struct *work)\n--\nfs/netfs/read_collect.c-511- */\nfs/netfs/read_collect.c:512:void netfs_read_subreq_progress(struct netfs_io_subrequest *subreq)\nfs/netfs/read_collect.c-513-{\n"
}

gemini-3.1-pro-preview

							input: 31593
							output: 37
							thoughts: 28

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing the Dynamic Nature**

Okay, so the code in question isn't static, meaning its behavior can change based on conditions. That's a key initial observation. Now, let's zero in on a specific function within the system: `netfs_unlock_abandoned_read_pages`. I need to re-examine that function closely. It's likely involved in handling read pages that are no longer needed, maybe due to an abandoned request or some kind of error. This is where the potential non-static behavior could introduce unexpected results. I need to understand its control flow, especially under various error scenarios or concurrent access situations to see how this impacts my analysis. Time to dig in.

{
  "Expression": "void netfs_unlock_abandoned_read_pages",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/internal.h=129=void netfs_retry_reads(struct netfs_io_request *rreq);\nfs/netfs/internal.h:130:void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq);\nfs/netfs/internal.h-131-\n--\nfs/netfs/read_retry.c=270=void netfs_retry_reads(struct netfs_io_request *rreq)\n--\nfs/netfs/read_retry.c-290- */\nfs/netfs/read_retry.c:291:void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq)\nfs/netfs/read_retry.c-292-{\n"
}

gemini-3.1-pro-preview

							input: 32031
							output: 35
							thoughts: 23

Here's my take on those thoughts:

**Analyzing `netfs_read_single`**

Okay, so the code in question isn't statically defined – that much is clear. Now, I need to drill down and make sure I understand how `netfs_read_single` is handling things. Let's see how it's dealing with the non-static elements. I'll need to go through it carefully. I'm going to pay extra attention to how it's interacting with any dynamic memory allocation or data structures. I want to make sure I understand the read path completely.

{
  "Expression": "ssize_t netfs_read_single",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/read_single.c=90=static int netfs_single_dispatch_read(struct netfs_io_request *rreq)\n--\nfs/netfs/read_single.c-161- */\nfs/netfs/read_single.c:162:ssize_t netfs_read_single(struct inode *inode, struct file *file, struct iov_iter *iter)\nfs/netfs/read_single.c-163-{\n"
}

gemini-3.1-pro-preview

							input: 32345
							output: 32
							thoughts: 23

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Non-Static, Double Check Time**

Okay, so the architecture definitely isn't static in this region. We're dealing with a dynamic situation, which is what I suspected given the behavior we've been observing.

Now, let's just make absolutely certain of this, let's head over and review `netfs_prepare_write`. I need to ensure that dynamic behavior is happening as expected in the method. I need to make certain that our assumptions align. We need to trace from there and make sure we can follow this process.

{
  "Expression": "void netfs_prepare_write",
  "PathPrefix": "fs/netfs/"
}

{
  "Output": "fs/netfs/internal.h=203=struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,\n--\nfs/netfs/internal.h-206-\t\t\t\t\t\tenum netfs_io_origin origin);\nfs/netfs/internal.h:207:void netfs_prepare_write(struct netfs_io_request *wreq,\nfs/netfs/internal.h-208-\t\t\t struct netfs_io_stream *stream,\n--\nfs/netfs/write_issue.c=90=struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,\n--\nfs/netfs/write_issue.c-145- */\nfs/netfs/write_issue.c:146:void netfs_prepare_write_failed(struct netfs_io_subrequest *subreq)\nfs/netfs/write_issue.c-147-{\n--\nfs/netfs/write_issue.c=151=EXPORT_SYMBOL(netfs_prepare_write_failed);\n--\nfs/netfs/write_issue.c-156- */\nfs/netfs/write_issue.c:157:void netfs_prepare_write(struct netfs_io_request *wreq,\nfs/netfs/write_issue.c-158-\t\t\t struct netfs_io_stream *stream,\n"
}

gemini-3.1-pro-preview

							input: 32894
							output: 31
							thoughts: 60

**My Analysis of the Filesystem Configuration**

Okay, so the context indicates this isn't a static situation – good, that gives us some flexibility. Now, let's see, the configurations involved are: `NETFS_SUPPORT`, `CACHEFILES`, `9P_FS`, `CIFS`, `CEPH_FS`, and `AFS_FS`. Given my expertise, I immediately recognize these as key elements related to network and distributed filesystems. I want to zero in on `9P_FS` – it's a protocol of interest. I'm going to quickly check for any dependencies associated with it; understanding those dependencies will be crucial to determining its overall impact and how it integrates with the other options.

{
  "Expression": "config 9P_FS",
  "PathPrefix": "fs/9p/"
}

{
  "Output": "fs/9p/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/9p/Kconfig:2:config 9P_FS\nfs/9p/Kconfig-3-\ttristate \"Plan 9 Resource Sharing Support (9P2000)\"\n--\nfs/9p/Kconfig=14=if 9P_FS\nfs/9p/Kconfig:15:config 9P_FSCACHE\nfs/9p/Kconfig-16-\tbool \"Enable 9P client caching support\"\n--\nfs/9p/Kconfig-22-\nfs/9p/Kconfig:23:config 9P_FS_POSIX_ACL\nfs/9p/Kconfig-24-\tbool \"9P POSIX Access Control Lists\"\n--\nfs/9p/Kconfig=32=endif\n--\nfs/9p/Kconfig-34-\nfs/9p/Kconfig:35:config 9P_FS_SECURITY\nfs/9p/Kconfig-36-\tbool \"9P Security Labels\"\n"
}

gemini-3.1-pro-preview

							input: 33409
							output: 30
							thoughts: 24

Here's my thought process, as it stands:

**Dependency Check: 9P\_FS & NET\_9P**

Okay, so `9P_FS` relies on `NET_9P`. That's a fundamental relationship I need to understand before proceeding. Before I dive any deeper into `9P_FS`, I'm going to quickly verify the state of `NET_9P`. I need to ensure it's properly configured or enabled (depending on the context - is this a configuration file, build system, or runtime environment?). Its status will be key to understanding the validity or potential issues with `9P_FS`. I'm essentially tracing a dependency to make sure the foundation is solid before I build on top of it.

{
  "Expression": "config NET_9P",
  "PathPrefix": "net/9p/"
}

{
  "Output": "net/9p/Kconfig-5-\nnet/9p/Kconfig:6:menuconfig NET_9P\nnet/9p/Kconfig-7-\ttristate \"Plan 9 Resource Sharing Support (9P2000)\"\n--\nnet/9p/Kconfig=17=if NET_9P\nnet/9p/Kconfig-18-\nnet/9p/Kconfig:19:config NET_9P_FD\nnet/9p/Kconfig-20-\tdefault NET_9P\n--\nnet/9p/Kconfig-27-\nnet/9p/Kconfig:28:config NET_9P_VIRTIO\nnet/9p/Kconfig-29-\tdepends on VIRTIO\n--\nnet/9p/Kconfig-34-\nnet/9p/Kconfig:35:config NET_9P_XEN\nnet/9p/Kconfig-36-\tdepends on XEN\n--\nnet/9p/Kconfig-42-\nnet/9p/Kconfig:43:config NET_9P_USBG\nnet/9p/Kconfig-44-\ttristate \"9P USB Gadget Transport\"\n--\nnet/9p/Kconfig-51-\nnet/9p/Kconfig:52:config NET_9P_RDMA\nnet/9p/Kconfig-53-\tdepends on INET \u0026\u0026 INFINIBAND \u0026\u0026 INFINIBAND_ADDR_TRANS\n--\nnet/9p/Kconfig-57-\nnet/9p/Kconfig:58:config NET_9P_DEBUG\nnet/9p/Kconfig-59-\tbool \"Debug information\"\n"
}

gemini-3.1-pro-preview

							input: 34035
							output: 30
							thoughts: 21

Here's my take on those thoughts:

**Analyzing Network Protocol Requirements**

Okay, so the project's architecture mandates the presence of `NET_9P`. That's the baseline. Now, before I proceed with any further integration steps, I need to thoroughly understand how `CIFS` dependencies factor into this. I'll take a look at the relationship of `CIFS` to `NET_9P`. Are there any inherent conflicts, or maybe hidden advantages to the coexistence of these two? What assumptions is this system making? Time to dig into the documentation and see what the build system wants.

{
  "Expression": "config CIFS",
  "PathPrefix": "fs/smb/client/"
}

{
  "Output": "fs/smb/client/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/smb/client/Kconfig:2:config CIFS\nfs/smb/client/Kconfig-3-\ttristate \"SMB3 and CIFS support (advanced network filesystem)\"\n--\nfs/smb/client/Kconfig-53-\nfs/smb/client/Kconfig:54:config CIFS_STATS2\nfs/smb/client/Kconfig-55-\tbool \"Extended statistics\"\n--\nfs/smb/client/Kconfig-67-\nfs/smb/client/Kconfig:68:config CIFS_ALLOW_INSECURE_LEGACY\nfs/smb/client/Kconfig-69-\tbool \"Support legacy servers which use less secure dialects\"\n--\nfs/smb/client/Kconfig-82-\nfs/smb/client/Kconfig:83:config CIFS_UPCALL\nfs/smb/client/Kconfig-84-\tbool \"Kerberos/SPNEGO advanced session setup\"\n--\nfs/smb/client/Kconfig-91-\nfs/smb/client/Kconfig:92:config CIFS_XATTR\nfs/smb/client/Kconfig-93-\tbool \"CIFS extended attributes\"\n--\nfs/smb/client/Kconfig-106-\nfs/smb/client/Kconfig:107:config CIFS_POSIX\nfs/smb/client/Kconfig-108-\tbool \"CIFS POSIX Extensions\"\n--\nfs/smb/client/Kconfig-118-\nfs/smb/client/Kconfig:119:config CIFS_DEBUG\nfs/smb/client/Kconfig-120-\tbool \"Enable CIFS debugging routines\"\n--\nfs/smb/client/Kconfig-127-\nfs/smb/client/Kconfig:128:config CIFS_DEBUG2\nfs/smb/client/Kconfig-129-\tbool \"Enable additional CIFS debugging routines\"\n--\nfs/smb/client/Kconfig-138-\nfs/smb/client/Kconfig:139:config CIFS_DEBUG_DUMP_KEYS\nfs/smb/client/Kconfig-140-\tbool \"Dump encryption keys for offline decryption (Unsafe)\"\n--\nfs/smb/client/Kconfig-148-\nfs/smb/client/Kconfig:149:config CIFS_DFS_UPCALL\nfs/smb/client/Kconfig-150-\tbool \"DFS feature support\"\n--\nfs/smb/client/Kconfig-161-\nfs/smb/client/Kconfig:162:config CIFS_SWN_UPCALL\nfs/smb/client/Kconfig-163-\tbool \"SWN feature support\"\n--\nfs/smb/client/Kconfig-172-\nfs/smb/client/Kconfig:173:config CIFS_NFSD_EXPORT\nfs/smb/client/Kconfig-174-\tbool \"Allow nfsd to export CIFS file system\"\n--\nfs/smb/client/Kconfig=179=if CIFS\nfs/smb/client/Kconfig-180-\nfs/smb/client/Kconfig:181:config CIFS_SMB_DIRECT\nfs/smb/client/Kconfig-182-\tbool \"SMB Direct support\"\n--\nfs/smb/client/Kconfig-190-\nfs/smb/client/Kconfig:191:config CIFS_FSCACHE\nfs/smb/client/Kconfig-192-\tbool \"Provide CIFS client caching support\"\n--\nfs/smb/client/Kconfig-198-\nfs/smb/client/Kconfig:199:config CIFS_ROOT\nfs/smb/client/Kconfig-200-\tbool \"SMB root file system (Experimental)\"\n--\nfs/smb/client/Kconfig-206-\nfs/smb/client/Kconfig:207:config CIFS_COMPRESSION\nfs/smb/client/Kconfig-208-\tbool \"SMB message compression (Experimental)\"\n"
}

gemini-3.1-pro-preview

							input: 35257
							output: 29
							thoughts: 22

Here's my thought process, as it stands:

**Dependency Deep Dive**

Okay, so I'm thinking about file systems and their relationships. Right off the bat, I know that CIFS, the Common Internet File System, leans on INET, which makes perfect sense. I mean, it's inherently a network protocol, so it needs the Internet Protocol. Makes sense, that's basic networking.

Now, I'm shifting gears. I need to understand the architecture a little better so now I'm thinking I should really dig into the dependency landscape for CEPH_FS. Where does that stand in relation to everything else? What core components is *that* built on? I need to figure out it's stack of dependencies.

{
  "Expression": "config CEPH_FS",
  "PathPrefix": "fs/ceph/"
}

{
  "Output": "fs/ceph/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/ceph/Kconfig:2:config CEPH_FS\nfs/ceph/Kconfig-3-\ttristate \"Ceph distributed file system\"\n--\nfs/ceph/Kconfig=19=if CEPH_FS\nfs/ceph/Kconfig:20:config CEPH_FSCACHE\nfs/ceph/Kconfig-21-\tbool \"Enable Ceph client caching support\"\n--\nfs/ceph/Kconfig=27=endif\nfs/ceph/Kconfig-28-\nfs/ceph/Kconfig:29:config CEPH_FS_POSIX_ACL\nfs/ceph/Kconfig-30-\tbool \"Ceph POSIX Access Control Lists\"\n--\nfs/ceph/Kconfig-38-\nfs/ceph/Kconfig:39:config CEPH_FS_SECURITY_LABEL\nfs/ceph/Kconfig-40-\tbool \"CephFS Security Labels\"\n"
}

gemini-3.1-pro-preview

							input: 35712
							output: 29
							thoughts: 23

Here's my thought process, as it went:

**Dependency Deep Dive**

Okay, so `CEPH_FS` is explicitly reliant on `INET`. That's not surprising, it's a distributed filesystem and needs network connectivity. Now, let's switch gears and investigate the dependencies for `AFS_FS`. Understanding its prerequisites is crucial for figuring out how all of these components integrate. I need to make sure I'm not missing any other implied dependencies.

{
  "Expression": "config AFS_FS",
  "PathPrefix": "fs/afs/"
}

{
  "Output": "fs/afs/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/afs/Kconfig:2:config AFS_FS\nfs/afs/Kconfig-3-\ttristate \"Andrew File System support (AFS)\"\n--\nfs/afs/Kconfig=17=config AFS_DEBUG\n--\nfs/afs/Kconfig-26-\nfs/afs/Kconfig:27:config AFS_FSCACHE\nfs/afs/Kconfig-28-\tbool \"Provide AFS client caching support\"\n"
}

gemini-3.1-pro-preview

							input: 36004
							output: 30
							thoughts: 98

**My Configuration Conundrum**

Right, so I'm tackling these file system configurations. I see that `AFS_FS` is dependent on `INET`, which makes sense. Looking at the list, I have: `NETFS_SUPPORT`, `CACHEFILES`, `9P_FS`, `NET_9P`, `CIFS`, `CEPH_FS`, and that problematic `AFS_FS` to deal with.

Aha! `NETFS_SUPPORT` is a common denominator, required by all of them. That simplifies things immensely; enabling `NETFS_SUPPORT` should be the key to getting these net filesystems going. Now that I am at it, I should verify the settings for `NFS_FS` and `NFS_FSCACHE` as well, just to be thorough and ensure the environment is fully accounted for.

{
  "Expression": "config NFS_FSCACHE",
  "PathPrefix": "fs/nfs/"
}

{
  "Output": "fs/nfs/Kconfig=162=config ROOT_NFS\n--\nfs/nfs/Kconfig-172-\nfs/nfs/Kconfig:173:config NFS_FSCACHE\nfs/nfs/Kconfig-174-\tbool \"Provide NFS client caching support\"\n"
}

gemini-3.1-pro-preview

							input: 36396
							output: 372
							thoughts: 537

**My Assessment of the NetFS Changes**

Okay, so I've been looking over these modifications, and it looks like `NFS_FS` and `NFS_FSCACHE` are potentially quite relevant here as well. Let's start with a solid configuration overview, just to keep things straight in my head: `NETFS_SUPPORT`, `CACHEFILES`, `9P_FS`, `NET_9P`, `CIFS`, `CEPH_FS`, `AFS_FS`, `NFS_FS`, and `NFS_FSCACHE`. That's the landscape we're dealing with.

Now, let's drill down to the symbols that are specifically impacted and are worth a deeper look: `cachefiles_set_object_xattr`, `cachefiles_check_auxdata`, `netfs_readahead`, `netfs_read_folio`, `netfs_write_begin`, `netfs_prefetch_for_write`, `netfs_unbuffered_write_iter_locked`, `netfs_wait_for_put_ra_refs`, `netfs_alloc_request`, `netfs_read_set_unlock_at`, `netfs_read_subreq_progress`, `netfs_unlock_abandoned_read_pages`, `netfs_read_single`, `rolling_buffer_bulk_load_from_ra`, and `netfs_prepare_write`. Seems comprehensive.

I made sure I reviewed all other modified functions, but it looks like `netfs_unbuffered_write_done`, `netfs_unbuffered_write`, `netfs_create_singular_buffer`, `netfs_read_gaps`, `netfs_read_to_pagecache`, `netfs_prepare_read_iterator`, `netfs_bulk_drop_ra_refs`, and `netfs_maybe_bulk_drop_ra_refs` are all static, so those are probably okay.

From what I can tell, this patch is introducing some fundamental changes to the `netfs` library. It's touching on how readahead is handled, the mechanics of read iterators, and folio unlocking. The fixes for unaligned memory accesses in `cachefiles` and a potential zero-length iterator issue in `netfs_unbuffered_write` are important, and they address actual issues. These changes touch on core I/O paths, and network file systems like 9p, cifs, ceph, afs, which are all likely to be present in various virtualized environments. Given the breadth of the impact, I'm thinking this is definitely worth some fuzzing.

{
  "EnableConfigs": [
    "NETFS_SUPPORT",
    "CACHEFILES",
    "9P_FS",
    "NET_9P",
    "CIFS",
    "CEPH_FS",
    "AFS_FS",
    "NFS_FS",
    "NFS_FSCACHE"
  ],
  "FocusSymbols": [
    "cachefiles_set_object_xattr",
    "cachefiles_check_auxdata",
    "netfs_readahead",
    "netfs_read_folio",
    "netfs_write_begin",
    "netfs_prefetch_for_write",
    "netfs_unbuffered_write_iter_locked",
    "netfs_wait_for_put_ra_refs",
    "netfs_alloc_request",
    "netfs_read_set_unlock_at",
    "netfs_read_subreq_progress",
    "netfs_unlock_abandoned_read_pages",
    "netfs_read_single",
    "rolling_buffer_bulk_load_from_ra",
    "netfs_prepare_write"
  ],
  "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "NETFS_SUPPORT",
    "CACHEFILES",
    "9P_FS",
    "NET_9P",
    "CIFS",
    "CEPH_FS",
    "AFS_FS",
    "NFS_FS",
    "NFS_FSCACHE"
  ],
  "FocusSymbols": [
    "cachefiles_set_object_xattr",
    "cachefiles_check_auxdata",
    "netfs_readahead",
    "netfs_read_folio",
    "netfs_write_begin",
    "netfs_prefetch_for_write",
    "netfs_unbuffered_write_iter_locked",
    "netfs_wait_for_put_ra_refs",
    "netfs_alloc_request",
    "netfs_read_set_unlock_at",
    "netfs_read_subreq_progress",
    "netfs_unlock_abandoned_read_pages",
    "netfs_read_single",
    "rolling_buffer_bulk_load_from_ra",
    "netfs_prepare_write"
  ],
  "Reasoning": "The patch introduces significant functional changes to the netfs library (used by network filesystems like 9p, cifs, ceph, afs) and cachefiles. It alters how readahead references are managed, how read iterators are prepared, and how folios are unlocked. It also fixes unaligned memory access in cachefiles xattr handling and a potential zero-length iterator issue in netfs_unbuffered_write. These changes affect core I/O paths for network filesystems, which are reachable in virtualized environments via loopback or local mounts.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

{
  "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.",
  "NeedsKMSAN": true
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 973032d62ca4dc98bf40ee8ea0fc4e48fdbf7eb9
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 25 14:11:17 2026 +0000

    syz-cluster: applied patch under review

diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index f8ae78b3f7b6d..c70bf67e52b01 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -13,6 +13,7 @@
 #include <linux/quotaops.h>
 #include <linux/xattr.h>
 #include <linux/slab.h>
+#include <linux/unaligned.h>
 #include "internal.h"
 
 #define CACHEFILES_COOKIE_TYPE_DATA 1
@@ -50,7 +51,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 
 	_enter("%x,#%d", object->debug_id, len);
 
-	buf = kmalloc(sizeof(struct cachefiles_xattr) + len, GFP_KERNEL);
+	buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
@@ -60,6 +61,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 	buf->content		= object->content_info;
 	if (test_bit(FSCACHE_COOKIE_LOCAL_WRITE, &object->cookie->flags))
 		buf->content	= CACHEFILES_CONTENT_DIRTY;
+	put_unaligned_be64(0, (__be64 *)buf->data);
 	if (len > 0)
 		memcpy(buf->data, fscache_get_aux(object->cookie), len);
 
@@ -77,8 +79,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 		trace_cachefiles_vfs_error(object, file_inode(file), ret,
 					   cachefiles_trace_setxattr_error);
 		trace_cachefiles_coherency(object, file_inode(file)->i_ino,
-					   be64_to_cpup((__be64 *)buf->data),
-					   buf->content,
+					   buf->data, buf->content,
 					   cachefiles_coherency_set_fail);
 		if (ret != -ENOMEM)
 			cachefiles_io_error_obj(
@@ -86,8 +87,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object)
 				"Failed to set xattr with error %d", ret);
 	} else {
 		trace_cachefiles_coherency(object, file_inode(file)->i_ino,
-					   be64_to_cpup((__be64 *)buf->data),
-					   buf->content,
+					   buf->data, buf->content,
 					   cachefiles_coherency_set_ok);
 	}
 
@@ -110,9 +110,10 @@ int cachefiles_check_auxdata(struct cachefiles_object *object, struct file *file
 	int ret = -ESTALE;
 
 	tlen = sizeof(struct cachefiles_xattr) + len;
-	buf = kmalloc(tlen, GFP_KERNEL);
+	buf = kmalloc(sizeof(struct cachefiles_xattr) + max(len, sizeof(__be64)), GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
+	put_unaligned_be64(0, (__be64 *)buf->data);
 
 	xlen = cachefiles_inject_read_error();
 	if (xlen == 0)
@@ -148,8 +149,7 @@ int cachefiles_check_auxdata(struct cachefiles_object *object, struct file *file
 
 out:
 	trace_cachefiles_coherency(object, file_inode(file)->i_ino,
-				   be64_to_cpup((__be64 *)buf->data),
-				   buf->content, why);
+				   buf->data, buf->content, why);
 	kfree(buf);
 	return ret;
 }
diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
index 7fdfa4f27e349..a2a9d8c083f99 100644
--- a/fs/netfs/buffered_read.c
+++ b/fs/netfs/buffered_read.c
@@ -54,6 +54,42 @@ static void netfs_rreq_expand(struct netfs_io_request *rreq,
 	}
 }
 
+/*
+ * Drop the folio refs acquired from the readahead API.
+ */
+static void netfs_bulk_drop_ra_refs(struct netfs_io_request *rreq)
+{
+	struct folio_batch fbatch;
+	struct folio *folio;
+	pgoff_t nr_pages = DIV_ROUND_UP(rreq->len, PAGE_SIZE);
+	pgoff_t first = rreq->start / PAGE_SIZE;
+	XA_STATE(xas, &rreq->mapping->i_pages, first);
+
+	folio_batch_init(&fbatch);
+
+	rcu_read_lock();
+
+	xas_for_each(&xas, folio,  first + nr_pages - 1) {
+		if (xas_retry(&xas, folio))
+			continue;
+
+		if (!folio_batch_add(&fbatch, folio))
+			folio_batch_release(&fbatch);
+	}
+
+	rcu_read_unlock();
+	folio_batch_release(&fbatch);
+	trace_netfs_rreq(rreq, netfs_rreq_trace_ra_put_ref);
+	clear_bit_unlock(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags);
+	wake_up(&rreq->waitq);
+}
+
+static void netfs_maybe_bulk_drop_ra_refs(struct netfs_io_request *rreq)
+{
+	if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+		netfs_bulk_drop_ra_refs(rreq);
+}
+
 /*
  * Begin an operation, and fetch the stored zero point value from the cookie if
  * available.
@@ -74,12 +110,8 @@ static int netfs_begin_cache_read(struct netfs_io_request *rreq, struct netfs_in
  *
  * Returns the limited size if successful and -ENOMEM if insufficient memory
  * available.
- *
- * [!] NOTE: This must be run in the same thread as ->issue_read() was called
- * in as we access the readahead_control struct.
  */
-static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq,
-					   struct readahead_control *ractl)
+static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq)
 {
 	struct netfs_io_request *rreq = subreq->rreq;
 	size_t rsize = subreq->len;
@@ -87,30 +119,6 @@ static ssize_t netfs_prepare_read_iterator(struct netfs_io_subrequest *subreq,
 	if (subreq->source == NETFS_DOWNLOAD_FROM_SERVER)
 		rsize = umin(rsize, rreq->io_streams[0].sreq_max_len);
 
-	if (ractl) {
-		/* If we don't have sufficient folios in the rolling buffer,
-		 * extract a folioq's worth from the readahead region at a time
-		 * into the buffer.  Note that this acquires a ref on each page
-		 * that we will need to release later - but we don't want to do
-		 * that until after we've started the I/O.
-		 */
-		struct folio_batch put_batch;
-
-		folio_batch_init(&put_batch);
-		while (rreq->submitted < subreq->start + rsize) {
-			ssize_t added;
-
-			added = rolling_buffer_load_from_ra(&rreq->buffer, ractl,
-							    &put_batch);
-			if (added < 0) {
-				folio_batch_release(&put_batch);
-				return added;
-			}
-			rreq->submitted += added;
-		}
-		folio_batch_release(&put_batch);
-	}
-
 	subreq->len = rsize;
 	if (unlikely(rreq->io_streams[0].sreq_max_segs)) {
 		size_t limit = netfs_limit_iter(&rreq->buffer.iter, 0, rsize,
@@ -208,8 +216,7 @@ static void netfs_issue_read(struct netfs_io_request *rreq,
  * slicing up the region to be read according to available cache blocks and
  * network rsize.
  */
-static void netfs_read_to_pagecache(struct netfs_io_request *rreq,
-				    struct readahead_control *ractl)
+static void netfs_read_to_pagecache(struct netfs_io_request *rreq)
 {
 	unsigned long long start = rreq->start;
 	ssize_t size = rreq->len;
@@ -288,7 +295,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq,
 		break;
 
 	issue:
-		slice = netfs_prepare_read_iterator(subreq, ractl);
+		slice = netfs_prepare_read_iterator(subreq);
 		if (slice < 0) {
 			ret = slice;
 			netfs_cancel_read(subreq, ret);
@@ -302,6 +309,7 @@ static void netfs_read_to_pagecache(struct netfs_io_request *rreq,
 		}
 
 		netfs_issue_read(rreq, subreq);
+		netfs_maybe_bulk_drop_ra_refs(rreq);
 
 		if (test_bit(NETFS_RREQ_PAUSE, &rreq->flags))
 			netfs_wait_for_paused_read(rreq);
@@ -339,7 +347,8 @@ void netfs_readahead(struct readahead_control *ractl)
 {
 	struct netfs_io_request *rreq;
 	struct netfs_inode *ictx = netfs_inode(ractl->mapping->host);
-	unsigned long long start = readahead_pos(ractl);
+	ssize_t added;
+	uoff_t start = readahead_pos(ractl);
 	size_t size = readahead_length(ractl);
 	int ret;
 
@@ -360,11 +369,24 @@ void netfs_readahead(struct readahead_control *ractl)
 
 	netfs_rreq_expand(rreq, ractl);
 
-	rreq->submitted = rreq->start;
-	if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST, rreq->gfp) < 0)
+	/* Load the folios to be read into a bvecq chain.  Note that this
+	 * acquires a ref on each folio that we will need to release later -
+	 * but we don't want to do that until after we've started the I/O.
+	 */
+	added = rolling_buffer_bulk_load_from_ra(&rreq->buffer, ractl,
+						 rreq->debug_id, rreq->gfp);
+	if (added < 0) {
+		ret = added;
 		goto cleanup_free;
-	netfs_read_to_pagecache(rreq, ractl);
+	}
+	__set_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags);
+
+	rreq->submitted = rreq->start + added;
+	rreq->cleaned_to = rreq->start;
+	netfs_read_set_unlock_at(rreq);
 
+	netfs_read_to_pagecache(rreq);
+	netfs_maybe_bulk_drop_ra_refs(rreq);
 	return netfs_put_request(rreq, netfs_rreq_trace_put_return);
 
 cleanup_free:
@@ -387,6 +409,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request *rreq, struct fo
 	if (added < 0)
 		return added;
 	rreq->submitted = rreq->start + added;
+	rreq->progress_at = added;
 	return 0;
 }
 
@@ -457,7 +480,7 @@ static int netfs_read_gaps(struct file *file, struct folio *folio)
 	iov_iter_bvec(&rreq->buffer.iter, ITER_DEST, bvec, i, rreq->len);
 	rreq->submitted = rreq->start + flen;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 
 	ret = netfs_wait_for_read(rreq);
 	if (ret >= 0) {
@@ -532,7 +555,7 @@ int netfs_read_folio(struct file *file, struct folio *folio)
 	if (ret < 0)
 		goto discard;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 	ret = netfs_wait_for_read(rreq);
 	netfs_put_request(rreq, netfs_rreq_trace_put_return);
 	return ret < 0 ? ret : 0;
@@ -689,7 +712,7 @@ int netfs_write_begin(struct netfs_inode *ctx,
 	if (ret < 0)
 		goto error_put;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 	ret = netfs_wait_for_read(rreq);
 	netfs_put_request(rreq, netfs_rreq_trace_put_return);
 	if (ret < 0)
@@ -754,7 +777,7 @@ int netfs_prefetch_for_write(struct file *file, struct folio *folio,
 	if (ret < 0)
 		goto error_put;
 
-	netfs_read_to_pagecache(rreq, NULL);
+	netfs_read_to_pagecache(rreq);
 	ret = netfs_wait_for_read(rreq);
 	netfs_put_request(rreq, netfs_rreq_trace_put_return);
 	return ret < 0 ? ret : 0;
diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c
index c16fbad286a17..7173ce04bac63 100644
--- a/fs/netfs/direct_write.c
+++ b/fs/netfs/direct_write.c
@@ -21,7 +21,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request *wreq)
 	/* Okay, declare that all I/O is complete. */
 	trace_netfs_rreq(wreq, netfs_rreq_trace_write_done);
 
-	if (!wreq->error)
+	if (wreq->transferred)
 		netfs_update_i_size(ictx, &ictx->inode, wreq->start, wreq->transferred);
 
 	if (wreq->origin == NETFS_DIO_WRITE &&
@@ -51,7 +51,7 @@ static void netfs_unbuffered_write_done(struct netfs_io_request *wreq)
 		wreq->iocb->ki_pos += written;
 		if (wreq->iocb->ki_complete) {
 			trace_netfs_rreq(wreq, netfs_rreq_trace_ki_complete);
-			wreq->iocb->ki_complete(wreq->iocb, wreq->error ?: written);
+			wreq->iocb->ki_complete(wreq->iocb, written ?: wreq->error);
 		}
 		wreq->iocb = VFS_PTR_POISON;
 	}
@@ -95,7 +95,7 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 {
 	struct netfs_io_subrequest *subreq = NULL;
 	struct netfs_io_stream *stream = &wreq->io_streams[0];
-	int ret;
+	int ret = 0;
 
 	_enter("%llx", wreq->len);
 
@@ -110,6 +110,10 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 		if (!subreq) {
 			netfs_prepare_write(wreq, stream, wreq->start + wreq->transferred);
 			subreq = stream->construct;
+			if (!subreq) {
+				ret = -ENOMEM;
+				break;
+			}
 			stream->construct = NULL;
 		}
 
@@ -121,8 +125,14 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 		}
 
 		iov_iter_truncate(&subreq->io_iter, wreq->len - wreq->transferred);
-		if (!iov_iter_count(&subreq->io_iter))
+		if (!iov_iter_count(&subreq->io_iter)) {
+			pr_warn("netfs: Unexpected zero-length iterator R=%08x\n",
+				wreq->debug_id);
+			__set_bit(NETFS_SREQ_FAILED, &subreq->flags);
+			netfs_write_subrequest_terminated(subreq, -EIO);
+			wreq->error = -EIO;
 			break;
+		}
 
 		subreq->len = netfs_limit_iter(&subreq->io_iter, 0,
 					       stream->sreq_max_len,
@@ -139,13 +149,11 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq)
 		if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
 			retry = true;
 		} else if (test_bit(NETFS_SREQ_FAILED, &subreq->flags)) {
-			ret = subreq->error;
-			wreq->error = ret;
+			wreq->error = subreq->error;
 			netfs_see_subrequest(subreq, netfs_sreq_trace_see_failed);
 			subreq = NULL;
 			break;
 		}
-		ret = 0;
 
 		if (!retry) {
 			netfs_unbuffered_write_collect(wreq, stream, subreq);
@@ -288,11 +296,11 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *
 		ret = -EIOCBQUEUED;
 	} else {
 		ret = netfs_unbuffered_write(wreq);
-		if (ret < 0) {
-			_debug("begin = %zd", ret);
-		} else {
+		if (wreq->transferred) {
 			iocb->ki_pos += wreq->transferred;
-			ret = wreq->transferred ?: wreq->error;
+			ret = wreq->transferred;
+		} else if (wreq->error) {
+			ret = wreq->error;
 		}
 
 		netfs_put_request(wreq, netfs_rreq_trace_put_complete);
diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h
index 420ee7b26580f..c734cad7063e5 100644
--- a/fs/netfs/internal.h
+++ b/fs/netfs/internal.h
@@ -79,6 +79,7 @@ ssize_t netfs_wait_for_read(struct netfs_io_request *rreq);
 ssize_t netfs_wait_for_write(struct netfs_io_request *rreq);
 void netfs_wait_for_paused_read(struct netfs_io_request *rreq);
 void netfs_wait_for_paused_write(struct netfs_io_request *rreq);
+void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq);
 
 /*
  * objects.c
@@ -109,6 +110,7 @@ static inline void netfs_see_subrequest(struct netfs_io_subrequest *subreq,
 /*
  * read_collect.c
  */
+void netfs_read_set_unlock_at(struct netfs_io_request *rreq);
 bool netfs_read_collection(struct netfs_io_request *rreq);
 void netfs_read_collection_worker(struct work_struct *work);
 void netfs_cancel_read(struct netfs_io_subrequest *subreq, int error);
diff --git a/fs/netfs/misc.c b/fs/netfs/misc.c
index 5d554512ed23a..f5c1c463f4ff7 100644
--- a/fs/netfs/misc.c
+++ b/fs/netfs/misc.c
@@ -563,3 +563,22 @@ void netfs_wait_for_paused_write(struct netfs_io_request *rreq)
 {
 	return netfs_wait_for_pause(rreq, netfs_write_collection);
 }
+
+/*
+ * Wait for the readahead-acquired refs to be put.
+ */
+void netfs_wait_for_put_ra_refs(struct netfs_io_request *rreq)
+{
+	DEFINE_WAIT(myself);
+
+	for (;;) {
+		trace_netfs_rreq(rreq, netfs_rreq_trace_wait_put_ra_refs);
+		prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE);
+		if (!test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+			break;
+		schedule();
+	}
+
+	trace_netfs_rreq(rreq, netfs_rreq_trace_waited_put_ra_refs);
+	finish_wait(&rreq->waitq, &myself);
+}
diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
index 01461a74642d6..7f6a3e912602e 100644
--- a/fs/netfs/objects.c
+++ b/fs/netfs/objects.c
@@ -41,24 +41,32 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
 
 	memset(rreq, 0, kmem_cache_size(cache));
 	INIT_WORK(&rreq->cleanup_work, netfs_free_request);
-	rreq->gfp	= gfp;
-	rreq->start	= start;
-	rreq->len	= len;
-	rreq->origin	= origin;
-	rreq->netfs_ops	= ctx->ops;
-	rreq->mapping	= mapping;
-	rreq->inode	= inode;
-	rreq->i_size	= i_size_read(inode);
-	rreq->debug_id	= atomic_inc_return(&debug_ids);
-	rreq->wsize	= INT_MAX;
+	rreq->gfp		= gfp;
+	rreq->start		= start;
+	rreq->collected_to	= start;
+	rreq->cleaned_to	= start;
+	rreq->len		= len;
+	rreq->progress_at	= 0;
+	rreq->origin		= origin;
+	rreq->netfs_ops		= ctx->ops;
+	rreq->mapping		= mapping;
+	rreq->inode		= inode;
+	rreq->i_size		= i_size_read(inode);
+	rreq->debug_id		= atomic_inc_return(&debug_ids);
+	rreq->wsize		= INT_MAX;
 	rreq->io_streams[0].sreq_max_len = ULONG_MAX;
 	rreq->io_streams[0].sreq_max_segs = 0;
 	spin_lock_init(&rreq->lock);
-	INIT_LIST_HEAD(&rreq->io_streams[0].subrequests);
-	INIT_LIST_HEAD(&rreq->io_streams[1].subrequests);
 	init_waitqueue_head(&rreq->waitq);
 	refcount_set(&rreq->ref, 2);
 
+	for (int s = 0; s < NR_IO_STREAMS; s++) {
+		struct netfs_io_stream *stream = &rreq->io_streams[s];
+
+		INIT_LIST_HEAD(&stream->subrequests);
+		stream->collected_to = rreq->start;
+	}
+
 	if (origin == NETFS_READAHEAD ||
 	    origin == NETFS_READPAGE ||
 	    origin == NETFS_READ_GAPS ||
diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
index 23660a5901246..8ba162cf568b2 100644
--- a/fs/netfs/read_collect.c
+++ b/fs/netfs/read_collect.c
@@ -94,6 +94,35 @@ static void netfs_unlock_read_folio(struct netfs_io_request *rreq,
 	folioq_clear(folioq, slot);
 }
 
+/*
+ * Determine how much to gather before unlocking more folios.
+ */
+void netfs_read_set_unlock_at(struct netfs_io_request *rreq)
+{
+	struct folio_queue *folioq = rreq->buffer.tail;
+	unsigned int slot = rreq->buffer.first_tail_slot;
+	size_t cleaned_to = rreq->cleaned_to - rreq->start;
+	size_t progress_at = cleaned_to;
+	size_t minimum = 256 * 1024;
+
+	while (progress_at < rreq->len) {
+		if (slot >= folioq_count(folioq)) {
+			folioq = folioq->next;
+			if (!folioq)
+				break;
+			slot = 0;
+		}
+
+		progress_at += folioq_folio_size(folioq, slot);
+		if (progress_at - cleaned_to >= minimum)
+			break;
+		slot++;
+	}
+
+	WRITE_ONCE(rreq->progress_at, progress_at);
+	trace_netfs_read_progress_at(rreq);
+}
+
 /*
  * Unlock any folios we've finished with.
  */
@@ -112,16 +141,22 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 	if (slot >= folioq_nr_slots(folioq)) {
 		folioq = rolling_buffer_delete_spent(&rreq->buffer);
 		if (!folioq) {
-			rreq->front_folio_order = 0;
+			WRITE_ONCE(rreq->progress_at, ULONG_MAX);
 			return;
 		}
 		slot = 0;
 	}
 
+	/* We have to wait for readahead refs to have been released before we
+	 * can unlock any folios as the ref-dropper walks i_pages and the only
+	 * thing preventing these folios from being removed is the folio lock.
+	 */
+	if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+		netfs_wait_for_put_ra_refs(rreq);
+
 	for (;;) {
 		struct folio *folio;
-		unsigned long long fpos, fend;
-		unsigned int order;
+		unsigned long long fpos = rreq->cleaned_to, fend;
 		size_t fsize;
 
 		if (*notes & COPY_TO_CACHE)
@@ -133,9 +168,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 			      rreq->debug_id, folio->index))
 			trace_netfs_folio(folio, netfs_folio_trace_not_locked);
 
-		order = folioq_folio_order(folioq, slot);
-		rreq->front_folio_order = order;
-		fsize = PAGE_SIZE << order;
+		fsize = folioq_folio_size(folioq, slot);
 		fpos = folio_pos(folio);
 		fend = fpos + fsize;
 
@@ -146,7 +179,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 			break;
 
 		netfs_unlock_read_folio(rreq, folioq, slot);
-		WRITE_ONCE(rreq->cleaned_to, fpos + fsize);
+		WRITE_ONCE(rreq->cleaned_to, fend);
 		*notes |= MADE_PROGRESS;
 
 		clear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, &rreq->flags);
@@ -172,6 +205,8 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
 	rreq->buffer.tail = folioq;
 done:
 	rreq->buffer.first_tail_slot = slot;
+
+	netfs_read_set_unlock_at(rreq);
 }
 
 /*
@@ -232,7 +267,7 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq)
 		 * subreqs.
 		 */
 		if (notes & BUFFERED) {
-			size_t fsize = PAGE_SIZE << rreq->front_folio_order;
+			uoff_t unlock_at = rreq->start + rreq->progress_at;
 
 			/* Clear the tail of a short read. */
 			if (!(notes & HIT_PENDING) &&
@@ -257,7 +292,7 @@ static void netfs_collect_read_results(struct netfs_io_request *rreq)
 				transferred = front->len;
 				trace_netfs_rreq(rreq, netfs_rreq_trace_set_abandon);
 			}
-			if (front->start + transferred >= rreq->cleaned_to + fsize ||
+			if (front->start + transferred >= unlock_at ||
 			    test_bit(NETFS_SREQ_HIT_EOF, &front->flags))
 				netfs_read_unlock_folios(rreq, &notes);
 		} else {
@@ -477,20 +512,22 @@ void netfs_read_collection_worker(struct work_struct *work)
 void netfs_read_subreq_progress(struct netfs_io_subrequest *subreq)
 {
 	struct netfs_io_request *rreq = subreq->rreq;
-	struct netfs_io_stream *stream = &rreq->io_streams[0];
-	size_t fsize = PAGE_SIZE << rreq->front_folio_order;
-
-	trace_netfs_sreq(subreq, netfs_sreq_trace_progress);
+	struct netfs_io_stream *stream = &rreq->io_streams[subreq->stream_nr];
+	size_t progress_at = READ_ONCE(rreq->progress_at);
+	uoff_t update_at = rreq->start + progress_at;
+	uoff_t transferred_to = subreq->start + subreq->transferred;
 
 	/* If we are at the head of the queue, wake up the collector,
 	 * getting a ref to it if we were the ones to do so.
 	 */
-	if (subreq->start + subreq->transferred > rreq->cleaned_to + fsize &&
+	if (progress_at != ULONG_MAX &&
+	    transferred_to >= update_at &&
 	    (rreq->origin == NETFS_READAHEAD ||
 	     rreq->origin == NETFS_READPAGE ||
 	     rreq->origin == NETFS_READ_FOR_WRITE) &&
 	    list_is_first(&subreq->rreq_link, &stream->subrequests)
 	    ) {
+		trace_netfs_sreq(subreq, netfs_sreq_trace_progress);
 		__set_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
 		netfs_wake_collector(rreq);
 	}
diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c
index 2b42758e01ec9..dd463a485139c 100644
--- a/fs/netfs/read_retry.c
+++ b/fs/netfs/read_retry.c
@@ -292,6 +292,13 @@ void netfs_unlock_abandoned_read_pages(struct netfs_io_request *rreq)
 {
 	struct folio_queue *p;
 
+	/* We have to wait for readahead refs to have been released before we
+	 * can unlock any folios as the ref-dropper walks i_pages and the only
+	 * thing preventing these folios from being removed is the folio lock.
+	 */
+	if (test_bit(NETFS_RREQ_NEED_PUT_RA_REFS, &rreq->flags))
+		netfs_wait_for_put_ra_refs(rreq);
+
 	for (p = rreq->buffer.tail; p; p = p->next) {
 		for (int slot = 0; slot < folioq_count(p); slot++) {
 			struct folio *folio = folioq_folio(p, slot);
diff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c
index 8833550d2eb60..de67ac41548d1 100644
--- a/fs/netfs/read_single.c
+++ b/fs/netfs/read_single.c
@@ -170,6 +170,8 @@ ssize_t netfs_read_single(struct inode *inode, struct file *file, struct iov_ite
 	if (IS_ERR(rreq))
 		return PTR_ERR(rreq);
 
+	rreq->progress_at = rreq->len;
+
 	ret = netfs_single_begin_cache_read(rreq, ictx);
 	if (ret == -ENOMEM || ret == -EINTR || ret == -ERESTARTSYS)
 		goto cleanup_free;
diff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c
index 8c0026836f9c1..424e77a9a1098 100644
--- a/fs/netfs/rolling_buffer.c
+++ b/fs/netfs/rolling_buffer.c
@@ -115,42 +115,65 @@ int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp)
 }
 
 /*
- * Decant the list of folios to read into a rolling buffer.
+ * Decant the entire list of folios to read into a rolling buffer.
  */
-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,
-				    struct readahead_control *ractl,
-				    struct folio_batch *put_batch)
+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,
+					 struct readahead_control *ractl,
+					 unsigned int rreq_id, gfp_t gfp)
 {
 	struct folio_queue *fq;
-	struct page **vec;
-	int nr, ix, to;
-	ssize_t size = 0;
+	ssize_t loaded = 0;
 
-	if (rolling_buffer_make_space(roll, GFP_KERNEL) < 0)
-		return -ENOMEM;
+	while (ractl->_nr_pages - ractl->_batch_count > 0) {
+		unsigned int nr;
 
-	fq = roll->head;
-	vec = (struct page **)fq->vec.folios;
-	nr = __readahead_batch(ractl, vec + folio_batch_count(&fq->vec),
-			       folio_batch_space(&fq->vec));
-	ix = fq->vec.nr;
-	to = ix + nr;
-	fq->vec.nr = to;
-	for (; ix < to; ix++) {
-		struct folio *folio = folioq_folio(fq, ix);
-		unsigned int order = folio_order(folio);
-
-		fq->orders[ix] = order;
-		size += PAGE_SIZE << order;
-		trace_netfs_folio(folio, netfs_folio_trace_read);
-		if (!folio_batch_add(put_batch, folio))
-			folio_batch_release(put_batch);
+		/* Allocate a folioq to put some folios into and attach it to
+		 * the rolling buffer.
+		 */
+		fq = netfs_folioq_alloc(rreq_id, gfp,
+					netfs_trace_folioq_make_space);
+		if (!fq)
+			goto nomem_unlock;
+		fq->prev = roll->head;
+		if (!roll->tail)
+			roll->tail = fq;
+		else
+			roll->head->next = fq;
+		roll->head = fq;
+
+		/* Get a batch of folios and note their orders. */
+		nr = __readahead_batch(ractl, (struct page **)fq->vec.folios,
+				       folioq_nr_slots(fq));
+		if (WARN_ON_ONCE(!nr))
+			break;
+		fq->vec.nr = nr;
+
+		for (int slot = 0; slot < nr; slot++) {
+			struct folio *folio = folioq_folio(fq, slot);
+			unsigned int order;
+
+			order = folio_order(folio);
+			fq->orders[slot] = order;
+			loaded += PAGE_SIZE << order;
+			trace_netfs_folio(folio, netfs_folio_trace_read);
+		}
 	}
-	WRITE_ONCE(roll->iter.count, roll->iter.count + size);
 
-	/* Store the counter after setting the slot. */
-	smp_store_release(&roll->next_head_slot, to);
-	return size;
+	WRITE_ONCE(roll->iter.count, loaded);
+	iov_iter_folio_queue(&roll->iter, ITER_DEST, roll->tail, 0, 0, loaded);
+	return loaded;
+
+nomem_unlock:
+	for (fq = roll->tail; fq; fq = fq->next) {
+		for (int slot = 0; slot < folioq_count(fq); slot++) {
+			folio_unlock(fq->vec.folios[slot]);
+			folioq_mark(fq, slot);
+		}
+	}
+	rolling_buffer_clear(roll);
+	roll->head = NULL;
+	roll->tail = NULL;
+	return -ENOMEM;
 }
 
 /*
diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index 2d9cfcd43658f..851f6f93ad45a 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -170,6 +170,8 @@ void netfs_prepare_write(struct netfs_io_request *wreq,
 		rolling_buffer_make_space(&wreq->buffer, wreq->gfp);
 
 	subreq = netfs_alloc_subrequest(wreq);
+	if (!subreq)
+		return;
 	subreq->source		= stream->source;
 	subreq->start		= start;
 	subreq->stream_nr	= stream->stream_nr;
diff --git a/include/linux/netfs.h b/include/linux/netfs.h
index f837a501008c9..1cf2ef3ce18b8 100644
--- a/include/linux/netfs.h
+++ b/include/linux/netfs.h
@@ -246,6 +246,7 @@ struct netfs_io_request {
 	unsigned long long	submitted;	/* Amount submitted for I/O so far */
 	unsigned long long	len;		/* Length of the request */
 	size_t			transferred;	/* Amount to be indicated as transferred */
+	size_t			progress_at;	/* Report read progress when hit this much read */
 	long			error;		/* 0 or error that occurred */
 	unsigned long long	i_size;		/* Size of the file */
 	unsigned long long	start;		/* Start position */
@@ -262,7 +263,6 @@ struct netfs_io_request {
 	atomic_t		subreq_counter;	/* Next subreq->debug_index */
 	unsigned int		nr_group_rel;	/* Number of refs to release on ->group */
 	spinlock_t		lock;		/* Lock for queuing subreqs */
-	unsigned char		front_folio_order; /* Order (size) of front folio */
 	enum netfs_io_origin	origin;		/* Origin of the request */
 	bool			direct_bv_unpin; /* T if direct_bv[] must be unpinned */
 	refcount_t		ref;
@@ -278,6 +278,7 @@ struct netfs_io_request {
 #define NETFS_RREQ_FOLIO_COPY_TO_CACHE	10	/* Copy current folio to cache from read */
 #define NETFS_RREQ_UPLOAD_TO_SERVER	11	/* Need to write to the server */
 #define NETFS_RREQ_USE_IO_ITER		12	/* Use ->io_iter rather than ->i_pages */
+#define NETFS_RREQ_NEED_PUT_RA_REFS	17	/* Need to put the folio refs RA gave us */
 #define NETFS_RREQ_USE_PGPRIV2		31	/* [DEPRECATED] Use PG_private_2 to mark
 						 * write to cache on read */
 	const struct netfs_request_ops *netfs_ops;
diff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h
index 9e5dad29669cf..a97f7cfaacaad 100644
--- a/include/linux/rolling_buffer.h
+++ b/include/linux/rolling_buffer.h
@@ -45,9 +45,9 @@ struct rolling_buffer_snapshot {
 int rolling_buffer_init(struct rolling_buffer *roll, unsigned int rreq_id,
 			unsigned int direction, gfp_t gfp);
 int rolling_buffer_make_space(struct rolling_buffer *roll, gfp_t gfp);
-ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,
-				    struct readahead_control *ractl,
-				    struct folio_batch *put_batch);
+ssize_t rolling_buffer_bulk_load_from_ra(struct rolling_buffer *roll,
+					 struct readahead_control *ractl,
+					 unsigned int rreq_id, gfp_t gfp);
 ssize_t rolling_buffer_append(struct rolling_buffer *roll, struct folio *folio,
 			      unsigned int flags, gfp_t gfp);
 struct folio_queue *rolling_buffer_delete_spent(struct rolling_buffer *roll);
diff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h
index 9259bc71049e0..e3101410e8b2d 100644
--- a/include/trace/events/cachefiles.h
+++ b/include/trace/events/cachefiles.h
@@ -372,7 +372,7 @@ TRACE_EVENT(cachefiles_rename,
 TRACE_EVENT(cachefiles_coherency,
 	    TP_PROTO(struct cachefiles_object *obj,
 		     ino_t ino,
-		     u64 disk_aux,
+		     const void *disk_aux,
 		     enum cachefiles_content content,
 		     enum cachefiles_coherency_trace why),
 
@@ -389,12 +389,27 @@ TRACE_EVENT(cachefiles_coherency,
 			     ),
 
 	    TP_fast_assign(
+		    union {
+			    __be16 s[4];
+			    __be64 ll;
+		    } x;
+
 		    __entry->obj	= obj->debug_id;
 		    __entry->why	= why;
 		    __entry->content	= content;
 		    __entry->ino	= ino;
 		    __entry->aux	= be64_to_cpup((__be64 *)obj->cookie->inline_aux);
-		    __entry->disk_aux	= disk_aux;
+
+		    /* cachefiles_xattr::data is 2-byte aligned but not 8-byte aligned. */
+		    if (disk_aux) {
+			    x.s[0] = ((__be16 *)disk_aux)[0];
+			    x.s[1] = ((__be16 *)disk_aux)[1];
+			    x.s[2] = ((__be16 *)disk_aux)[2];
+			    x.s[3] = ((__be16 *)disk_aux)[3];
+			    __entry->disk_aux = be64_to_cpu(x.ll);
+		    } else {
+			    __entry->disk_aux = 0;
+		    }
 			   ),
 
 	    TP_printk("o=%08x %s B=%llx c=%u aux=%llx dsk=%llx",
diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h
index 082cb03c61316..b5da315274ad5 100644
--- a/include/trace/events/netfs.h
+++ b/include/trace/events/netfs.h
@@ -59,6 +59,7 @@
 	EM(netfs_rreq_trace_free,		"FREE   ")	\
 	EM(netfs_rreq_trace_intr,		"INTR   ")	\
 	EM(netfs_rreq_trace_ki_complete,	"KI-CMPL")	\
+	EM(netfs_rreq_trace_ra_put_ref,		"RA-PUT ")	\
 	EM(netfs_rreq_trace_recollect,		"RECLLCT")	\
 	EM(netfs_rreq_trace_redirty,		"REDIRTY")	\
 	EM(netfs_rreq_trace_resubmit,		"RESUBMT")	\
@@ -70,9 +71,11 @@
 	EM(netfs_rreq_trace_unpause,		"UNPAUSE")	\
 	EM(netfs_rreq_trace_wait_ip,		"WAIT-IP")	\
 	EM(netfs_rreq_trace_wait_pause,		"--PAUSED--")	\
+	EM(netfs_rreq_trace_wait_put_ra_refs,	"WAIT-P-RA")	\
 	EM(netfs_rreq_trace_wait_quiesce,	"WAIT-QUIESCE")	\
 	EM(netfs_rreq_trace_waited_ip,		"DONE-IP")	\
 	EM(netfs_rreq_trace_waited_pause,	"--UNPAUSED--")	\
+	EM(netfs_rreq_trace_waited_put_ra_refs,	"DONE-P-RA")	\
 	EM(netfs_rreq_trace_waited_quiesce,	"DONE-QUIESCE")	\
 	EM(netfs_rreq_trace_wake_ip,		"WAKE-IP")	\
 	EM(netfs_rreq_trace_wake_queue,		"WAKE-Q ")	\
@@ -786,6 +789,27 @@ TRACE_EVENT(netfs_folioq,
 		      __print_symbolic(__entry->trace, netfs_folioq_traces))
 	    );
 
+TRACE_EVENT(netfs_read_progress_at,
+	    TP_PROTO(const struct netfs_io_request *rreq),
+
+	    TP_ARGS(rreq),
+
+	    TP_STRUCT__entry(
+		    __field(unsigned int,	rreq)
+		    __field(size_t,		progress_at)
+		    __field(size_t,		cleaned_to)
+			     ),
+
+	    TP_fast_assign(
+		    __entry->rreq	= rreq->debug_id;
+		    __entry->cleaned_to	= rreq->cleaned_to - rreq->start;
+		    __entry->progress_at = rreq->progress_at;
+			   ),
+
+	    TP_printk("R=%08x cln=%zx prg=%zx",
+		      __entry->rreq, __entry->cleaned_to, __entry->progress_at)
+	    );
+
 #undef EM
 #undef E_
 #endif /* _TRACE_NETFS_H */

gemini-3.1-pro-preview

							input: 14829
							output: 321
							thoughts: 11323

**KMSAN Justification for Cachefiles Patch**

Okay, so I've been digging into this patch, and it looks like it modifies `fs/cachefiles/xattr.c` and some `fs/netfs/` files. Let's start with `fs/cachefiles/xattr.c`. The core of the issue revolves around handling extended attributes (xattrs) for the cache.

The patch is fixing a problem where the buffer allocated for storing the xattr data, specifically within `cachefiles_set_object_xattr` and `cachefiles_check_auxdata`, wasn't properly initialized. Before this, if `vfs_getxattr` failed (e.g., if the requested xattr didn't exist), the `buf` allocated with `kmalloc` remained uninitialized. Because of this, when `trace_cachefiles_coherency` was called, it could read data from `buf->data` and `buf->content` that hadn't been written to.

I initially thought KASAN would catch this, because of potential OOB reads, but that's not the case. The patch ensures that if `len` is smaller than 8 bytes, `put_unaligned_be64` ensures that 8 bytes are initialized. While KASAN may find OOBs for lengths under 8, it won't trigger if the allocated buffer is large enough to contain the 8 byte read because KASAN only protects memory beyond the allocated size.

The problem lies with how this uninitialized data can be accessed. Specifically, `trace_cachefiles_coherency` is a tracepoint that accesses the allocated buffer for the xattr. If the xattr does not exist, `vfs_getxattr` returns an error. The allocated buffer contains uninitialized memory. `buf->content` is 8 bytes, and it remains uninitialized.

This patch addresses it with the `put_unaligned_be64(0, (__be64 *)buf->data);` call, which zeroes `buf->data`. Before this, if the code went down a failure path, the tracepoint would be reading uninitialized memory. However, it still does not initialize `buf->content`.

If we allocate `buf` with `kmalloc`, the contents are uninitialized. `trace_cachefiles_coherency` and tracepoints are great for catching bugs like these, but they are not the only places where the bug could be triggered.

Now, why KMSAN?

* **KASAN vs. KMSAN:** KASAN is all about detecting *out-of-bounds* memory accesses. KMSAN, on the other hand, is specifically for detecting *reads of uninitialized memory*. The critical point here is that if the `vfs_getxattr` call fails, we read a value in `trace_cachefiles_coherency` that never had a value assigned to it, which is exactly the kind of thing KMSAN is designed to catch. This happens if `len >= 8` where KASAN doesn't report it since it's within bounds.

* **Uninitialized Read:** The key to this is the *uninitialized* state. The problem is that, without the patch, the `buf` is allocated but might not be fully initialized if the read xattr fails.
This, then, can cause the KMSAN fuzzer to report bugs.

Therefore, KMSAN is required here, because it will report a bug that other tools, such as KASAN, do not catch.

{
  "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.",
  "NeedsKMSAN": true
}

{
  "KMSANReasoning": "The patch modifies `cachefiles_set_object_xattr` and `cachefiles_check_auxdata` to allocate a buffer with `max(len, sizeof(__be64))` and explicitly zeroes the first 8 bytes of `buf-\u003edata` using `put_unaligned_be64(0, ...)`.\n\nBefore this patch, if `vfs_getxattr` failed (e.g., returning `-ENODATA`), the `buf` allocated via `kmalloc` remained uninitialized. The uninitialized `buf-\u003edata` was then passed to `trace_cachefiles_coherency`, which reads 8 bytes from it.\n\nIf `len \u003e= 8`, the allocation size is at least 16 bytes. The 8-byte read from `buf-\u003edata` (at offset 8) falls completely within the requested allocation bounds. KASAN only detects out-of-bounds accesses and will not detect this read of uninitialized memory within bounds. KMSAN is specifically designed to detect uses of uninitialized memory and is the only tool capable of catching this bug.\n\nFurthermore, the patch does not appear to initialize `buf-\u003econtent` in the error path of `cachefiles_check_auxdata`, meaning an uninitialized read might still exist there when passed to the tracepoint. This further justifies a dedicated KMSAN fuzzing session to uncover any remaining uninitialized memory issues.",
  "NeedsKMSAN": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)