AI Trajectory

null

{
  "EnableConfigs": [
    "EXT4_FS",
    "EXT4_FS_POSIX_ACL",
    "EXT4_FS_SECURITY"
  ],
  "FocusSymbols": [
    "ext4_put_ea_inode",
    "ext4_ea_inode_work",
    "ext4_xattr_delete_inode",
    "ext4_xattr_release_block",
    "ext4_xattr_inode_dec_ref_all",
    "ext4_xattr_block_set",
    "ext4_xattr_ibody_set"
  ],
  "Reasoning": "The patch modifies core ext4 xattr logic, specifically how EA inodes are tracked and freed, introducing a deferred iput mechanism via a workqueue to avoid lock ordering issues. This is a functional change in a widely used filesystem.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit ad12ff48d153a0b113bc3c95d2d784191066edcb\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Jul 11 01:09:28 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h\nindex b37c136ea3ab33..b9b0ada7774bb4 100644\n--- a/fs/ext4/ext4.h\n+++ b/fs/ext4/ext4.h\n@@ -1070,8 +1070,14 @@ struct ext4_inode_info {\n \t * between readers of EAs and writers of regular file data, so\n \t * instead we synchronize on xattr_sem when reading or changing\n \t * EAs.\n+\t *\n+\t * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse\n+\t * the space for deferred iput linkage.\n \t */\n-\tstruct rw_semaphore xattr_sem;\n+\tunion {\n+\t\tstruct rw_semaphore xattr_sem;\n+\t\tstruct llist_node i_ea_iput_node;\n+\t};\n \n \t/*\n \t * Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise\n@@ -1770,6 +1776,11 @@ struct ext4_sb_info {\n \tstruct ext4_es_stats s_es_stats;\n \tstruct mb_cache *s_ea_block_cache;\n \tstruct mb_cache *s_ea_inode_cache;\n+\n+\t/* Deferred iput for EA inodes to avoid lock ordering issues */\n+\tstruct llist_head s_ea_inode_to_free;\n+\tstruct delayed_work s_ea_inode_work;\n+\n \tspinlock_t s_es_lock ____cacheline_aligned_in_smp;\n \n \t/* Journal triggers for checksum computation */\ndiff --git a/fs/ext4/inode.c b/fs/ext4/inode.c\nindex ce99807c5f5b2c..747c52c232cc03 100644\n--- a/fs/ext4/inode.c\n+++ b/fs/ext4/inode.c\n@@ -176,7 +176,6 @@ void ext4_evict_inode(struct inode *inode)\n \t * (xattr block freeing), bitmap, group descriptor (inode freeing)\n \t */\n \tint extra_credits = 6;\n-\tstruct ext4_xattr_inode_array *ea_inode_array = NULL;\n \tbool freeze_protected = false;\n \n \ttrace_ext4_evict_inode(inode);\n@@ -281,8 +280,7 @@ void ext4_evict_inode(struct inode *inode)\n \t}\n \n \t/* Remove xattr references. */\n-\terr = ext4_xattr_delete_inode(handle, inode, \u0026ea_inode_array,\n-\t\t\t\t      extra_credits);\n+\terr = ext4_xattr_delete_inode(handle, inode, extra_credits);\n \tif (err) {\n \t\text4_warning(inode-\u003ei_sb, \"xattr delete (err %d)\", err);\n stop_handle:\n@@ -290,7 +288,6 @@ void ext4_evict_inode(struct inode *inode)\n \t\text4_orphan_del(NULL, inode);\n \t\tif (freeze_protected)\n \t\t\tsb_end_intwrite(inode-\u003ei_sb);\n-\t\text4_xattr_inode_array_free(ea_inode_array);\n \t\tgoto no_delete;\n \t}\n \n@@ -320,7 +317,6 @@ void ext4_evict_inode(struct inode *inode)\n \text4_journal_stop(handle);\n \tif (freeze_protected)\n \t\tsb_end_intwrite(inode-\u003ei_sb);\n-\text4_xattr_inode_array_free(ea_inode_array);\n \treturn;\n no_delete:\n \t/*\ndiff --git a/fs/ext4/super.c b/fs/ext4/super.c\nindex 245f67d10ded34..898d8c6431baea 100644\n--- a/fs/ext4/super.c\n+++ b/fs/ext4/super.c\n@@ -1303,6 +1303,8 @@ static void ext4_put_super(struct super_block *sb)\n \t\t\t \u0026sb-\u003es_uuid);\n \n \text4_unregister_li_request(sb);\n+\t/* Drain deferred EA inode iputs while quota is still active. */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_quotas_off(sb, EXT4_MAXQUOTAS);\n \n \tdestroy_workqueue(sbi-\u003ersv_conversion_wq);\n@@ -1423,6 +1425,13 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)\n \tmemset(\u0026ei-\u003ei_dquot, 0, sizeof(ei-\u003ei_dquot));\n #endif\n \tei-\u003ejinode = NULL;\n+\t/*\n+\t * Reinitialize xattr_sem every allocation because EA inodes\n+\t * share this space with i_ea_iput_node (via union) which may\n+\t * have overwritten the semaphore when the slab object was\n+\t * previously used as an EA inode.\n+\t */\n+\tinit_rwsem(\u0026ei-\u003exattr_sem);\n \tINIT_LIST_HEAD(\u0026ei-\u003ei_rsv_conversion_list);\n \tspin_lock_init(\u0026ei-\u003ei_completed_io_lock);\n \tei-\u003ei_sync_tid = 0;\n@@ -1488,7 +1497,6 @@ static void init_once(void *foo)\n \tstruct ext4_inode_info *ei = foo;\n \n \tINIT_LIST_HEAD(\u0026ei-\u003ei_orphan);\n-\tinit_rwsem(\u0026ei-\u003exattr_sem);\n \tinit_rwsem(\u0026ei-\u003ei_data_sem);\n \tinode_init_once(\u0026ei-\u003evfs_inode);\n \text4_fc_init_inode(\u0026ei-\u003evfs_inode);\n@@ -5497,6 +5505,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)\n \t\t\t  ext4_has_feature_orphan_present(sb) ||\n \t\t\t  ext4_has_feature_journal_needs_recovery(sb));\n \n+\text4_init_ea_inode_work(sbi);\n+\n \tif (ext4_has_feature_mmp(sb) \u0026\u0026 !sb_rdonly(sb)) {\n \t\terr = ext4_multi_mount_protect(sb, le64_to_cpu(es-\u003es_mmp_block));\n \t\tif (err)\n@@ -5747,6 +5757,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)\n \treturn 0;\n \n failed_mount9:\n+\t/* Drain deferred EA inode iputs before quota shutdown */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_quotas_off(sb, EXT4_MAXQUOTAS);\n failed_mount8: __maybe_unused\n \text4_release_orphan_info(sb);\n@@ -5767,6 +5779,8 @@ failed_mount8: __maybe_unused\n \tif (EXT4_SB(sb)-\u003ersv_conversion_wq)\n \t\tdestroy_workqueue(EXT4_SB(sb)-\u003ersv_conversion_wq);\n failed_mount_wq:\n+\t/* Drain deferred EA inode iputs before freeing structures */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_xattr_destroy_cache(sbi-\u003es_ea_inode_cache);\n \tsbi-\u003es_ea_inode_cache = NULL;\n \n@@ -5777,6 +5791,8 @@ failed_mount8: __maybe_unused\n \t\text4_journal_destroy(sbi, sbi-\u003es_journal);\n \t}\n failed_mount3a:\n+\t/* Drain deferred EA inode iputs from journal replay */\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \text4_es_unregister_shrinker(sbi);\n failed_mount3:\n \t/* flush s_sb_upd_work before sbi destroy */\n@@ -6447,6 +6463,7 @@ static int ext4_sync_fs(struct super_block *sb, int wait)\n \n \ttrace_ext4_sync_fs(sb, wait);\n \tflush_workqueue(sbi-\u003ersv_conversion_wq);\n+\tflush_delayed_work(\u0026sbi-\u003es_ea_inode_work);\n \t/*\n \t * Writeback quota in non-journalled quota case - journalled quota has\n \t * no dirty dquots\ndiff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c\nindex 982a1f831e2282..4ae6ce1115660e 100644\n--- a/fs/ext4/xattr.c\n+++ b/fs/ext4/xattr.c\n@@ -114,10 +114,6 @@ const struct xattr_handler * const ext4_xattr_handlers[] = {\n #define EA_INODE_CACHE(inode)\t(((struct ext4_sb_info *) \\\n \t\t\t\tinode-\u003ei_sb-\u003es_fs_info)-\u003es_ea_inode_cache)\n \n-static int\n-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n-\t\t\tstruct inode *inode);\n-\n #ifdef CONFIG_LOCKDEP\n void ext4_xattr_inode_set_class(struct inode *ea_inode)\n {\n@@ -567,7 +563,7 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,\n \t\t\t\t\tea_inode-\u003ei_ino, true /* reusable */);\n \t}\n out:\n-\tiput(ea_inode);\n+\text4_put_ea_inode(ea_inode);\n \treturn err;\n }\n \n@@ -1104,10 +1100,10 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,\n \t\terr = ext4_xattr_inode_inc_ref(handle, ea_inode);\n \t\tif (err) {\n \t\t\text4_warning_inode(ea_inode, \"inc ref error %d\", err);\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\tgoto cleanup;\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \t}\n \treturn 0;\n \n@@ -1133,7 +1129,7 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err)\n \t\t\text4_warning_inode(ea_inode, \"cleanup dec ref error %d\",\n \t\t\t\t\t   err);\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \t}\n \treturn saved_err;\n }\n@@ -1160,7 +1156,6 @@ static void\n ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\t\t     struct buffer_head *bh,\n \t\t\t     struct ext4_xattr_entry *first, bool block_csum,\n-\t\t\t     struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t     int extra_credits, bool skip_quota)\n {\n \tstruct inode *ea_inode;\n@@ -1197,14 +1192,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err)\n \t\t\tcontinue;\n \n-\t\terr = ext4_expand_inode_array(ea_inode_array, ea_inode);\n-\t\tif (err) {\n-\t\t\text4_warning_inode(ea_inode,\n-\t\t\t\t\t   \"Expand inode array err=%d\", err);\n-\t\t\tiput(ea_inode);\n-\t\t\tcontinue;\n-\t\t}\n-\n \t\terr = ext4_journal_ensure_credits_fn(handle, credits, credits,\n \t\t\text4_free_metadata_revoke_credits(parent-\u003ei_sb, 1),\n \t\t\text4_xattr_restart_fn(handle, parent, bh, block_csum,\n@@ -1212,6 +1199,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err \u003c 0) {\n \t\t\text4_warning_inode(ea_inode, \"Ensure credits err=%d\",\n \t\t\t\t\t   err);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\tcontinue;\n \t\t}\n \t\tif (err \u003e 0) {\n@@ -1221,6 +1209,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\t\"Re-get write access err=%d\",\n \t\t\t\t\t\terr);\n+\t\t\t\text4_put_ea_inode(ea_inode);\n \t\t\t\tcontinue;\n \t\t\t}\n \t\t}\n@@ -1229,6 +1218,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err) {\n \t\t\text4_warning_inode(ea_inode, \"ea_inode dec ref err=%d\",\n \t\t\t\t\t   err);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\tcontinue;\n \t\t}\n \n@@ -1245,6 +1235,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tentry-\u003ee_value_inum = 0;\n \t\tentry-\u003ee_value_size = 0;\n \n+\t\text4_put_ea_inode(ea_inode);\n \t\tdirty = true;\n \t}\n \n@@ -1271,7 +1262,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n static void\n ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n \t\t\t struct buffer_head *bh,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits)\n {\n \tstruct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);\n@@ -1313,7 +1303,6 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_dec_ref_all(handle, inode, bh,\n \t\t\t\t\t\t     BFIRST(bh),\n \t\t\t\t\t\t     true /* block_csum */,\n-\t\t\t\t\t\t     ea_inode_array,\n \t\t\t\t\t\t     extra_credits,\n \t\t\t\t\t\t     true /* skip_quota */);\n \t\text4_free_blocks(handle, inode, bh, 0, 1,\n@@ -1505,7 +1494,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,\n \t\t\tif (ext4_xattr_inode_dec_ref(handle, ea_inode))\n \t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\"cleanup dec ref error %d\", err);\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t\treturn ERR_PTR(err);\n \t\t}\n \n@@ -1564,7 +1553,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,\n \t\t\tkvfree(ea_data);\n \t\t\treturn ea_inode;\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \tnext_entry:\n \t\tce = mb_cache_entry_find_next(ea_inode_cache, ce);\n \t}\n@@ -1615,7 +1604,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,\n \t\t\t\t      ea_inode-\u003ei_ino, true /* reusable */);\n \treturn ea_inode;\n out_err:\n-\tiput(ea_inode);\n+\text4_put_ea_inode(ea_inode);\n \text4_xattr_inode_free_quota(inode, NULL, value_len);\n \treturn ERR_PTR(err);\n }\n@@ -1848,7 +1837,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,\n \n \tret = 0;\n out:\n-\tiput(old_ea_inode);\n+\text4_put_ea_inode(old_ea_inode);\n \treturn ret;\n }\n \n@@ -2010,7 +1999,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\t\told_ea_inode_quota = le32_to_cpu(\n \t\t\t\t\t\ts-\u003ehere-\u003ee_value_size);\n \t\t\t}\n-\t\t\tiput(tmp_inode);\n+\t\t\text4_put_ea_inode(tmp_inode);\n \n \t\t\ts-\u003ehere-\u003ee_value_inum = 0;\n \t\t\ts-\u003ehere-\u003ee_value_size = 0;\n@@ -2150,7 +2139,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\t\t   \"dec ref error=%d\",\n \t\t\t\t\t\t\t   error);\n-\t\t\t\tiput(ea_inode);\n+\t\t\t\text4_put_ea_inode(ea_inode);\n \t\t\t\tea_inode = NULL;\n \t\t\t}\n \n@@ -2182,12 +2171,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \n \t/* Drop the previous xattr block. */\n \tif (bs-\u003ebh \u0026\u0026 bs-\u003ebh != new_bh) {\n-\t\tstruct ext4_xattr_inode_array *ea_inode_array = NULL;\n-\n \t\text4_xattr_release_block(handle, inode, bs-\u003ebh,\n-\t\t\t\t\t \u0026ea_inode_array,\n \t\t\t\t\t 0 /* extra_credits */);\n-\t\text4_xattr_inode_array_free(ea_inode_array);\n \t}\n \terror = 0;\n \n@@ -2203,7 +2188,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t\t    i_size_read(ea_inode));\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(ea_inode);\n \t}\n \tif (ce)\n \t\tmb_cache_entry_put(ea_block_cache, ce);\n@@ -2285,7 +2270,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,\n \n \t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t\t    i_size_read(ea_inode));\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(ea_inode);\n \t\t}\n \t\treturn error;\n \t}\n@@ -2297,7 +2282,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,\n \t\theader-\u003eh_magic = cpu_to_le32(0);\n \t\text4_clear_inode_state(inode, EXT4_STATE_XATTR);\n \t}\n-\tiput(ea_inode);\n+\text4_put_ea_inode(ea_inode);\n \treturn 0;\n }\n \n@@ -2863,46 +2848,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n \treturn error;\n }\n \n-#define EIA_INCR 16 /* must be 2^n */\n-#define EIA_MASK (EIA_INCR - 1)\n-\n-/* Add the large xattr @inode into @ea_inode_array for deferred iput().\n- * If @ea_inode_array is new or full it will be grown and the old\n- * contents copied over.\n- */\n-static int\n-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n-\t\t\tstruct inode *inode)\n-{\n-\tif (*ea_inode_array == NULL) {\n-\t\t/*\n-\t\t * Start with 15 inodes, so it fits into a power-of-two size.\n-\t\t */\n-\t\t(*ea_inode_array) = kmalloc_flex(**ea_inode_array, inodes,\n-\t\t\t\t\t\t EIA_MASK, GFP_NOFS);\n-\t\tif (*ea_inode_array == NULL)\n-\t\t\treturn -ENOMEM;\n-\t\t(*ea_inode_array)-\u003ecount = 0;\n-\t} else if (((*ea_inode_array)-\u003ecount \u0026 EIA_MASK) == EIA_MASK) {\n-\t\t/* expand the array once all 15 + n * 16 slots are full */\n-\t\tstruct ext4_xattr_inode_array *new_array = NULL;\n-\n-\t\tnew_array = kmalloc_flex(**ea_inode_array, inodes,\n-\t\t\t\t\t (*ea_inode_array)-\u003ecount + EIA_INCR,\n-\t\t\t\t\t GFP_NOFS);\n-\t\tif (new_array == NULL)\n-\t\t\treturn -ENOMEM;\n-\t\tmemcpy(new_array, *ea_inode_array,\n-\t\t       struct_size(*ea_inode_array, inodes,\n-\t\t\t\t   (*ea_inode_array)-\u003ecount));\n-\t\tkfree(*ea_inode_array);\n-\t\t*ea_inode_array = new_array;\n-\t}\n-\t(*ea_inode_array)-\u003ecount++;\n-\t(*ea_inode_array)-\u003einodes[(*ea_inode_array)-\u003ecount - 1] = inode;\n-\treturn 0;\n-}\n-\n /*\n  * ext4_xattr_delete_inode()\n  *\n@@ -2913,7 +2858,6 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n  * references on xattr block and xattr inodes.\n  */\n int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n-\t\t\t    struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t    int extra_credits)\n {\n \tstruct buffer_head *bh = NULL;\n@@ -2952,7 +2896,6 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,\n \t\t\t\t\t\t     IFIRST(header),\n \t\t\t\t\t\t     false /* block_csum */,\n-\t\t\t\t\t\t     ea_inode_array,\n \t\t\t\t\t\t     extra_credits,\n \t\t\t\t\t\t     false /* skip_quota */);\n \t}\n@@ -2986,12 +2929,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \t\t\t\t\tcontinue;\n \t\t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t      le32_to_cpu(entry-\u003ee_value_size));\n-\t\t\t\tiput(ea_inode);\n+\t\t\t\text4_put_ea_inode(ea_inode);\n \t\t\t}\n \n \t\t}\n \n-\t\text4_xattr_release_block(handle, inode, bh, ea_inode_array,\n+\t\text4_xattr_release_block(handle, inode, bh,\n \t\t\t\t\t extra_credits);\n \t\t/*\n \t\t * Update i_file_acl value in the same transaction that releases\n@@ -3013,16 +2956,63 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \treturn error;\n }\n \n-void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *ea_inode_array)\n+/*\n+ * Worker function for deferred EA inode iput.  Processes all inodes queued\n+ * on s_ea_inode_to_free in a context free of xattr_sem/jbd2 handle locks.\n+ */\n+static void ext4_ea_inode_work(struct work_struct *work)\n {\n-\tint idx;\n+\tstruct ext4_sb_info *sbi = container_of(to_delayed_work(work),\n+\t\t\t\t\t\tstruct ext4_sb_info,\n+\t\t\t\t\t\ts_ea_inode_work);\n+\tstruct llist_node *node = llist_del_all(\u0026sbi-\u003es_ea_inode_to_free);\n \n-\tif (ea_inode_array == NULL)\n+\twhile (node) {\n+\t\tstruct ext4_inode_info *ei = container_of(node,\n+\t\t\t\t\tstruct ext4_inode_info, i_ea_iput_node);\n+\t\tnode = node-\u003enext;\n+\t\tiput(\u0026ei-\u003evfs_inode);\n+\t}\n+}\n+\n+/*\n+ * Release a VFS reference on an EA inode.  Must be used instead of iput()\n+ * in any context where xattr_sem or a jbd2 handle is held.\n+ *\n+ * If this is not the last reference, drops it immediately via\n+ * iput_if_not_last() with no further action needed.\n+ *\n+ * If this is the last reference, the inode is linked onto a per-sb\n+ * llist via i_ea_iput_node (embedded in ext4_inode_info, sharing space\n+ * with the unused xattr_sem) and a delayed worker performs the final\n+ * iput() in a clean context.\n+ *\n+ * Note: while an inode is on s_ea_inode_to_free, the unconsumed i_count\n+ * reference (still 1) keeps it in the inode cache, so any concurrent\n+ * iget() bumps i_count to \u003e= 2 and iput_if_not_last() will succeed.\n+ * Nobody will add the inode a second time until ext4_ea_inode_work()\n+ * drops that reference via iput().\n+ */\n+void ext4_put_ea_inode(struct inode *inode)\n+{\n+\tif (!inode)\n+\t\treturn;\n+\tWARN_ON_ONCE(!(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL));\n+\tif (iput_if_not_last(inode))\n \t\treturn;\n+\tllist_add(\u0026EXT4_I(inode)-\u003ei_ea_iput_node,\n+\t\t  \u0026EXT4_SB(inode-\u003ei_sb)-\u003es_ea_inode_to_free);\n+\t/*\n+\t * Use a short delay to allow multiple EA inodes to accumulate,\n+\t * reducing workqueue wakeups when several are released together.\n+\t */\n+\tschedule_delayed_work(\u0026EXT4_SB(inode-\u003ei_sb)-\u003es_ea_inode_work, 1);\n+}\n \n-\tfor (idx = 0; idx \u003c ea_inode_array-\u003ecount; ++idx)\n-\t\tiput(ea_inode_array-\u003einodes[idx]);\n-\tkfree(ea_inode_array);\n+void ext4_init_ea_inode_work(struct ext4_sb_info *sbi)\n+{\n+\tinit_llist_head(\u0026sbi-\u003es_ea_inode_to_free);\n+\tINIT_DELAYED_WORK(\u0026sbi-\u003es_ea_inode_work, ext4_ea_inode_work);\n }\n \n /*\ndiff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h\nindex 1fedf44d4fb65e..821dc6a50e51e7 100644\n--- a/fs/ext4/xattr.h\n+++ b/fs/ext4/xattr.h\n@@ -131,11 +131,6 @@ struct ext4_xattr_ibody_find {\n \tstruct ext4_iloc iloc;\n };\n \n-struct ext4_xattr_inode_array {\n-\tunsigned int count;\n-\tstruct inode *inodes[] __counted_by(count);\n-};\n-\n extern const struct xattr_handler ext4_xattr_user_handler;\n extern const struct xattr_handler ext4_xattr_trusted_handler;\n extern const struct xattr_handler ext4_xattr_security_handler;\n@@ -187,9 +182,9 @@ extern int __ext4_xattr_set_credits(struct super_block *sb, struct inode *inode,\n \t\t\t\tbool is_create);\n \n extern int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n-\t\t\t\t   struct ext4_xattr_inode_array **array,\n \t\t\t\t   int extra_credits);\n-extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);\n+extern void ext4_init_ea_inode_work(struct ext4_sb_info *sbi);\n+extern void ext4_put_ea_inode(struct inode *inode);\n \n extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n \t\t\t    struct ext4_inode *raw_inode, handle_t *handle);\ndiff --git a/include/linux/fs.h b/include/linux/fs.h\nindex 50ce731a2b78f1..aa1d501d2bb627 100644\n--- a/include/linux/fs.h\n+++ b/include/linux/fs.h\n@@ -2413,6 +2413,21 @@ static inline void super_set_sysfs_name_generic(struct super_block *sb, const ch\n extern void ihold(struct inode * inode);\n extern void iput(struct inode *);\n void iput_not_last(struct inode *);\n+\n+/**\n+ * iput_if_not_last - drop an inode reference only if it is not the last one\n+ * @inode: inode to put\n+ *\n+ * Returns true if the reference was dropped, false if this was the last\n+ * reference and the caller must arrange for final iput() in a safe context.\n+ */\n+static inline bool __must_check iput_if_not_last(struct inode *inode)\n+{\n+\tVFS_BUG_ON_INODE(inode_state_read_once(inode) \u0026 (I_FREEING | I_CLEAR), inode);\n+\tVFS_BUG_ON_INODE(icount_read_once(inode) \u003c 1, inode);\n+\treturn atomic_add_unless(\u0026inode-\u003ei_count, -1, 1);\n+}\n+\n int inode_update_time(struct inode *inode, enum fs_update_time type,\n \t\tunsigned int flags);\n int generic_update_time(struct inode *inode, enum fs_update_time type,\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "EXT4_FS",
    "EXT4_FS_POSIX_ACL",
    "EXT4_FS_SECURITY"
  ],
  "FocusSymbols": [
    "ext4_put_ea_inode",
    "ext4_ea_inode_work",
    "ext4_xattr_delete_inode",
    "ext4_xattr_release_block",
    "ext4_xattr_inode_dec_ref_all",
    "ext4_xattr_block_set",
    "ext4_xattr_ibody_set"
  ],
  "Reasoning": "The patch modifies core ext4 xattr logic, specifically how EA inodes are tracked and freed, introducing a deferred iput mechanism via a workqueue to avoid lock ordering issues. This is a functional change in a widely used filesystem.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit ad12ff48d153a0b113bc3c95d2d784191066edcb
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Jul 11 01:09:28 2026 +0000

    syz-cluster: applied patch under review

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index b37c136ea3ab33..b9b0ada7774bb4 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1070,8 +1070,14 @@ struct ext4_inode_info {
 	 * between readers of EAs and writers of regular file data, so
 	 * instead we synchronize on xattr_sem when reading or changing
 	 * EAs.
+	 *
+	 * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse
+	 * the space for deferred iput linkage.
 	 */
-	struct rw_semaphore xattr_sem;
+	union {
+		struct rw_semaphore xattr_sem;
+		struct llist_node i_ea_iput_node;
+	};
 
 	/*
 	 * Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise
@@ -1770,6 +1776,11 @@ struct ext4_sb_info {
 	struct ext4_es_stats s_es_stats;
 	struct mb_cache *s_ea_block_cache;
 	struct mb_cache *s_ea_inode_cache;
+
+	/* Deferred iput for EA inodes to avoid lock ordering issues */
+	struct llist_head s_ea_inode_to_free;
+	struct delayed_work s_ea_inode_work;
+
 	spinlock_t s_es_lock ____cacheline_aligned_in_smp;
 
 	/* Journal triggers for checksum computation */
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ce99807c5f5b2c..747c52c232cc03 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -176,7 +176,6 @@ void ext4_evict_inode(struct inode *inode)
 	 * (xattr block freeing), bitmap, group descriptor (inode freeing)
 	 */
 	int extra_credits = 6;
-	struct ext4_xattr_inode_array *ea_inode_array = NULL;
 	bool freeze_protected = false;
 
 	trace_ext4_evict_inode(inode);
@@ -281,8 +280,7 @@ void ext4_evict_inode(struct inode *inode)
 	}
 
 	/* Remove xattr references. */
-	err = ext4_xattr_delete_inode(handle, inode, &ea_inode_array,
-				      extra_credits);
+	err = ext4_xattr_delete_inode(handle, inode, extra_credits);
 	if (err) {
 		ext4_warning(inode->i_sb, "xattr delete (err %d)", err);
 stop_handle:
@@ -290,7 +288,6 @@ void ext4_evict_inode(struct inode *inode)
 		ext4_orphan_del(NULL, inode);
 		if (freeze_protected)
 			sb_end_intwrite(inode->i_sb);
-		ext4_xattr_inode_array_free(ea_inode_array);
 		goto no_delete;
 	}
 
@@ -320,7 +317,6 @@ void ext4_evict_inode(struct inode *inode)
 	ext4_journal_stop(handle);
 	if (freeze_protected)
 		sb_end_intwrite(inode->i_sb);
-	ext4_xattr_inode_array_free(ea_inode_array);
 	return;
 no_delete:
 	/*
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 245f67d10ded34..898d8c6431baea 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1303,6 +1303,8 @@ static void ext4_put_super(struct super_block *sb)
 			 &sb->s_uuid);
 
 	ext4_unregister_li_request(sb);
+	/* Drain deferred EA inode iputs while quota is still active. */
+	flush_delayed_work(&sbi->s_ea_inode_work);
 	ext4_quotas_off(sb, EXT4_MAXQUOTAS);
 
 	destroy_workqueue(sbi->rsv_conversion_wq);
@@ -1423,6 +1425,13 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
 	memset(&ei->i_dquot, 0, sizeof(ei->i_dquot));
 #endif
 	ei->jinode = NULL;
+	/*
+	 * Reinitialize xattr_sem every allocation because EA inodes
+	 * share this space with i_ea_iput_node (via union) which may
+	 * have overwritten the semaphore when the slab object was
+	 * previously used as an EA inode.
+	 */
+	init_rwsem(&ei->xattr_sem);
 	INIT_LIST_HEAD(&ei->i_rsv_conversion_list);
 	spin_lock_init(&ei->i_completed_io_lock);
 	ei->i_sync_tid = 0;
@@ -1488,7 +1497,6 @@ static void init_once(void *foo)
 	struct ext4_inode_info *ei = foo;
 
 	INIT_LIST_HEAD(&ei->i_orphan);
-	init_rwsem(&ei->xattr_sem);
 	init_rwsem(&ei->i_data_sem);
 	inode_init_once(&ei->vfs_inode);
 	ext4_fc_init_inode(&ei->vfs_inode);
@@ -5497,6 +5505,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
 			  ext4_has_feature_orphan_present(sb) ||
 			  ext4_has_feature_journal_needs_recovery(sb));
 
+	ext4_init_ea_inode_work(sbi);
+
 	if (ext4_has_feature_mmp(sb) && !sb_rdonly(sb)) {
 		err = ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block));
 		if (err)
@@ -5747,6 +5757,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
 	return 0;
 
 failed_mount9:
+	/* Drain deferred EA inode iputs before quota shutdown */
+	flush_delayed_work(&sbi->s_ea_inode_work);
 	ext4_quotas_off(sb, EXT4_MAXQUOTAS);
 failed_mount8: __maybe_unused
 	ext4_release_orphan_info(sb);
@@ -5767,6 +5779,8 @@ failed_mount8: __maybe_unused
 	if (EXT4_SB(sb)->rsv_conversion_wq)
 		destroy_workqueue(EXT4_SB(sb)->rsv_conversion_wq);
 failed_mount_wq:
+	/* Drain deferred EA inode iputs before freeing structures */
+	flush_delayed_work(&sbi->s_ea_inode_work);
 	ext4_xattr_destroy_cache(sbi->s_ea_inode_cache);
 	sbi->s_ea_inode_cache = NULL;
 
@@ -5777,6 +5791,8 @@ failed_mount8: __maybe_unused
 		ext4_journal_destroy(sbi, sbi->s_journal);
 	}
 failed_mount3a:
+	/* Drain deferred EA inode iputs from journal replay */
+	flush_delayed_work(&sbi->s_ea_inode_work);
 	ext4_es_unregister_shrinker(sbi);
 failed_mount3:
 	/* flush s_sb_upd_work before sbi destroy */
@@ -6447,6 +6463,7 @@ static int ext4_sync_fs(struct super_block *sb, int wait)
 
 	trace_ext4_sync_fs(sb, wait);
 	flush_workqueue(sbi->rsv_conversion_wq);
+	flush_delayed_work(&sbi->s_ea_inode_work);
 	/*
 	 * Writeback quota in non-journalled quota case - journalled quota has
 	 * no dirty dquots
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 982a1f831e2282..4ae6ce1115660e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -114,10 +114,6 @@ const struct xattr_handler * const ext4_xattr_handlers[] = {
 #define EA_INODE_CACHE(inode)	(((struct ext4_sb_info *) \
 				inode->i_sb->s_fs_info)->s_ea_inode_cache)
 
-static int
-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
-			struct inode *inode);
-
 #ifdef CONFIG_LOCKDEP
 void ext4_xattr_inode_set_class(struct inode *ea_inode)
 {
@@ -567,7 +563,7 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,
 					ea_inode->i_ino, true /* reusable */);
 	}
 out:
-	iput(ea_inode);
+	ext4_put_ea_inode(ea_inode);
 	return err;
 }
 
@@ -1104,10 +1100,10 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,
 		err = ext4_xattr_inode_inc_ref(handle, ea_inode);
 		if (err) {
 			ext4_warning_inode(ea_inode, "inc ref error %d", err);
-			iput(ea_inode);
+			ext4_put_ea_inode(ea_inode);
 			goto cleanup;
 		}
-		iput(ea_inode);
+		ext4_put_ea_inode(ea_inode);
 	}
 	return 0;
 
@@ -1133,7 +1129,7 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,
 		if (err)
 			ext4_warning_inode(ea_inode, "cleanup dec ref error %d",
 					   err);
-		iput(ea_inode);
+		ext4_put_ea_inode(ea_inode);
 	}
 	return saved_err;
 }
@@ -1160,7 +1156,6 @@ static void
 ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 			     struct buffer_head *bh,
 			     struct ext4_xattr_entry *first, bool block_csum,
-			     struct ext4_xattr_inode_array **ea_inode_array,
 			     int extra_credits, bool skip_quota)
 {
 	struct inode *ea_inode;
@@ -1197,14 +1192,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 		if (err)
 			continue;
 
-		err = ext4_expand_inode_array(ea_inode_array, ea_inode);
-		if (err) {
-			ext4_warning_inode(ea_inode,
-					   "Expand inode array err=%d", err);
-			iput(ea_inode);
-			continue;
-		}
-
 		err = ext4_journal_ensure_credits_fn(handle, credits, credits,
 			ext4_free_metadata_revoke_credits(parent->i_sb, 1),
 			ext4_xattr_restart_fn(handle, parent, bh, block_csum,
@@ -1212,6 +1199,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 		if (err < 0) {
 			ext4_warning_inode(ea_inode, "Ensure credits err=%d",
 					   err);
+			ext4_put_ea_inode(ea_inode);
 			continue;
 		}
 		if (err > 0) {
@@ -1221,6 +1209,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 				ext4_warning_inode(ea_inode,
 						"Re-get write access err=%d",
 						err);
+				ext4_put_ea_inode(ea_inode);
 				continue;
 			}
 		}
@@ -1229,6 +1218,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 		if (err) {
 			ext4_warning_inode(ea_inode, "ea_inode dec ref err=%d",
 					   err);
+			ext4_put_ea_inode(ea_inode);
 			continue;
 		}
 
@@ -1245,6 +1235,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 		entry->e_value_inum = 0;
 		entry->e_value_size = 0;
 
+		ext4_put_ea_inode(ea_inode);
 		dirty = true;
 	}
 
@@ -1271,7 +1262,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
 static void
 ext4_xattr_release_block(handle_t *handle, struct inode *inode,
 			 struct buffer_head *bh,
-			 struct ext4_xattr_inode_array **ea_inode_array,
 			 int extra_credits)
 {
 	struct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);
@@ -1313,7 +1303,6 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
 			ext4_xattr_inode_dec_ref_all(handle, inode, bh,
 						     BFIRST(bh),
 						     true /* block_csum */,
-						     ea_inode_array,
 						     extra_credits,
 						     true /* skip_quota */);
 		ext4_free_blocks(handle, inode, bh, 0, 1,
@@ -1505,7 +1494,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
 			if (ext4_xattr_inode_dec_ref(handle, ea_inode))
 				ext4_warning_inode(ea_inode,
 					"cleanup dec ref error %d", err);
-			iput(ea_inode);
+			ext4_put_ea_inode(ea_inode);
 			return ERR_PTR(err);
 		}
 
@@ -1564,7 +1553,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
 			kvfree(ea_data);
 			return ea_inode;
 		}
-		iput(ea_inode);
+		ext4_put_ea_inode(ea_inode);
 	next_entry:
 		ce = mb_cache_entry_find_next(ea_inode_cache, ce);
 	}
@@ -1615,7 +1604,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,
 				      ea_inode->i_ino, true /* reusable */);
 	return ea_inode;
 out_err:
-	iput(ea_inode);
+	ext4_put_ea_inode(ea_inode);
 	ext4_xattr_inode_free_quota(inode, NULL, value_len);
 	return ERR_PTR(err);
 }
@@ -1848,7 +1837,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
 
 	ret = 0;
 out:
-	iput(old_ea_inode);
+	ext4_put_ea_inode(old_ea_inode);
 	return ret;
 }
 
@@ -2010,7 +1999,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 				old_ea_inode_quota = le32_to_cpu(
 						s->here->e_value_size);
 			}
-			iput(tmp_inode);
+			ext4_put_ea_inode(tmp_inode);
 
 			s->here->e_value_inum = 0;
 			s->here->e_value_size = 0;
@@ -2150,7 +2139,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 					ext4_warning_inode(ea_inode,
 							   "dec ref error=%d",
 							   error);
-				iput(ea_inode);
+				ext4_put_ea_inode(ea_inode);
 				ea_inode = NULL;
 			}
 
@@ -2182,12 +2171,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 
 	/* Drop the previous xattr block. */
 	if (bs->bh && bs->bh != new_bh) {
-		struct ext4_xattr_inode_array *ea_inode_array = NULL;
-
 		ext4_xattr_release_block(handle, inode, bs->bh,
-					 &ea_inode_array,
 					 0 /* extra_credits */);
-		ext4_xattr_inode_array_free(ea_inode_array);
 	}
 	error = 0;
 
@@ -2203,7 +2188,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 			ext4_xattr_inode_free_quota(inode, ea_inode,
 						    i_size_read(ea_inode));
 		}
-		iput(ea_inode);
+		ext4_put_ea_inode(ea_inode);
 	}
 	if (ce)
 		mb_cache_entry_put(ea_block_cache, ce);
@@ -2285,7 +2270,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
 
 			ext4_xattr_inode_free_quota(inode, ea_inode,
 						    i_size_read(ea_inode));
-			iput(ea_inode);
+			ext4_put_ea_inode(ea_inode);
 		}
 		return error;
 	}
@@ -2297,7 +2282,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
 		header->h_magic = cpu_to_le32(0);
 		ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
 	}
-	iput(ea_inode);
+	ext4_put_ea_inode(ea_inode);
 	return 0;
 }
 
@@ -2863,46 +2848,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
 	return error;
 }
 
-#define EIA_INCR 16 /* must be 2^n */
-#define EIA_MASK (EIA_INCR - 1)
-
-/* Add the large xattr @inode into @ea_inode_array for deferred iput().
- * If @ea_inode_array is new or full it will be grown and the old
- * contents copied over.
- */
-static int
-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
-			struct inode *inode)
-{
-	if (*ea_inode_array == NULL) {
-		/*
-		 * Start with 15 inodes, so it fits into a power-of-two size.
-		 */
-		(*ea_inode_array) = kmalloc_flex(**ea_inode_array, inodes,
-						 EIA_MASK, GFP_NOFS);
-		if (*ea_inode_array == NULL)
-			return -ENOMEM;
-		(*ea_inode_array)->count = 0;
-	} else if (((*ea_inode_array)->count & EIA_MASK) == EIA_MASK) {
-		/* expand the array once all 15 + n * 16 slots are full */
-		struct ext4_xattr_inode_array *new_array = NULL;
-
-		new_array = kmalloc_flex(**ea_inode_array, inodes,
-					 (*ea_inode_array)->count + EIA_INCR,
-					 GFP_NOFS);
-		if (new_array == NULL)
-			return -ENOMEM;
-		memcpy(new_array, *ea_inode_array,
-		       struct_size(*ea_inode_array, inodes,
-				   (*ea_inode_array)->count));
-		kfree(*ea_inode_array);
-		*ea_inode_array = new_array;
-	}
-	(*ea_inode_array)->count++;
-	(*ea_inode_array)->inodes[(*ea_inode_array)->count - 1] = inode;
-	return 0;
-}
-
 /*
  * ext4_xattr_delete_inode()
  *
@@ -2913,7 +2858,6 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
  * references on xattr block and xattr inodes.
  */
 int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
-			    struct ext4_xattr_inode_array **ea_inode_array,
 			    int extra_credits)
 {
 	struct buffer_head *bh = NULL;
@@ -2952,7 +2896,6 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
 			ext4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,
 						     IFIRST(header),
 						     false /* block_csum */,
-						     ea_inode_array,
 						     extra_credits,
 						     false /* skip_quota */);
 	}
@@ -2986,12 +2929,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
 					continue;
 				ext4_xattr_inode_free_quota(inode, ea_inode,
 					      le32_to_cpu(entry->e_value_size));
-				iput(ea_inode);
+				ext4_put_ea_inode(ea_inode);
 			}
 
 		}
 
-		ext4_xattr_release_block(handle, inode, bh, ea_inode_array,
+		ext4_xattr_release_block(handle, inode, bh,
 					 extra_credits);
 		/*
 		 * Update i_file_acl value in the same transaction that releases
@@ -3013,16 +2956,63 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
 	return error;
 }
 
-void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *ea_inode_array)
+/*
+ * Worker function for deferred EA inode iput.  Processes all inodes queued
+ * on s_ea_inode_to_free in a context free of xattr_sem/jbd2 handle locks.
+ */
+static void ext4_ea_inode_work(struct work_struct *work)
 {
-	int idx;
+	struct ext4_sb_info *sbi = container_of(to_delayed_work(work),
+						struct ext4_sb_info,
+						s_ea_inode_work);
+	struct llist_node *node = llist_del_all(&sbi->s_ea_inode_to_free);
 
-	if (ea_inode_array == NULL)
+	while (node) {
+		struct ext4_inode_info *ei = container_of(node,
+					struct ext4_inode_info, i_ea_iput_node);
+		node = node->next;
+		iput(&ei->vfs_inode);
+	}
+}
+
+/*
+ * Release a VFS reference on an EA inode.  Must be used instead of iput()
+ * in any context where xattr_sem or a jbd2 handle is held.
+ *
+ * If this is not the last reference, drops it immediately via
+ * iput_if_not_last() with no further action needed.
+ *
+ * If this is the last reference, the inode is linked onto a per-sb
+ * llist via i_ea_iput_node (embedded in ext4_inode_info, sharing space
+ * with the unused xattr_sem) and a delayed worker performs the final
+ * iput() in a clean context.
+ *
+ * Note: while an inode is on s_ea_inode_to_free, the unconsumed i_count
+ * reference (still 1) keeps it in the inode cache, so any concurrent
+ * iget() bumps i_count to >= 2 and iput_if_not_last() will succeed.
+ * Nobody will add the inode a second time until ext4_ea_inode_work()
+ * drops that reference via iput().
+ */
+void ext4_put_ea_inode(struct inode *inode)
+{
+	if (!inode)
+		return;
+	WARN_ON_ONCE(!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL));
+	if (iput_if_not_last(inode))
 		return;
+	llist_add(&EXT4_I(inode)->i_ea_iput_node,
+		  &EXT4_SB(inode->i_sb)->s_ea_inode_to_free);
+	/*
+	 * Use a short delay to allow multiple EA inodes to accumulate,
+	 * reducing workqueue wakeups when several are released together.
+	 */
+	schedule_delayed_work(&EXT4_SB(inode->i_sb)->s_ea_inode_work, 1);
+}
 
-	for (idx = 0; idx < ea_inode_array->count; ++idx)
-		iput(ea_inode_array->inodes[idx]);
-	kfree(ea_inode_array);
+void ext4_init_ea_inode_work(struct ext4_sb_info *sbi)
+{
+	init_llist_head(&sbi->s_ea_inode_to_free);
+	INIT_DELAYED_WORK(&sbi->s_ea_inode_work, ext4_ea_inode_work);
 }
 
 /*
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 1fedf44d4fb65e..821dc6a50e51e7 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -131,11 +131,6 @@ struct ext4_xattr_ibody_find {
 	struct ext4_iloc iloc;
 };
 
-struct ext4_xattr_inode_array {
-	unsigned int count;
-	struct inode *inodes[] __counted_by(count);
-};
-
 extern const struct xattr_handler ext4_xattr_user_handler;
 extern const struct xattr_handler ext4_xattr_trusted_handler;
 extern const struct xattr_handler ext4_xattr_security_handler;
@@ -187,9 +182,9 @@ extern int __ext4_xattr_set_credits(struct super_block *sb, struct inode *inode,
 				bool is_create);
 
 extern int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
-				   struct ext4_xattr_inode_array **array,
 				   int extra_credits);
-extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);
+extern void ext4_init_ea_inode_work(struct ext4_sb_info *sbi);
+extern void ext4_put_ea_inode(struct inode *inode);
 
 extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
 			    struct ext4_inode *raw_inode, handle_t *handle);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 50ce731a2b78f1..aa1d501d2bb627 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2413,6 +2413,21 @@ static inline void super_set_sysfs_name_generic(struct super_block *sb, const ch
 extern void ihold(struct inode * inode);
 extern void iput(struct inode *);
 void iput_not_last(struct inode *);
+
+/**
+ * iput_if_not_last - drop an inode reference only if it is not the last one
+ * @inode: inode to put
+ *
+ * Returns true if the reference was dropped, false if this was the last
+ * reference and the caller must arrange for final iput() in a safe context.
+ */
+static inline bool __must_check iput_if_not_last(struct inode *inode)
+{
+	VFS_BUG_ON_INODE(inode_state_read_once(inode) & (I_FREEING | I_CLEAR), inode);
+	VFS_BUG_ON_INODE(icount_read_once(inode) < 1, inode);
+	return atomic_add_unless(&inode->i_count, -1, 1);
+}
+
 int inode_update_time(struct inode *inode, enum fs_update_time type,
 		unsigned int flags);
 int generic_update_time(struct inode *inode, enum fs_update_time type,

gemini-3.1-pro-preview

null

null

							input: 9592
							output: 30
							thoughts: 224
						

**Analyzing the Ext4 Xattr Patch**

Okay, so I'm looking at this patch for ext4. It's making some pretty fundamental changes to how Extended Attributes (EAs) are handled, specifically around the tracking and freeing of EA inodes. They've added this `ext4_put_ea_inode` function, which is interesting. Using `iput_if_not_last` is a good approach to avoid premature inode release, and deferring the final `iput` to that workqueue, `s_ea_inode_work`, makes sense for avoiding potential lock ordering issues, which is always a concern in filesystem code. Good to see they're being proactive about that.

Now, the unioning of `xattr_sem` with `i_ea_iput_node` within `ext4_inode_info` seems like a clever optimization. Consolidating those two, especially if `i_ea_iput_node` is an `llist_node`, makes me think they're trying to reduce memory footprint, and possibly improve cache efficiency. Smart move. This is definitely a functional change affecting the core ext4 filesystem, so it’s worth a deep dive.

First, I need to make sure this code path is actually reachable, which is crucial. Ext4 is the filesystem, of course. Then, let's figure out the necessary configuration options. `EXT4_FS` is the obvious one, which will bring in most of what’s needed, but I should probably check for `EXT4_FS_XATTR` too, just in case they've got some finer-grained dependencies. Maybe `EXT4_FS_POSIX_ACL` or `EXT4_FS_SECURITY` are involved too, though less likely. Time to check `fs/ext4/Kconfig` to be certain.

{
  "Expression": "config EXT4",
  "PathPrefix": "fs/ext4/Kconfig"
}

{
  "Output": "fs/ext4/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/ext4/Kconfig:2:config EXT4_FS\nfs/ext4/Kconfig-3-\ttristate \"The Extended 4 (ext4) filesystem\"\n--\nfs/ext4/Kconfig-34-\nfs/ext4/Kconfig:35:config EXT4_USE_FOR_EXT2\nfs/ext4/Kconfig-36-\tbool \"Use ext4 for ext2 file systems\"\n--\nfs/ext4/Kconfig-45-\nfs/ext4/Kconfig:46:config EXT4_FS_POSIX_ACL\nfs/ext4/Kconfig-47-\tbool \"Ext4 POSIX Access Control Lists\"\n--\nfs/ext4/Kconfig-55-\nfs/ext4/Kconfig:56:config EXT4_FS_SECURITY\nfs/ext4/Kconfig-57-\tbool \"Ext4 Security Labels\"\n--\nfs/ext4/Kconfig-67-\nfs/ext4/Kconfig:68:config EXT4_DEBUG\nfs/ext4/Kconfig-69-\tbool \"Ext4 debugging support\"\n--\nfs/ext4/Kconfig-76-\nfs/ext4/Kconfig:77:config EXT4_KUNIT_TESTS\nfs/ext4/Kconfig-78-\ttristate \"KUnit tests for ext4\" if !KUNIT_ALL_TESTS\n"
}

gemini-3.1-pro-preview

null

null

							input: 10606
							output: 32
							thoughts: 196
						

**Analyzing the Ext4 Xattr Patch**

Okay, so this patch is digging into the heart of Ext4's extended attribute (xattr) handling. I see it's touching quite a few key files: `fs/ext4/xattr.c`, `fs/ext4/inode.c`, `fs/ext4/super.c`, as well as the related headers, and even `include/linux/fs.h`. This suggests some pretty fundamental changes are happening, potentially impacting how xattrs are stored, accessed, and managed within the filesystem.

Specifically, I'm noticing a cluster of newly introduced or modified functions: `ext4_put_ea_inode`, `ext4_ea_inode_work`, `ext4_init_ea_inode_work`, `iput_if_not_last`, `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, and `ext4_xattr_inode_dec_ref_all`. The names alone give me a pretty good idea of what's going on, but I'll need to dive deeper into the actual code. It looks like they are handling extended attribute (EA) inodes, likely around the lifecycle of the inodes and associated blocks. It might be related to reference counting or memory management in the xattr space, and potentially how they are cleaned up or removed. The `iput_if_not_last` function seems particularly interesting, suggesting a focus on inode handling and reference counts.

Before I go too far, I need to check something basic: is xattr functionality conditional on the `EXT4_FS_XATTR` configuration option, or is it always built in for Ext4? I need to figure out if this patch is expanding existing features, or changing the standard behavior for most Ext4 installations.

no matches

{
  "Expression": "EXT4_FS_XATTR",
  "PathPrefix": "fs/ext4/"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 11236
							output: 28
							thoughts: 46
						

**Investigating EXT4 Xattr Configuration**

Okay, so I'm looking at this and there's no explicitly defined `EXT4_FS_XATTR` option in the configuration. That's a bit odd. My first thought is that the extended attribute support for ext4 is either compiled directly into the filesystem itself, or perhaps it's gated behind the general `EXT4_FS` configuration option. Let's dig in a bit deeper and see what the build system has to say. The `fs/ext4/Makefile` is the logical place to start. I'll take a quick look to see how the various features are enabled during the build process and see if I can understand how xattr support is handled.

{
  "Expression": "xattr",
  "PathPrefix": "fs/ext4/Makefile"
}

{
  "Output": "fs/ext4/Makefile=8=ext4-y\t:= balloc.o bitmap.o block_validity.o dir.o ext4_jbd2.o extents.o \\\n--\nfs/ext4/Makefile-11-\t\tmmp.o move_extent.o namei.o page-io.o readpage.o resize.o \\\nfs/ext4/Makefile:12:\t\tsuper.o symlink.o sysfs.o xattr.o xattr_hurd.o xattr_trusted.o \\\nfs/ext4/Makefile:13:\t\txattr_user.o fast_commit.o orphan.o\nfs/ext4/Makefile-14-\nfs/ext4/Makefile=15=ext4-$(CONFIG_EXT4_FS_POSIX_ACL)\t+= acl.o\nfs/ext4/Makefile:16:ext4-$(CONFIG_EXT4_FS_SECURITY)\t\t+= xattr_security.o\nfs/ext4/Makefile-17-ext4-test-objs\t\t\t\t+= inode-test.o mballoc-test.o \\\n"
}

gemini-3.1-pro-preview

null

null

							input: 11733
							output: 45
							thoughts: 244
						

**Analyzing EXT4 Extended Attribute Implementation**

Okay, so looking at this, it seems that the `xattr.o` object file is *always* built when the `EXT4_FS` configuration option is enabled. That makes sense, but to make sure we're thoroughly testing the extended attribute code, I should probably also enable `EXT4_FS_POSIX_ACL` and `EXT4_FS_SECURITY`. That should provide complete coverage.

Now, let's drill down into some key symbols. I need to understand how the inode-related functions are being handled. I'm focusing on `ext4_put_ea_inode`, `ext4_ea_inode_work`, `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, and `ext4_xattr_inode_dec_ref_all`.

`ext4_put_ea_inode`, ah, that's defined in `fs/ext4/xattr.c` and is actually exported. So other EXT4 components are using it, which is good to know. Now `ext4_ea_inode_work` is static to the file and therefore not exposed to other ext4 files. I also need to verify that `ext4_xattr_delete_inode` is in that same file, `fs/ext4/xattr.c`.

I should probably double-check those function names, just to be absolutely certain I have the correct symbols. Better safe than sorry.

{
  "Expression": "^(static )?(void|int) ext4_put_ea_inode",
  "PathPrefix": "fs/ext4/xattr.c"
}

{
  "Output": "fs/ext4/xattr.c=2963=static void ext4_ea_inode_work(struct work_struct *work)\n--\nfs/ext4/xattr.c-2995- */\nfs/ext4/xattr.c:2996:void ext4_put_ea_inode(struct inode *inode)\nfs/ext4/xattr.c-2997-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 12455
							output: 46
							thoughts: 116
						

**Analyzing Extended Attribute Release and Reference Counting in ext4**

Okay, here's what's running through my head as I look at this: I need to zero in on a few critical functions within the ext4 extended attribute (xattr) handling code. Based on the context, I suspect these are key areas for review and likely where related issues could be. Specifically, I'm thinking about: `ext4_put_ea_inode`, `ext4_ea_inode_work`, `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, and `ext4_xattr_inode_dec_ref_all`.

My initial focus will be on the interactions between the block release and reference counting. The key functions to investigate further are `ext4_xattr_release_block` and `ext4_xattr_inode_dec_ref_all` – particularly how they manage the release of xattr blocks and reduce the reference count on the associated inode, respectively. I'll need to dig into `fs/ext4/xattr.c` and figure out their exact behavior.

no matches

{
  "Expression": "^(static )?(void|int) ext4_xattr_release_block",
  "PathPrefix": "fs/ext4/xattr.c"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 12872
							output: 38
							thoughts: 17
						

Here's my thought process, summarized as you requested:

**Deconstructing a Kernel Issue: `ext4_xattr_release_block`**

Okay, so I'm seeing something about `ext4_xattr_release_block`. Immediately, my brain zeroes in on that function name. It screams "ext4 filesystem" and "extended attributes" – specifically, the release of a block involved in managing xattrs. This likely points to an issue related to how the filesystem is handling the freeing up of disk space tied to those extended attribute entries. My initial thought is it's probably related to some kind of write path or perhaps a deletion scenario, possibly involving corrupted metadata or a race condition. I'm imagining potentially an issue where the block is being prematurely released, or perhaps is not getting freed up correctly at all. Need to dive deeper! I’d start by looking for any recent patches, bugs or regressions around this function within the last few kernel releases. Let’s grep the codebase for that exact function name and see what comes up. My immediate goal is to understand the context of this function call – what calls it? what is called by it? What structures does it interact with? That's where I need to start.

{
  "Expression": "ext4_xattr_release_block",
  "PathPrefix": "fs/ext4/xattr.c"
}

{
  "Output": "fs/ext4/xattr.c=1262=static void\nfs/ext4/xattr.c:1263:ext4_xattr_release_block(handle_t *handle, struct inode *inode,\nfs/ext4/xattr.c-1264-\t\t\t struct buffer_head *bh,\n--\nfs/ext4/xattr.c=1888=ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-2173-\tif (bs-\u003ebh \u0026\u0026 bs-\u003ebh != new_bh) {\nfs/ext4/xattr.c:2174:\t\text4_xattr_release_block(handle, inode, bs-\u003ebh,\nfs/ext4/xattr.c-2175-\t\t\t\t\t 0 /* extra_credits */);\n--\nfs/ext4/xattr.c=2860=int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n--\nfs/ext4/xattr.c-2936-\nfs/ext4/xattr.c:2937:\t\text4_xattr_release_block(handle, inode, bh,\nfs/ext4/xattr.c-2938-\t\t\t\t\t extra_credits);\n"
}

gemini-3.1-pro-preview

null

null

							input: 13521
							output: 38
							thoughts: 52
						

Here's my thought process, as if I were analyzing this code:

**Analyzing Ext4 Xattr Deletion**

Alright, I'm diving into this `ext4_xattr_delete_inode` function. Good to see that `ext4_xattr_release_block` and `ext4_xattr_inode_dec_ref_all` are both static, which helps in understanding the scope of their use within the xattr handling. Now, the key is to understand what `ext4_xattr_delete_inode` *does* and how it interacts with the related functions. I need to trace the flow from there. What are the dependencies? What are the potential side effects? Let's get to the bottom of this.

{
  "Expression": "ext4_xattr_delete_inode",
  "PathPrefix": "fs/ext4/xattr.c"
}

{
  "Output": "fs/ext4/xattr.c=2748=int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n--\nfs/ext4/xattr.c-2851-/*\nfs/ext4/xattr.c:2852: * ext4_xattr_delete_inode()\nfs/ext4/xattr.c-2853- *\n--\nfs/ext4/xattr.c-2859- */\nfs/ext4/xattr.c:2860:int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\nfs/ext4/xattr.c-2861-\t\t\t    int extra_credits)\n"
}

gemini-3.1-pro-preview

null

null

							input: 13968
							output: 35
							thoughts: 579
						

**My Initial Assessment of the EXT4 Xattr Patch**

Okay, so I'm looking at this patch and it's immediately clear that it's fundamentally altering how we handle extended attributes (xattrs) for EA inodes within the ext4 filesystem. Given the scope, this screams "potential for fuzzing opportunities." Specifically, the changes appear to be concentrated around the handling of EA inodes.

Let's quickly check the config options, just to be sure we are covering all potential bases: `EXT4_FS`, `EXT4_FS_POSIX_ACL`, and `EXT4_FS_SECURITY` are definitely relevant here.

Now, let's identify the key functions that have been modified or added. The initial list includes `ext4_put_ea_inode`, `ext4_ea_inode_work`, `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, and `ext4_xattr_inode_dec_ref_all`, so I will give them the priority.

However, I should be thorough and check for other changes. Okay, let's see... looking at the complete list of modified functions, I find `ext4_alloc_inode` in `fs/ext4/super.c`, `ext4_evict_inode` in `fs/ext4/inode.c`, `ext4_put_super` in `fs/ext4/super.c`, `__ext4_fill_super` in `fs/ext4/super.c`, `ext4_sync_fs` in `fs/ext4/super.c`, `ext4_xattr_inode_get` in `fs/ext4/xattr.c`, `ext4_xattr_inode_inc_ref_all` in `fs/ext4/xattr.c`, `ext4_xattr_inode_create` in `fs/ext4/xattr.c`, `ext4_xattr_inode_cache_find` in `fs/ext4/xattr.c`, `ext4_xattr_inode_lookup_create` in `fs/ext4/xattr.c`, `ext4_xattr_set_entry` in `fs/ext4/xattr.c`, `ext4_xattr_block_set` in `fs/ext4/xattr.c`, and `ext4_xattr_ibody_set` in `fs/ext4/xattr.c`.

Okay, after reviewing the other modified functions, I can see that `ext4_xattr_block_set` and `ext4_xattr_ibody_set` are also quite relevant and should be added to the fuzzing focus. I'll include those in my list of `FocusSymbols`.

Now, before I proceed with the actual fuzzing, I'll need to double check `iput_if_not_last`. That seems like an important function to keep in mind, in regards to the code-path taken.

{
  "Expression": "iput_if_not_last",
  "PathPrefix": "include/linux/fs.h"
}

{
  "Output": "include/linux/fs.h=2415=void iput_not_last(struct inode *);\n--\ninclude/linux/fs.h-2417-/**\ninclude/linux/fs.h:2418: * iput_if_not_last - drop an inode reference only if it is not the last one\ninclude/linux/fs.h-2419- * @inode: inode to put\n--\ninclude/linux/fs.h-2423- */\ninclude/linux/fs.h:2424:static inline bool __must_check iput_if_not_last(struct inode *inode)\ninclude/linux/fs.h-2425-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 15415
							output: 189
							thoughts: 209
						

**My Assessment of the Patch's Fuzzing Potential**

Okay, so I've got this patch here and I'm running through my mental checklist. First off, this function is `static inline`, which is good to know because it means it won't clutter the kernel symbol table. I can skip including it in `FocusSymbols`. That'll keep things cleaner.

Now, let's get down to brass tacks and prepare the final decision.

`WorthFuzzing` should definitely be `true`. The reasoning is pretty compelling here: this patch is messing with *core* ext4 xattr logic, specifically how Extended Attribute (EA) inodes are managed. It's making fundamental changes to how those inodes are tracked and freed, and it's doing so with a new deferred `iput` mechanism implemented via a workqueue. This is designed to sidestep those nasty lock ordering issues. We're talking about a significant functional change in a filesystem that's used *everywhere*. The potential for subtle bugs is high, and the impact could be widespread.

Given the scope of the change, the necessary configurations look like `EXT4_FS`, `EXT4_FS_POSIX_ACL`, and `EXT4_FS_SECURITY`.

Finally, the `FocusSymbols` list is looking solid. I should keep an eye on these functions: `ext4_put_ea_inode`, `ext4_ea_inode_work`, `ext4_xattr_delete_inode`, `ext4_xattr_release_block`, `ext4_xattr_inode_dec_ref_all`, `ext4_xattr_block_set`, and `ext4_xattr_ibody_set`. They're all key to this new EA inode management and deferred `iput` process. It's a complete view of how the functionality is changed and gives a good point to begin testing.

{
  "EnableConfigs": [
    "EXT4_FS",
    "EXT4_FS_POSIX_ACL",
    "EXT4_FS_SECURITY"
  ],
  "FocusSymbols": [
    "ext4_put_ea_inode",
    "ext4_ea_inode_work",
    "ext4_xattr_delete_inode",
    "ext4_xattr_release_block",
    "ext4_xattr_inode_dec_ref_all",
    "ext4_xattr_block_set",
    "ext4_xattr_ibody_set"
  ],
  "Reasoning": "The patch modifies core ext4 xattr logic, specifically how EA inodes are tracked and freed, introducing a deferred iput mechanism via a workqueue to avoid lock ordering issues. This is a functional change in a widely used filesystem.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "EXT4_FS",
    "EXT4_FS_POSIX_ACL",
    "EXT4_FS_SECURITY"
  ],
  "FocusSymbols": [
    "ext4_put_ea_inode",
    "ext4_ea_inode_work",
    "ext4_xattr_delete_inode",
    "ext4_xattr_release_block",
    "ext4_xattr_inode_dec_ref_all",
    "ext4_xattr_block_set",
    "ext4_xattr_ibody_set"
  ],
  "Reasoning": "The patch modifies core ext4 xattr logic, specifically how EA inodes are tracked and freed, introducing a deferred iput mechanism via a workqueue to avoid lock ordering issues. This is a functional change in a widely used filesystem.",
  "WorthFuzzing": true
}