| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/06/25 04:48 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"PAGE_OWNER"
],
"FocusSymbols": [
"page_owner_open",
"page_owner_release",
"page_owner_write",
"read_page_owner",
"print_page_owner"
],
"Reasoning": "The patch adds a new write interface to `/sys/kernel/debug/page_owner` to allow filtering page owner output by print mode and NUMA node. It introduces new parsing logic, state management per file descriptor, and modifies the read path to respect the filter. This is reachable from userspace via debugfs and should be fuzzed to ensure the parsing and state management are robust.",
"WorthFuzzing": true
} |
| 1/1 | 2026/06/25 04:48 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 258f0cbf27c1e487ad085971d5db1e7cfec41b8e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Thu Jun 25 04:47:59 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/mm/page_owner.rst b/Documentation/mm/page_owner.rst\nindex 6b12f3b007ec91..383e59c42743bd 100644\n--- a/Documentation/mm/page_owner.rst\n+++ b/Documentation/mm/page_owner.rst\n@@ -65,7 +65,14 @@ un-tracking state.\n Usage\n =====\n \n-1) Build user-space helper::\n+1) Build user-space helpers::\n+\n+To filter page_owner output:\n+\n+\tcd tools/mm\n+\tmake page_owner_filter\n+\n+To sort and analyze page_owner output:\n \n \tcd tools/mm\n \tmake page_owner_sort\n@@ -74,7 +81,11 @@ Usage\n \n 3) Do the job that you want to debug.\n \n-4) Analyze information from page owner::\n+4) (Optional) Filter page_owner output::\n+\n+\t./page_owner_filter -m handle -n 0,1,2 \u003e filtered_page_owner.txt\n+\n+5) Analyze information from page owner::\n \n \tcat /sys/kernel/debug/page_owner_stacks/show_stacks \u003e stacks.txt\n \tcat stacks.txt\n@@ -263,3 +274,65 @@ STANDARD FORMAT SPECIFIERS\n \tf\t\tfree\t\twhether the page has been released or not\n \tst\t\tstacktrace\tstack trace of the page allocation\n \tator\t\tallocator\tmemory allocator for pages\n+\n+Filtering page_owner output\n+============================\n+\n+page_owner supports filtering output at the kernel level before reading,\n+which reduces the amount of data that needs to be processed in userspace.\n+\n+The page_owner_filter tool provides a convenient interface for this filtering\n+capability. It supports two types of filters:\n+\n+1. **print_mode filter**: Control what information is printed for each page\n+\t- ``stack``: Print full stack traces (default, compatible with existing usage)\n+\t- ``handle``: Print only stack handle numbers (much faster, smaller output)\n+\t- ``stack_handle``: Print both stack traces and handle numbers\n+\n+\tThe ``handle`` mode uses numeric identifiers instead of full stack traces.\n+\tThe mapping from handles to actual stack traces can be obtained via the\n+\tshow_stacks_handles interface.\n+\n+2. **NUMA node filter**: Filter pages by NUMA node ID\n+\t- Supports single node: ``-n 0``\n+\t- Multiple nodes: ``-n 0,1,2``\n+\t- Ranges: ``-n 0-3``\n+\t- Mixed format: ``-n 0,2-3,5``\n+\n+Usage examples::\n+\n+\t# Filter by print mode\n+\t./page_owner_filter -m handle\n+\t./page_owner_filter -m stack_handle\n+\n+\t# Filter by NUMA node\n+\t./page_owner_filter -n 0\n+\t./page_owner_filter -n 0-3\n+\n+\t# Combined filters\n+\t./page_owner_filter -m stack -n 0,1,2\n+\t./page_owner_filter -m handle -n 0,2-3\n+\n+\t# Save to file\n+\t./page_owner_filter -m handle -o filtered_output.txt\n+\n+The handle mode is particularly useful for monitoring and performance-critical\n+scenarios as it dramatically reduces output size. Testing shows handle mode can\n+reduce output size by ~66% (84MB vs 244MB) and improve read performance by ~4.4x\n+compared to full stack output.\n+\n+The NUMA node filter is useful for NUMA-aware memory allocation analysis and debugging.\n+\n+Behind the scenes, page_owner_filter opens /sys/kernel/debug/page_owner and\n+writes filter commands before reading the filtered output. The filtering uses\n+per-file-descriptor state, allowing each open() to have independent filter settings.\n+\n+Each file descriptor maintains its own filter state, so you can have multiple\n+independent filtering operations running concurrently. For example, in different\n+terminals you can run different filters simultaneously::\n+\n+\t# Terminal 1: Filter node 0\n+\t./page_owner_filter -n 0 \u003e node0_output.txt\n+\n+\t# Terminal 2: Filter node 1 (runs concurrently)\n+\t./page_owner_filter -n 1 \u003e node1_output.txt\ndiff --git a/mm/page_owner.c b/mm/page_owner.c\nindex 8178e0be557f87..cae5abf0ac9afa 100644\n--- a/mm/page_owner.c\n+++ b/mm/page_owner.c\n@@ -54,6 +54,25 @@ struct stack_print_ctx {\n \tu8 flags;\n };\n \n+enum page_owner_print_mode {\n+\tPAGE_OWNER_PRINT_STACK,\n+\tPAGE_OWNER_PRINT_HANDLE,\n+\tPAGE_OWNER_PRINT_STACK_HANDLE,\n+};\n+\n+static const char * const page_owner_print_mode_strings[] = {\n+\t[PAGE_OWNER_PRINT_STACK]\t= \"stack\",\n+\t[PAGE_OWNER_PRINT_HANDLE]\t= \"handle\",\n+\t[PAGE_OWNER_PRINT_STACK_HANDLE]\t= \"stack_handle\",\n+};\n+\n+struct page_owner_filter_state {\n+\tenum page_owner_print_mode print_mode;\n+\tnodemask_t nid_filter;\n+\tbool nid_filter_enabled;\n+\tspinlock_t lock;\n+};\n+\n static bool page_owner_enabled __initdata;\n DEFINE_STATIC_KEY_FALSE(page_owner_inited);\n \n@@ -547,16 +566,23 @@ static inline int print_page_owner_memcg(char *kbuf, size_t count, int ret,\n static ssize_t\n print_page_owner(char __user *buf, size_t count, unsigned long pfn,\n \t\tstruct page *page, struct page_owner *page_owner,\n-\t\tdepot_stack_handle_t handle)\n+\t\tdepot_stack_handle_t handle,\n+\t\tstruct page_owner_filter_state *state)\n {\n \tint ret, pageblock_mt, page_mt;\n \tchar *kbuf;\n+\tenum page_owner_print_mode print_mode;\n+\tunsigned long flags;\n \n \tcount = min_t(size_t, count, PAGE_SIZE);\n \tkbuf = kmalloc(count, GFP_KERNEL);\n \tif (!kbuf)\n \t\treturn -ENOMEM;\n \n+\tspin_lock_irqsave(\u0026state-\u003elock, flags);\n+\tprint_mode = state-\u003eprint_mode;\n+\tspin_unlock_irqrestore(\u0026state-\u003elock, flags);\n+\n \tret = scnprintf(kbuf, count,\n \t\t\t\"Page allocated via order %u, mask %#x(%pGg), pid %d, tgid %d (%s), ts %llu ns\\n\",\n \t\t\tpage_owner-\u003eorder, page_owner-\u003egfp_mask,\n@@ -575,9 +601,18 @@ print_page_owner(char __user *buf, size_t count, unsigned long pfn,\n \t\t\tmigratetype_names[pageblock_mt],\n \t\t\t\u0026page-\u003eflags);\n \n-\tret += stack_depot_snprint(handle, kbuf + ret, count - ret, 0);\n-\tif (ret \u003e= count)\n-\t\tgoto err;\n+\tif (print_mode != PAGE_OWNER_PRINT_HANDLE) {\n+\t\tret += stack_depot_snprint(handle, kbuf + ret, count - ret, 0);\n+\t\tif (ret \u003e= count)\n+\t\t\tgoto err;\n+\t}\n+\n+\tif (print_mode != PAGE_OWNER_PRINT_STACK) {\n+\t\tret += scnprintf(kbuf + ret, count - ret, \"handle: %u\\n\",\n+\t\t\t\t handle);\n+\t\tif (ret \u003e= count)\n+\t\t\tgoto err;\n+\t}\n \n \tif (page_owner-\u003elast_migrate_reason != -1) {\n \t\tret += scnprintf(kbuf + ret, count - ret,\n@@ -664,6 +699,8 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)\n \tstruct page_ext *page_ext;\n \tstruct page_owner *page_owner;\n \tdepot_stack_handle_t handle;\n+\tstruct page_owner_filter_state *state = file-\u003eprivate_data;\n+\tunsigned long flags;\n \n \tif (!static_branch_unlikely(\u0026page_owner_inited))\n \t\treturn -EINVAL;\n@@ -740,15 +777,37 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)\n \t\tif (!handle)\n \t\t\tgoto ext_put_continue;\n \n+\t\tspin_lock_irqsave(\u0026state-\u003elock, flags);\n+\t\tif (state-\u003enid_filter_enabled) {\n+\t\t\tint nid;\n+\t\t\tmemdesc_flags_t page_flags = READ_ONCE(page-\u003eflags);\n+\n+\t\t\t/*\n+\t\t\t * Bypass PF_POISONED_CHECK() in page_to_nid() to avoid\n+\t\t\t * VM_BUG_ON when accessing poisoned pages.\n+\t\t\t */\n+\t\t\tif (page_flags.f == PAGE_POISON_PATTERN) {\n+\t\t\t\tspin_unlock_irqrestore(\u0026state-\u003elock, flags);\n+\t\t\t\tgoto ext_put_continue;\n+\t\t\t}\n+\t\t\tnid = memdesc_nid(page_flags);\n+\t\t\tif (!node_isset(nid, state-\u003enid_filter)) {\n+\t\t\t\tspin_unlock_irqrestore(\u0026state-\u003elock, flags);\n+\t\t\t\tgoto ext_put_continue;\n+\t\t\t}\n+\t\t}\n+\t\tspin_unlock_irqrestore(\u0026state-\u003elock, flags);\n+\n \t\t/* Record the next PFN to read in the file offset */\n \t\t*ppos = pfn + 1;\n \n \t\tpage_owner_tmp = *page_owner;\n \t\tpage_ext_put(page_ext);\n \t\treturn print_page_owner(buf, count, pfn, page,\n-\t\t\t\t\u0026page_owner_tmp, handle);\n+\t\t\t\t\u0026page_owner_tmp, handle, state);\n ext_put_continue:\n \t\tpage_ext_put(page_ext);\n+\t\tcond_resched();\n \t}\n \n \treturn 0;\n@@ -847,7 +906,122 @@ static void init_early_allocated_pages(void)\n \t\tinit_pages_in_zone(zone);\n }\n \n+static int page_owner_open(struct inode *inode, struct file *file)\n+{\n+\tstruct page_owner_filter_state *state;\n+\n+\tstate = kzalloc_obj(*state);\n+\tif (!state)\n+\t\treturn -ENOMEM;\n+\n+\tspin_lock_init(\u0026state-\u003elock);\n+\tstate-\u003eprint_mode = PAGE_OWNER_PRINT_STACK;\n+\tnodes_clear(state-\u003enid_filter);\n+\tstate-\u003enid_filter_enabled = false;\n+\tfile-\u003eprivate_data = state;\n+\treturn 0;\n+}\n+\n+static int page_owner_release(struct inode *inode, struct file *file)\n+{\n+\tkfree(file-\u003eprivate_data);\n+\treturn 0;\n+}\n+\n+static ssize_t page_owner_write(struct file *file,\n+\t\t\t\t const char __user *buf,\n+\t\t\t\t size_t count, loff_t *ppos)\n+{\n+\tchar *kbuf;\n+\tchar *orig;\n+\tchar *token;\n+\tint ret;\n+\tsize_t max_input_len;\n+\tstruct page_owner_filter_state *state = file-\u003eprivate_data;\n+\tenum page_owner_print_mode new_print_mode;\n+\tnodemask_t new_nid_filter;\n+\tbool new_nid_filter_enabled;\n+\tunsigned long flags;\n+\n+\t/*\n+\t * Maximum input length for filter commands:\n+\t * - 32: print_mode command max length is 17 (\"mode=stack_handle\")\n+\t * with sufficient buffer\n+\t * - 6 * MAX_NUMNODES: worst case for nid list\n+\t * Worst case per node: \",NNNNN\" (comma + 5-digit node number) = 6 bytes\n+\t */\n+\tmax_input_len = 32 + 6 * MAX_NUMNODES;\n+\n+\tif (count \u003e max_input_len)\n+\t\treturn -EINVAL;\n+\n+\tkbuf = memdup_user_nul(buf, count);\n+\tif (IS_ERR(kbuf))\n+\t\treturn PTR_ERR(kbuf);\n+\n+\torig = kbuf;\n+\n+\tspin_lock_irqsave(\u0026state-\u003elock, flags);\n+\tnew_print_mode = state-\u003eprint_mode;\n+\tnew_nid_filter = state-\u003enid_filter;\n+\tnew_nid_filter_enabled = state-\u003enid_filter_enabled;\n+\tspin_unlock_irqrestore(\u0026state-\u003elock, flags);\n+\n+\twhile ((token = strsep(\u0026kbuf, \" \\t\\n\")) != NULL) {\n+\t\tif (*token == '\\0')\n+\t\t\tcontinue;\n+\n+\t\tif (!strncmp(token, \"mode=\", 5)) {\n+\t\t\tret = sysfs_match_string(page_owner_print_mode_strings,\n+\t\t\t\t\t\ttoken + 5);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto out_free;\n+\t\t\tnew_print_mode = ret;\n+\t\t} else if (!strncmp(token, \"nid=\", 4)) {\n+\t\t\tret = nodelist_parse(token + 4, new_nid_filter);\n+\t\t\tif (ret \u003c 0)\n+\t\t\t\tgoto out_free;\n+\n+\t\t\tif (nodes_empty(new_nid_filter)) {\n+\t\t\t\tret = -EINVAL;\n+\t\t\t\tgoto out_free;\n+\t\t\t}\n+\n+\t\t\t/*\n+\t\t\t * We want to filter memory allocations by numa nodes, so make sure\n+\t\t\t * that the specified nodes have memory.\n+\t\t\t */\n+\t\t\tif (!nodes_subset(new_nid_filter, node_states[N_MEMORY])) {\n+\t\t\t\tret = -EINVAL;\n+\t\t\t\tgoto out_free;\n+\t\t\t}\n+\n+\t\t\tnew_nid_filter_enabled = true;\n+\t\t} else {\n+\t\t\tret = -EINVAL;\n+\t\t\tgoto out_free;\n+\t\t}\n+\t}\n+\n+\t/* Commit all filter changes */\n+\tspin_lock_irqsave(\u0026state-\u003elock, flags);\n+\tstate-\u003eprint_mode = new_print_mode;\n+\tstate-\u003enid_filter = new_nid_filter;\n+\tstate-\u003enid_filter_enabled = new_nid_filter_enabled;\n+\tspin_unlock_irqrestore(\u0026state-\u003elock, flags);\n+\n+\tret = count;\n+\n+out_free:\n+\tkfree(orig);\n+\treturn ret;\n+}\n+\n static const struct file_operations page_owner_fops = {\n+\t.owner\t\t= THIS_MODULE,\n+\t.open\t\t= page_owner_open,\n+\t.release\t= page_owner_release,\n+\t.write\t\t= page_owner_write,\n \t.read\t\t= read_page_owner,\n \t.llseek\t\t= lseek_page_owner,\n };\n@@ -980,7 +1154,7 @@ static int __init pageowner_init(void)\n \t\treturn 0;\n \t}\n \n-\tdebugfs_create_file(\"page_owner\", 0400, NULL, NULL, \u0026page_owner_fops);\n+\tdebugfs_create_file(\"page_owner\", 0600, NULL, NULL, \u0026page_owner_fops);\n \tdir = debugfs_create_dir(\"page_owner_stacks\", NULL);\n \tdebugfs_create_file(\"show_stacks\", 0400, dir,\n \t\t\t (void *)(STACK_PRINT_FLAG_STACK |\ndiff --git a/tools/mm/Makefile b/tools/mm/Makefile\nindex f5725b5c23aa26..858186a6eefdbd 100644\n--- a/tools/mm/Makefile\n+++ b/tools/mm/Makefile\n@@ -3,7 +3,7 @@\n #\n include ../scripts/Makefile.include\n \n-BUILD_TARGETS=page-types slabinfo page_owner_sort thp_swap_allocator_test\n+BUILD_TARGETS=page-types slabinfo page_owner_sort page_owner_filter thp_swap_allocator_test\n INSTALL_TARGETS = $(BUILD_TARGETS) thpmaps\n \n LIB_DIR = ../lib/api\n@@ -23,7 +23,7 @@ $(LIBS):\n \t$(CC) $(CFLAGS) -o $@ $\u003c $(LDFLAGS)\n \n clean:\n-\t$(RM) page-types slabinfo page_owner_sort thp_swap_allocator_test\n+\t$(RM) page-types slabinfo page_owner_sort page_owner_filter thp_swap_allocator_test\n \tmake -C $(LIB_DIR) clean\n \n sbindir ?= /usr/sbin\ndiff --git a/tools/mm/page_owner_filter.c b/tools/mm/page_owner_filter.c\nnew file mode 100644\nindex 00000000000000..1d1f0a38678a2f\n--- /dev/null\n+++ b/tools/mm/page_owner_filter.c\n@@ -0,0 +1,310 @@\n+// SPDX-License-Identifier: GPL-2.0\n+/*\n+ * User-space helper to filter page_owner output per-fd\n+ *\n+ * Example use:\n+ * ./page_owner_filter -m handle\n+ * ./page_owner_filter -m stack_handle\n+ * ./page_owner_filter -n 0,1,2\n+ *\n+ * See Documentation/mm/page_owner.rst\n+ */\n+\n+#include \u003cstdio.h\u003e\n+#include \u003cstdlib.h\u003e\n+#include \u003cstring.h\u003e\n+#include \u003cunistd.h\u003e\n+#include \u003cfcntl.h\u003e\n+#include \u003cerrno.h\u003e\n+#include \u003cctype.h\u003e\n+#include \u003cgetopt.h\u003e\n+#include \u003csignal.h\u003e\n+\n+#define MAX_CMD_LEN\t512\n+\n+static void usage(const char *prog)\n+{\n+\tfprintf(stderr, \"Usage: %s [OPTIONS]\\n\", prog);\n+\tfprintf(stderr, \"\\nOptions:\\n\");\n+\tfprintf(stderr, \" -m, --mode MODE : print_mode (stack, handle, or stack_handle)\\n\");\n+\tfprintf(stderr, \" -n, --nid NID_LIST : NUMA node IDs (comma-separated or ranges)\\n\");\n+\tfprintf(stderr, \" -o, --output FILE : output file (default: stdout)\\n\");\n+\tfprintf(stderr, \" -h, --help : show this help message\\n\");\n+\tfprintf(stderr, \"\\nExamples:\\n\");\n+\tfprintf(stderr, \" %s -m stack\\n\", prog);\n+\tfprintf(stderr, \" %s -m handle\\n\", prog);\n+\tfprintf(stderr, \" %s -m stack_handle\\n\", prog);\n+\tfprintf(stderr, \" %s -m stack -o output.txt\\n\", prog);\n+\tfprintf(stderr, \" %s -n 0,1,2\\n\", prog);\n+\tfprintf(stderr, \" %s -m stack -n 0\\n\", prog);\n+}\n+\n+static int validate_mode(const char *mode)\n+{\n+\tif (strcmp(mode, \"stack\") == 0 ||\n+\t strcmp(mode, \"handle\") == 0 ||\n+\t strcmp(mode, \"stack_handle\") == 0)\n+\t\treturn 0;\n+\n+\tfprintf(stderr, \"Error: Invalid mode '%s'\\n\", mode);\n+\tfprintf(stderr, \"Valid modes: stack, handle, stack_handle\\n\");\n+\treturn -1;\n+}\n+\n+static int validate_nid_list(const char *nid_list)\n+{\n+\tconst char *p;\n+\tint i = 0;\n+\tint has_digit = 0;\n+\tint in_range = 0;\n+\tint prev_num = 0;\n+\tint curr_num = 0;\n+\n+\tif (!nid_list || strlen(nid_list) == 0)\n+\t\treturn 0;\n+\n+\tfor (p = nid_list; *p; p++) {\n+\t\tif (*p == ',') {\n+\t\t\tif (!has_digit) {\n+\t\t\t\tfprintf(stderr, \"Error: Invalid nid_list format\\n\");\n+\t\t\t\treturn -1;\n+\t\t\t}\n+\t\t\tif (in_range \u0026\u0026 prev_num \u003e curr_num) {\n+\t\t\t\tfprintf(stderr,\n+\t\t\t\t\t\"Error: Invalid range %d-%d (start must be \u003c= end)\\n\",\n+\t\t\t\t\tprev_num, curr_num);\n+\t\t\t\treturn -1;\n+\t\t\t}\n+\t\t\ti = 0;\n+\t\t\thas_digit = 0;\n+\t\t\tin_range = 0;\n+\t\t\tprev_num = 0;\n+\t\t\tcurr_num = 0;\n+\t\t\tcontinue;\n+\t\t}\n+\n+\t\tif (*p == '-') {\n+\t\t\tif (!has_digit) {\n+\t\t\t\tfprintf(stderr,\n+\t\t\t\t\t\"Error: Invalid nid_list format \");\n+\t\t\t\tfprintf(stderr,\n+\t\t\t\t\t\"(dash without preceding number)\\n\");\n+\t\t\t\treturn -1;\n+\t\t\t}\n+\t\t\tif (in_range) {\n+\t\t\t\tfprintf(stderr, \"Error: Multiple dashes in nid_list\\n\");\n+\t\t\t\treturn -1;\n+\t\t\t}\n+\t\t\tprev_num = curr_num;\n+\t\t\tcurr_num = 0;\n+\t\t\ti = 0;\n+\t\t\thas_digit = 0;\n+\t\t\tin_range = 1;\n+\t\t\tcontinue;\n+\t\t}\n+\n+\t\tif (!isdigit((unsigned char)*p)) {\n+\t\t\tfprintf(stderr, \"Error: Invalid character '%c' in nid_list\\n\", *p);\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\tif (i \u003e 5) {\n+\t\t\tfprintf(stderr, \"Error: NID too long (max 65536)\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\t\tcurr_num = curr_num * 10 + (*p - '0');\n+\t\ti++;\n+\t\thas_digit = 1;\n+\t}\n+\n+\tif (!has_digit) {\n+\t\tfprintf(stderr, \"Error: Invalid nid_list format\\n\");\n+\t\treturn -1;\n+\t}\n+\n+\tif (in_range \u0026\u0026 prev_num \u003e curr_num) {\n+\t\tfprintf(stderr,\n+\t\t\t\"Error: Invalid range %d-%d (start must be \u003c= end)\\n\",\n+\t\t\tprev_num, curr_num);\n+\t\treturn -1;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+int main(int argc, char *argv[])\n+{\n+\tconst char *output_file = NULL;\n+\tchar filter_cmd[MAX_CMD_LEN];\n+\tFILE *output = NULL;\n+\tint fd = -1;\n+\tssize_t ret;\n+\tchar buf[4096];\n+\tint opt;\n+\tsize_t cmd_len = 0;\n+\n+\tsignal(SIGPIPE, SIG_IGN);\n+\n+\tstatic struct option long_options[] = {\n+\t\t{\"mode\",\trequired_argument, 0, 'm'},\n+\t\t{\"nid\",\t\trequired_argument, 0, 'n'},\n+\t\t{\"output\",\trequired_argument, 0, 'o'},\n+\t\t{\"help\",\tno_argument,\t 0, 'h'},\n+\t\t{0, 0, 0, 0}\n+\t};\n+\n+\tfilter_cmd[0] = '\\0';\n+\n+\tif (argc \u003e 1) {\n+\t\tfor (int i = 1; i \u003c argc; i++) {\n+\t\t\tif (strcmp(argv[i], \"-h\") == 0 || strcmp(argv[i], \"--help\") == 0) {\n+\t\t\t\tusage(argv[0]);\n+\t\t\t\treturn 0;\n+\t\t\t}\n+\t\t}\n+\t}\n+\n+\t/* Check if page_owner exists and is readable */\n+\tif (access(\"/sys/kernel/debug/page_owner\", F_OK) != 0) {\n+\t\tif (errno == ENOENT)\n+\t\t\tfprintf(stderr, \"Error: /sys/kernel/debug/page_owner does not exist\\n\");\n+\t\telse\n+\t\t\tperror(\"Error accessing /sys/kernel/debug/page_owner\");\n+\t\tfprintf(stderr, \"Make sure page_owner is enabled in kernel\\n\");\n+\t\treturn 1;\n+\t}\n+\n+\twhile ((opt = getopt_long(argc, argv, \"m:n:o:h\", long_options, NULL)) != -1) {\n+\t\tint len;\n+\n+\t\tswitch (opt) {\n+\t\tcase 'm': {\n+\t\t\tconst char *mode = optarg;\n+\n+\t\t\tif (validate_mode(mode) \u003c 0)\n+\t\t\t\treturn 1;\n+\t\t\tlen = snprintf(filter_cmd + cmd_len, MAX_CMD_LEN - cmd_len,\n+\t\t\t\t \"%smode=%s\", cmd_len \u003e 0 ? \" \" : \"\", mode);\n+\t\t\tif (len \u003c 0 || cmd_len + len \u003e= MAX_CMD_LEN) {\n+\t\t\t\tfprintf(stderr, \"Error: Command too long\\n\");\n+\t\t\t\treturn 1;\n+\t\t\t}\n+\t\t\tcmd_len += len;\n+\t\t\tbreak;\n+\t\t}\n+\t\tcase 'n': {\n+\t\t\tconst char *nid_list = optarg;\n+\n+\t\t\tif (validate_nid_list(nid_list) \u003c 0)\n+\t\t\t\treturn 1;\n+\t\t\tlen = snprintf(filter_cmd + cmd_len, MAX_CMD_LEN - cmd_len,\n+\t\t\t\t \"%snid=%s\", cmd_len \u003e 0 ? \" \" : \"\", nid_list);\n+\t\t\tif (len \u003c 0 || cmd_len + len \u003e= MAX_CMD_LEN) {\n+\t\t\t\tfprintf(stderr, \"Error: Command too long\\n\");\n+\t\t\t\treturn 1;\n+\t\t\t}\n+\t\t\tcmd_len += len;\n+\t\t\tbreak;\n+\t\t}\n+\t\tcase 'o':\n+\t\t\toutput_file = optarg;\n+\t\t\tbreak;\n+\t\tcase 'h':\n+\t\t\t/* Already handled above */\n+\t\t\tbreak;\n+\t\tdefault:\n+\t\t\tusage(argv[0]);\n+\t\t\treturn 1;\n+\t\t}\n+\t}\n+\n+\t/* At least one filter must be specified */\n+\tif (cmd_len == 0) {\n+\t\tfprintf(stderr, \"Error: At least one filter (-m or -n) must be specified\\n\\n\");\n+\t\tusage(argv[0]);\n+\t\treturn 1;\n+\t}\n+\n+\t/* Open page_owner for read-write - this will fail if kernel doesn't support write */\n+\tfd = open(\"/sys/kernel/debug/page_owner\", O_RDWR);\n+\tif (fd \u003c 0) {\n+\t\tif (errno == EACCES || errno == EPERM) {\n+\t\t\tfprintf(stderr, \"Error: /sys/kernel/debug/page_owner \");\n+\t\t\tfprintf(stderr, \"does not support write access\\n\");\n+\t\t\tfprintf(stderr, \"This kernel does not support \");\n+\t\t\tfprintf(stderr, \"per-fd filtering.\\n\");\n+\t\t\tfprintf(stderr, \"Please ensure you have a kernel with \");\n+\t\t\tfprintf(stderr, \"per-fd filtering support.\\n\");\n+\t\t} else {\n+\t\t\tperror(\"Error opening /sys/kernel/debug/page_owner\");\n+\t\t}\n+\t\treturn 1;\n+\t}\n+\n+\tif (output_file) {\n+\t\toutput = fopen(output_file, \"w\");\n+\t\tif (!output) {\n+\t\t\tperror(\"open output file\");\n+\t\t\tclose(fd);\n+\t\t\treturn 1;\n+\t\t}\n+\t} else {\n+\t\toutput = stdout;\n+\t}\n+\n+\tret = write(fd, filter_cmd, strlen(filter_cmd));\n+\n+\tif (ret \u003c 0) {\n+\t\tif (errno == EINVAL) {\n+\t\t\tfprintf(stderr, \"Error: Kernel rejected the filter command.\\n\");\n+\t\t\tfprintf(stderr, \"Possible causes:\\n\");\n+\t\t\tfprintf(stderr, \" - Kernel does not support per-fd filtering\\n\");\n+\t\t\tfprintf(stderr, \" - NUMA node has no memory\\n\");\n+\t\t\tfprintf(stderr, \" - Unknown reason\\n\");\n+\t\t} else {\n+\t\t\tperror(\"write filter command\");\n+\t\t}\n+\t\tgoto out;\n+\t}\n+\n+\tif ((size_t)ret != strlen(filter_cmd))\n+\t\tfprintf(stderr, \"Warning: Partial write (%zd/%zu)\\n\", ret, strlen(filter_cmd));\n+\n+\t/* Read and display filtered output */\n+\tret = 0;\n+\twhile ((ret = read(fd, buf, sizeof(buf))) \u003e 0) {\n+\t\tsize_t written = fwrite(buf, 1, ret, output);\n+\n+\t\tif (written != (size_t)ret) {\n+\t\t\tif (errno == EPIPE) {\n+\t\t\t\t/* Pipe closed, treat as success */\n+\t\t\t\tret = 0;\n+\t\t\t\tgoto out;\n+\t\t\t}\n+\t\t\tperror(\"write output\");\n+\t\t\tret = -1;\n+\t\t\tgoto out;\n+\t\t}\n+\t}\n+\n+\tif (ret \u003c 0) {\n+\t\tperror(\"read page_owner\");\n+\t\tgoto out;\n+\t}\n+\n+\tif (fflush(output)) {\n+\t\tif (errno == EPIPE) {\n+\t\t\t/* Pipe closed, treat as success */\n+\t\t\tret = 0;\n+\t\t} else {\n+\t\t\tperror(\"flush output\");\n+\t\t\tret = -1;\n+\t\t}\n+\t}\n+\n+out:\n+\tclose(fd);\n+\tif (output != stdout)\n+\t\tfclose(output);\n+\treturn ret \u003c 0 ? 1 : 0;\n+}\n"
} |
| 2/1 | 2026/06/25 04:48 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"PAGE_OWNER"
],
"FocusSymbols": [
"page_owner_open",
"page_owner_release",
"page_owner_write",
"read_page_owner",
"print_page_owner"
],
"Reasoning": "The patch adds a new write interface to `/sys/kernel/debug/page_owner` to allow filtering page owner output by print mode and NUMA node. It introduces new parsing logic, state management per file descriptor, and modifies the read path to respect the filter. This is reachable from userspace via debugfs and should be fuzzed to ensure the parsing and state management are robust.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 258f0cbf27c1e487ad085971d5db1e7cfec41b8e
Author: syz-cluster <triage@syzkaller.com>
Date: Thu Jun 25 04:47:59 2026 +0000
syz-cluster: applied patch under review
diff --git a/Documentation/mm/page_owner.rst b/Documentation/mm/page_owner.rst
index 6b12f3b007ec91..383e59c42743bd 100644
--- a/Documentation/mm/page_owner.rst
+++ b/Documentation/mm/page_owner.rst
@@ -65,7 +65,14 @@ un-tracking state.
Usage
=====
-1) Build user-space helper::
+1) Build user-space helpers::
+
+To filter page_owner output:
+
+ cd tools/mm
+ make page_owner_filter
+
+To sort and analyze page_owner output:
cd tools/mm
make page_owner_sort
@@ -74,7 +81,11 @@ Usage
3) Do the job that you want to debug.
-4) Analyze information from page owner::
+4) (Optional) Filter page_owner output::
+
+ ./page_owner_filter -m handle -n 0,1,2 > filtered_page_owner.txt
+
+5) Analyze information from page owner::
cat /sys/kernel/debug/page_owner_stacks/show_stacks > stacks.txt
cat stacks.txt
@@ -263,3 +274,65 @@ STANDARD FORMAT SPECIFIERS
f free whether the page has been released or not
st stacktrace stack trace of the page allocation
ator allocator memory allocator for pages
+
+Filtering page_owner output
+============================
+
+page_owner supports filtering output at the kernel level before reading,
+which reduces the amount of data that needs to be processed in userspace.
+
+The page_owner_filter tool provides a convenient interface for this filtering
+capability. It supports two types of filters:
+
+1. **print_mode filter**: Control what information is printed for each page
+ - ``stack``: Print full stack traces (default, compatible with existing usage)
+ - ``handle``: Print only stack handle numbers (much faster, smaller output)
+ - ``stack_handle``: Print both stack traces and handle numbers
+
+ The ``handle`` mode uses numeric identifiers instead of full stack traces.
+ The mapping from handles to actual stack traces can be obtained via the
+ show_stacks_handles interface.
+
+2. **NUMA node filter**: Filter pages by NUMA node ID
+ - Supports single node: ``-n 0``
+ - Multiple nodes: ``-n 0,1,2``
+ - Ranges: ``-n 0-3``
+ - Mixed format: ``-n 0,2-3,5``
+
+Usage examples::
+
+ # Filter by print mode
+ ./page_owner_filter -m handle
+ ./page_owner_filter -m stack_handle
+
+ # Filter by NUMA node
+ ./page_owner_filter -n 0
+ ./page_owner_filter -n 0-3
+
+ # Combined filters
+ ./page_owner_filter -m stack -n 0,1,2
+ ./page_owner_filter -m handle -n 0,2-3
+
+ # Save to file
+ ./page_owner_filter -m handle -o filtered_output.txt
+
+The handle mode is particularly useful for monitoring and performance-critical
+scenarios as it dramatically reduces output size. Testing shows handle mode can
+reduce output size by ~66% (84MB vs 244MB) and improve read performance by ~4.4x
+compared to full stack output.
+
+The NUMA node filter is useful for NUMA-aware memory allocation analysis and debugging.
+
+Behind the scenes, page_owner_filter opens /sys/kernel/debug/page_owner and
+writes filter commands before reading the filtered output. The filtering uses
+per-file-descriptor state, allowing each open() to have independent filter settings.
+
+Each file descriptor maintains its own filter state, so you can have multiple
+independent filtering operations running concurrently. For example, in different
+terminals you can run different filters simultaneously::
+
+ # Terminal 1: Filter node 0
+ ./page_owner_filter -n 0 > node0_output.txt
+
+ # Terminal 2: Filter node 1 (runs concurrently)
+ ./page_owner_filter -n 1 > node1_output.txt
diff --git a/mm/page_owner.c b/mm/page_owner.c
index 8178e0be557f87..cae5abf0ac9afa 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -54,6 +54,25 @@ struct stack_print_ctx {
u8 flags;
};
+enum page_owner_print_mode {
+ PAGE_OWNER_PRINT_STACK,
+ PAGE_OWNER_PRINT_HANDLE,
+ PAGE_OWNER_PRINT_STACK_HANDLE,
+};
+
+static const char * const page_owner_print_mode_strings[] = {
+ [PAGE_OWNER_PRINT_STACK] = "stack",
+ [PAGE_OWNER_PRINT_HANDLE] = "handle",
+ [PAGE_OWNER_PRINT_STACK_HANDLE] = "stack_handle",
+};
+
+struct page_owner_filter_state {
+ enum page_owner_print_mode print_mode;
+ nodemask_t nid_filter;
+ bool nid_filter_enabled;
+ spinlock_t lock;
+};
+
static bool page_owner_enabled __initdata;
DEFINE_STATIC_KEY_FALSE(page_owner_inited);
@@ -547,16 +566,23 @@ static inline int print_page_owner_memcg(char *kbuf, size_t count, int ret,
static ssize_t
print_page_owner(char __user *buf, size_t count, unsigned long pfn,
struct page *page, struct page_owner *page_owner,
- depot_stack_handle_t handle)
+ depot_stack_handle_t handle,
+ struct page_owner_filter_state *state)
{
int ret, pageblock_mt, page_mt;
char *kbuf;
+ enum page_owner_print_mode print_mode;
+ unsigned long flags;
count = min_t(size_t, count, PAGE_SIZE);
kbuf = kmalloc(count, GFP_KERNEL);
if (!kbuf)
return -ENOMEM;
+ spin_lock_irqsave(&state->lock, flags);
+ print_mode = state->print_mode;
+ spin_unlock_irqrestore(&state->lock, flags);
+
ret = scnprintf(kbuf, count,
"Page allocated via order %u, mask %#x(%pGg), pid %d, tgid %d (%s), ts %llu ns\n",
page_owner->order, page_owner->gfp_mask,
@@ -575,9 +601,18 @@ print_page_owner(char __user *buf, size_t count, unsigned long pfn,
migratetype_names[pageblock_mt],
&page->flags);
- ret += stack_depot_snprint(handle, kbuf + ret, count - ret, 0);
- if (ret >= count)
- goto err;
+ if (print_mode != PAGE_OWNER_PRINT_HANDLE) {
+ ret += stack_depot_snprint(handle, kbuf + ret, count - ret, 0);
+ if (ret >= count)
+ goto err;
+ }
+
+ if (print_mode != PAGE_OWNER_PRINT_STACK) {
+ ret += scnprintf(kbuf + ret, count - ret, "handle: %u\n",
+ handle);
+ if (ret >= count)
+ goto err;
+ }
if (page_owner->last_migrate_reason != -1) {
ret += scnprintf(kbuf + ret, count - ret,
@@ -664,6 +699,8 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)
struct page_ext *page_ext;
struct page_owner *page_owner;
depot_stack_handle_t handle;
+ struct page_owner_filter_state *state = file->private_data;
+ unsigned long flags;
if (!static_branch_unlikely(&page_owner_inited))
return -EINVAL;
@@ -740,15 +777,37 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)
if (!handle)
goto ext_put_continue;
+ spin_lock_irqsave(&state->lock, flags);
+ if (state->nid_filter_enabled) {
+ int nid;
+ memdesc_flags_t page_flags = READ_ONCE(page->flags);
+
+ /*
+ * Bypass PF_POISONED_CHECK() in page_to_nid() to avoid
+ * VM_BUG_ON when accessing poisoned pages.
+ */
+ if (page_flags.f == PAGE_POISON_PATTERN) {
+ spin_unlock_irqrestore(&state->lock, flags);
+ goto ext_put_continue;
+ }
+ nid = memdesc_nid(page_flags);
+ if (!node_isset(nid, state->nid_filter)) {
+ spin_unlock_irqrestore(&state->lock, flags);
+ goto ext_put_continue;
+ }
+ }
+ spin_unlock_irqrestore(&state->lock, flags);
+
/* Record the next PFN to read in the file offset */
*ppos = pfn + 1;
page_owner_tmp = *page_owner;
page_ext_put(page_ext);
return print_page_owner(buf, count, pfn, page,
- &page_owner_tmp, handle);
+ &page_owner_tmp, handle, state);
ext_put_continue:
page_ext_put(page_ext);
+ cond_resched();
}
return 0;
@@ -847,7 +906,122 @@ static void init_early_allocated_pages(void)
init_pages_in_zone(zone);
}
+static int page_owner_open(struct inode *inode, struct file *file)
+{
+ struct page_owner_filter_state *state;
+
+ state = kzalloc_obj(*state);
+ if (!state)
+ return -ENOMEM;
+
+ spin_lock_init(&state->lock);
+ state->print_mode = PAGE_OWNER_PRINT_STACK;
+ nodes_clear(state->nid_filter);
+ state->nid_filter_enabled = false;
+ file->private_data = state;
+ return 0;
+}
+
+static int page_owner_release(struct inode *inode, struct file *file)
+{
+ kfree(file->private_data);
+ return 0;
+}
+
+static ssize_t page_owner_write(struct file *file,
+ const char __user *buf,
+ size_t count, loff_t *ppos)
+{
+ char *kbuf;
+ char *orig;
+ char *token;
+ int ret;
+ size_t max_input_len;
+ struct page_owner_filter_state *state = file->private_data;
+ enum page_owner_print_mode new_print_mode;
+ nodemask_t new_nid_filter;
+ bool new_nid_filter_enabled;
+ unsigned long flags;
+
+ /*
+ * Maximum input length for filter commands:
+ * - 32: print_mode command max length is 17 ("mode=stack_handle")
+ * with sufficient buffer
+ * - 6 * MAX_NUMNODES: worst case for nid list
+ * Worst case per node: ",NNNNN" (comma + 5-digit node number) = 6 bytes
+ */
+ max_input_len = 32 + 6 * MAX_NUMNODES;
+
+ if (count > max_input_len)
+ return -EINVAL;
+
+ kbuf = memdup_user_nul(buf, count);
+ if (IS_ERR(kbuf))
+ return PTR_ERR(kbuf);
+
+ orig = kbuf;
+
+ spin_lock_irqsave(&state->lock, flags);
+ new_print_mode = state->print_mode;
+ new_nid_filter = state->nid_filter;
+ new_nid_filter_enabled = state->nid_filter_enabled;
+ spin_unlock_irqrestore(&state->lock, flags);
+
+ while ((token = strsep(&kbuf, " \t\n")) != NULL) {
+ if (*token == '\0')
+ continue;
+
+ if (!strncmp(token, "mode=", 5)) {
+ ret = sysfs_match_string(page_owner_print_mode_strings,
+ token + 5);
+ if (ret < 0)
+ goto out_free;
+ new_print_mode = ret;
+ } else if (!strncmp(token, "nid=", 4)) {
+ ret = nodelist_parse(token + 4, new_nid_filter);
+ if (ret < 0)
+ goto out_free;
+
+ if (nodes_empty(new_nid_filter)) {
+ ret = -EINVAL;
+ goto out_free;
+ }
+
+ /*
+ * We want to filter memory allocations by numa nodes, so make sure
+ * that the specified nodes have memory.
+ */
+ if (!nodes_subset(new_nid_filter, node_states[N_MEMORY])) {
+ ret = -EINVAL;
+ goto out_free;
+ }
+
+ new_nid_filter_enabled = true;
+ } else {
+ ret = -EINVAL;
+ goto out_free;
+ }
+ }
+
+ /* Commit all filter changes */
+ spin_lock_irqsave(&state->lock, flags);
+ state->print_mode = new_print_mode;
+ state->nid_filter = new_nid_filter;
+ state->nid_filter_enabled = new_nid_filter_enabled;
+ spin_unlock_irqrestore(&state->lock, flags);
+
+ ret = count;
+
+out_free:
+ kfree(orig);
+ return ret;
+}
+
static const struct file_operations page_owner_fops = {
+ .owner = THIS_MODULE,
+ .open = page_owner_open,
+ .release = page_owner_release,
+ .write = page_owner_write,
.read = read_page_owner,
.llseek = lseek_page_owner,
};
@@ -980,7 +1154,7 @@ static int __init pageowner_init(void)
return 0;
}
- debugfs_create_file("page_owner", 0400, NULL, NULL, &page_owner_fops);
+ debugfs_create_file("page_owner", 0600, NULL, NULL, &page_owner_fops);
dir = debugfs_create_dir("page_owner_stacks", NULL);
debugfs_create_file("show_stacks", 0400, dir,
(void *)(STACK_PRINT_FLAG_STACK |
diff --git a/tools/mm/Makefile b/tools/mm/Makefile
index f5725b5c23aa26..858186a6eefdbd 100644
--- a/tools/mm/Makefile
+++ b/tools/mm/Makefile
@@ -3,7 +3,7 @@
#
include ../scripts/Makefile.include
-BUILD_TARGETS=page-types slabinfo page_owner_sort thp_swap_allocator_test
+BUILD_TARGETS=page-types slabinfo page_owner_sort page_owner_filter thp_swap_allocator_test
INSTALL_TARGETS = $(BUILD_TARGETS) thpmaps
LIB_DIR = ../lib/api
@@ -23,7 +23,7 @@ $(LIBS):
$(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
clean:
- $(RM) page-types slabinfo page_owner_sort thp_swap_allocator_test
+ $(RM) page-types slabinfo page_owner_sort page_owner_filter thp_swap_allocator_test
make -C $(LIB_DIR) clean
sbindir ?= /usr/sbin
diff --git a/tools/mm/page_owner_filter.c b/tools/mm/page_owner_filter.c
new file mode 100644
index 00000000000000..1d1f0a38678a2f
--- /dev/null
+++ b/tools/mm/page_owner_filter.c
@@ -0,0 +1,310 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * User-space helper to filter page_owner output per-fd
+ *
+ * Example use:
+ * ./page_owner_filter -m handle
+ * ./page_owner_filter -m stack_handle
+ * ./page_owner_filter -n 0,1,2
+ *
+ * See Documentation/mm/page_owner.rst
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <ctype.h>
+#include <getopt.h>
+#include <signal.h>
+
+#define MAX_CMD_LEN 512
+
+static void usage(const char *prog)
+{
+ fprintf(stderr, "Usage: %s [OPTIONS]\n", prog);
+ fprintf(stderr, "\nOptions:\n");
+ fprintf(stderr, " -m, --mode MODE : print_mode (stack, handle, or stack_handle)\n");
+ fprintf(stderr, " -n, --nid NID_LIST : NUMA node IDs (comma-separated or ranges)\n");
+ fprintf(stderr, " -o, --output FILE : output file (default: stdout)\n");
+ fprintf(stderr, " -h, --help : show this help message\n");
+ fprintf(stderr, "\nExamples:\n");
+ fprintf(stderr, " %s -m stack\n", prog);
+ fprintf(stderr, " %s -m handle\n", prog);
+ fprintf(stderr, " %s -m stack_handle\n", prog);
+ fprintf(stderr, " %s -m stack -o output.txt\n", prog);
+ fprintf(stderr, " %s -n 0,1,2\n", prog);
+ fprintf(stderr, " %s -m stack -n 0\n", prog);
+}
+
+static int validate_mode(const char *mode)
+{
+ if (strcmp(mode, "stack") == 0 ||
+ strcmp(mode, "handle") == 0 ||
+ strcmp(mode, "stack_handle") == 0)
+ return 0;
+
+ fprintf(stderr, "Error: Invalid mode '%s'\n", mode);
+ fprintf(stderr, "Valid modes: stack, handle, stack_handle\n");
+ return -1;
+}
+
+static int validate_nid_list(const char *nid_list)
+{
+ const char *p;
+ int i = 0;
+ int has_digit = 0;
+ int in_range = 0;
+ int prev_num = 0;
+ int curr_num = 0;
+
+ if (!nid_list || strlen(nid_list) == 0)
+ return 0;
+
+ for (p = nid_list; *p; p++) {
+ if (*p == ',') {
+ if (!has_digit) {
+ fprintf(stderr, "Error: Invalid nid_list format\n");
+ return -1;
+ }
+ if (in_range && prev_num > curr_num) {
+ fprintf(stderr,
+ "Error: Invalid range %d-%d (start must be <= end)\n",
+ prev_num, curr_num);
+ return -1;
+ }
+ i = 0;
+ has_digit = 0;
+ in_range = 0;
+ prev_num = 0;
+ curr_num = 0;
+ continue;
+ }
+
+ if (*p == '-') {
+ if (!has_digit) {
+ fprintf(stderr,
+ "Error: Invalid nid_list format ");
+ fprintf(stderr,
+ "(dash without preceding number)\n");
+ return -1;
+ }
+ if (in_range) {
+ fprintf(stderr, "Error: Multiple dashes in nid_list\n");
+ return -1;
+ }
+ prev_num = curr_num;
+ curr_num = 0;
+ i = 0;
+ has_digit = 0;
+ in_range = 1;
+ continue;
+ }
+
+ if (!isdigit((unsigned char)*p)) {
+ fprintf(stderr, "Error: Invalid character '%c' in nid_list\n", *p);
+ return -1;
+ }
+
+ if (i > 5) {
+ fprintf(stderr, "Error: NID too long (max 65536)\n");
+ return -1;
+ }
+ curr_num = curr_num * 10 + (*p - '0');
+ i++;
+ has_digit = 1;
+ }
+
+ if (!has_digit) {
+ fprintf(stderr, "Error: Invalid nid_list format\n");
+ return -1;
+ }
+
+ if (in_range && prev_num > curr_num) {
+ fprintf(stderr,
+ "Error: Invalid range %d-%d (start must be <= end)\n",
+ prev_num, curr_num);
+ return -1;
+ }
+
+ return 0;
+}
+
+int main(int argc, char *argv[])
+{
+ const char *output_file = NULL;
+ char filter_cmd[MAX_CMD_LEN];
+ FILE *output = NULL;
+ int fd = -1;
+ ssize_t ret;
+ char buf[4096];
+ int opt;
+ size_t cmd_len = 0;
+
+ signal(SIGPIPE, SIG_IGN);
+
+ static struct option long_options[] = {
+ {"mode", required_argument, 0, 'm'},
+ {"nid", required_argument, 0, 'n'},
+ {"output", required_argument, 0, 'o'},
+ {"help", no_argument, 0, 'h'},
+ {0, 0, 0, 0}
+ };
+
+ filter_cmd[0] = '\0';
+
+ if (argc > 1) {
+ for (int i = 1; i < argc; i++) {
+ if (strcmp(argv[i], "-h") == 0 || strcmp(argv[i], "--help") == 0) {
+ usage(argv[0]);
+ return 0;
+ }
+ }
+ }
+
+ /* Check if page_owner exists and is readable */
+ if (access("/sys/kernel/debug/page_owner", F_OK) != 0) {
+ if (errno == ENOENT)
+ fprintf(stderr, "Error: /sys/kernel/debug/page_owner does not exist\n");
+ else
+ perror("Error accessing /sys/kernel/debug/page_owner");
+ fprintf(stderr, "Make sure page_owner is enabled in kernel\n");
+ return 1;
+ }
+
+ while ((opt = getopt_long(argc, argv, "m:n:o:h", long_options, NULL)) != -1) {
+ int len;
+
+ switch (opt) {
+ case 'm': {
+ const char *mode = optarg;
+
+ if (validate_mode(mode) < 0)
+ return 1;
+ len = snprintf(filter_cmd + cmd_len, MAX_CMD_LEN - cmd_len,
+ "%smode=%s", cmd_len > 0 ? " " : "", mode);
+ if (len < 0 || cmd_len + len >= MAX_CMD_LEN) {
+ fprintf(stderr, "Error: Command too long\n");
+ return 1;
+ }
+ cmd_len += len;
+ break;
+ }
+ case 'n': {
+ const char *nid_list = optarg;
+
+ if (validate_nid_list(nid_list) < 0)
+ return 1;
+ len = snprintf(filter_cmd + cmd_len, MAX_CMD_LEN - cmd_len,
+ "%snid=%s", cmd_len > 0 ? " " : "", nid_list);
+ if (len < 0 || cmd_len + len >= MAX_CMD_LEN) {
+ fprintf(stderr, "Error: Command too long\n");
+ return 1;
+ }
+ cmd_len += len;
+ break;
+ }
+ case 'o':
+ output_file = optarg;
+ break;
+ case 'h':
+ /* Already handled above */
+ break;
+ default:
+ usage(argv[0]);
+ return 1;
+ }
+ }
+
+ /* At least one filter must be specified */
+ if (cmd_len == 0) {
+ fprintf(stderr, "Error: At least one filter (-m or -n) must be specified\n\n");
+ usage(argv[0]);
+ return 1;
+ }
+
+ /* Open page_owner for read-write - this will fail if kernel doesn't support write */
+ fd = open("/sys/kernel/debug/page_owner", O_RDWR);
+ if (fd < 0) {
+ if (errno == EACCES || errno == EPERM) {
+ fprintf(stderr, "Error: /sys/kernel/debug/page_owner ");
+ fprintf(stderr, "does not support write access\n");
+ fprintf(stderr, "This kernel does not support ");
+ fprintf(stderr, "per-fd filtering.\n");
+ fprintf(stderr, "Please ensure you have a kernel with ");
+ fprintf(stderr, "per-fd filtering support.\n");
+ } else {
+ perror("Error opening /sys/kernel/debug/page_owner");
+ }
+ return 1;
+ }
+
+ if (output_file) {
+ output = fopen(output_file, "w");
+ if (!output) {
+ perror("open output file");
+ close(fd);
+ return 1;
+ }
+ } else {
+ output = stdout;
+ }
+
+ ret = write(fd, filter_cmd, strlen(filter_cmd));
+
+ if (ret < 0) {
+ if (errno == EINVAL) {
+ fprintf(stderr, "Error: Kernel rejected the filter command.\n");
+ fprintf(stderr, "Possible causes:\n");
+ fprintf(stderr, " - Kernel does not support per-fd filtering\n");
+ fprintf(stderr, " - NUMA node has no memory\n");
+ fprintf(stderr, " - Unknown reason\n");
+ } else {
+ perror("write filter command");
+ }
+ goto out;
+ }
+
+ if ((size_t)ret != strlen(filter_cmd))
+ fprintf(stderr, "Warning: Partial write (%zd/%zu)\n", ret, strlen(filter_cmd));
+
+ /* Read and display filtered output */
+ ret = 0;
+ while ((ret = read(fd, buf, sizeof(buf))) > 0) {
+ size_t written = fwrite(buf, 1, ret, output);
+
+ if (written != (size_t)ret) {
+ if (errno == EPIPE) {
+ /* Pipe closed, treat as success */
+ ret = 0;
+ goto out;
+ }
+ perror("write output");
+ ret = -1;
+ goto out;
+ }
+ }
+
+ if (ret < 0) {
+ perror("read page_owner");
+ goto out;
+ }
+
+ if (fflush(output)) {
+ if (errno == EPIPE) {
+ /* Pipe closed, treat as success */
+ ret = 0;
+ } else {
+ perror("flush output");
+ ret = -1;
+ }
+ }
+
+out:
+ close(fd);
+ if (output != stdout)
+ fclose(output);
+ return ret < 0 ? 1 : 0;
+}
|
| 3/2 | 2026/06/25 04:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9208 output: 19 thoughts: 671 Thoughts: **Analyzing the New Page Owner Filtering Patch** Okay, so I've got this patch here that’s been submitted, and it looks like a fairly interesting addition to the `page_owner` debugging feature. My initial assessment is that it adds filtering capabilities based on print modes (stack, handle, stack_handle) and NUMA node IDs. The core of this new functionality centers around a new `write` operation on `/sys/kernel/debug/page_owner`. This write operation is what sets up a filter state, stored in `file->private_data`, which `read_page_owner` then respects. First things first, I need to confirm reachability and functionality. The `page_owner` feature itself is enabled via `CONFIG_PAGE_OWNER`, so that's the first config I want to check. Good, it's a kernel config. Now, let’s see what's actually been added and modified in `mm/page_owner.c`. I see new functions: `page_owner_write`, `page_owner_open`, `page_owner_release`, along with modifications to `read_page_owner` and `print_page_owner`. This is starting to look like a prime target for fuzzing. We have a new write interface to a debugfs file. And it's parsing user input. I see `strsep`, `sysfs_match_string`, `nodelist_parse`, all potential areas where fuzzing could uncover some interesting behavior. Memory is allocated with `memdup_user_nul`, and there's a spinlock with `spin_lock_irqsave(&state->lock, flags)`. This is definitely reachable from user space, assuming debugfs is mounted, and given Syzkaller runs as root or can access debugfs, we should be able to trigger this code. The key is root. Wait... I also see the file permissions have been changed. The file is created with 0600 permissions, so root can write. Perfect. So, the focus points are: `page_owner_write`, `page_owner_open`, `page_owner_release`, `read_page_owner`, and `print_page_owner`. Good, let's verify that the config name is `PAGE_OWNER`. And, `DEBUG_FS` is needed, but that is usually enabled. Let's do a quick grep for `PAGE_OWNER` to double check. Looks like we're good to go. Time to spin up the fuzzers and see what we can find. |
| 4/2 | 2026/06/25 04:48 | tool | grepper |
0mArgs:{
"Expression": "config PAGE_OWNER"
}Results: {
"Output": "mm/Kconfig.debug=73=config SLUB_RCU_DEBUG\n--\nmm/Kconfig.debug-104-\nmm/Kconfig.debug:105:config PAGE_OWNER\nmm/Kconfig.debug-106-\tbool \"Track page owner\"\n"
} |
| 5/2 | 2026/06/25 04:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10526 output: 19 thoughts: 34 Thoughts: Here's my take on the thought process: **Diving into the `PAGE_OWNER` Configuration** Alright, so `PAGE_OWNER` is the key configuration parameter. That's the starting point. Time to drill down and see how it's implemented. I need to understand what this configuration option actually *does*. Let's jump into the code and investigate the `page_owner_write` function. Specifically, I'll be looking in `mm/page_owner.c`. This is where the magic (or the problems!) are probably happening. I need to understand the write behavior within that context. |
| 6/2 | 2026/06/25 04:48 | tool | grepper |
0mArgs:{
"Expression": "page_owner_write"
}Results: {
"Output": "mm/page_owner.c=925=static int page_owner_release(struct inode *inode, struct file *file)\n--\nmm/page_owner.c-930-\nmm/page_owner.c:931:static ssize_t page_owner_write(struct file *file,\nmm/page_owner.c-932-\t\t\t\t const char __user *buf,\n--\nmm/page_owner.c=1020=static const struct file_operations page_owner_fops = {\n--\nmm/page_owner.c-1023-\t.release\t= page_owner_release,\nmm/page_owner.c:1024:\t.write\t\t= page_owner_write,\nmm/page_owner.c-1025-\t.read\t\t= read_page_owner,\n"
} |
| 7/2 | 2026/06/25 04:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10926 output: 19 thoughts: 11 Thoughts: Okay, here's my attempt at summarizing that thought process, tailored for an expert audience: **Checking `read_page_owner` Function** Alright, let's just make sure we're on the right track here. Specifically, I'm thinking we should quickly verify the implementation of `read_page_owner`. Given the context, this probably means mentally stepping through its likely code path. I want to quickly ensure that: * It's handling all expected edge cases properly. * The data validation is robust enough, particularly around things like ownership, security context and any permissions required to access the target information. * That we're not inadvertently opening any security holes, like exposing sensitive information or creating opportunities for privilege escalation. * It's thread-safe or properly protected by whatever synchronization primitives we're using, depending on the system design, of course. * That performance is acceptable. I'm not expecting anything groundbreaking here, but I don't want any obvious bottlenecks. This is just a quick sanity check to avoid a potentially nasty oversight later. A good function name is only good as the code that executes it. I'll get that fresh in my mind and, just double check it, and move on. |
| 8/2 | 2026/06/25 04:48 | tool | grepper |
0mArgs:{
"Expression": "read_page_owner"
}Results: {
"Output": "mm/page_owner.c=694=static ssize_t\nmm/page_owner.c:695:read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos)\nmm/page_owner.c-696-{\n--\nmm/page_owner.c=1020=static const struct file_operations page_owner_fops = {\n--\nmm/page_owner.c-1024-\t.write\t\t= page_owner_write,\nmm/page_owner.c:1025:\t.read\t\t= read_page_owner,\nmm/page_owner.c-1026-\t.llseek\t\t= lseek_page_owner,\n--\nscripts/gdb/linux/page_owner.py=30=class DumpPageOwner(gdb.Command):\n--\nscripts/gdb/linux/page_owner.py-52- if len(argv) == 0:\nscripts/gdb/linux/page_owner.py:53: self.read_page_owner()\nscripts/gdb/linux/page_owner.py-54- elif len(argv) == 2:\n--\nscripts/gdb/linux/page_owner.py-56- pfn = int(argv[1])\nscripts/gdb/linux/page_owner.py:57: self.read_page_owner_by_addr(self.p_ops.pfn_to_page(pfn))\nscripts/gdb/linux/page_owner.py-58- else:\n--\nscripts/gdb/linux/page_owner.py-97-\nscripts/gdb/linux/page_owner.py:98: def read_page_owner_by_addr(self, struct_page_addr):\nscripts/gdb/linux/page_owner.py-99- page = gdb.Value(struct_page_addr).cast(utils.get_page_type().pointer())\n--\nscripts/gdb/linux/page_owner.py-143-\nscripts/gdb/linux/page_owner.py:144: def read_page_owner(self):\nscripts/gdb/linux/page_owner.py-145- pfn = self.min_pfn\n"
} |
| 9/2 | 2026/06/25 04:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11796 output: 34 thoughts: 144 Thoughts: **Analyzing the Page Owner Patch** Okay, so this patch is aimed at refining the `page_owner` functionality. My initial assessment is that it looks like we're leveraging the filter state within the `read_page_owner` function, and that's good; any optimization that streamlines this is welcome. It's also touching `print_page_owner`, which I assume indicates a change in how we're presenting this information – potentially improved clarity or added context. The meat of this appears to be the addition of these new functions: `page_owner_open`, `page_owner_release`, and `page_owner_write`. That's where I'll focus my attention. These sound like they're managing access to or interaction with the page owner data, perhaps related to persistent state. So, let's keep an eye on these five function calls: * `page_owner_open` * `page_owner_release` * `page_owner_write` * `read_page_owner` * `print_page_owner` But, before diving deeper, I need to make sure I understand the dependencies. I see that the `PAGE_OWNER` config itself depends on `DEBUG_KERNEL` and `STACKTRACE_SUPPORT`. I should cross-reference this with `mm/Kconfig.debug` to verify and understand how those dependencies come into play. Understanding those configs will give me the proper context. |
| 10/2 | 2026/06/25 04:48 | tool | read-file |
0mArgs:{
"File": "mm/Kconfig.debug",
"FirstLine": 100,
"LineCount": 20
}Results: {
"Contents": " 100:\t\t This is designed as a debugging feature, not a security feature.\n 101:\t\t Objects are sometimes recycled without RCU delay under memory pressure.\n 102:\t\n 103:\t\t If unsure, say N.\n 104:\t\n 105:\tconfig PAGE_OWNER\n 106:\t\tbool \"Track page owner\"\n 107:\t\tdepends on DEBUG_KERNEL \u0026\u0026 STACKTRACE_SUPPORT\n 108:\t\tselect DEBUG_FS\n 109:\t\tselect STACKTRACE\n 110:\t\tselect STACKDEPOT\n 111:\t\tselect PAGE_EXTENSION\n 112:\t\thelp\n 113:\t\t This keeps track of what call chain is the owner of a page, may\n 114:\t\t help to find bare alloc_page(s) leaks. Even if you include this\n 115:\t\t feature on your build, it is disabled in default. You should pass\n 116:\t\t \"page_owner=on\" to boot parameter in order to enable it. Eats\n 117:\t\t a fair amount of memory if enabled. See tools/mm/page_owner_sort.c\n 118:\t\t for user-space helper.\n 119:\t\n"
} |
| 11/2 | 2026/06/25 04:48 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 12611 output: 156 thoughts: 947 Thoughts: **Analyzing the Kernel's Page Owner Feature for Fuzzing** Okay, so I'm looking at how to best test this new functionality in the kernel, specifically the modifications around the `/sys/kernel/debug/page_owner` interface. The initial thought is, "Right, `PAGE_OWNER` is disabled by default, and enabling it needs the `page_owner=on` boot parameter." The immediate question is, how does syzkaller handle that boot parameter? Usually, syzkaller parameters are fixed, but if `PAGE_OWNER` is enabled in the kernel config AND `page_owner=on` is passed, then syzkaller could test it. The prompt specifically asks for kernel *config* flags. So, the key takeaway is that I definitely need to list `PAGE_OWNER`. Then, I started to think, "If the feature needs a boot parameter to be truly active, won't syzkaller struggle to test it if we don't also add the parameter?" I then went digging into the source code to clarify this. I see `page_owner_enabled` is checked in `read_page_owner`. If `page_owner=on` isn't passed, then `page_owner_inited` will be false, and `read_page_owner` will return an error. I thought, what about `page_owner_write`? Interestingly, it *doesn't* check `page_owner_inited`. So, the `page_owner_write` function *could* be executed even if the boot parameter wasn't passed, which is interesting. Same goes for `page_owner_open`. But then I see the `/sys/kernel/debug/page_owner` file is *only* created if `page_owner_inited` is true. So, the file isn't even there unless `page_owner=on` is passed. This means no direct interaction. Then I considered the infrastructure in syzkaller, maybe it handles boot parameters, or perhaps it already has `page_owner=on` on some instances. Based on this, I'm pretty certain that the main thing to provide is `PAGE_OWNER` in `EnableConfigs`. I then made a mental list of the relevant functions: `page_owner_open`, `page_owner_release`, `page_owner_write`, `read_page_owner`, `print_page_owner`. I eliminated the userspace tool. So, the reasoning is as follows: The patch introduces a new write interface to filter page owner output by print mode and NUMA node. It adds parsing logic, state management per file descriptor, and modifies the read path to respect the filter. This is accessible through debugfs and needs to be fuzzed to ensure robustness. Therefore: * Configs: `PAGE_OWNER` * FocusSymbols: `page_owner_open`, `page_owner_release`, `page_owner_write`, `read_page_owner`, `print_page_owner` I quickly verified that all the functions I listed are static. Now I am ready to call `set-results`. |
| 12/2 | 2026/06/25 04:48 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"PAGE_OWNER"
],
"FocusSymbols": [
"page_owner_open",
"page_owner_release",
"page_owner_write",
"read_page_owner",
"print_page_owner"
],
"Reasoning": "The patch adds a new write interface to `/sys/kernel/debug/page_owner` to allow filtering page owner output by print mode and NUMA node. It introduces new parsing logic, state management per file descriptor, and modifies the read path to respect the filter. This is reachable from userspace via debugfs and should be fuzzed to ensure the parsing and state management are robust.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"PAGE_OWNER"
],
"FocusSymbols": [
"page_owner_open",
"page_owner_release",
"page_owner_write",
"read_page_owner",
"print_page_owner"
],
"Reasoning": "The patch adds a new write interface to `/sys/kernel/debug/page_owner` to allow filtering page owner output by print mode and NUMA node. It introduces new parsing logic, state management per file descriptor, and modifies the read path to respect the filter. This is reachable from userspace via debugfs and should be fuzzed to ensure the parsing and state management are robust.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|