| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/10/27 16:42 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch introduces two new tracepoints (shmem_swapin_folio and shmem_alloc_folio_finish) along with their definitions and documentation in Documentation/trace/. The changes in mm/shmem.c only collect trace arguments and call the tracepoints, consolidating exit points to emit the event before returning without altering functional control flow, error handling, or kernel data structures. Per the negative criteria, tracepoints that do not alter control flow or data structures do not warrant fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/10/27 16:42 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 5dfeec02d6ae52011ee2b010d0569b7fed009cf6\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Oct 27 16:42:51 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/trace/events-shmem.rst b/Documentation/trace/events-shmem.rst\nnew file mode 100644\nindex 00000000000000..4a0e50bdbdf37e\n--- /dev/null\n+++ b/Documentation/trace/events-shmem.rst\n@@ -0,0 +1,118 @@\n+.. SPDX-License-Identifier: GPL-2.0\n+\n+Tmpfs and shmem events\n+=====================\n+\n+The events in ``events/shmem/`` attribute swapin and allocation activity to\n+``dev`` (the filesystem device) and ``ino`` (the inode number). They also\n+cover anonymous shared memory and memfd files. ``index`` is the page offset\n+requested by the caller, before any alignment for a large folio.\n+\n+Swapin\n+------\n+\n+``shmem_swapin_folio`` records each return from ``shmem_swapin_folio()``.\n+``error`` is the return value: zero means a folio was installed in the file\n+page cache; ``-EEXIST`` normally asks the caller to retry after a race.\n+Entry validation failures and poison markers also produce events.\n+\n+``entry`` contains the original XArray entry's type and offset. For a large\n+entry, this is its base swap slot even when ``index`` lies in its middle.\n+For ``path=poison``, it encodes a marker, not a real swap slot.\n+\n+``requested_order`` is the confirmed XArray entry order, or -1 when unknown.\n+``actual_order`` is the order of the folio obtained, or -1 if none was\n+obtained. A nonnegative actual order does not imply successful insertion:\n+always check ``error``. One successful event may cover multiple pages.\n+\n+``path`` identifies the branch taken: ``lookup`` for entry validation\n+failure, ``cache`` for the initial swap cache hit, ``sync`` for synchronous\n+swapin, ``readahead`` for the readahead helper, or ``poison`` for a marker.\n+The helpers may themselves find a cached folio, so path does not prove I/O\n+occurred. Event counts are not disk-I/O or major-fault counts.\n+\n+``fallback`` is a bitmask recording explicit downgrades from a higher order\n+to order 0 in the synchronous helper. An initial order-0 request does not\n+set policy reason bits, even when the policy conditions hold. Set reasons\n+are printed separated by ``|``:\n+\n+* ``none``: no explicit downgrade in the synchronous helper.\n+* ``userfaultfd``: the VMA has userfaultfd armed.\n+* ``zswap``: ``zswap_never_enabled()`` is false, restricting the request\n+ to order 0.\n+* ``sync_fail``: the initial higher-order synchronous attempt failed.\n+\n+The zswap restriction follows a static key, not the current enable setting.\n+It persists after zswap is disabled and also applies with\n+``CONFIG_ZSWAP_DEFAULT_ON=y`` even when booting with ``zswap.enabled=0``.\n+The policy reasons can occur together, so both ``userfaultfd`` and ``zswap``\n+are recorded when both restrictions apply to a higher-order request.\n+``fallback_error`` preserves the initial synchronous error, including\n+range conflicts such as ``-EBUSY``; it is zero for policy downgrades and\n+when fallback is ``none``. ``-ENOMEM`` can indicate allocation or memcg\n+charging failure.\n+\n+These fields describe a decision to request order 0, not a guarantee about\n+the returned folio: a racing swap-cache insertion may provide a different\n+order. Swap-cache and readahead paths can also return a smaller folio\n+without setting ``fallback``.\n+\n+For example, after mounting tracefs at ``/sys/kernel/tracing``, use a private\n+instance to capture a workload's swapins::\n+\n+ mkdir /sys/kernel/tracing/instances/shmem\n+ cd /sys/kernel/tracing/instances/shmem\n+ echo 1 \u003e events/shmem/shmem_swapin_folio/enable\n+ # Run the workload, then stop recording before reading the buffer.\n+ echo 0 \u003e tracing_on\n+ cat trace\n+\n+Filter or aggregate by both ``dev`` and ``ino``; inode numbers alone are\n+not unique across mounts. Trace filters use the numeric values shown by\n+the event's ``format`` file. Check ``per_cpu/cpu*/stats`` for dropped events\n+before interpreting counts.\n+\n+Allocation attempts\n+-------------------\n+\n+``shmem_alloc_folio_finish`` records failed calls to\n+``shmem_alloc_and_add_folio()`` and successful calls that allocate below\n+their requested order. Successes at the requested order are omitted,\n+including ordinary order-0 allocations.\n+\n+This is an attempt result, not the final result of a read, write or fault.\n+After a higher-order failure the caller may retry at order 0, or restart\n+its lookup on ``-EEXIST``. A successful order-0 retry is not recorded.\n+Do not count all nonzero returns as failed user operations.\n+\n+``requested_order`` is the highest order allowed by this call's order mask,\n+or 0 for a base-page request. ``suitable_order`` is the highest remaining\n+order after VMA and page-cache filtering, or -1 if none remains.\n+``actual_order`` is the allocated folio's order, or -1 if allocation did\n+not produce a folio. Orders refer to base pages, not bytes.\n+\n+``stage`` identifies where the attempt ended:\n+\n+* ``filter``: filtering removed every candidate order, so no folio\n+ allocation was attempted. ``suitable_order=-1`` identifies this case.\n+* ``alloc``: a suitable order existed, but every allocation failed.\n+* ``charge``: memcg charging failed.\n+* ``cache``: page-cache insertion failed.\n+* ``account``: filesystem block accounting failed after its retry.\n+* ``done``: allocation succeeded at a smaller order.\n+\n+``error`` is the error at that stage; ``ret`` is the error returned to the\n+caller. ``stage=filter`` has ``error=0`` because no allocator call occurred,\n+while ``ret=-ENOMEM`` preserves the helper's return value. Both are zero for\n+``done``. For a charge failure followed by a page-cache conflict, ``error``\n+retains the charge error (such as ``-ENOMEM``), while ``ret=-EEXIST``\n+requests a lookup retry. A direct insertion race instead has\n+``stage=cache error=-EEXIST ret=-EEXIST``. Accounting errors retain\n+``-ENOSPC`` or ``-EDQUOT`` as appropriate.\n+\n+Enable ``events/shmem/shmem_alloc_folio_finish/enable`` in the trace\n+instance to collect these records. On successful fallbacks,\n+``suitable_order \u003c requested_order`` shows filtering, and\n+``actual_order \u003c suitable_order`` shows allocator fallback. Both may\n+occur in one attempt. The existing shmem allocation and fallback\n+counters remain useful for aggregate statistics.\ndiff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst\nindex f4058e8e92e3d1..dbf40774443056 100644\n--- a/Documentation/trace/index.rst\n+++ b/Documentation/trace/index.rst\n@@ -51,6 +51,7 @@ applications.\n \n events\n events-kmem\n+ events-shmem\n events-power\n events-nmi\n events-msr\ndiff --git a/MAINTAINERS b/MAINTAINERS\nindex d2fc3d8364b326..8f6a02dcf9c7df 100644\n--- a/MAINTAINERS\n+++ b/MAINTAINERS\n@@ -27602,8 +27602,10 @@ M:\tHugh Dickins \u003chughd@google.com\u003e\n R:\tBaolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\n L:\tlinux-mm@kvack.org\n S:\tMaintained\n+F:\tDocumentation/trace/events-shmem.rst\n F:\tinclude/linux/memfd.h\n F:\tinclude/linux/shmem_fs.h\n+F:\tinclude/trace/events/shmem.h\n F:\tmm/memfd.c\n F:\tmm/shmem.c\n F:\tmm/shmem_quota.c\ndiff --git a/include/trace/events/shmem.h b/include/trace/events/shmem.h\nnew file mode 100644\nindex 00000000000000..72b20d6b3caf95\n--- /dev/null\n+++ b/include/trace/events/shmem.h\n@@ -0,0 +1,141 @@\n+/* SPDX-License-Identifier: GPL-2.0 */\n+#undef TRACE_SYSTEM\n+#define TRACE_SYSTEM shmem\n+\n+#if !defined(_TRACE_SHMEM_H) || defined(TRACE_HEADER_MULTI_READ)\n+#define _TRACE_SHMEM_H\n+\n+#include \u003clinux/bits.h\u003e\n+#include \u003clinux/fs.h\u003e\n+#include \u003clinux/kdev_t.h\u003e\n+#include \u003clinux/tracepoint.h\u003e\n+\n+#define SHMEM_SWAPIN_LOOKUP\t0\n+#define SHMEM_SWAPIN_CACHE\t1\n+#define SHMEM_SWAPIN_SYNC\t\t2\n+#define SHMEM_SWAPIN_READAHEAD\t3\n+#define SHMEM_SWAPIN_POISON\t4\n+\n+#define SHMEM_SWAPIN_FALLBACK_NONE\t\t0\n+#define SHMEM_SWAPIN_FALLBACK_USERFAULTFD\tBIT(0)\n+#define SHMEM_SWAPIN_FALLBACK_ZSWAP\t\tBIT(1)\n+#define SHMEM_SWAPIN_FALLBACK_SYNC\t\tBIT(2)\n+\n+#define show_shmem_swapin_fallback(flags)\t\t\t\\\n+\t(flags) ? __print_flags(flags, \"|\",\t\t\\\n+\t{ SHMEM_SWAPIN_FALLBACK_USERFAULTFD, \"userfaultfd\" },\\\n+\t{ SHMEM_SWAPIN_FALLBACK_ZSWAP, \"zswap\" },\t\\\n+\t{ SHMEM_SWAPIN_FALLBACK_SYNC, \"sync_fail\" }) : \"none\"\n+\n+TRACE_EVENT(shmem_swapin_folio,\n+\n+\tTP_PROTO(struct inode *inode, pgoff_t index,\n+\t\t unsigned int entry_type, pgoff_t entry_offset,\n+\t\t int requested_order, int actual_order, unsigned int path,\n+\t\t unsigned int fallback, int fallback_error, int error),\n+\n+\tTP_ARGS(inode, index, entry_type, entry_offset, requested_order,\n+\t\tactual_order, path, fallback, fallback_error, error),\n+\n+\tTP_STRUCT__entry(\n+\t\t__field(dev_t, dev)\n+\t\t__field(unsigned long, ino)\n+\t\t__field(unsigned long, index)\n+\t\t__field(unsigned int, entry_type)\n+\t\t__field(unsigned long, entry_offset)\n+\t\t__field(int, requested_order)\n+\t\t__field(int, actual_order)\n+\t\t__field(unsigned int, path)\n+\t\t__field(unsigned int, fallback)\n+\t\t__field(int, fallback_error)\n+\t\t__field(int, error)\n+\t),\n+\n+\tTP_fast_assign(\n+\t\t__entry-\u003edev = inode-\u003ei_sb-\u003es_dev;\n+\t\t__entry-\u003eino = inode-\u003ei_ino;\n+\t\t__entry-\u003eindex = index;\n+\t\t__entry-\u003eentry_type = entry_type;\n+\t\t__entry-\u003eentry_offset = entry_offset;\n+\t\t__entry-\u003erequested_order = requested_order;\n+\t\t__entry-\u003eactual_order = actual_order;\n+\t\t__entry-\u003epath = path;\n+\t\t__entry-\u003efallback = fallback;\n+\t\t__entry-\u003efallback_error = fallback_error;\n+\t\t__entry-\u003eerror = error;\n+\t),\n+\n+\tTP_printk(\"dev=%d:%d ino=%lu index=%lu entry=%u:%lu requested_order=%d actual_order=%d path=%s fallback=%s fallback_error=%d error=%d\",\n+\t\t MAJOR(__entry-\u003edev), MINOR(__entry-\u003edev),\n+\t\t __entry-\u003eino, __entry-\u003eindex,\n+\t\t __entry-\u003eentry_type, __entry-\u003eentry_offset,\n+\t\t __entry-\u003erequested_order, __entry-\u003eactual_order,\n+\t\t __print_symbolic(__entry-\u003epath,\n+\t\t\t\t { SHMEM_SWAPIN_LOOKUP, \"lookup\" },\n+\t\t\t\t { SHMEM_SWAPIN_CACHE, \"cache\" },\n+\t\t\t\t { SHMEM_SWAPIN_SYNC, \"sync\" },\n+\t\t\t\t { SHMEM_SWAPIN_READAHEAD, \"readahead\" },\n+\t\t\t\t { SHMEM_SWAPIN_POISON, \"poison\" }),\n+\t\t show_shmem_swapin_fallback(__entry-\u003efallback),\n+\t\t __entry-\u003efallback_error, __entry-\u003eerror)\n+);\n+\n+#define SHMEM_ALLOC_ALLOC\t0\n+#define SHMEM_ALLOC_CHARGE\t1\n+#define SHMEM_ALLOC_CACHE\t\t2\n+#define SHMEM_ALLOC_ACCOUNT\t3\n+#define SHMEM_ALLOC_DONE\t\t4\n+#define SHMEM_ALLOC_FILTER\t5\n+\n+TRACE_EVENT(shmem_alloc_folio_finish,\n+\n+\tTP_PROTO(struct inode *inode, pgoff_t index,\n+\t\t int requested_order, int suitable_order, int actual_order,\n+\t\t unsigned int stage, int error, int ret),\n+\n+\tTP_ARGS(inode, index, requested_order, suitable_order, actual_order,\n+\t\tstage, error, ret),\n+\n+\tTP_STRUCT__entry(\n+\t\t__field(dev_t, dev)\n+\t\t__field(unsigned long, ino)\n+\t\t__field(unsigned long, index)\n+\t\t__field(int, requested_order)\n+\t\t__field(int, suitable_order)\n+\t\t__field(int, actual_order)\n+\t\t__field(unsigned int, stage)\n+\t\t__field(int, error)\n+\t\t__field(int, ret)\n+\t),\n+\n+\tTP_fast_assign(\n+\t\t__entry-\u003edev = inode-\u003ei_sb-\u003es_dev;\n+\t\t__entry-\u003eino = inode-\u003ei_ino;\n+\t\t__entry-\u003eindex = index;\n+\t\t__entry-\u003erequested_order = requested_order;\n+\t\t__entry-\u003esuitable_order = suitable_order;\n+\t\t__entry-\u003eactual_order = actual_order;\n+\t\t__entry-\u003estage = stage;\n+\t\t__entry-\u003eerror = error;\n+\t\t__entry-\u003eret = ret;\n+\t),\n+\n+\tTP_printk(\"dev=%d:%d ino=%lu index=%lu requested_order=%d suitable_order=%d actual_order=%d stage=%s error=%d ret=%d\",\n+\t\t MAJOR(__entry-\u003edev), MINOR(__entry-\u003edev),\n+\t\t __entry-\u003eino, __entry-\u003eindex,\n+\t\t __entry-\u003erequested_order, __entry-\u003esuitable_order,\n+\t\t __entry-\u003eactual_order,\n+\t\t __print_symbolic(__entry-\u003estage,\n+\t\t\t\t { SHMEM_ALLOC_ALLOC, \"alloc\" },\n+\t\t\t\t { SHMEM_ALLOC_CHARGE, \"charge\" },\n+\t\t\t\t { SHMEM_ALLOC_CACHE, \"cache\" },\n+\t\t\t\t { SHMEM_ALLOC_ACCOUNT, \"account\" },\n+\t\t\t\t { SHMEM_ALLOC_DONE, \"done\" },\n+\t\t\t\t { SHMEM_ALLOC_FILTER, \"filter\" }),\n+\t\t __entry-\u003eerror, __entry-\u003eret)\n+);\n+\n+#endif /* _TRACE_SHMEM_H */\n+\n+/* This part must be outside protection */\n+#include \u003ctrace/define_trace.h\u003e\ndiff --git a/mm/shmem.c b/mm/shmem.c\nindex 9f0965b8b59c5d..68321d61dfdbb2 100644\n--- a/mm/shmem.c\n+++ b/mm/shmem.c\n@@ -87,6 +87,9 @@ static struct vfsmount *shm_mnt __ro_after_init;\n \n #include \"internal.h\"\n \n+#define CREATE_TRACE_POINTS\n+#include \u003ctrace/events/shmem.h\u003e\n+\n #define VM_ACCT(size) (PAGE_ALIGN(size) \u003e\u003e PAGE_SHIFT)\n \n /* Pretend that each entry is of this size in directory's i_size */\n@@ -2152,17 +2155,23 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,\n \tunsigned long suitable_orders = 0;\n \tstruct folio *folio = NULL;\n \tpgoff_t aligned_index;\n+\tpgoff_t orig_index = index;\n \tlong pages;\n \tint error, order;\n+\tint requested_order, suitable_order;\n+\tint charge_error = 0;\n+\tunsigned int stage;\n \n \tif (!IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE))\n \t\torders = 0;\n \n+\trequested_order = orders ? highest_order(orders) : 0;\n \tif (orders \u003e 0) {\n \t\tsuitable_orders = shmem_suitable_orders(inode, vmf,\n \t\t\t\t\t\t\tmapping, index, orders);\n \n \t\torder = highest_order(suitable_orders);\n+\t\tsuitable_order = order;\n \t\twhile (suitable_orders) {\n \t\t\tpages = 1UL \u003c\u003c order;\n \t\t\taligned_index = round_down(index, pages);\n@@ -2178,19 +2187,35 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,\n \t\t\torder = next_order(\u0026suitable_orders, order);\n \t\t}\n \t} else {\n+\t\tsuitable_order = 0;\n \t\tpages = 1;\n \t\tfolio = shmem_alloc_folio(gfp, 0, info, index);\n \t}\n-\tif (!folio)\n+\tif (!folio) {\n+\t\tif (suitable_order \u003c 0)\n+\t\t\ttrace_shmem_alloc_folio_finish(inode, orig_index,\n+\t\t\t\t\t\t requested_order,\n+\t\t\t\t\t\t suitable_order, -1,\n+\t\t\t\t\t\t SHMEM_ALLOC_FILTER, 0,\n+\t\t\t\t\t\t -ENOMEM);\n+\t\telse\n+\t\t\ttrace_shmem_alloc_folio_finish(inode, orig_index,\n+\t\t\t\t\t\t requested_order,\n+\t\t\t\t\t\t suitable_order, -1,\n+\t\t\t\t\t\t SHMEM_ALLOC_ALLOC, -ENOMEM,\n+\t\t\t\t\t\t -ENOMEM);\n \t\treturn ERR_PTR(-ENOMEM);\n+\t}\n \n allocated:\n \t__folio_set_locked(folio);\n \t__folio_set_swapbacked(folio);\n \n \tgfp \u0026= GFP_RECLAIM_MASK;\n+\tstage = SHMEM_ALLOC_CHARGE;\n \terror = mem_cgroup_charge(folio, fault_mm, gfp);\n \tif (error) {\n+\t\tcharge_error = error;\n \t\tif (xa_find(\u0026mapping-\u003ei_pages, \u0026index,\n \t\t\t\tindex + pages - 1, XA_PRESENT)) {\n \t\t\terror = -EEXIST;\n@@ -2205,10 +2230,12 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,\n \t\tgoto unlock;\n \t}\n \n+\tstage = SHMEM_ALLOC_CACHE;\n \terror = shmem_add_to_page_cache(folio, mapping, index, NULL, gfp);\n \tif (error)\n \t\tgoto unlock;\n \n+\tstage = SHMEM_ALLOC_ACCOUNT;\n \terror = shmem_inode_acct_blocks(inode, pages);\n \tif (error) {\n \t\tstruct shmem_sb_info *sbinfo = SHMEM_SB(inode-\u003ei_sb);\n@@ -2239,9 +2266,17 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,\n \n \tshmem_recalc_inode(inode, pages, 0);\n \tfolio_add_lru(folio);\n+\tif (folio_order(folio) \u003c requested_order)\n+\t\ttrace_shmem_alloc_folio_finish(inode, orig_index,\n+\t\t\t\t\t requested_order, suitable_order,\n+\t\t\t\t\t folio_order(folio),\n+\t\t\t\t\t SHMEM_ALLOC_DONE, 0, 0);\n \treturn folio;\n \n unlock:\n+\ttrace_shmem_alloc_folio_finish(inode, orig_index, requested_order,\n+\t\t\t\t suitable_order, folio_order(folio), stage,\n+\t\t\t\t charge_error ?: error, error);\n \tfolio_unlock(folio);\n \tfolio_put(folio);\n \treturn ERR_PTR(error);\n@@ -2249,16 +2284,22 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,\n \n static struct folio *shmem_swap_alloc_folio(struct inode *inode,\n \t\tstruct vm_fault *vmf, pgoff_t index,\n-\t\tswp_entry_t entry, int order, gfp_t gfp)\n+\t\tswp_entry_t entry, int order, gfp_t gfp,\n+\t\tunsigned int *fallback, int *fallback_error)\n {\n \tpgoff_t ilx;\n \tstruct folio *folio;\n \tstruct mempolicy *mpol;\n \tstruct shmem_inode_info *info = SHMEM_I(inode);\n \n-\tif ((vmf \u0026\u0026 unlikely(userfaultfd_armed(vmf-\u003evma))) ||\n-\t !zswap_never_enabled())\n-\t\torder = 0;\n+\tif (order) {\n+\t\tif (vmf \u0026\u0026 unlikely(userfaultfd_armed(vmf-\u003evma)))\n+\t\t\t*fallback |= SHMEM_SWAPIN_FALLBACK_USERFAULTFD;\n+\t\tif (!zswap_never_enabled())\n+\t\t\t*fallback |= SHMEM_SWAPIN_FALLBACK_ZSWAP;\n+\t\tif (*fallback)\n+\t\t\torder = 0;\n+\t}\n \n again:\n \tmpol = shmem_get_pgoff_policy(info, index, order, \u0026ilx);\n@@ -2269,6 +2310,8 @@ static struct folio *shmem_swap_alloc_folio(struct inode *inode,\n \t\treturn folio;\n \n \tif (order) {\n+\t\t*fallback |= SHMEM_SWAPIN_FALLBACK_SYNC;\n+\t\t*fallback_error = PTR_ERR(folio);\n \t\torder = 0;\n \t\tgoto again;\n \t}\n@@ -2471,7 +2514,12 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \tsoftleaf_t index_entry;\n \tstruct swap_info_struct *si;\n \tstruct folio *folio = NULL;\n-\tint error, nr_pages, order;\n+\tint error, nr_pages, order = -1;\n+\tint actual_order = -1;\n+\tunsigned int path = SHMEM_SWAPIN_LOOKUP;\n+\tunsigned int fallback = SHMEM_SWAPIN_FALLBACK_NONE;\n+\tint fallback_error = 0;\n+\tpgoff_t orig_index = index;\n \tpgoff_t offset;\n \n \tVM_BUG_ON(!*foliop || !xa_is_value(*foliop));\n@@ -2479,20 +2527,21 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \tswap = index_entry;\n \t*foliop = NULL;\n \n-\tif (softleaf_is_poison_marker(index_entry))\n-\t\treturn -EIO;\n+\tif (softleaf_is_poison_marker(index_entry)) {\n+\t\tpath = SHMEM_SWAPIN_POISON;\n+\t\terror = -EIO;\n+\t\tgoto out;\n+\t}\n \n \tsi = get_swap_device(index_entry);\n \torder = shmem_confirm_swap(mapping, index, index_entry);\n \tif (IS_ERR_OR_NULL(si)) {\n-\t\tif (order \u003c 0)\n-\t\t\treturn -EEXIST;\n-\t\telse\n-\t\t\treturn -EINVAL;\n+\t\terror = order \u003c 0 ? -EEXIST : -EINVAL;\n+\t\tgoto out;\n \t}\n \tif (unlikely(order \u003c 0)) {\n-\t\tput_swap_device(si);\n-\t\treturn -EEXIST;\n+\t\terror = -EEXIST;\n+\t\tgoto put_swap;\n \t}\n \n \t/* index may point to the middle of a large entry, get the sub entry */\n@@ -2506,10 +2555,13 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \tif (!folio) {\n \t\tif (data_race(si-\u003eflags \u0026 SWP_SYNCHRONOUS_IO)) {\n \t\t\t/* Direct swapin skipping swap cache \u0026 readahead */\n+\t\t\tpath = SHMEM_SWAPIN_SYNC;\n \t\t\tfolio = shmem_swap_alloc_folio(inode, vmf, index,\n-\t\t\t\t\t\t swap, order, gfp);\n+\t\t\t\t\t\t swap, order, gfp, \u0026fallback,\n+\t\t\t\t\t\t \u0026fallback_error);\n \t\t} else {\n \t\t\t/* Cached swapin only supports order 0 folio */\n+\t\t\tpath = SHMEM_SWAPIN_READAHEAD;\n \t\t\tfolio = shmem_swapin_cluster(swap, gfp, info, index);\n \t\t}\n \t\tif (IS_ERR_OR_NULL(folio)) {\n@@ -2526,6 +2578,7 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \t\t\tcount_memcg_event_mm(fault_mm, PGMAJFAULT);\n \t\t}\n \t} else {\n+\t\tpath = SHMEM_SWAPIN_CACHE;\n \t\tswap_update_readahead(folio, NULL, 0);\n \t}\n \n@@ -2603,10 +2656,9 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \tfolio_put_swap(folio, NULL);\n \tswap_cache_del_folio(folio);\n \tfolio_mark_dirty(folio);\n-\tput_swap_device(si);\n-\n+\tactual_order = folio_order(folio);\n \t*foliop = folio;\n-\treturn 0;\n+\tgoto put_swap;\n failed:\n \tif (shmem_confirm_swap(mapping, index, swap) \u003c 0)\n \t\terror = -EEXIST;\n@@ -2616,10 +2668,16 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \tif (folio)\n \t\tfolio_unlock(folio);\n failed_nolock:\n-\tif (folio)\n+\tif (folio) {\n+\t\tactual_order = folio_order(folio);\n \t\tfolio_put(folio);\n+\t}\n+put_swap:\n \tput_swap_device(si);\n-\n+out:\n+\ttrace_shmem_swapin_folio(inode, orig_index, swp_type(index_entry),\n+\t\t\t\t swp_offset(index_entry), order, actual_order,\n+\t\t\t\t path, fallback, fallback_error, error);\n \treturn error;\n }\n \n"
} |
| 2/1 | 2026/10/27 16:42 | agent | patch-evaluator |
1mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch introduces two new tracepoints (shmem_swapin_folio and shmem_alloc_folio_finish) along with their definitions and documentation in Documentation/trace/. The changes in mm/shmem.c only collect trace arguments and call the tracepoints, consolidating exit points to emit the event before returning without altering functional control flow, error handling, or kernel data structures. Per the negative criteria, tracepoints that do not alter control flow or data structures do not warrant fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 5dfeec02d6ae52011ee2b010d0569b7fed009cf6
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Oct 27 16:42:51 2026 +0000
syz-cluster: applied patch under review
diff --git a/Documentation/trace/events-shmem.rst b/Documentation/trace/events-shmem.rst
new file mode 100644
index 00000000000000..4a0e50bdbdf37e
--- /dev/null
+++ b/Documentation/trace/events-shmem.rst
@@ -0,0 +1,118 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+Tmpfs and shmem events
+=====================
+
+The events in ``events/shmem/`` attribute swapin and allocation activity to
+``dev`` (the filesystem device) and ``ino`` (the inode number). They also
+cover anonymous shared memory and memfd files. ``index`` is the page offset
+requested by the caller, before any alignment for a large folio.
+
+Swapin
+------
+
+``shmem_swapin_folio`` records each return from ``shmem_swapin_folio()``.
+``error`` is the return value: zero means a folio was installed in the file
+page cache; ``-EEXIST`` normally asks the caller to retry after a race.
+Entry validation failures and poison markers also produce events.
+
+``entry`` contains the original XArray entry's type and offset. For a large
+entry, this is its base swap slot even when ``index`` lies in its middle.
+For ``path=poison``, it encodes a marker, not a real swap slot.
+
+``requested_order`` is the confirmed XArray entry order, or -1 when unknown.
+``actual_order`` is the order of the folio obtained, or -1 if none was
+obtained. A nonnegative actual order does not imply successful insertion:
+always check ``error``. One successful event may cover multiple pages.
+
+``path`` identifies the branch taken: ``lookup`` for entry validation
+failure, ``cache`` for the initial swap cache hit, ``sync`` for synchronous
+swapin, ``readahead`` for the readahead helper, or ``poison`` for a marker.
+The helpers may themselves find a cached folio, so path does not prove I/O
+occurred. Event counts are not disk-I/O or major-fault counts.
+
+``fallback`` is a bitmask recording explicit downgrades from a higher order
+to order 0 in the synchronous helper. An initial order-0 request does not
+set policy reason bits, even when the policy conditions hold. Set reasons
+are printed separated by ``|``:
+
+* ``none``: no explicit downgrade in the synchronous helper.
+* ``userfaultfd``: the VMA has userfaultfd armed.
+* ``zswap``: ``zswap_never_enabled()`` is false, restricting the request
+ to order 0.
+* ``sync_fail``: the initial higher-order synchronous attempt failed.
+
+The zswap restriction follows a static key, not the current enable setting.
+It persists after zswap is disabled and also applies with
+``CONFIG_ZSWAP_DEFAULT_ON=y`` even when booting with ``zswap.enabled=0``.
+The policy reasons can occur together, so both ``userfaultfd`` and ``zswap``
+are recorded when both restrictions apply to a higher-order request.
+``fallback_error`` preserves the initial synchronous error, including
+range conflicts such as ``-EBUSY``; it is zero for policy downgrades and
+when fallback is ``none``. ``-ENOMEM`` can indicate allocation or memcg
+charging failure.
+
+These fields describe a decision to request order 0, not a guarantee about
+the returned folio: a racing swap-cache insertion may provide a different
+order. Swap-cache and readahead paths can also return a smaller folio
+without setting ``fallback``.
+
+For example, after mounting tracefs at ``/sys/kernel/tracing``, use a private
+instance to capture a workload's swapins::
+
+ mkdir /sys/kernel/tracing/instances/shmem
+ cd /sys/kernel/tracing/instances/shmem
+ echo 1 > events/shmem/shmem_swapin_folio/enable
+ # Run the workload, then stop recording before reading the buffer.
+ echo 0 > tracing_on
+ cat trace
+
+Filter or aggregate by both ``dev`` and ``ino``; inode numbers alone are
+not unique across mounts. Trace filters use the numeric values shown by
+the event's ``format`` file. Check ``per_cpu/cpu*/stats`` for dropped events
+before interpreting counts.
+
+Allocation attempts
+-------------------
+
+``shmem_alloc_folio_finish`` records failed calls to
+``shmem_alloc_and_add_folio()`` and successful calls that allocate below
+their requested order. Successes at the requested order are omitted,
+including ordinary order-0 allocations.
+
+This is an attempt result, not the final result of a read, write or fault.
+After a higher-order failure the caller may retry at order 0, or restart
+its lookup on ``-EEXIST``. A successful order-0 retry is not recorded.
+Do not count all nonzero returns as failed user operations.
+
+``requested_order`` is the highest order allowed by this call's order mask,
+or 0 for a base-page request. ``suitable_order`` is the highest remaining
+order after VMA and page-cache filtering, or -1 if none remains.
+``actual_order`` is the allocated folio's order, or -1 if allocation did
+not produce a folio. Orders refer to base pages, not bytes.
+
+``stage`` identifies where the attempt ended:
+
+* ``filter``: filtering removed every candidate order, so no folio
+ allocation was attempted. ``suitable_order=-1`` identifies this case.
+* ``alloc``: a suitable order existed, but every allocation failed.
+* ``charge``: memcg charging failed.
+* ``cache``: page-cache insertion failed.
+* ``account``: filesystem block accounting failed after its retry.
+* ``done``: allocation succeeded at a smaller order.
+
+``error`` is the error at that stage; ``ret`` is the error returned to the
+caller. ``stage=filter`` has ``error=0`` because no allocator call occurred,
+while ``ret=-ENOMEM`` preserves the helper's return value. Both are zero for
+``done``. For a charge failure followed by a page-cache conflict, ``error``
+retains the charge error (such as ``-ENOMEM``), while ``ret=-EEXIST``
+requests a lookup retry. A direct insertion race instead has
+``stage=cache error=-EEXIST ret=-EEXIST``. Accounting errors retain
+``-ENOSPC`` or ``-EDQUOT`` as appropriate.
+
+Enable ``events/shmem/shmem_alloc_folio_finish/enable`` in the trace
+instance to collect these records. On successful fallbacks,
+``suitable_order < requested_order`` shows filtering, and
+``actual_order < suitable_order`` shows allocator fallback. Both may
+occur in one attempt. The existing shmem allocation and fallback
+counters remain useful for aggregate statistics.
diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst
index f4058e8e92e3d1..dbf40774443056 100644
--- a/Documentation/trace/index.rst
+++ b/Documentation/trace/index.rst
@@ -51,6 +51,7 @@ applications.
events
events-kmem
+ events-shmem
events-power
events-nmi
events-msr
diff --git a/MAINTAINERS b/MAINTAINERS
index d2fc3d8364b326..8f6a02dcf9c7df 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -27602,8 +27602,10 @@ M: Hugh Dickins <hughd@google.com>
R: Baolin Wang <baolin.wang@linux.alibaba.com>
L: linux-mm@kvack.org
S: Maintained
+F: Documentation/trace/events-shmem.rst
F: include/linux/memfd.h
F: include/linux/shmem_fs.h
+F: include/trace/events/shmem.h
F: mm/memfd.c
F: mm/shmem.c
F: mm/shmem_quota.c
diff --git a/include/trace/events/shmem.h b/include/trace/events/shmem.h
new file mode 100644
index 00000000000000..72b20d6b3caf95
--- /dev/null
+++ b/include/trace/events/shmem.h
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM shmem
+
+#if !defined(_TRACE_SHMEM_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_SHMEM_H
+
+#include <linux/bits.h>
+#include <linux/fs.h>
+#include <linux/kdev_t.h>
+#include <linux/tracepoint.h>
+
+#define SHMEM_SWAPIN_LOOKUP 0
+#define SHMEM_SWAPIN_CACHE 1
+#define SHMEM_SWAPIN_SYNC 2
+#define SHMEM_SWAPIN_READAHEAD 3
+#define SHMEM_SWAPIN_POISON 4
+
+#define SHMEM_SWAPIN_FALLBACK_NONE 0
+#define SHMEM_SWAPIN_FALLBACK_USERFAULTFD BIT(0)
+#define SHMEM_SWAPIN_FALLBACK_ZSWAP BIT(1)
+#define SHMEM_SWAPIN_FALLBACK_SYNC BIT(2)
+
+#define show_shmem_swapin_fallback(flags) \
+ (flags) ? __print_flags(flags, "|", \
+ { SHMEM_SWAPIN_FALLBACK_USERFAULTFD, "userfaultfd" },\
+ { SHMEM_SWAPIN_FALLBACK_ZSWAP, "zswap" }, \
+ { SHMEM_SWAPIN_FALLBACK_SYNC, "sync_fail" }) : "none"
+
+TRACE_EVENT(shmem_swapin_folio,
+
+ TP_PROTO(struct inode *inode, pgoff_t index,
+ unsigned int entry_type, pgoff_t entry_offset,
+ int requested_order, int actual_order, unsigned int path,
+ unsigned int fallback, int fallback_error, int error),
+
+ TP_ARGS(inode, index, entry_type, entry_offset, requested_order,
+ actual_order, path, fallback, fallback_error, error),
+
+ TP_STRUCT__entry(
+ __field(dev_t, dev)
+ __field(unsigned long, ino)
+ __field(unsigned long, index)
+ __field(unsigned int, entry_type)
+ __field(unsigned long, entry_offset)
+ __field(int, requested_order)
+ __field(int, actual_order)
+ __field(unsigned int, path)
+ __field(unsigned int, fallback)
+ __field(int, fallback_error)
+ __field(int, error)
+ ),
+
+ TP_fast_assign(
+ __entry->dev = inode->i_sb->s_dev;
+ __entry->ino = inode->i_ino;
+ __entry->index = index;
+ __entry->entry_type = entry_type;
+ __entry->entry_offset = entry_offset;
+ __entry->requested_order = requested_order;
+ __entry->actual_order = actual_order;
+ __entry->path = path;
+ __entry->fallback = fallback;
+ __entry->fallback_error = fallback_error;
+ __entry->error = error;
+ ),
+
+ TP_printk("dev=%d:%d ino=%lu index=%lu entry=%u:%lu requested_order=%d actual_order=%d path=%s fallback=%s fallback_error=%d error=%d",
+ MAJOR(__entry->dev), MINOR(__entry->dev),
+ __entry->ino, __entry->index,
+ __entry->entry_type, __entry->entry_offset,
+ __entry->requested_order, __entry->actual_order,
+ __print_symbolic(__entry->path,
+ { SHMEM_SWAPIN_LOOKUP, "lookup" },
+ { SHMEM_SWAPIN_CACHE, "cache" },
+ { SHMEM_SWAPIN_SYNC, "sync" },
+ { SHMEM_SWAPIN_READAHEAD, "readahead" },
+ { SHMEM_SWAPIN_POISON, "poison" }),
+ show_shmem_swapin_fallback(__entry->fallback),
+ __entry->fallback_error, __entry->error)
+);
+
+#define SHMEM_ALLOC_ALLOC 0
+#define SHMEM_ALLOC_CHARGE 1
+#define SHMEM_ALLOC_CACHE 2
+#define SHMEM_ALLOC_ACCOUNT 3
+#define SHMEM_ALLOC_DONE 4
+#define SHMEM_ALLOC_FILTER 5
+
+TRACE_EVENT(shmem_alloc_folio_finish,
+
+ TP_PROTO(struct inode *inode, pgoff_t index,
+ int requested_order, int suitable_order, int actual_order,
+ unsigned int stage, int error, int ret),
+
+ TP_ARGS(inode, index, requested_order, suitable_order, actual_order,
+ stage, error, ret),
+
+ TP_STRUCT__entry(
+ __field(dev_t, dev)
+ __field(unsigned long, ino)
+ __field(unsigned long, index)
+ __field(int, requested_order)
+ __field(int, suitable_order)
+ __field(int, actual_order)
+ __field(unsigned int, stage)
+ __field(int, error)
+ __field(int, ret)
+ ),
+
+ TP_fast_assign(
+ __entry->dev = inode->i_sb->s_dev;
+ __entry->ino = inode->i_ino;
+ __entry->index = index;
+ __entry->requested_order = requested_order;
+ __entry->suitable_order = suitable_order;
+ __entry->actual_order = actual_order;
+ __entry->stage = stage;
+ __entry->error = error;
+ __entry->ret = ret;
+ ),
+
+ TP_printk("dev=%d:%d ino=%lu index=%lu requested_order=%d suitable_order=%d actual_order=%d stage=%s error=%d ret=%d",
+ MAJOR(__entry->dev), MINOR(__entry->dev),
+ __entry->ino, __entry->index,
+ __entry->requested_order, __entry->suitable_order,
+ __entry->actual_order,
+ __print_symbolic(__entry->stage,
+ { SHMEM_ALLOC_ALLOC, "alloc" },
+ { SHMEM_ALLOC_CHARGE, "charge" },
+ { SHMEM_ALLOC_CACHE, "cache" },
+ { SHMEM_ALLOC_ACCOUNT, "account" },
+ { SHMEM_ALLOC_DONE, "done" },
+ { SHMEM_ALLOC_FILTER, "filter" }),
+ __entry->error, __entry->ret)
+);
+
+#endif /* _TRACE_SHMEM_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/mm/shmem.c b/mm/shmem.c
index 9f0965b8b59c5d..68321d61dfdbb2 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -87,6 +87,9 @@ static struct vfsmount *shm_mnt __ro_after_init;
#include "internal.h"
+#define CREATE_TRACE_POINTS
+#include <trace/events/shmem.h>
+
#define VM_ACCT(size) (PAGE_ALIGN(size) >> PAGE_SHIFT)
/* Pretend that each entry is of this size in directory's i_size */
@@ -2152,17 +2155,23 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,
unsigned long suitable_orders = 0;
struct folio *folio = NULL;
pgoff_t aligned_index;
+ pgoff_t orig_index = index;
long pages;
int error, order;
+ int requested_order, suitable_order;
+ int charge_error = 0;
+ unsigned int stage;
if (!IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE))
orders = 0;
+ requested_order = orders ? highest_order(orders) : 0;
if (orders > 0) {
suitable_orders = shmem_suitable_orders(inode, vmf,
mapping, index, orders);
order = highest_order(suitable_orders);
+ suitable_order = order;
while (suitable_orders) {
pages = 1UL << order;
aligned_index = round_down(index, pages);
@@ -2178,19 +2187,35 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,
order = next_order(&suitable_orders, order);
}
} else {
+ suitable_order = 0;
pages = 1;
folio = shmem_alloc_folio(gfp, 0, info, index);
}
- if (!folio)
+ if (!folio) {
+ if (suitable_order < 0)
+ trace_shmem_alloc_folio_finish(inode, orig_index,
+ requested_order,
+ suitable_order, -1,
+ SHMEM_ALLOC_FILTER, 0,
+ -ENOMEM);
+ else
+ trace_shmem_alloc_folio_finish(inode, orig_index,
+ requested_order,
+ suitable_order, -1,
+ SHMEM_ALLOC_ALLOC, -ENOMEM,
+ -ENOMEM);
return ERR_PTR(-ENOMEM);
+ }
allocated:
__folio_set_locked(folio);
__folio_set_swapbacked(folio);
gfp &= GFP_RECLAIM_MASK;
+ stage = SHMEM_ALLOC_CHARGE;
error = mem_cgroup_charge(folio, fault_mm, gfp);
if (error) {
+ charge_error = error;
if (xa_find(&mapping->i_pages, &index,
index + pages - 1, XA_PRESENT)) {
error = -EEXIST;
@@ -2205,10 +2230,12 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,
goto unlock;
}
+ stage = SHMEM_ALLOC_CACHE;
error = shmem_add_to_page_cache(folio, mapping, index, NULL, gfp);
if (error)
goto unlock;
+ stage = SHMEM_ALLOC_ACCOUNT;
error = shmem_inode_acct_blocks(inode, pages);
if (error) {
struct shmem_sb_info *sbinfo = SHMEM_SB(inode->i_sb);
@@ -2239,9 +2266,17 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,
shmem_recalc_inode(inode, pages, 0);
folio_add_lru(folio);
+ if (folio_order(folio) < requested_order)
+ trace_shmem_alloc_folio_finish(inode, orig_index,
+ requested_order, suitable_order,
+ folio_order(folio),
+ SHMEM_ALLOC_DONE, 0, 0);
return folio;
unlock:
+ trace_shmem_alloc_folio_finish(inode, orig_index, requested_order,
+ suitable_order, folio_order(folio), stage,
+ charge_error ?: error, error);
folio_unlock(folio);
folio_put(folio);
return ERR_PTR(error);
@@ -2249,16 +2284,22 @@ static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,
static struct folio *shmem_swap_alloc_folio(struct inode *inode,
struct vm_fault *vmf, pgoff_t index,
- swp_entry_t entry, int order, gfp_t gfp)
+ swp_entry_t entry, int order, gfp_t gfp,
+ unsigned int *fallback, int *fallback_error)
{
pgoff_t ilx;
struct folio *folio;
struct mempolicy *mpol;
struct shmem_inode_info *info = SHMEM_I(inode);
- if ((vmf && unlikely(userfaultfd_armed(vmf->vma))) ||
- !zswap_never_enabled())
- order = 0;
+ if (order) {
+ if (vmf && unlikely(userfaultfd_armed(vmf->vma)))
+ *fallback |= SHMEM_SWAPIN_FALLBACK_USERFAULTFD;
+ if (!zswap_never_enabled())
+ *fallback |= SHMEM_SWAPIN_FALLBACK_ZSWAP;
+ if (*fallback)
+ order = 0;
+ }
again:
mpol = shmem_get_pgoff_policy(info, index, order, &ilx);
@@ -2269,6 +2310,8 @@ static struct folio *shmem_swap_alloc_folio(struct inode *inode,
return folio;
if (order) {
+ *fallback |= SHMEM_SWAPIN_FALLBACK_SYNC;
+ *fallback_error = PTR_ERR(folio);
order = 0;
goto again;
}
@@ -2471,7 +2514,12 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
softleaf_t index_entry;
struct swap_info_struct *si;
struct folio *folio = NULL;
- int error, nr_pages, order;
+ int error, nr_pages, order = -1;
+ int actual_order = -1;
+ unsigned int path = SHMEM_SWAPIN_LOOKUP;
+ unsigned int fallback = SHMEM_SWAPIN_FALLBACK_NONE;
+ int fallback_error = 0;
+ pgoff_t orig_index = index;
pgoff_t offset;
VM_BUG_ON(!*foliop || !xa_is_value(*foliop));
@@ -2479,20 +2527,21 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
swap = index_entry;
*foliop = NULL;
- if (softleaf_is_poison_marker(index_entry))
- return -EIO;
+ if (softleaf_is_poison_marker(index_entry)) {
+ path = SHMEM_SWAPIN_POISON;
+ error = -EIO;
+ goto out;
+ }
si = get_swap_device(index_entry);
order = shmem_confirm_swap(mapping, index, index_entry);
if (IS_ERR_OR_NULL(si)) {
- if (order < 0)
- return -EEXIST;
- else
- return -EINVAL;
+ error = order < 0 ? -EEXIST : -EINVAL;
+ goto out;
}
if (unlikely(order < 0)) {
- put_swap_device(si);
- return -EEXIST;
+ error = -EEXIST;
+ goto put_swap;
}
/* index may point to the middle of a large entry, get the sub entry */
@@ -2506,10 +2555,13 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
if (!folio) {
if (data_race(si->flags & SWP_SYNCHRONOUS_IO)) {
/* Direct swapin skipping swap cache & readahead */
+ path = SHMEM_SWAPIN_SYNC;
folio = shmem_swap_alloc_folio(inode, vmf, index,
- swap, order, gfp);
+ swap, order, gfp, &fallback,
+ &fallback_error);
} else {
/* Cached swapin only supports order 0 folio */
+ path = SHMEM_SWAPIN_READAHEAD;
folio = shmem_swapin_cluster(swap, gfp, info, index);
}
if (IS_ERR_OR_NULL(folio)) {
@@ -2526,6 +2578,7 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
count_memcg_event_mm(fault_mm, PGMAJFAULT);
}
} else {
+ path = SHMEM_SWAPIN_CACHE;
swap_update_readahead(folio, NULL, 0);
}
@@ -2603,10 +2656,9 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
folio_put_swap(folio, NULL);
swap_cache_del_folio(folio);
folio_mark_dirty(folio);
- put_swap_device(si);
-
+ actual_order = folio_order(folio);
*foliop = folio;
- return 0;
+ goto put_swap;
failed:
if (shmem_confirm_swap(mapping, index, swap) < 0)
error = -EEXIST;
@@ -2616,10 +2668,16 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
if (folio)
folio_unlock(folio);
failed_nolock:
- if (folio)
+ if (folio) {
+ actual_order = folio_order(folio);
folio_put(folio);
+ }
+put_swap:
put_swap_device(si);
-
+out:
+ trace_shmem_swapin_folio(inode, orig_index, swp_type(index_entry),
+ swp_offset(index_entry), order, actual_order,
+ path, fallback, fallback_error, error);
return error;
}
|
| 3/2 | 2026/10/27 16:42 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 9706 output: 35 thoughts: 1128 Thoughts: **Analyzing the Shmem Fuzzing Patch Series** Okay, so I've been asked to take a look at this patch series aimed at improving fuzzing coverage with syzkaller, specifically targeting shmem. Time to dive in. First, I need to understand what's changed and then, importantly, how those changes might impact fuzzing. Alright, the diff touches on a few files: documentation, the MAINTAINERS file, and, most importantly, `include/trace/events/shmem.h` and `mm/shmem.c`. Looks like the core of the work lies in adding tracepoints. This is interesting. Tracepoints can be incredibly valuable for gathering detailed information during fuzzing, which can help find corner cases and trigger new code paths. Let's break down the changes in `mm/shmem.c`. In `shmem_alloc_and_add_folio`, there are new variables tracking memory allocation states: `orig_index`, `requested_order`, `suitable_order`, and `stage`. These additions, coupled with the new `trace_shmem_alloc_folio_finish` tracepoint, suggests fine-grained monitoring of folio allocation. This is definitely a good thing. In `shmem_swap_alloc_folio`, the addition of `fallback` and `fallback_error` parameters is interesting, and the assignments within suggest the goal is to trace more data. And the changes to `shmem_swapin_folio` are the most critical. I'm seeing new trace variables: `order`, `actual_order`, `path`, `fallback`, `fallback_error`, and `orig_index`. That tells me that we have more data, and that more execution paths are now tracked. The key here, though, is the change in control flow to use a `goto out` or `put_swap` and call the `trace_shmem_swapin_folio` tracepoint. This is very good for fuzzing because we can observe both success and failure cases. This is what I was hoping to see. Now, hold on. The diff also *seems* to have touched error handling in `shmem_swapin_folio`. Let me be careful here, this is where subtle bugs can hide. Okay, I see it. The way it handles `softleaf_is_poison_marker(index_entry)` *has* changed. Instead of early returns, there's a `goto out` after setting `path` and `error`. This ensures that the tracepoint is always called, regardless of the error, which is crucial for complete coverage. And the modification around `get_swap_device` is similar: It uses `goto out` or `goto put_swap`. This is critical for fuzzing. My primary concern now is the `put_swap` block. What state is `error` in when it reaches `put_swap`? The code moves the `put_swap_device` call *after* the `trace_shmem_swapin_folio` call, and the *success* path now also branches to `put_swap`. However, the error isn't explicitly set *before* the `goto put_swap;`! This could be a problem. We need to know that `error` is properly initialized or set to zero before this point, otherwise we could be reporting the wrong error code in the tracepoint. We need to check the code around `shmem_swapin_folio` very carefully! Let's go read the source! |
| 4/2 | 2026/10/27 16:43 | tool | read-file |
0mArgs:{
"File": "mm/shmem.c",
"FirstLine": 2510,
"LineCount": 90
}Results: {
"Contents": "2510:\t\tstruct vm_area_struct *vma = vmf ? vmf-\u003evma : NULL;\n2511:\t\tstruct mm_struct *fault_mm = vmf ? vmf-\u003evma-\u003evm_mm : NULL;\n2512:\t\tstruct shmem_inode_info *info = SHMEM_I(inode);\n2513:\t\tswp_entry_t swap;\n2514:\t\tsoftleaf_t index_entry;\n2515:\t\tstruct swap_info_struct *si;\n2516:\t\tstruct folio *folio = NULL;\n2517:\t\tint error, nr_pages, order = -1;\n2518:\t\tint actual_order = -1;\n2519:\t\tunsigned int path = SHMEM_SWAPIN_LOOKUP;\n2520:\t\tunsigned int fallback = SHMEM_SWAPIN_FALLBACK_NONE;\n2521:\t\tint fallback_error = 0;\n2522:\t\tpgoff_t orig_index = index;\n2523:\t\tpgoff_t offset;\n2524:\t\n2525:\t\tVM_BUG_ON(!*foliop || !xa_is_value(*foliop));\n2526:\t\tindex_entry = radix_to_swp_entry(*foliop);\n2527:\t\tswap = index_entry;\n2528:\t\t*foliop = NULL;\n2529:\t\n2530:\t\tif (softleaf_is_poison_marker(index_entry)) {\n2531:\t\t\tpath = SHMEM_SWAPIN_POISON;\n2532:\t\t\terror = -EIO;\n2533:\t\t\tgoto out;\n2534:\t\t}\n2535:\t\n2536:\t\tsi = get_swap_device(index_entry);\n2537:\t\torder = shmem_confirm_swap(mapping, index, index_entry);\n2538:\t\tif (IS_ERR_OR_NULL(si)) {\n2539:\t\t\terror = order \u003c 0 ? -EEXIST : -EINVAL;\n2540:\t\t\tgoto out;\n2541:\t\t}\n2542:\t\tif (unlikely(order \u003c 0)) {\n2543:\t\t\terror = -EEXIST;\n2544:\t\t\tgoto put_swap;\n2545:\t\t}\n2546:\t\n2547:\t\t/* index may point to the middle of a large entry, get the sub entry */\n2548:\t\tif (order) {\n2549:\t\t\toffset = index - round_down(index, 1 \u003c\u003c order);\n2550:\t\t\tswap = swp_entry(swp_type(swap), swp_offset(swap) + offset);\n2551:\t\t}\n2552:\t\n2553:\t\t/* Look it up and read it in.. */\n2554:\t\tfolio = swap_cache_get_folio(swap);\n2555:\t\tif (!folio) {\n2556:\t\t\tif (data_race(si-\u003eflags \u0026 SWP_SYNCHRONOUS_IO)) {\n2557:\t\t\t\t/* Direct swapin skipping swap cache \u0026 readahead */\n2558:\t\t\t\tpath = SHMEM_SWAPIN_SYNC;\n2559:\t\t\t\tfolio = shmem_swap_alloc_folio(inode, vmf, index,\n2560:\t\t\t\t\t\t\t swap, order, gfp, \u0026fallback,\n2561:\t\t\t\t\t\t\t \u0026fallback_error);\n2562:\t\t\t} else {\n2563:\t\t\t\t/* Cached swapin only supports order 0 folio */\n2564:\t\t\t\tpath = SHMEM_SWAPIN_READAHEAD;\n2565:\t\t\t\tfolio = shmem_swapin_cluster(swap, gfp, info, index);\n2566:\t\t\t}\n2567:\t\t\tif (IS_ERR_OR_NULL(folio)) {\n2568:\t\t\t\tif (IS_ERR(folio))\n2569:\t\t\t\t\terror = PTR_ERR(folio);\n2570:\t\t\t\telse\n2571:\t\t\t\t\terror = -ENOMEM;\n2572:\t\t\t\tfolio = NULL;\n2573:\t\t\t\tgoto failed;\n2574:\t\t\t}\n2575:\t\t\tif (fault_type) {\n2576:\t\t\t\t*fault_type |= VM_FAULT_MAJOR;\n2577:\t\t\t\tcount_vm_event(PGMAJFAULT);\n2578:\t\t\t\tcount_memcg_event_mm(fault_mm, PGMAJFAULT);\n2579:\t\t\t}\n2580:\t\t} else {\n2581:\t\t\tpath = SHMEM_SWAPIN_CACHE;\n2582:\t\t\tswap_update_readahead(folio, NULL, 0);\n2583:\t\t}\n2584:\t\n2585:\t\tif (order \u003e folio_order(folio)) {\n2586:\t\t\t/*\n2587:\t\t\t * Swapin may get smaller folios due to various reasons:\n2588:\t\t\t * It may fallback to order 0 due to memory pressure or race,\n2589:\t\t\t * swap readahead may swap in order 0 folios into swapcache\n2590:\t\t\t * asynchronously, while the shmem mapping can still stores\n2591:\t\t\t * large swap entries. In such cases, we should split the\n2592:\t\t\t * large swap entry to prevent possible data corruption.\n2593:\t\t\t */\n2594:\t\t\terror = shmem_split_large_entry(inode, index, index_entry, gfp);\n2595:\t\t\tif (error)\n2596:\t\t\t\tgoto failed_nolock;\n2597:\t\t}\n2598:\t\n2599:\t\t/*\n"
} |
| 5/2 | 2026/10/27 16:43 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 13070 output: 35 thoughts: 29 Thoughts: Okay, here's my interpretation of what's going through my mind as I analyze that code, keeping in mind I'm an expert in this field: **Diving Deeper into `shmem_swapin_folio`** Alright, let's zoom in on `shmem_swapin_folio` – specifically lines 2600 to 2680. My immediate thought is, "Okay, this is where the *real* magic happens, or at least where a significant chunk of it is orchestrated." I expect this section deals with the core logic of bringing a folio back into active memory after it's been swapped out. I'm going to be looking for the crucial steps: the interaction with the swap cache, the handling of page faults, and how it manages the physical memory allocation. I'm already anticipating the typical challenges here: race conditions, potential deadlocks, and the overall efficiency of the swap-in process. We need to look closely at synchronization primitives. Is it a spinlock? Read-copy-update? Mutexes? I’m also looking for subtle details – what kind of error handling is implemented? Does it gracefully deal with swap failures? Does it handle NUMA implications? I want to understand how it deals with page migration. Let’s see how they've structured the code. Does it follow a clear, maintainable pattern? Are there any obvious areas for optimization? This is where the rubber meets the road. |
| 6/2 | 2026/10/27 16:43 | tool | read-file |
0mArgs:{
"File": "mm/shmem.c",
"FirstLine": 2600,
"LineCount": 85
}Results: {
"Contents": "2600:\t\t * If the folio is large, round down swap and index by folio size.\n2601:\t\t * No matter what race occurs, the swap layer ensures we either get\n2602:\t\t * a valid folio that has its swap entry aligned by size, or a\n2603:\t\t * temporarily invalid one which we'll abort very soon and retry.\n2604:\t\t *\n2605:\t\t * shmem_add_to_page_cache ensures the whole range contains expected\n2606:\t\t * entries and prevents any corruption, so any race split is fine\n2607:\t\t * too, it will succeed as long as the entries are still there.\n2608:\t\t */\n2609:\t\tnr_pages = folio_nr_pages(folio);\n2610:\t\tif (nr_pages \u003e 1) {\n2611:\t\t\tswap.val = round_down(swap.val, nr_pages);\n2612:\t\t\tindex = round_down(index, nr_pages);\n2613:\t\t}\n2614:\t\n2615:\t\t/*\n2616:\t\t * We have to do this with the folio locked to prevent races.\n2617:\t\t * The shmem_confirm_swap below only checks if the first swap\n2618:\t\t * entry matches the folio, that's enough to ensure the folio\n2619:\t\t * is not used outside of shmem, as shmem swap entries\n2620:\t\t * and swap cache folios are never partially freed.\n2621:\t\t */\n2622:\t\tfolio_lock(folio);\n2623:\t\tif (!folio_matches_swap_entry(folio, swap) ||\n2624:\t\t shmem_confirm_swap(mapping, index, swap) \u003c 0) {\n2625:\t\t\terror = -EEXIST;\n2626:\t\t\tgoto unlock;\n2627:\t\t}\n2628:\t\tif (!folio_test_uptodate(folio)) {\n2629:\t\t\terror = -EIO;\n2630:\t\t\tgoto failed;\n2631:\t\t}\n2632:\t\tfolio_wait_writeback(folio);\n2633:\t\n2634:\t\t/*\n2635:\t\t * Some architectures may have to restore extra metadata to the\n2636:\t\t * folio after reading from swap.\n2637:\t\t */\n2638:\t\tarch_swap_restore(folio_swap(swap, folio), folio);\n2639:\t\n2640:\t\tif (shmem_should_replace_folio(folio, gfp)) {\n2641:\t\t\terror = shmem_replace_folio(\u0026folio, gfp, info, index, vma);\n2642:\t\t\tif (error)\n2643:\t\t\t\tgoto failed;\n2644:\t\t}\n2645:\t\n2646:\t\terror = shmem_add_to_page_cache(folio, mapping, index,\n2647:\t\t\t\t\t\tswp_to_radix_entry(swap), gfp);\n2648:\t\tif (error)\n2649:\t\t\tgoto failed;\n2650:\t\n2651:\t\tshmem_recalc_inode(inode, 0, -nr_pages);\n2652:\t\n2653:\t\tif (sgp == SGP_WRITE)\n2654:\t\t\tfolio_mark_accessed(folio);\n2655:\t\n2656:\t\tfolio_put_swap(folio, NULL);\n2657:\t\tswap_cache_del_folio(folio);\n2658:\t\tfolio_mark_dirty(folio);\n2659:\t\tactual_order = folio_order(folio);\n2660:\t\t*foliop = folio;\n2661:\t\tgoto put_swap;\n2662:\tfailed:\n2663:\t\tif (shmem_confirm_swap(mapping, index, swap) \u003c 0)\n2664:\t\t\terror = -EEXIST;\n2665:\t\tif (error == -EIO)\n2666:\t\t\tshmem_set_folio_swapin_error(inode, index, folio, swap);\n2667:\tunlock:\n2668:\t\tif (folio)\n2669:\t\t\tfolio_unlock(folio);\n2670:\tfailed_nolock:\n2671:\t\tif (folio) {\n2672:\t\t\tactual_order = folio_order(folio);\n2673:\t\t\tfolio_put(folio);\n2674:\t\t}\n2675:\tput_swap:\n2676:\t\tput_swap_device(si);\n2677:\tout:\n2678:\t\ttrace_shmem_swapin_folio(inode, orig_index, swp_type(index_entry),\n2679:\t\t\t\t\t swp_offset(index_entry), order, actual_order,\n2680:\t\t\t\t\t path, fallback, fallback_error, error);\n2681:\t\treturn error;\n2682:\t}\n2683:\t\n2684:\t/*\n"
} |
| 7/2 | 2026/10/27 16:43 | llm | patch-evaluator |
1mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14730 output: 131 thoughts: 9305 Thoughts: **Fuzzing Verdict: WorthFuzzing = False**
Okay, so I've carefully dissected this patch, and I'm quite confident in my assessment. Essentially, this patch is adding tracepoints to the shmem subsystem. The added tracepoints, `trace_shmem_swapin_folio` and `trace_shmem_alloc_folio_finish`, are purely for debugging and monitoring purposes. After reviewing the changes to the `mm/shmem.c` file, the changes are local variables used to pass to the added tracepoints. The changes do NOT modify any core data structures or the control flow of the kernel.
Specifically, in `shmem_swap_alloc_folio`, the introduction of `fallback` and `fallback_error` and the modified `if (order)` logic are functionally identical to the original code and only set variables for use in the tracepoint; the control flow is unchanged. Also the changes made to `shmem_swapin_folio`, the unified exit points are just to ensure the tracepoint fires before returning, with no alterations to the function's core behavior. They're just there to collect and report information. No crashes, regressions, or new bugs are likely to be introduced.
Let's not forget the documentation updates in `Documentation/trace/` and `MAINTAINERS` (no executable code). The primary objective here is monitoring, not functional alteration. This patch strictly adheres to the negative criteria: "tracepoints that do not alter control flow or data structures" and is clearly a "non-kernel and non-executable change". Therefore, given the negative criteria stated, there is no value in fuzzing this patch.
Therefore, the reasoning is as follows:
The patch series only introduces trace events (`shmem_swapin_folio` and `shmem_alloc_folio_finish`) in `include/trace/events/shmem.h` and instruments them in `mm/shmem.c`, alongside trace documentation in `Documentation/trace/`. No kernel data structures or execution control flows are altered; local variables and jump targets are only introduced to gather metadata and emit the tracepoints at function exit/fallback points without changing functional semantics or error handling. According to negative criteria ("tracepoints that do not alter control flow or data structures"), this change does not warrant fuzzing.
|
| 8/2 | 2026/10/27 16:44 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch introduces two new tracepoints (shmem_swapin_folio and shmem_alloc_folio_finish) along with their definitions and documentation in Documentation/trace/. The changes in mm/shmem.c only collect trace arguments and call the tracepoints, consolidating exit points to emit the event before returning without altering functional control flow, error handling, or kernel data structures. Per the negative criteria, tracepoints that do not alter control flow or data structures do not warrant fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch introduces two new tracepoints (shmem_swapin_folio and shmem_alloc_folio_finish) along with their definitions and documentation in Documentation/trace/. The changes in mm/shmem.c only collect trace arguments and call the tracepoints, consolidating exit points to emit the event before returning without altering functional control flow, error handling, or kernel data structures. Per the negative criteria, tracepoints that do not alter control flow or data structures do not warrant fuzzing.",
"WorthFuzzing": false
} |
| 9/1 | 2026/10/27 16:44 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|