AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/09 22:01	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "HUGETLBFS" ], "FocusSymbols": [ "hugepage_subpool_get_pages", "hugepage_subpool_put_pages", "hugetlb_reserve_pages", "alloc_hugetlb_folio", "hugetlbfs_statfs", "hugetlb_unreserve_pages", "hugepage_put_subpool" ], "KMSANReasoning": "The patch modifies the subpool accounting and reservation logic for hugetlbfs (including hugetlb_subpool_get_pages, hugetlb_subpool_put_pages, statfs reporting, and rollback handling in alloc_hugetlb_folio and hugetlb_reserve_pages).\n\nAll local variables introduced or modified (such as gbl_resv_get, gbl_resv_put, gbl_resv_accted, limit, and free_pages) are explicitly initialized before use across all control flow paths. No new structures or buffers are allocated without initialization, no padding bytes are exposed, and no uninitialized kernel memory is passed to user space or used in conditional branching.\n\nPotential risks associated with this patch involve page accounting inaccuracies, concurrency/synchronization under race conditions, or memory exhaustion, which are covered by standard kernel assertions, KASAN, and LOCKDEP. There are no uninitialized memory hazards that would necessitate a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false, "Reasoning": "The patch modifies hugetlbfs subpool accounting logic and reservation error-unwind paths in mm/hugetlb.c and fs/hugetlbfs/inode.c. Specifically, it changes how `used_hpages` and `rsv_hpages` are updated in `hugepage_subpool_get_pages()` and `hugepage_subpool_put_pages()`, alters subpool release checks in `subpool_is_free()`, fixes statfs calculation for unbounded subpools in `hugetlbfs_statfs()`, and refactors global memory reservation rollbacks in `alloc_hugetlb_folio()` and `hugetlb_reserve_pages()`. This logic is fully reachable from userspace via hugetlbfs filesystem mounts, allocations, and mmap operations.", "WorthFuzzing": true }
1/1	2026/09/09 22:01	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 7a37054a7fd996be30e903655617f856efc766d0\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Sep 9 22:01:13 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/Documentation/mm/hugetlbfs_reserv.rst b/Documentation/mm/hugetlbfs_reserv.rst\nindex a49115db18c76..d244583fdcbc3 100644\n--- a/Documentation/mm/hugetlbfs_reserv.rst\n+++ b/Documentation/mm/hugetlbfs_reserv.rst\n@@ -314,21 +314,8 @@ huge pages. If they can not be reserved, the mount fails.\n The routines hugepage_subpool_get/put_pages() are called when pages are\n obtained from or released back to a subpool. They perform all subpool\n accounting, and track any reservations associated with the subpool.\n-hugepage_subpool_get/put_pages are passed the number of huge pages by which\n-to adjust the subpool 'used page' count (down for get, up for put). Normally,\n-they return the same value that was passed or an error if not enough pages\n-exist in the subpool.\n-\n-However, if reserves are associated with the subpool a return value less\n-than the passed value may be returned. This return value indicates the\n-number of additional global pool adjustments which must be made. For example,\n-suppose a subpool contains 3 reserved huge pages and someone asks for 5.\n-The 3 reserved pages associated with the subpool can be used to satisfy part\n-of the request. But, 2 pages must be obtained from the global pools. To\n-relay this information to the caller, the value 2 is returned. The caller\n-is then responsible for attempting to obtain the additional two pages from\n-the global pools.\n-\n+hugepage_subpool_get/put_pages() use the number of huge pages passed to adjust\n+the subpool 'used page' count.\n \n COW and Reservations\n ====================\ndiff --git a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst\nindex 20947f8bd0654..ae1f1f31477fc 100644\n--- a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst\n+++ b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst\n@@ -246,15 +246,8 @@ hugepage_subpool的min_hpages字段中被跟踪。在挂载时，hugetlb_acct_me\n 被调用以预留指定数量的巨页。如果它们不能被预留，挂载就会失败。\n \n 当从子池中获取或释放页面时，会调用hugepage_subpool_get/put_pages()函数。\n-hugepage_subpool_get/put_pages被传递给巨页数量，以此来调整子池的 “已用页面” 计数\n-（get为下降，put为上升）。通常情况下，如果子池中没有足够的页面，它们会返回与传递的相同的值或\n-一个错误。\n-\n-然而，如果预留与子池相关联，可能会返回一个小于传递值的返回值。这个返回值表示必须进行的额外全局\n-池调整的数量。例如，假设一个子池包含3个预留的巨页，有人要求5个。与子池相关的3个预留页可以用来\n-满足部分请求。但是，必须从全局池中获得2个页面。为了向调用者转达这一信息，将返回值2。然后，调用\n-者要负责从全局池中获取另外两个页面。\n-\n+它们负责所有子池的统计核算，并跟踪与子池相关联的预留。\n+hugepage_subpool_get/put_pages()函数使用传入的巨页数量来调整子池的“已用页面”计数。\n \n COW和预留\n ==========\ndiff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c\nindex 7611a8470ea26..5113f743f6fc7 100644\n--- a/fs/hugetlbfs/inode.c\n+++ b/fs/hugetlbfs/inode.c\n@@ -1109,8 +1109,12 @@ static int hugetlbfs_statfs(struct dentry dentry, struct kstatfs buf)\n \n \t\t\tspin_lock_irq(\u0026sbinfo-\u003espool-\u003elock);\n \t\t\tbuf-\u003ef_blocks = sbinfo-\u003espool-\u003emax_hpages;\n-\t\t\tfree_pages = sbinfo-\u003espool-\u003emax_hpages\n-\t\t\t\t- sbinfo-\u003espool-\u003eused_hpages;\n+\t\t\tif (sbinfo-\u003espool-\u003emax_hpages == -1) {\n+\t\t\t\tfree_pages = -1;\n+\t\t\t} else {\n+\t\t\t\tfree_pages = sbinfo-\u003espool-\u003emax_hpages -\n+\t\t\t\t\t sbinfo-\u003espool-\u003eused_hpages;\n+\t\t\t}\n \t\t\tbuf-\u003ef_bavail = buf-\u003ef_bfree = free_pages;\n \t\t\tspin_unlock_irq(\u0026sbinfo-\u003espool-\u003elock);\n \t\t\tbuf-\u003ef_files = sbinfo-\u003emax_inodes;\ndiff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h\nindex 16c4c4caa126c..4551ff3023640 100644\n--- a/include/linux/hugetlb.h\n+++ b/include/linux/hugetlb.h\n@@ -39,8 +39,8 @@ struct hugepage_subpool {\n \tspinlock_t lock;\n \tlong count;\n \tlong max_hpages;\t/* Maximum huge pages or -1 if no maximum. /\n-\tlong used_hpages;\t/ Used count against maximum, includes /\n-\t\t\t\t/ both allocated and reserved pages. /\n+\tlong used_hpages;\t/ Used page count, includes both /\n+\t\t\t\t/ allocated and reserved pages. /\n \tstruct hstate hstate;\n \tlong min_hpages;\t/* Minimum huge pages or -1 if no minimum. /\n \tlong rsv_hpages;\t/ Pages reserved against global pool to /\ndiff --git a/mm/hugetlb.c b/mm/hugetlb.c\nindex 4f6f58bf3db6c..1151ad959ffd5 100644\n--- a/mm/hugetlb.c\n+++ b/mm/hugetlb.c\n@@ -130,12 +130,8 @@ static inline bool subpool_is_free(struct hugepage_subpool spool)\n {\n \tif (spool-\u003ecount)\n \t\treturn false;\n-\tif (spool-\u003emax_hpages != -1)\n-\t\treturn spool-\u003eused_hpages == 0;\n-\tif (spool-\u003emin_hpages != -1)\n-\t\treturn spool-\u003ersv_hpages == spool-\u003emin_hpages;\n \n-\treturn true;\n+\treturn spool-\u003eused_hpages == 0;\n }\n \n static inline void unlock_or_release_subpool(struct hugepage_subpool spool,\n@@ -193,13 +189,18 @@ void hugepage_put_subpool(struct hugepage_subpool spool)\n \tunlock_or_release_subpool(spool, flags);\n }\n \n-/\n- Subpool accounting for allocating and reserving pages.\n- * Return -ENOMEM if there are not enough resources to satisfy the\n- * request. Otherwise, return the number of pages by which the\n- * global pools must be adjusted (upward). The returned value may\n- * only be different than the passed value (delta) in the case where\n- * a subpool minimum size must be maintained.\n+/*\n+ hugepage_subpool_get_pages - Get pages from a subpool\n+ * @spool: pointer to subpool structure (may be NULL)\n+ * @delta: number of pages to allocate or reserve\n+ \n+ Check and update subpool page usage counts when allocating or\n+ * reserving @delta hugepages.\n+ \n+ Context: Takes spool-\u003elock using spin_lock_irq().\n+ * Return: Non-negative number of reservations that cannot be\n+ * satisfied by the subpool, or -ENOMEM if the subpool maximum\n+ * limit would be exceeded.\n /\n static long hugepage_subpool_get_pages(struct hugepage_subpool spool,\n \t\t\t\t long delta)\n@@ -211,15 +212,14 @@ static long hugepage_subpool_get_pages(struct hugepage_subpool spool,\n \n \tspin_lock_irq(\u0026spool-\u003elock);\n \n-\tif (spool-\u003emax_hpages != -1) {\t\t/ maximum size accounting /\n-\t\tif ((spool-\u003eused_hpages + delta) \u003c= spool-\u003emax_hpages)\n-\t\t\tspool-\u003eused_hpages += delta;\n-\t\telse {\n-\t\t\tret = -ENOMEM;\n-\t\t\tgoto unlock_ret;\n-\t\t}\n+\tif (spool-\u003emax_hpages != -1 \u0026\u0026\n+\t spool-\u003eused_hpages + delta \u003e spool-\u003emax_hpages) {\n+\t\tret = -ENOMEM;\n+\t\tgoto unlock_ret;\n \t}\n \n+\tspool-\u003eused_hpages += delta;\n+\n \t/ minimum size accounting /\n \tif (spool-\u003emin_hpages != -1 \u0026\u0026 spool-\u003ersv_hpages) {\n \t\tif (delta \u003e spool-\u003ersv_hpages) {\n@@ -240,11 +240,19 @@ static long hugepage_subpool_get_pages(struct hugepage_subpool spool,\n \treturn ret;\n }\n \n-/\n- Subpool accounting for freeing and unreserving pages.\n- * Return the number of global page reservations that must be dropped.\n- * The return value may only be different than the passed value (delta)\n- * in the case where a subpool minimum size must be maintained.\n+/*\n+ hugepage_subpool_put_pages - Release pages back to a subpool\n+ * @spool: pointer to subpool structure (may be NULL)\n+ * @delta: number of pages to free or unreserve\n+ \n+ Check and update subpool page usage counts when freeing or\n+ * unreserving @delta hugepages.\n+ \n+ Context: Takes spool-\u003elock using spin_lock_irqsave(). May release\n+ * and free @spool if its usage count and references reach\n+ * zero.\n+ * Return: Non-negative number of reservations that the subpool cannot\n+ * absorb.\n /\n static long hugepage_subpool_put_pages(struct hugepage_subpool spool,\n \t\t\t\t long delta)\n@@ -257,19 +265,24 @@ static long hugepage_subpool_put_pages(struct hugepage_subpool spool,\n \n \tspin_lock_irqsave(\u0026spool-\u003elock, flags);\n \n-\tif (spool-\u003emax_hpages != -1)\t\t/ maximum size accounting /\n-\t\tspool-\u003eused_hpages -= delta;\n+\tspool-\u003eused_hpages -= delta;\n \n \t / minimum size accounting /\n \tif (spool-\u003emin_hpages != -1 \u0026\u0026 spool-\u003eused_hpages \u003c spool-\u003emin_hpages) {\n-\t\tif (spool-\u003ersv_hpages + delta \u003c= spool-\u003emin_hpages)\n+\t\t/\n+\t\t * limit is the maximum number of reservations that\n+\t\t * can be restored to this subpool.\n+\t\t /\n+\t\tlong limit = spool-\u003emin_hpages - spool-\u003eused_hpages;\n+\n+\t\tif (spool-\u003ersv_hpages + delta \u003c= limit)\n \t\t\tret = 0;\n \t\telse\n-\t\t\tret = spool-\u003ersv_hpages + delta - spool-\u003emin_hpages;\n+\t\t\tret = spool-\u003ersv_hpages + delta - limit;\n \n \t\tspool-\u003ersv_hpages += delta;\n-\t\tif (spool-\u003ersv_hpages \u003e spool-\u003emin_hpages)\n-\t\t\tspool-\u003ersv_hpages = spool-\u003emin_hpages;\n+\t\tif (spool-\u003ersv_hpages \u003e limit)\n+\t\t\tspool-\u003ersv_hpages = limit;\n \t}\n \n \t/\n@@ -2944,7 +2957,7 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n \tstruct hugepage_subpool spool = subpool_vma(vma);\n \tstruct hstate h = hstate_vma(vma);\n \tstruct folio folio;\n-\tlong retval, gbl_chg, gbl_reserve;\n+\tlong retval, gbl_resv_get;\n \tmap_chg_state map_chg;\n \tstruct mempolicy_interpreted mpoli;\n \tgfp_t gfp = htlb_alloc_mask(h);\n@@ -2983,8 +2996,8 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n \t Or if it can get one from the pool reservation directly.\n \t /\n \tif (map_chg) {\n-\t\tgbl_chg = hugepage_subpool_get_pages(spool, 1);\n-\t\tif (gbl_chg \u003c 0) {\n+\t\tgbl_resv_get = hugepage_subpool_get_pages(spool, 1);\n+\t\tif (gbl_resv_get \u003c 0) {\n \t\t\tret = -ENOSPC;\n \t\t\tgoto out_end_reservation;\n \t\t}\n@@ -2993,7 +3006,7 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n \t\t If we have the vma reservation ready, no need for extra\n \t\t * global reservation.\n \t\t /\n-\t\tgbl_chg = 0;\n+\t\tgbl_resv_get = 0;\n \t}\n \n \t/\n@@ -3004,10 +3017,10 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n \t\talloc_flags \|= HUGETLB_ALLOC_CHARG_CGROUP_RSVD;\n \n \t/\n-\t gbl_chg == 0 indicates a reservation exists for this\n+\t * gbl_resv_get == 0 indicates a reservation exists for this\n \t * allocation, so try to use it.\n \t /\n-\tif (gbl_chg == 0)\n+\tif (gbl_resv_get == 0)\n \t\talloc_flags \|= HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS;\n \n \t/ Takes reference on mpol. /\n@@ -3061,13 +3074,10 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n \treturn folio;\n \n out_subpool_put:\n-\t/\n-\t * put page to subpool iff the quota of subpool's rsv_hpages is used\n-\t * during hugepage_subpool_get_pages.\n-\t /\n-\tif (map_chg \u0026\u0026 !gbl_chg) {\n-\t\tgbl_reserve = hugepage_subpool_put_pages(spool, 1);\n-\t\thugetlb_acct_memory(h, -gbl_reserve);\n+\tif (map_chg) {\n+\t\tlong gbl_resv_put = hugepage_subpool_put_pages(spool, 1);\n+\n+\t\thugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put);\n \t}\n \n out_end_reservation:\n@@ -6663,12 +6673,15 @@ long hugetlb_reserve_pages(struct inode inode,\n \t\tstruct vm_area_struct vma,\n \t\tvma_flags_t vma_flags)\n {\n-\tlong chg = -1, add = -1, spool_resv, gbl_resv;\n+\tlong chg = -1, add = -1;\n \tstruct hstate h = hstate_inode(inode);\n \tstruct hugepage_subpool spool = subpool_inode(inode);\n \tstruct resv_map resv_map;\n \tstruct hugetlb_cgroup h_cg = NULL;\n-\tlong gbl_reserve, regions_needed = 0;\n+\tlong gbl_resv_accted = 0;\n+\tlong regions_needed = 0;\n+\tlong gbl_resv_get;\n+\tlong gbl_resv_put;\n \tint err;\n \n \t/ This should never happen /\n@@ -6743,9 +6756,9 @@ long hugetlb_reserve_pages(struct inode inode,\n \t * the subpool has a minimum size, there may be some global\n \t * reservations already in place (gbl_reserve).\n \t /\n-\tgbl_reserve = hugepage_subpool_get_pages(spool, chg);\n-\tif (gbl_reserve \u003c 0) {\n-\t\terr = gbl_reserve;\n+\tgbl_resv_get = hugepage_subpool_get_pages(spool, chg);\n+\tif (gbl_resv_get \u003c 0) {\n+\t\terr = gbl_resv_get;\n \t\tgoto out_uncharge_cgroup;\n \t}\n \n@@ -6753,9 +6766,10 @@ long hugetlb_reserve_pages(struct inode inode,\n \t * Check enough hugepages are available for the reservation.\n \t * Hand the pages back to the subpool if there are not\n \t /\n-\terr = hugetlb_acct_memory(h, gbl_reserve);\n+\terr = hugetlb_acct_memory(h, gbl_resv_get);\n \tif (err \u003c 0)\n \t\tgoto out_put_pages;\n+\tgbl_resv_accted = gbl_resv_get;\n \n \t/\n \t * Account for the reservations made. Shared mappings record regions\n@@ -6772,7 +6786,6 @@ long hugetlb_reserve_pages(struct inode inode,\n \t\tadd = region_add(resv_map, from, to, regions_needed, h, h_cg);\n \n \t\tif (unlikely(add \u003c 0)) {\n-\t\t\thugetlb_acct_memory(h, -gbl_reserve);\n \t\t\terr = add;\n \t\t\tgoto out_put_pages;\n \t\t} else if (unlikely(chg \u003e add)) {\n@@ -6808,26 +6821,22 @@ long hugetlb_reserve_pages(struct inode inode,\n \t}\n \treturn chg;\n \n-out_put_pages:\n-\tspool_resv = chg - gbl_reserve;\n-\tif (spool_resv) {\n-\t\t/* put sub pool's reservation back, chg - gbl_reserve /\n-\t\tgbl_resv = hugepage_subpool_put_pages(spool, spool_resv);\n-\t\t/\n-\t\t * subpool's reserved pages can not be put back due to race,\n-\t\t * return to hstate.\n-\t\t /\n-\t\thugetlb_acct_memory(h, -gbl_resv);\n-\t}\n-\t/ Restore used_hpages for pages that failed global reservation /\n-\tif (gbl_reserve \u0026\u0026 spool) {\n-\t\tunsigned long flags;\n+ out_put_pages:\n+\t/\n+\t * Return all that was requested from the subpool, let subpool\n+\t * tell us the new number of reservations that need to be\n+\t * returned to the global pool.\n+\t /\n+\tgbl_resv_put = hugepage_subpool_put_pages(spool, chg);\n+\t/\n+\t * There may be a difference between the number of\n+\t * reservations to consume and the number to restore now if\n+\t * there are multiple threads interacting with the subpool -\n+\t * restore the difference, taking into account any global\n+\t * reservations already acquired.\n+\t /\n+\thugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put - gbl_resv_accted);\n \n-\t\tspin_lock_irqsave(\u0026spool-\u003elock, flags);\n-\t\tif (spool-\u003emax_hpages != -1)\n-\t\t\tspool-\u003eused_hpages -= gbl_reserve;\n-\t\tunlock_or_release_subpool(spool, flags);\n-\t}\n out_uncharge_cgroup:\n \thugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h),\n \t\t\t\t\t chg pages_per_huge_page(h), h_cg);\n" }
2/1	2026/09/09 22:01	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": [ "HUGETLBFS" ], "FocusSymbols": [ "hugepage_subpool_get_pages", "hugepage_subpool_put_pages", "hugetlb_reserve_pages", "alloc_hugetlb_folio", "hugetlbfs_statfs", "hugetlb_unreserve_pages", "hugepage_put_subpool" ], "Reasoning": "The patch modifies hugetlbfs subpool accounting logic and reservation error-unwind paths in mm/hugetlb.c and fs/hugetlbfs/inode.c. Specifically, it changes how `used_hpages` and `rsv_hpages` are updated in `hugepage_subpool_get_pages()` and `hugepage_subpool_put_pages()`, alters subpool release checks in `subpool_is_free()`, fixes statfs calculation for unbounded subpools in `hugetlbfs_statfs()`, and refactors global memory reservation rollbacks in `alloc_hugetlb_folio()` and `hugetlb_reserve_pages()`. This logic is fully reachable from userspace via hugetlbfs filesystem mounts, allocations, and mmap operations.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 7a37054a7fd996be30e903655617f856efc766d0 Author: syz-cluster <triage@syzkaller.com> Date: Wed Sep 9 22:01:13 2026 +0000 syz-cluster: applied patch under review diff --git a/Documentation/mm/hugetlbfs_reserv.rst b/Documentation/mm/hugetlbfs_reserv.rst index a49115db18c76..d244583fdcbc3 100644 --- a/Documentation/mm/hugetlbfs_reserv.rst +++ b/Documentation/mm/hugetlbfs_reserv.rst @@ -314,21 +314,8 @@ huge pages. If they can not be reserved, the mount fails. The routines hugepage_subpool_get/put_pages() are called when pages are obtained from or released back to a subpool. They perform all subpool accounting, and track any reservations associated with the subpool. -hugepage_subpool_get/put_pages are passed the number of huge pages by which -to adjust the subpool 'used page' count (down for get, up for put). Normally, -they return the same value that was passed or an error if not enough pages -exist in the subpool. - -However, if reserves are associated with the subpool a return value less -than the passed value may be returned. This return value indicates the -number of additional global pool adjustments which must be made. For example, -suppose a subpool contains 3 reserved huge pages and someone asks for 5. -The 3 reserved pages associated with the subpool can be used to satisfy part -of the request. But, 2 pages must be obtained from the global pools. To -relay this information to the caller, the value 2 is returned. The caller -is then responsible for attempting to obtain the additional two pages from -the global pools. - +hugepage_subpool_get/put_pages() use the number of huge pages passed to adjust +the subpool 'used page' count. COW and Reservations ==================== diff --git a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst index 20947f8bd0654..ae1f1f31477fc 100644 --- a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst +++ b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst @@ -246,15 +246,8 @@ hugepage_subpool的min_hpages字段中被跟踪。在挂载时，hugetlb_acct_me 被调用以预留指定数量的巨页。如果它们不能被预留，挂载就会失败。当从子池中获取或释放页面时，会调用hugepage_subpool_get/put_pages()函数。 -hugepage_subpool_get/put_pages被传递给巨页数量，以此来调整子池的 “已用页面” 计数 -（get为下降，put为上升）。通常情况下，如果子池中没有足够的页面，它们会返回与传递的相同的值或 -一个错误。 - -然而，如果预留与子池相关联，可能会返回一个小于传递值的返回值。这个返回值表示必须进行的额外全局 -池调整的数量。例如，假设一个子池包含3个预留的巨页，有人要求5个。与子池相关的3个预留页可以用来 -满足部分请求。但是，必须从全局池中获得2个页面。为了向调用者转达这一信息，将返回值2。然后，调用 -者要负责从全局池中获取另外两个页面。 - +它们负责所有子池的统计核算，并跟踪与子池相关联的预留。 +hugepage_subpool_get/put_pages()函数使用传入的巨页数量来调整子池的“已用页面”计数。 COW和预留 ========== diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 7611a8470ea26..5113f743f6fc7 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1109,8 +1109,12 @@ static int hugetlbfs_statfs(struct dentry dentry, struct kstatfs buf) spin_lock_irq(&sbinfo->spool->lock); buf->f_blocks = sbinfo->spool->max_hpages; - free_pages = sbinfo->spool->max_hpages - - sbinfo->spool->used_hpages; + if (sbinfo->spool->max_hpages == -1) { + free_pages = -1; + } else { + free_pages = sbinfo->spool->max_hpages - + sbinfo->spool->used_hpages; + } buf->f_bavail = buf->f_bfree = free_pages; spin_unlock_irq(&sbinfo->spool->lock); buf->f_files = sbinfo->max_inodes; diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 16c4c4caa126c..4551ff3023640 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -39,8 +39,8 @@ struct hugepage_subpool { spinlock_t lock; long count; long max_hpages; /* Maximum huge pages or -1 if no maximum. / - long used_hpages; / Used count against maximum, includes / - / both allocated and reserved pages. / + long used_hpages; / Used page count, includes both / + / allocated and reserved pages. / struct hstate hstate; long min_hpages; /* Minimum huge pages or -1 if no minimum. / long rsv_hpages; / Pages reserved against global pool to / diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4f6f58bf3db6c..1151ad959ffd5 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -130,12 +130,8 @@ static inline bool subpool_is_free(struct hugepage_subpool spool) { if (spool->count) return false; - if (spool->max_hpages != -1) - return spool->used_hpages == 0; - if (spool->min_hpages != -1) - return spool->rsv_hpages == spool->min_hpages; - return true; + return spool->used_hpages == 0; } static inline void unlock_or_release_subpool(struct hugepage_subpool spool, @@ -193,13 +189,18 @@ void hugepage_put_subpool(struct hugepage_subpool spool) unlock_or_release_subpool(spool, flags); } -/* - * Subpool accounting for allocating and reserving pages. - * Return -ENOMEM if there are not enough resources to satisfy the - * request. Otherwise, return the number of pages by which the - * global pools must be adjusted (upward). The returned value may - * only be different than the passed value (delta) in the case where - * a subpool minimum size must be maintained. +/** + * hugepage_subpool_get_pages - Get pages from a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to allocate or reserve + * + * Check and update subpool page usage counts when allocating or + * reserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irq(). + * Return: Non-negative number of reservations that cannot be + * satisfied by the subpool, or -ENOMEM if the subpool maximum + * limit would be exceeded. / static long hugepage_subpool_get_pages(struct hugepage_subpool spool, long delta) @@ -211,15 +212,14 @@ static long hugepage_subpool_get_pages(struct hugepage_subpool spool, spin_lock_irq(&spool->lock); - if (spool->max_hpages != -1) { / maximum size accounting / - if ((spool->used_hpages + delta) <= spool->max_hpages) - spool->used_hpages += delta; - else { - ret = -ENOMEM; - goto unlock_ret; - } + if (spool->max_hpages != -1 && + spool->used_hpages + delta > spool->max_hpages) { + ret = -ENOMEM; + goto unlock_ret; } + spool->used_hpages += delta; + / minimum size accounting / if (spool->min_hpages != -1 && spool->rsv_hpages) { if (delta > spool->rsv_hpages) { @@ -240,11 +240,19 @@ static long hugepage_subpool_get_pages(struct hugepage_subpool spool, return ret; } -/* - * Subpool accounting for freeing and unreserving pages. - * Return the number of global page reservations that must be dropped. - * The return value may only be different than the passed value (delta) - * in the case where a subpool minimum size must be maintained. +/** + * hugepage_subpool_put_pages - Release pages back to a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to free or unreserve + * + * Check and update subpool page usage counts when freeing or + * unreserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irqsave(). May release + * and free @spool if its usage count and references reach + * zero. + * Return: Non-negative number of reservations that the subpool cannot + * absorb. / static long hugepage_subpool_put_pages(struct hugepage_subpool spool, long delta) @@ -257,19 +265,24 @@ static long hugepage_subpool_put_pages(struct hugepage_subpool spool, spin_lock_irqsave(&spool->lock, flags); - if (spool->max_hpages != -1) / maximum size accounting / - spool->used_hpages -= delta; + spool->used_hpages -= delta; / minimum size accounting / if (spool->min_hpages != -1 && spool->used_hpages < spool->min_hpages) { - if (spool->rsv_hpages + delta <= spool->min_hpages) + / + * limit is the maximum number of reservations that + * can be restored to this subpool. + / + long limit = spool->min_hpages - spool->used_hpages; + + if (spool->rsv_hpages + delta <= limit) ret = 0; else - ret = spool->rsv_hpages + delta - spool->min_hpages; + ret = spool->rsv_hpages + delta - limit; spool->rsv_hpages += delta; - if (spool->rsv_hpages > spool->min_hpages) - spool->rsv_hpages = spool->min_hpages; + if (spool->rsv_hpages > limit) + spool->rsv_hpages = limit; } / @@ -2944,7 +2957,7 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, struct hugepage_subpool spool = subpool_vma(vma); struct hstate h = hstate_vma(vma); struct folio folio; - long retval, gbl_chg, gbl_reserve; + long retval, gbl_resv_get; map_chg_state map_chg; struct mempolicy_interpreted mpoli; gfp_t gfp = htlb_alloc_mask(h); @@ -2983,8 +2996,8 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, Or if it can get one from the pool reservation directly. / if (map_chg) { - gbl_chg = hugepage_subpool_get_pages(spool, 1); - if (gbl_chg < 0) { + gbl_resv_get = hugepage_subpool_get_pages(spool, 1); + if (gbl_resv_get < 0) { ret = -ENOSPC; goto out_end_reservation; } @@ -2993,7 +3006,7 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, If we have the vma reservation ready, no need for extra * global reservation. / - gbl_chg = 0; + gbl_resv_get = 0; } / @@ -3004,10 +3017,10 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, alloc_flags \|= HUGETLB_ALLOC_CHARG_CGROUP_RSVD; /* - * gbl_chg == 0 indicates a reservation exists for this + * gbl_resv_get == 0 indicates a reservation exists for this * allocation, so try to use it. / - if (gbl_chg == 0) + if (gbl_resv_get == 0) alloc_flags \|= HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS; / Takes reference on mpol. / @@ -3061,13 +3074,10 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, return folio; out_subpool_put: - / - * put page to subpool iff the quota of subpool's rsv_hpages is used - * during hugepage_subpool_get_pages. - / - if (map_chg && !gbl_chg) { - gbl_reserve = hugepage_subpool_put_pages(spool, 1); - hugetlb_acct_memory(h, -gbl_reserve); + if (map_chg) { + long gbl_resv_put = hugepage_subpool_put_pages(spool, 1); + + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); } out_end_reservation: @@ -6663,12 +6673,15 @@ long hugetlb_reserve_pages(struct inode inode, struct vm_area_struct vma, vma_flags_t vma_flags) { - long chg = -1, add = -1, spool_resv, gbl_resv; + long chg = -1, add = -1; struct hstate h = hstate_inode(inode); struct hugepage_subpool spool = subpool_inode(inode); struct resv_map resv_map; struct hugetlb_cgroup h_cg = NULL; - long gbl_reserve, regions_needed = 0; + long gbl_resv_accted = 0; + long regions_needed = 0; + long gbl_resv_get; + long gbl_resv_put; int err; / This should never happen / @@ -6743,9 +6756,9 @@ long hugetlb_reserve_pages(struct inode inode, * the subpool has a minimum size, there may be some global * reservations already in place (gbl_reserve). / - gbl_reserve = hugepage_subpool_get_pages(spool, chg); - if (gbl_reserve < 0) { - err = gbl_reserve; + gbl_resv_get = hugepage_subpool_get_pages(spool, chg); + if (gbl_resv_get < 0) { + err = gbl_resv_get; goto out_uncharge_cgroup; } @@ -6753,9 +6766,10 @@ long hugetlb_reserve_pages(struct inode inode, * Check enough hugepages are available for the reservation. * Hand the pages back to the subpool if there are not / - err = hugetlb_acct_memory(h, gbl_reserve); + err = hugetlb_acct_memory(h, gbl_resv_get); if (err < 0) goto out_put_pages; + gbl_resv_accted = gbl_resv_get; / * Account for the reservations made. Shared mappings record regions @@ -6772,7 +6786,6 @@ long hugetlb_reserve_pages(struct inode inode, add = region_add(resv_map, from, to, regions_needed, h, h_cg); if (unlikely(add < 0)) { - hugetlb_acct_memory(h, -gbl_reserve); err = add; goto out_put_pages; } else if (unlikely(chg > add)) { @@ -6808,26 +6821,22 @@ long hugetlb_reserve_pages(struct inode inode, } return chg; -out_put_pages: - spool_resv = chg - gbl_reserve; - if (spool_resv) { - /* put sub pool's reservation back, chg - gbl_reserve / - gbl_resv = hugepage_subpool_put_pages(spool, spool_resv); - / - * subpool's reserved pages can not be put back due to race, - * return to hstate. - / - hugetlb_acct_memory(h, -gbl_resv); - } - / Restore used_hpages for pages that failed global reservation / - if (gbl_reserve && spool) { - unsigned long flags; + out_put_pages: + / + * Return all that was requested from the subpool, let subpool + * tell us the new number of reservations that need to be + * returned to the global pool. + / + gbl_resv_put = hugepage_subpool_put_pages(spool, chg); + / + * There may be a difference between the number of + * reservations to consume and the number to restore now if + * there are multiple threads interacting with the subpool - + * restore the difference, taking into account any global + * reservations already acquired. + / + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put - gbl_resv_accted); - spin_lock_irqsave(&spool->lock, flags); - if (spool->max_hpages != -1) - spool->used_hpages -= gbl_reserve; - unlock_or_release_subpool(spool, flags); - } out_uncharge_cgroup: hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h), chg pages_per_huge_page(h), h_cg);
3/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 7857 output: 30 thoughts: 529 Thoughts: Analyzing this Hugetlbfs Patch Series Okay, let's break down this patch series. First, the file changes. I see: `Documentation/mm/hugetlbfs_reserv.rst`, the Chinese translation, `fs/hugetlbfs/inode.c`, `include/linux/hugetlb.h`, and `mm/hugetlb.c`. Alright, so we're looking at changes across documentation, the filesystem implementation, and the core hugetlb memory management. Now for the meat of it. In `fs/hugetlbfs/inode.c`, the `hugetlbfs_statfs` function has a bugfix. It correctly handles the case where `max_hpages` is -1 (meaning unlimited pages) in `sbinfo->spool`. Instead of subtracting from -1, which would lead to arithmetic nonsense, it sets the `free_pages` to -1. Good catch. The core of the work, though, is in the header and mm files. It looks like a refactoring and fix for subpool accounting within hugetlbfs. They've touched `subpool_is_free`, `hugepage_subpool_get_pages`, `hugepage_subpool_put_pages`, `alloc_hugetlb_folio`, and `hugetlb_reserve_pages`. Specifically: * `subpool_is_free` now just checks if `used_hpages` is zero (seems more straightforward). * `hugepage_subpool_get_pages` increments `used_hpages` unconditionally, which is crucial for accurate tracking. * `hugepage_subpool_put_pages` decrements `used_hpages` unconditionally too, and now includes a calculation for the `limit` using both `min_hpages` and `used_hpages`, making it all more precise. * `alloc_hugetlb_folio` has an improvement; It now properly handles reservation accounting on failure using a difference calculation, which indicates a more robust error handling approach. * `hugetlb_reserve_pages` cleans up the error paths involving subpools, leading to more resilient code. Is this reachable code? Absolutely. The files `mm/hugetlb.c` and `fs/hugetlbfs/` are integral to the memory management and filesystem subsystems. I'd expect this code to be hit frequently when using hugetlbfs through mmap, syscalls, or fallocate within a standard QEMU environment. Alright, now I need to check the Kconfig options required for hugetlbfs and hugetlb. I'll get the grepper ready.
4/2	2026/09/09 22:01	tool	grepper	0m Error: no matches Args: { "Expression": "config HUGETLB", "PathPrefix": "fs/hugetlbfs" } Results: { "error": "no matches" }
5/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 9007 output: 26 thoughts: 14 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Hunting Down the hugetlbfs Kconfig Alright, let's get down to brass tacks. I need to nail down the Kconfig file responsible for configuring hugetlbfs. This isn't usually a wild goose chase, but depending on the project structure, it can be slightly less obvious than one might hope. My initial thought process usually follows a few quick paths. I’ll start by thinking about common locations – the `fs/`, `mm/`, or maybe even the root of the kernel source tree if it's a particularly core feature, though that's less likely these days with the modularization efforts. I'll be mentally running through my mental map of the kernel directory structure. My next move will be to think about other similar features. What are the patterns? Is it using a standard `Kconfig` include, or is it a more bespoke setup? I'll probably be quickly scanning my memory for related filesystem options or memory management options that I configured recently, and cross-referencing. Once I've got a likely suspect location or two, I'll dive in, using `grep` or `find` as a quick test, if I can't remember precisely. I'll search for the relevant config symbol, like "HUGETLBFS" or maybe even a related dependency, just to make sure I'm zeroing in on the right file. I'll expect to recognize the standard `config` directive and associated help text. From there, I can refine my search or move on to the next likely location until I land on the file, or files, that I need.
6/2	2026/09/09 22:01	tool	grepper	0m Args: { "Expression": "hugetlbfs", "PathPrefix": "fs/" } Results: { "Output": "fs/Kconfig=250=menuconfig HUGETLBFS\n--\nfs/Kconfig-255-\thelp\nfs/Kconfig:256:\t hugetlbfs is a filesystem backing for HugeTLB pages, based on\nfs/Kconfig-257-\t ramfs. For architectures that support it, say Y here and read\n--\nfs/Makefile=73=obj-y\t\t\t\t+= ramfs/\nfs/Makefile:74:obj-$(CONFIG_HUGETLBFS)\t\t+= hugetlbfs/\nfs/Makefile-75-obj-$(CONFIG_CODA_FS)\t\t+= coda/\n--\nfs/hugetlbfs/Makefile-5-\nfs/hugetlbfs/Makefile:6:obj-$(CONFIG_HUGETLBFS) += hugetlbfs.o\nfs/hugetlbfs/Makefile-7-\nfs/hugetlbfs/Makefile:8:hugetlbfs-objs := inode.o\n--\nfs/hugetlbfs/inode.c-42-#define CREATE_TRACE_POINTS\nfs/hugetlbfs/inode.c:43:#include \u003ctrace/events/hugetlbfs.h\u003e\nfs/hugetlbfs/inode.c-44-\nfs/hugetlbfs/inode.c:45:static const struct address_space_operations hugetlbfs_aops;\nfs/hugetlbfs/inode.c:46:static const struct file_operations hugetlbfs_file_operations;\nfs/hugetlbfs/inode.c:47:static const struct inode_operations hugetlbfs_dir_inode_operations;\nfs/hugetlbfs/inode.c:48:static const struct inode_operations hugetlbfs_inode_operations;\nfs/hugetlbfs/inode.c-49-\nfs/hugetlbfs/inode.c:50:enum hugetlbfs_size_type { NO_SIZE, SIZE_STD, SIZE_PERCENT };\nfs/hugetlbfs/inode.c-51-\nfs/hugetlbfs/inode.c:52:struct hugetlbfs_fs_context {\nfs/hugetlbfs/inode.c-53-\tstruct hstate\t\thstate;\n--\nfs/hugetlbfs/inode.c-58-\tlong\t\t\tmin_hpages;\nfs/hugetlbfs/inode.c:59:\tenum hugetlbfs_size_type max_val_type;\nfs/hugetlbfs/inode.c:60:\tenum hugetlbfs_size_type min_val_type;\nfs/hugetlbfs/inode.c-61-\tkuid_t\t\t\tuid;\n--\nfs/hugetlbfs/inode.c=78=static const struct fs_parameter_spec hugetlb_fs_parameters[] = {\n--\nfs/hugetlbfs/inode.c-98-\nfs/hugetlbfs/inode.c:99:static int hugetlbfs_file_mmap(struct file file, struct vm_area_struct vma)\nfs/hugetlbfs/inode.c-100-{\n--\nfs/hugetlbfs/inode.c-146-\t for SHM_HUGETLB, the pages are reserved in the shmget() call so skip\nfs/hugetlbfs/inode.c:147:\t * reserving here. Note: only for SHM hugetlbfs file, the inode\nfs/hugetlbfs/inode.c-148-\t * flag S_PRIVATE is set.\n--\nfs/hugetlbfs/inode.c=196=static size_t adjust_range_hwpoison(struct folio folio, size_t offset,\n--\nfs/hugetlbfs/inode.c-219- /\nfs/hugetlbfs/inode.c:220:static ssize_t hugetlbfs_read_iter(struct kiocb iocb, struct iov_iter to)\nfs/hugetlbfs/inode.c-221-{\n--\nfs/hugetlbfs/inode.c-297-\nfs/hugetlbfs/inode.c:298:static int hugetlbfs_write_begin(const struct kiocb iocb,\nfs/hugetlbfs/inode.c-299-\t\t\tstruct address_space mapping,\n--\nfs/hugetlbfs/inode.c-305-\nfs/hugetlbfs/inode.c:306:static int hugetlbfs_write_end(const struct kiocb iocb,\nfs/hugetlbfs/inode.c-307-\t\t\t struct address_space mapping,\n--\nfs/hugetlbfs/inode.c=552=static void remove_inode_hugepages(struct inode inode, loff_t lstart,\n--\nfs/hugetlbfs/inode.c-592-\nfs/hugetlbfs/inode.c:593:static void hugetlbfs_evict_inode(struct inode inode)\nfs/hugetlbfs/inode.c-594-{\n--\nfs/hugetlbfs/inode.c-596-\nfs/hugetlbfs/inode.c:597:\ttrace_hugetlbfs_evict_inode(inode);\nfs/hugetlbfs/inode.c-598-\tremove_inode_hugepages(inode, 0, LLONG_MAX);\n--\nfs/hugetlbfs/inode.c=607=static void hugetlb_vmtruncate(struct inode inode, loff_t offset)\n--\nfs/hugetlbfs/inode.c-623-\nfs/hugetlbfs/inode.c:624:static void hugetlbfs_zero_partial_page(struct hstate h,\nfs/hugetlbfs/inode.c-625-\t\t\t\t\tstruct address_space mapping,\n--\nfs/hugetlbfs/inode.c-646-\nfs/hugetlbfs/inode.c:647:static long hugetlbfs_punch_hole(struct inode inode, loff_t offset, loff_t len)\nfs/hugetlbfs/inode.c-648-{\nfs/hugetlbfs/inode.c:649:\tstruct hugetlbfs_inode_info info = HUGETLBFS_I(inode);\nfs/hugetlbfs/inode.c-650-\tstruct address_space mapping = inode-\u003ei_mapping;\n--\nfs/hugetlbfs/inode.c-672-\tif (offset \u003c hole_start)\nfs/hugetlbfs/inode.c:673:\t\thugetlbfs_zero_partial_page(h, mapping,\nfs/hugetlbfs/inode.c-674-\t\t\t\toffset, min(offset + len, hole_start));\n--\nfs/hugetlbfs/inode.c-685-\tif ((offset + len) \u003e hole_end \u0026\u0026 (offset + len) \u003e hole_start)\nfs/hugetlbfs/inode.c:686:\t\thugetlbfs_zero_partial_page(h, mapping,\nfs/hugetlbfs/inode.c-687-\t\t\t\thole_end, offset + len);\n--\nfs/hugetlbfs/inode.c-699-\nfs/hugetlbfs/inode.c:700:static long hugetlbfs_fallocate(struct file file, int mode, loff_t offset,\nfs/hugetlbfs/inode.c-701-\t\t\t\tloff_t len)\n--\nfs/hugetlbfs/inode.c-703-\tstruct inode inode = file_inode(file);\nfs/hugetlbfs/inode.c:704:\tstruct hugetlbfs_inode_info info = HUGETLBFS_I(inode);\nfs/hugetlbfs/inode.c-705-\tstruct address_space mapping = inode-\u003ei_mapping;\n--\nfs/hugetlbfs/inode.c-718-\tif (mode \u0026 FALLOC_FL_PUNCH_HOLE) {\nfs/hugetlbfs/inode.c:719:\t\terror = hugetlbfs_punch_hole(inode, offset, len);\nfs/hugetlbfs/inode.c-720-\t\tgoto out_nolock;\n--\nfs/hugetlbfs/inode.c-826-out_nolock:\nfs/hugetlbfs/inode.c:827:\ttrace_hugetlbfs_fallocate(inode, mode, offset, len, error);\nfs/hugetlbfs/inode.c-828-\treturn error;\n--\nfs/hugetlbfs/inode.c-830-\nfs/hugetlbfs/inode.c:831:static int hugetlbfs_setattr(struct mnt_idmap idmap,\nfs/hugetlbfs/inode.c-832-\t\t\t struct dentry dentry, struct iattr attr)\n--\nfs/hugetlbfs/inode.c-837-\tunsigned int ia_valid = attr-\u003eia_valid;\nfs/hugetlbfs/inode.c:838:\tstruct hugetlbfs_inode_info info = HUGETLBFS_I(inode);\nfs/hugetlbfs/inode.c-839-\n--\nfs/hugetlbfs/inode.c-843-\nfs/hugetlbfs/inode.c:844:\ttrace_hugetlbfs_setattr(inode, dentry, attr);\nfs/hugetlbfs/inode.c-845-\n--\nfs/hugetlbfs/inode.c-863-\nfs/hugetlbfs/inode.c:864:static struct inode hugetlbfs_get_root(struct super_block sb,\nfs/hugetlbfs/inode.c:865:\t\t\t\t\tstruct hugetlbfs_fs_context ctx)\nfs/hugetlbfs/inode.c-866-{\n--\nfs/hugetlbfs/inode.c-875-\t\tsimple_inode_init_ts(inode);\nfs/hugetlbfs/inode.c:876:\t\tinode-\u003ei_op = \u0026hugetlbfs_dir_inode_operations;\nfs/hugetlbfs/inode.c-877-\t\tinode-\u003ei_fop = \u0026simple_dir_operations;\n--\nfs/hugetlbfs/inode.c-891- /\nfs/hugetlbfs/inode.c:892:static struct lock_class_key hugetlbfs_i_mmap_rwsem_key;\nfs/hugetlbfs/inode.c-893-\nfs/hugetlbfs/inode.c:894:static struct inode hugetlbfs_get_inode(struct super_block sb,\nfs/hugetlbfs/inode.c-895-\t\t\t\t\tstruct mnt_idmap idmap,\n--\nfs/hugetlbfs/inode.c-913-\tif (inode) {\nfs/hugetlbfs/inode.c:914:\t\tstruct hugetlbfs_inode_info info = HUGETLBFS_I(inode);\nfs/hugetlbfs/inode.c-915-\n--\nfs/hugetlbfs/inode.c-918-\t\tlockdep_set_class(\u0026inode-\u003ei_mapping-\u003ei_mmap_rwsem,\nfs/hugetlbfs/inode.c:919:\t\t\t\t\u0026hugetlbfs_i_mmap_rwsem_key);\nfs/hugetlbfs/inode.c:920:\t\tinode-\u003ei_mapping-\u003ea_ops = \u0026hugetlbfs_aops;\nfs/hugetlbfs/inode.c-921-\t\tsimple_inode_init_ts(inode);\n--\nfs/hugetlbfs/inode.c-928-\t\tcase S_IFREG:\nfs/hugetlbfs/inode.c:929:\t\t\tinode-\u003ei_op = \u0026hugetlbfs_inode_operations;\nfs/hugetlbfs/inode.c:930:\t\t\tinode-\u003ei_fop = \u0026hugetlbfs_file_operations;\nfs/hugetlbfs/inode.c-931-\t\t\tbreak;\nfs/hugetlbfs/inode.c-932-\t\tcase S_IFDIR:\nfs/hugetlbfs/inode.c:933:\t\t\tinode-\u003ei_op = \u0026hugetlbfs_dir_inode_operations;\nfs/hugetlbfs/inode.c-934-\t\t\tinode-\u003ei_fop = \u0026simple_dir_operations;\n--\nfs/hugetlbfs/inode.c-944-\t\tlockdep_annotate_inode_mutex_key(inode);\nfs/hugetlbfs/inode.c:945:\t\ttrace_hugetlbfs_alloc_inode(inode, dir, mode);\nfs/hugetlbfs/inode.c-946-\t} else {\n--\nfs/hugetlbfs/inode.c-956- /\nfs/hugetlbfs/inode.c:957:static int hugetlbfs_mknod(struct mnt_idmap idmap, struct inode dir,\nfs/hugetlbfs/inode.c-958-\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n--\nfs/hugetlbfs/inode.c-961-\nfs/hugetlbfs/inode.c:962:\tinode = hugetlbfs_get_inode(dir-\u003ei_sb, idmap, dir, mode, dev);\nfs/hugetlbfs/inode.c-963-\tif (!inode)\n--\nfs/hugetlbfs/inode.c-969-\nfs/hugetlbfs/inode.c:970:static struct dentry hugetlbfs_mkdir(struct mnt_idmap idmap, struct inode dir,\nfs/hugetlbfs/inode.c-971-\t\t\t\t struct dentry dentry, umode_t mode)\nfs/hugetlbfs/inode.c-972-{\nfs/hugetlbfs/inode.c:973:\tint retval = hugetlbfs_mknod(idmap, dir, dentry,\nfs/hugetlbfs/inode.c-974-\t\t\t\t mode, 0);\n--\nfs/hugetlbfs/inode.c-979-\nfs/hugetlbfs/inode.c:980:static int hugetlbfs_create(struct mnt_idmap idmap,\nfs/hugetlbfs/inode.c-981-\t\t\t struct inode dir, struct dentry dentry,\n--\nfs/hugetlbfs/inode.c-983-{\nfs/hugetlbfs/inode.c:984:\treturn hugetlbfs_mknod(idmap, dir, dentry, mode \| S_IFREG, 0);\nfs/hugetlbfs/inode.c-985-}\nfs/hugetlbfs/inode.c-986-\nfs/hugetlbfs/inode.c:987:static int hugetlbfs_tmpfile(struct mnt_idmap idmap,\nfs/hugetlbfs/inode.c-988-\t\t\t struct inode dir, struct file file,\n--\nfs/hugetlbfs/inode.c-992-\nfs/hugetlbfs/inode.c:993:\tinode = hugetlbfs_get_inode(dir-\u003ei_sb, idmap, dir, mode \| S_IFREG, 0);\nfs/hugetlbfs/inode.c-994-\tif (!inode)\n--\nfs/hugetlbfs/inode.c-1000-\nfs/hugetlbfs/inode.c:1001:static int hugetlbfs_symlink(struct mnt_idmap idmap,\nfs/hugetlbfs/inode.c-1002-\t\t\t struct inode dir, struct dentry dentry,\n--\nfs/hugetlbfs/inode.c-1008-\nfs/hugetlbfs/inode.c:1009:\tinode = hugetlbfs_get_inode(dir-\u003ei_sb, idmap, dir, mode, 0);\nfs/hugetlbfs/inode.c-1010-\tif (inode) {\n--\nfs/hugetlbfs/inode.c-1023-#ifdef CONFIG_MIGRATION\nfs/hugetlbfs/inode.c:1024:static int hugetlbfs_migrate_folio(struct address_space mapping,\nfs/hugetlbfs/inode.c-1025-\t\t\t\tstruct folio dst, struct folio src,\n--\nfs/hugetlbfs/inode.c-1044-#else\nfs/hugetlbfs/inode.c:1045:#define hugetlbfs_migrate_folio NULL\nfs/hugetlbfs/inode.c-1046-#endif\nfs/hugetlbfs/inode.c-1047-\nfs/hugetlbfs/inode.c:1048:static int hugetlbfs_error_remove_folio(struct address_space mapping,\nfs/hugetlbfs/inode.c-1049-\t\t\t\tstruct folio folio)\n--\nfs/hugetlbfs/inode.c-1056- /\nfs/hugetlbfs/inode.c:1057:static int hugetlbfs_show_options(struct seq_file m, struct dentry root)\nfs/hugetlbfs/inode.c-1058-{\nfs/hugetlbfs/inode.c:1059:\tstruct hugetlbfs_sb_info sbinfo = HUGETLBFS_SB(root-\u003ed_sb);\nfs/hugetlbfs/inode.c-1060-\tstruct hugepage_subpool spool = sbinfo-\u003espool;\n--\nfs/hugetlbfs/inode.c-1093-\nfs/hugetlbfs/inode.c:1094:static int hugetlbfs_statfs(struct dentry dentry, struct kstatfs buf)\nfs/hugetlbfs/inode.c-1095-{\nfs/hugetlbfs/inode.c:1096:\tstruct hugetlbfs_sb_info sbinfo = HUGETLBFS_SB(dentry-\u003ed_sb);\nfs/hugetlbfs/inode.c-1097-\tstruct hstate h = hstate_inode(d_inode(dentry));\n--\nfs/hugetlbfs/inode.c-1128-\nfs/hugetlbfs/inode.c:1129:static void hugetlbfs_put_super(struct super_block sb)\nfs/hugetlbfs/inode.c-1130-{\nfs/hugetlbfs/inode.c:1131:\tstruct hugetlbfs_sb_info sbi = HUGETLBFS_SB(sb);\nfs/hugetlbfs/inode.c-1132-\n--\nfs/hugetlbfs/inode.c-1141-\nfs/hugetlbfs/inode.c:1142:static inline int hugetlbfs_dec_free_inodes(struct hugetlbfs_sb_info sbinfo)\nfs/hugetlbfs/inode.c-1143-{\n--\nfs/hugetlbfs/inode.c-1156-\nfs/hugetlbfs/inode.c:1157:static void hugetlbfs_inc_free_inodes(struct hugetlbfs_sb_info sbinfo)\nfs/hugetlbfs/inode.c-1158-{\n--\nfs/hugetlbfs/inode.c-1166-\nfs/hugetlbfs/inode.c:1167:static struct kmem_cache hugetlbfs_inode_cachep;\nfs/hugetlbfs/inode.c-1168-\nfs/hugetlbfs/inode.c:1169:static struct inode hugetlbfs_alloc_inode(struct super_block sb)\nfs/hugetlbfs/inode.c-1170-{\nfs/hugetlbfs/inode.c:1171:\tstruct hugetlbfs_sb_info sbinfo = HUGETLBFS_SB(sb);\nfs/hugetlbfs/inode.c:1172:\tstruct hugetlbfs_inode_info p;\nfs/hugetlbfs/inode.c-1173-\nfs/hugetlbfs/inode.c:1174:\tif (unlikely(!hugetlbfs_dec_free_inodes(sbinfo)))\nfs/hugetlbfs/inode.c-1175-\t\treturn NULL;\nfs/hugetlbfs/inode.c:1176:\tp = alloc_inode_sb(sb, hugetlbfs_inode_cachep, GFP_KERNEL);\nfs/hugetlbfs/inode.c-1177-\tif (unlikely(!p)) {\nfs/hugetlbfs/inode.c:1178:\t\thugetlbfs_inc_free_inodes(sbinfo);\nfs/hugetlbfs/inode.c-1179-\t\treturn NULL;\n--\nfs/hugetlbfs/inode.c-1183-\nfs/hugetlbfs/inode.c:1184:static void hugetlbfs_free_inode(struct inode inode)\nfs/hugetlbfs/inode.c-1185-{\nfs/hugetlbfs/inode.c:1186:\ttrace_hugetlbfs_free_inode(inode);\nfs/hugetlbfs/inode.c:1187:\tkmem_cache_free(hugetlbfs_inode_cachep, HUGETLBFS_I(inode));\nfs/hugetlbfs/inode.c-1188-}\nfs/hugetlbfs/inode.c-1189-\nfs/hugetlbfs/inode.c:1190:static void hugetlbfs_destroy_inode(struct inode inode)\nfs/hugetlbfs/inode.c-1191-{\nfs/hugetlbfs/inode.c:1192:\thugetlbfs_inc_free_inodes(HUGETLBFS_SB(inode-\u003ei_sb));\nfs/hugetlbfs/inode.c-1193-}\nfs/hugetlbfs/inode.c-1194-\nfs/hugetlbfs/inode.c:1195:static const struct address_space_operations hugetlbfs_aops = {\nfs/hugetlbfs/inode.c:1196:\t.write_begin\t= hugetlbfs_write_begin,\nfs/hugetlbfs/inode.c:1197:\t.write_end\t= hugetlbfs_write_end,\nfs/hugetlbfs/inode.c-1198-\t.dirty_folio\t= noop_dirty_folio,\nfs/hugetlbfs/inode.c:1199:\t.migrate_folio = hugetlbfs_migrate_folio,\nfs/hugetlbfs/inode.c:1200:\t.error_remove_folio\t= hugetlbfs_error_remove_folio,\nfs/hugetlbfs/inode.c-1201-};\n--\nfs/hugetlbfs/inode.c=1204=static void init_once(void foo)\nfs/hugetlbfs/inode.c-1205-{\nfs/hugetlbfs/inode.c:1206:\tstruct hugetlbfs_inode_info ei = foo;\nfs/hugetlbfs/inode.c-1207-\n--\nfs/hugetlbfs/inode.c-1210-\nfs/hugetlbfs/inode.c:1211:static const struct file_operations hugetlbfs_file_operations = {\nfs/hugetlbfs/inode.c:1212:\t.read_iter\t\t= hugetlbfs_read_iter,\nfs/hugetlbfs/inode.c:1213:\t.mmap\t\t\t= hugetlbfs_file_mmap,\nfs/hugetlbfs/inode.c-1214-\t.fsync\t\t\t= noop_fsync,\n--\nfs/hugetlbfs/inode.c-1216-\t.llseek\t\t\t= default_llseek,\nfs/hugetlbfs/inode.c:1217:\t.fallocate\t\t= hugetlbfs_fallocate,\nfs/hugetlbfs/inode.c-1218-\t.fop_flags\t\t= FOP_HUGE_PAGES,\n--\nfs/hugetlbfs/inode.c-1220-\nfs/hugetlbfs/inode.c:1221:static const struct inode_operations hugetlbfs_dir_inode_operations = {\nfs/hugetlbfs/inode.c:1222:\t.create\t\t= hugetlbfs_create,\nfs/hugetlbfs/inode.c-1223-\t.lookup\t\t= simple_lookup,\n--\nfs/hugetlbfs/inode.c-1225-\t.unlink\t\t= simple_unlink,\nfs/hugetlbfs/inode.c:1226:\t.symlink\t= hugetlbfs_symlink,\nfs/hugetlbfs/inode.c:1227:\t.mkdir\t\t= hugetlbfs_mkdir,\nfs/hugetlbfs/inode.c-1228-\t.rmdir\t\t= simple_rmdir,\nfs/hugetlbfs/inode.c:1229:\t.mknod\t\t= hugetlbfs_mknod,\nfs/hugetlbfs/inode.c-1230-\t.rename\t\t= simple_rename,\nfs/hugetlbfs/inode.c:1231:\t.setattr\t= hugetlbfs_setattr,\nfs/hugetlbfs/inode.c:1232:\t.tmpfile\t= hugetlbfs_tmpfile,\nfs/hugetlbfs/inode.c-1233-};\nfs/hugetlbfs/inode.c-1234-\nfs/hugetlbfs/inode.c:1235:static const struct inode_operations hugetlbfs_inode_operations = {\nfs/hugetlbfs/inode.c:1236:\t.setattr\t= hugetlbfs_setattr,\nfs/hugetlbfs/inode.c-1237-};\nfs/hugetlbfs/inode.c-1238-\nfs/hugetlbfs/inode.c:1239:static const struct super_operations hugetlbfs_ops = {\nfs/hugetlbfs/inode.c:1240:\t.alloc_inode = hugetlbfs_alloc_inode,\nfs/hugetlbfs/inode.c:1241:\t.free_inode = hugetlbfs_free_inode,\nfs/hugetlbfs/inode.c:1242:\t.destroy_inode = hugetlbfs_destroy_inode,\nfs/hugetlbfs/inode.c:1243:\t.evict_inode\t= hugetlbfs_evict_inode,\nfs/hugetlbfs/inode.c:1244:\t.statfs\t\t= hugetlbfs_statfs,\nfs/hugetlbfs/inode.c:1245:\t.put_super\t= hugetlbfs_put_super,\nfs/hugetlbfs/inode.c:1246:\t.show_options\t= hugetlbfs_show_options,\nfs/hugetlbfs/inode.c-1247-};\n--\nfs/hugetlbfs/inode.c=1254=static long\nfs/hugetlbfs/inode.c:1255:hugetlbfs_size_to_hpages(struct hstate h, unsigned long long size_opt,\nfs/hugetlbfs/inode.c:1256:\t\t\t enum hugetlbfs_size_type val_type)\nfs/hugetlbfs/inode.c-1257-{\n--\nfs/hugetlbfs/inode.c-1273- /\nfs/hugetlbfs/inode.c:1274:static int hugetlbfs_parse_param(struct fs_context fc, struct fs_parameter param)\nfs/hugetlbfs/inode.c-1275-{\nfs/hugetlbfs/inode.c:1276:\tstruct hugetlbfs_fs_context ctx = fc-\u003efs_private;\nfs/hugetlbfs/inode.c-1277-\tstruct fs_parse_result result;\n--\nfs/hugetlbfs/inode.c-1348- /\nfs/hugetlbfs/inode.c:1349:static int hugetlbfs_validate(struct fs_context fc)\nfs/hugetlbfs/inode.c-1350-{\nfs/hugetlbfs/inode.c:1351:\tstruct hugetlbfs_fs_context ctx = fc-\u003efs_private;\nfs/hugetlbfs/inode.c-1352-\n--\nfs/hugetlbfs/inode.c-1356-\t /\nfs/hugetlbfs/inode.c:1357:\tctx-\u003emax_hpages = hugetlbfs_size_to_hpages(ctx-\u003ehstate,\nfs/hugetlbfs/inode.c-1358-\t\t\t\t\t\t ctx-\u003emax_size_opt,\nfs/hugetlbfs/inode.c-1359-\t\t\t\t\t\t ctx-\u003emax_val_type);\nfs/hugetlbfs/inode.c:1360:\tctx-\u003emin_hpages = hugetlbfs_size_to_hpages(ctx-\u003ehstate,\nfs/hugetlbfs/inode.c-1361-\t\t\t\t\t\t ctx-\u003emin_size_opt,\n--\nfs/hugetlbfs/inode.c=1376=static int\nfs/hugetlbfs/inode.c:1377:hugetlbfs_fill_super(struct super_block sb, struct fs_context fc)\nfs/hugetlbfs/inode.c-1378-{\nfs/hugetlbfs/inode.c:1379:\tstruct hugetlbfs_fs_context ctx = fc-\u003efs_private;\nfs/hugetlbfs/inode.c:1380:\tstruct hugetlbfs_sb_info sbinfo;\nfs/hugetlbfs/inode.c-1381-\nfs/hugetlbfs/inode.c:1382:\tsbinfo = kmalloc_obj(struct hugetlbfs_sb_info);\nfs/hugetlbfs/inode.c-1383-\tif (!sbinfo)\n--\nfs/hugetlbfs/inode.c-1410-\tsb-\u003es_magic = HUGETLBFS_MAGIC;\nfs/hugetlbfs/inode.c:1411:\tsb-\u003es_op = \u0026hugetlbfs_ops;\nfs/hugetlbfs/inode.c-1412-\tsb-\u003es_d_flags = DCACHE_DONTCACHE;\n--\nfs/hugetlbfs/inode.c-1415-\t/\nfs/hugetlbfs/inode.c:1416:\t * Due to the special and limited functionality of hugetlbfs, it does\nfs/hugetlbfs/inode.c-1417-\t * not work well as a stacking filesystem.\n--\nfs/hugetlbfs/inode.c-1419-\tsb-\u003es_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;\nfs/hugetlbfs/inode.c:1420:\tsb-\u003es_root = d_make_root(hugetlbfs_get_root(sb, ctx));\nfs/hugetlbfs/inode.c-1421-\tif (!sb-\u003es_root)\n--\nfs/hugetlbfs/inode.c-1429-\nfs/hugetlbfs/inode.c:1430:static int hugetlbfs_get_tree(struct fs_context fc)\nfs/hugetlbfs/inode.c-1431-{\nfs/hugetlbfs/inode.c:1432:\tint err = hugetlbfs_validate(fc);\nfs/hugetlbfs/inode.c-1433-\tif (err)\nfs/hugetlbfs/inode.c-1434-\t\treturn err;\nfs/hugetlbfs/inode.c:1435:\treturn get_tree_nodev(fc, hugetlbfs_fill_super);\nfs/hugetlbfs/inode.c-1436-}\nfs/hugetlbfs/inode.c-1437-\nfs/hugetlbfs/inode.c:1438:static void hugetlbfs_fs_context_free(struct fs_context fc)\nfs/hugetlbfs/inode.c-1439-{\n--\nfs/hugetlbfs/inode.c-1442-\nfs/hugetlbfs/inode.c:1443:static const struct fs_context_operations hugetlbfs_fs_context_ops = {\nfs/hugetlbfs/inode.c:1444:\t.free\t\t= hugetlbfs_fs_context_free,\nfs/hugetlbfs/inode.c:1445:\t.parse_param\t= hugetlbfs_parse_param,\nfs/hugetlbfs/inode.c:1446:\t.get_tree\t= hugetlbfs_get_tree,\nfs/hugetlbfs/inode.c-1447-};\nfs/hugetlbfs/inode.c-1448-\nfs/hugetlbfs/inode.c:1449:static int hugetlbfs_init_fs_context(struct fs_context fc)\nfs/hugetlbfs/inode.c-1450-{\nfs/hugetlbfs/inode.c:1451:\tstruct hugetlbfs_fs_context ctx;\nfs/hugetlbfs/inode.c-1452-\nfs/hugetlbfs/inode.c:1453:\tctx = kzalloc_obj(struct hugetlbfs_fs_context);\nfs/hugetlbfs/inode.c-1454-\tif (!ctx)\n--\nfs/hugetlbfs/inode.c-1466-\tfc-\u003efs_private = ctx;\nfs/hugetlbfs/inode.c:1467:\tfc-\u003eops\t= \u0026hugetlbfs_fs_context_ops;\nfs/hugetlbfs/inode.c-1468-\treturn 0;\n--\nfs/hugetlbfs/inode.c-1470-\nfs/hugetlbfs/inode.c:1471:static struct file_system_type hugetlbfs_fs_type = {\nfs/hugetlbfs/inode.c:1472:\t.name\t\t\t= \"hugetlbfs\",\nfs/hugetlbfs/inode.c:1473:\t.init_fs_context\t= hugetlbfs_init_fs_context,\nfs/hugetlbfs/inode.c-1474-\t.parameters\t\t= hugetlb_fs_parameters,\n--\nfs/hugetlbfs/inode.c-1478-\nfs/hugetlbfs/inode.c:1479:static struct vfsmount hugetlbfs_vfsmount[HUGE_MAX_HSTATE];\nfs/hugetlbfs/inode.c-1480-\n--\nfs/hugetlbfs/inode.c=1501=struct file hugetlb_file_setup(const char name, size_t size,\n--\nfs/hugetlbfs/inode.c-1513-\nfs/hugetlbfs/inode.c:1514:\tmnt = hugetlbfs_vfsmount[hstate_idx];\nfs/hugetlbfs/inode.c-1515-\tif (!mnt)\n--\nfs/hugetlbfs/inode.c-1529-\tfile = ERR_PTR(-ENOSPC);\nfs/hugetlbfs/inode.c:1530:\t/ hugetlbfs_vfsmount[] mounts do not use idmapped mounts. /\nfs/hugetlbfs/inode.c:1531:\tinode = hugetlbfs_get_inode(mnt-\u003emnt_sb, \u0026nop_mnt_idmap, NULL,\nfs/hugetlbfs/inode.c-1532-\t\t\t\t S_IFREG \| S_IRWXUGO, 0);\n--\nfs/hugetlbfs/inode.c-1546-\t\tfile = alloc_file_pseudo(inode, mnt, name, O_RDWR,\nfs/hugetlbfs/inode.c:1547:\t\t\t\t\t\u0026hugetlbfs_file_operations);\nfs/hugetlbfs/inode.c-1548-\tif (!IS_ERR(file))\n--\nfs/hugetlbfs/inode.c-1555-\nfs/hugetlbfs/inode.c:1556:static struct vfsmount __init mount_one_hugetlbfs(struct hstate h)\nfs/hugetlbfs/inode.c-1557-{\n--\nfs/hugetlbfs/inode.c-1560-\nfs/hugetlbfs/inode.c:1561:\tfc = fs_context_for_mount(\u0026hugetlbfs_fs_type, SB_KERNMOUNT);\nfs/hugetlbfs/inode.c-1562-\tif (IS_ERR(fc)) {\n--\nfs/hugetlbfs/inode.c-1564-\t} else {\nfs/hugetlbfs/inode.c:1565:\t\tstruct hugetlbfs_fs_context ctx = fc-\u003efs_private;\nfs/hugetlbfs/inode.c-1566-\t\tctx-\u003ehstate = h;\n--\nfs/hugetlbfs/inode.c-1570-\tif (IS_ERR(mnt))\nfs/hugetlbfs/inode.c:1571:\t\tpr_err(\"Cannot mount internal hugetlbfs for page size %luK\",\nfs/hugetlbfs/inode.c-1572-\t\t huge_page_size(h) / SZ_1K);\n--\nfs/hugetlbfs/inode.c-1575-\nfs/hugetlbfs/inode.c:1576:static int __init init_hugetlbfs_fs(void)\nfs/hugetlbfs/inode.c-1577-{\n--\nfs/hugetlbfs/inode.c-1588-\terror = -ENOMEM;\nfs/hugetlbfs/inode.c:1589:\thugetlbfs_inode_cachep = kmem_cache_create(\"hugetlbfs_inode_cache\",\nfs/hugetlbfs/inode.c:1590:\t\t\t\t\tsizeof(struct hugetlbfs_inode_info),\nfs/hugetlbfs/inode.c-1591-\t\t\t\t\t0, SLAB_ACCOUNT, init_once);\nfs/hugetlbfs/inode.c:1592:\tif (hugetlbfs_inode_cachep == NULL)\nfs/hugetlbfs/inode.c-1593-\t\tgoto out;\nfs/hugetlbfs/inode.c-1594-\nfs/hugetlbfs/inode.c:1595:\terror = register_filesystem(\u0026hugetlbfs_fs_type);\nfs/hugetlbfs/inode.c-1596-\tif (error)\n--\nfs/hugetlbfs/inode.c-1599-\t/* default hstate mount is required */\nfs/hugetlbfs/inode.c:1600:\tmnt = mount_one_hugetlbfs(\u0026default_hstate);\nfs/hugetlbfs/inode.c-1601-\tif (IS_ERR(mnt)) {\n--\nfs/hugetlbfs/inode.c-1604-\t}\nfs/hugetlbfs/inode.c:1605:\thugetlbfs_vfsmount[default_hstate_idx] = mnt;\nfs/hugetlbfs/inode.c-1606-\n--\nfs/hugetlbfs/inode.c-1614-\nfs/hugetlbfs/inode.c:1615:\t\tmnt = mount_one_hugetlbfs(h);\nfs/hugetlbfs/inode.c-1616-\t\tif (IS_ERR(mnt))\nfs/hugetlbfs/inode.c:1617:\t\t\thugetlbfs_vfsmount[i] = NULL;\nfs/hugetlbfs/inode.c-1618-\t\telse\nfs/hugetlbfs/inode.c:1619:\t\t\thugetlbfs_vfsmount[i] = mnt;\nfs/hugetlbfs/inode.c-1620-\t\ti++;\n--\nfs/hugetlbfs/inode.c-1625- out_unreg:\nfs/hugetlbfs/inode.c:1626:\t(void)unregister_filesystem(\u0026hugetlbfs_fs_type);\nfs/hugetlbfs/inode.c-1627- out_free:\nfs/hugetlbfs/inode.c:1628:\tkmem_cache_destroy(hugetlbfs_inode_cachep);\nfs/hugetlbfs/inode.c-1629- out:\n--\nfs/hugetlbfs/inode.c-1631-}\nfs/hugetlbfs/inode.c:1632:fs_initcall(init_hugetlbfs_fs)\n" }
7/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 19837 output: 32 thoughts: 34 Thoughts: Here's my take on the thought process: Diving into the Kernel Configuration for Huge Pages Okay, so I need to understand the dependencies between `HUGETLBFS` and `HUGETLB_PAGE`. My gut feeling is that they're related, but I need to make sure I've got the logic straight in my head. Time to open up the `fs/Kconfig` file in the kernel source. I know that's the canonical place for all the configuration options, their descriptions, and, critically, their relationships. I'm going to jump straight to around line 250 – that feels like a reasonable place to start looking, given my experience with similar options in the past. Hopefully, that section will contain the relevant `config` statements and any `depends on` clauses that spell out exactly how these two options are linked. I'm expecting to see things like `depends on` directives specifying which other options must be enabled for these to even show up in the menuconfig, or which features they can enable. I should also check if one is an alternative to the other.
8/2	2026/09/09 22:01	tool	read-file	0m Args: { "File": "fs/Kconfig", "FirstLine": 245, "LineCount": 25 } Results: { "Contents": " 245:\t\t If unsure, say N.\n 246:\t\n 247:\tconfig ARCH_SUPPORTS_HUGETLBFS\n 248:\t\tdef_bool n\n 249:\t\n 250:\tmenuconfig HUGETLBFS\n 251:\t\tbool \"HugeTLB file system support\"\n 252:\t\tdepends on ARCH_SUPPORTS_HUGETLBFS\n 253:\t\tselect MEMFD_CREATE\n 254:\t\tselect PADATA if SMP\n 255:\t\thelp\n 256:\t\t hugetlbfs is a filesystem backing for HugeTLB pages, based on\n 257:\t\t ramfs. For architectures that support it, say Y here and read\n 258:\t\t \u003cfile:Documentation/admin-guide/mm/hugetlbpage.rst\u003e for details.\n 259:\t\n 260:\t\t If unsure, say N.\n 261:\t\n 262:\tif HUGETLBFS\n 263:\tconfig HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON\n 264:\t\tbool \"HugeTLB Vmemmap Optimization (HVO) defaults to on\"\n 265:\t\tdefault n\n 266:\t\tdepends on HUGETLB_PAGE_OPTIMIZE_VMEMMAP\n 267:\t\thelp\n 268:\t\t The HugeTLB Vmemmap Optimization (HVO) defaults to off. Say Y here to\n 269:\t\t enable HVO by default. It can be disabled via hugetlb_free_vmemmap=off\n" }
9/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20542 output: 28 thoughts: 18 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Checking the Kconfig for HUGETLB_PAGE Alright, so I need to make absolutely sure I'm not missing any relevant configurations for the task at hand. I should immediately cross-reference the `mm/Kconfig` file in the kernel source. The most logical place to start digging is for settings related to HugeTLB pages. That's usually the defining feature. This will help to confirm what, if any, features were enabled, and what dependencies there may have been on this function. I'll need to check the Kconfig for `HUGETLB_PAGE`. Let's confirm how the specific options for that are set up. I can't assume anything. I need a clear understanding of the existing configuration.
10/2	2026/09/09 22:01	tool	grepper	0m Args: { "Expression": "config HUGETLB_PAGE", "PathPrefix": "mm/" } Results: { "Output": "mm/Kconfig=694=config ARCH_HAS_PMD_SOFTLEAVES\n--\nmm/Kconfig-696-\nmm/Kconfig:697:config HUGETLB_PAGE_SIZE_VARIABLE\nmm/Kconfig-698-\tdef_bool n\n" }
11/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20840 output: 21 thoughts: 16 Thoughts: Here's my thought process, as if I were the one thinking it: Finding the HUGETLB_PAGE Definition in Kconfig Okay, so I need to track down the definition of `HUGETLB_PAGE` within the Kconfig files. This likely ties into huge page support, and figuring out its exact definition will be key to understanding the configuration options and dependencies associated with it. Time to dive into the kernel source tree's Kconfig files. I'll need to use `grep` or a similar search tool to quickly locate it. I'm assuming it's part of the memory or architecture-specific configurations, but best to start with a broad search to ensure I don't miss anything. Let's start with a general search and then narrow the scope if necessary. This will help me understand the conditional inclusion and any associated settings related to the use of huge pages.
12/2	2026/09/09 22:01	tool	grepper	0m Args: { "Expression": "config HUGETLB_PAGE$" } Results: { "Output": "fs/Kconfig=271=endif # HUGETLBFS\nfs/Kconfig-272-\nfs/Kconfig:273:config HUGETLB_PAGE\nfs/Kconfig-274-\tdef_bool HUGETLBFS\n" }
13/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 21136 output: 36 thoughts: 277 Thoughts: Analyzing the Impact of HUGETLBFS on Huge Pages Okay, so we're looking at `HUGETLBFS` enabling `HUGETLB_PAGE`. Right, that's the core relationship we need to understand. Let's see how this plays out in the code. I'll need to go through the functions that have been touched by this diff. Specifically, I'm noting: 1. `hugetlbfs_statfs` in `fs/hugetlbfs/inode.c`. This suggests changes to how the file system's status is reported, which makes sense. We could see different reporting relating to huge page allocations. 2. `hugepage_subpool_get_pages` in `mm/hugetlb.c`. That's a key one. It's a static function, but it's called by `alloc_hugetlb_folio`, and `hugetlb_reserve_pages`, suggesting a relationship with page allocation and reservation. 3. `hugepage_subpool_put_pages` also in `mm/hugetlb.c`. Another static function, it's called by the counterparts of the "get" functions, plus `remove_inode_hugepages`. It's related to releasing pages. 4. `subpool_is_free` also in `mm/hugetlb.c`. This is static and called by `unlock_or_release_subpool` and `hugepage_put_subpool`, which is a key part of the allocation/deallocation process. 5. `alloc_hugetlb_folio` in `mm/hugetlb.c`. This is obviously a key function for folio allocation, so it's essential to look at. 6. `hugetlb_reserve_pages` in `mm/hugetlb.c`. Page reservation is also an important part of the folio process. Now, I'm going to quickly scan for any other callers of those `hugepage_subpool_get_pages` and `hugepage_subpool_put_pages` functions, just to get a broader view of how these changes are integrated and ensure I'm not missing anything critical in the overall flow.
14/2	2026/09/09 22:01	tool	grepper	0m Args: { "Expression": "hugepage_subpool_._pages", "PathPrefix": "mm/hugetlb.c" } Results:* { "Output": "mm/hugetlb.c=179=void hugepage_put_subpool(struct hugepage_subpool spool)\n--\nmm/hugetlb.c-192-/\nmm/hugetlb.c:193: hugepage_subpool_get_pages - Get pages from a subpool\nmm/hugetlb.c-194- * @spool: pointer to subpool structure (may be NULL)\n--\nmm/hugetlb.c-204- /\nmm/hugetlb.c:205:static long hugepage_subpool_get_pages(struct hugepage_subpool spool,\nmm/hugetlb.c-206-\t\t\t\t long delta)\n--\nmm/hugetlb.c-243-/*\nmm/hugetlb.c:244: hugepage_subpool_put_pages - Release pages back to a subpool\nmm/hugetlb.c-245- * @spool: pointer to subpool structure (may be NULL)\n--\nmm/hugetlb.c-256- /\nmm/hugetlb.c:257:static long hugepage_subpool_put_pages(struct hugepage_subpool spool,\nmm/hugetlb.c-258-\t\t\t\t long delta)\n--\nmm/hugetlb.c=975=void hugetlb_fix_reserve_counts(struct inode inode)\n--\nmm/hugetlb.c-980-\nmm/hugetlb.c:981:\trsv_adjust = hugepage_subpool_get_pages(spool, 1);\nmm/hugetlb.c-982-\tif (rsv_adjust \u003e 0) {\n--\nmm/hugetlb.c=1686=void free_huge_folio(struct folio folio)\n--\nmm/hugetlb.c-1711-\t * would have been a page reserved in the subpool before allocation\nmm/hugetlb.c:1712:\t * via hugepage_subpool_get_pages(). Since we are 'restoring' the\nmm/hugetlb.c:1713:\t * reservation, do not call hugepage_subpool_put_pages() as this will\nmm/hugetlb.c-1714-\t * remove the reserved page from the subpool.\n--\nmm/hugetlb.c-1722-\t\t /\nmm/hugetlb.c:1723:\t\tif (hugepage_subpool_put_pages(spool, 1) == 0)\nmm/hugetlb.c-1724-\t\t\trestore_reserve = true;\n--\nmm/hugetlb.c=2954=struct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n--\nmm/hugetlb.c-2998-\tif (map_chg) {\nmm/hugetlb.c:2999:\t\tgbl_resv_get = hugepage_subpool_get_pages(spool, 1);\nmm/hugetlb.c-3000-\t\tif (gbl_resv_get \u003c 0) {\n--\nmm/hugetlb.c-3064-\nmm/hugetlb.c:3065:\t\t\trsv_adjust = hugepage_subpool_put_pages(spool, 1);\nmm/hugetlb.c-3066-\t\t\thugetlb_acct_memory(h, -rsv_adjust);\n--\nmm/hugetlb.c-3077-\tif (map_chg) {\nmm/hugetlb.c:3078:\t\tlong gbl_resv_put = hugepage_subpool_put_pages(spool, 1);\nmm/hugetlb.c-3079-\n--\nmm/hugetlb.c=4721=static void hugetlb_vm_op_close(struct vm_area_struct vma)\n--\nmm/hugetlb.c-4744-\t\t /\nmm/hugetlb.c:4745:\t\tgbl_reserve = hugepage_subpool_put_pages(spool, reserve);\nmm/hugetlb.c-4746-\t\thugetlb_acct_memory(h, -gbl_reserve);\n--\nmm/hugetlb.c=6671=long hugetlb_reserve_pages(struct inode inode,\n--\nmm/hugetlb.c-6758-\t /\nmm/hugetlb.c:6759:\tgbl_resv_get = hugepage_subpool_get_pages(spool, chg);\nmm/hugetlb.c-6760-\tif (gbl_resv_get \u003c 0) {\n--\nmm/hugetlb.c-6808-\nmm/hugetlb.c:6809:\t\t\trsv_adjust = hugepage_subpool_put_pages(spool,\nmm/hugetlb.c-6810-\t\t\t\t\t\t\t\tchg - add);\n--\nmm/hugetlb.c-6829-\t /\nmm/hugetlb.c:6830:\tgbl_resv_put = hugepage_subpool_put_pages(spool, chg);\nmm/hugetlb.c-6831-\t/\n--\nmm/hugetlb.c=6858=long hugetlb_unreserve_pages(struct inode inode, long start, long end,\n--\nmm/hugetlb.c-6892-\t */\nmm/hugetlb.c:6893:\tgbl_reserve = hugepage_subpool_put_pages(spool, (chg - freed));\nmm/hugetlb.c-6894-\thugetlb_acct_memory(h, -gbl_reserve);\n" }
15/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23396 output: 31 thoughts: 20 Thoughts: Okay, here's my summarized thought process, as requested, geared toward someone knowledgeable in this area: Investigating Potential Callers in fs/hugetlbfs Right, let's not limit our search to just the obvious suspects. I need to be thorough. I know what I'm looking for, and I have a good idea of where to start, but experience tells me there's almost always something lurking in the shadows. I've got to cast a wider net. The core issue is probably localized, but I'm going to take a moment and also meticulously check `fs/hugetlbfs`. There could be related calls, or even subtle interactions, lurking within that part of the filesystem code that I'm missing. Time to dive deeper and see if anything else is using those components or functions. Gotta cover all the bases to avoid any nasty surprises down the line.
16/2	2026/09/09 22:01	tool	grepper	0m Args: { "Expression": "hugepage_subpool", "PathPrefix": "fs/hugetlbfs" } Results: { "Output": "fs/hugetlbfs/inode.c=1057=static int hugetlbfs_show_options(struct seq_file m, struct dentry root)\n--\nfs/hugetlbfs/inode.c-1059-\tstruct hugetlbfs_sb_info sbinfo = HUGETLBFS_SB(root-\u003ed_sb);\nfs/hugetlbfs/inode.c:1060:\tstruct hugepage_subpool spool = sbinfo-\u003espool;\nfs/hugetlbfs/inode.c-1061-\tunsigned long hpage_size = huge_page_size(sbinfo-\u003ehstate);\n" }
17/2	2026/09/09 22:01	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23806 output: 281 thoughts: 940 Thoughts: Fuzzing Target Identification: Hugetlbfs Subpool Accounting Alright, let's break this down. First, the question: is this code worth fuzzing? Based on the analysis, absolutely. The code is reachable through standard QEMU and syscalls like `mmap`, `statfs`, and specific hugetlbfs mount options – no magic required. This is a good start. The real meat is in the modification of the hugetlb subpool accounting logic. We're talking about core memory management functions: `hugepage_subpool_get_pages`, `hugepage_subpool_put_pages`, `subpool_is_free`, `alloc_hugetlb_folio`, `hugetlb_reserve_pages`, and `hugetlbfs_statfs`. Specifically, the accounting for `used_hpages` is unconditionally adjusted now, and minimum size calculations are completely restructured. Error unwind calculations for subpools and global reservations within `alloc_hugetlb_folio` and `hugetlb_reserve_pages` have also been altered. This is a direct touch to memory management invariants in `mm/hugetlb.c` and `fs/hugetlbfs/inode.c`. That's a textbook definition of "worth fuzzing." Now, let's be strategic about our `FocusSymbols`. We don't want to waste cycles on ubiquitous allocators or general lock primitives. Instead, we want functions directly impacted by the patch. So, we're targeting these exact symbols: * `hugepage_subpool_get_pages` * `hugepage_subpool_put_pages` * `hugetlb_reserve_pages` * `alloc_hugetlb_folio` * `hugetlbfs_statfs` * `hugepage_put_subpool` / `unlock_or_release_subpool` (where subpool_is_free is called) * `hugetlb_unreserve_pages` * `hugetlb_fix_reserve_counts` Confirmed the exact names against `mm/hugetlb.c` and `fs/hugetlbfs/inode.c`: * `hugetlbfs_statfs` * `hugepage_subpool_get_pages` * `hugepage_subpool_put_pages` * `alloc_hugetlb_folio` * `hugetlb_reserve_pages` * `hugetlb_unreserve_pages` * `hugepage_put_subpool` And for configurations? We need `HUGETLBFS`. This implies `HUGETLB_PAGE` on supported architectures (like x86\_64), so that's covered. Sanity check confirms the format for `EnableConfigs` is just the flags without the `CONFIG_` prefix: `["HUGETLBFS"]` (or potentially `["HUGETLBFS", "HUGETLB_PAGE"]`). So, to summarize and confirm: * WorthFuzzing: True. * Reasoning: Subpool accounting and error handling changes, impacting memory management and accessible via `hugetlbfs` and `mmap`. * FocusSymbols: Specific functions listed above. * EnableConfigs: `"HUGETLBFS"` * Time to call set-results.
18/2	2026/09/09 22:01	tool	set-results	0m Args: { "EnableConfigs": [ "HUGETLBFS" ], "FocusSymbols": [ "hugepage_subpool_get_pages", "hugepage_subpool_put_pages", "hugetlb_reserve_pages", "alloc_hugetlb_folio", "hugetlbfs_statfs", "hugetlb_unreserve_pages", "hugepage_put_subpool" ], "Reasoning": "The patch modifies hugetlbfs subpool accounting logic and reservation error-unwind paths in mm/hugetlb.c and fs/hugetlbfs/inode.c. Specifically, it changes how `used_hpages` and `rsv_hpages` are updated in `hugepage_subpool_get_pages()` and `hugepage_subpool_put_pages()`, alters subpool release checks in `subpool_is_free()`, fixes statfs calculation for unbounded subpools in `hugetlbfs_statfs()`, and refactors global memory reservation rollbacks in `alloc_hugetlb_folio()` and `hugetlb_reserve_pages()`. This logic is fully reachable from userspace via hugetlbfs filesystem mounts, allocations, and mmap operations.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "HUGETLBFS" ], "FocusSymbols": [ "hugepage_subpool_get_pages", "hugepage_subpool_put_pages", "hugetlb_reserve_pages", "alloc_hugetlb_folio", "hugetlbfs_statfs", "hugetlb_unreserve_pages", "hugepage_put_subpool" ], "Reasoning": "The patch modifies hugetlbfs subpool accounting logic and reservation error-unwind paths in mm/hugetlb.c and fs/hugetlbfs/inode.c. Specifically, it changes how `used_hpages` and `rsv_hpages` are updated in `hugepage_subpool_get_pages()` and `hugepage_subpool_put_pages()`, alters subpool release checks in `subpool_is_free()`, fixes statfs calculation for unbounded subpools in `hugetlbfs_statfs()`, and refactors global memory reservation rollbacks in `alloc_hugetlb_folio()` and `hugetlb_reserve_pages()`. This logic is fully reachable from userspace via hugetlbfs filesystem mounts, allocations, and mmap operations.", "WorthFuzzing": true }
19/1	2026/09/09 22:01	action	If	0m Args: { "WorthFuzzing": true } Results: null
20/2	2026/09/09 22:01	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch modifies the subpool accounting and reservation logic for hugetlbfs (including hugetlb_subpool_get_pages, hugetlb_subpool_put_pages, statfs reporting, and rollback handling in alloc_hugetlb_folio and hugetlb_reserve_pages).\n\nAll local variables introduced or modified (such as gbl_resv_get, gbl_resv_put, gbl_resv_accted, limit, and free_pages) are explicitly initialized before use across all control flow paths. No new structures or buffers are allocated without initialization, no padding bytes are exposed, and no uninitialized kernel memory is passed to user space or used in conditional branching.\n\nPotential risks associated with this patch involve page accounting inaccuracies, concurrency/synchronization under race conditions, or memory exhaustion, which are covered by standard kernel assertions, KASAN, and LOCKDEP. There are no uninitialized memory hazards that would necessitate a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 7a37054a7fd996be30e903655617f856efc766d0 Author: syz-cluster <triage@syzkaller.com> Date: Wed Sep 9 22:01:13 2026 +0000 syz-cluster: applied patch under review diff --git a/Documentation/mm/hugetlbfs_reserv.rst b/Documentation/mm/hugetlbfs_reserv.rst index a49115db18c76..d244583fdcbc3 100644 --- a/Documentation/mm/hugetlbfs_reserv.rst +++ b/Documentation/mm/hugetlbfs_reserv.rst @@ -314,21 +314,8 @@ huge pages. If they can not be reserved, the mount fails. The routines hugepage_subpool_get/put_pages() are called when pages are obtained from or released back to a subpool. They perform all subpool accounting, and track any reservations associated with the subpool. -hugepage_subpool_get/put_pages are passed the number of huge pages by which -to adjust the subpool 'used page' count (down for get, up for put). Normally, -they return the same value that was passed or an error if not enough pages -exist in the subpool. - -However, if reserves are associated with the subpool a return value less -than the passed value may be returned. This return value indicates the -number of additional global pool adjustments which must be made. For example, -suppose a subpool contains 3 reserved huge pages and someone asks for 5. -The 3 reserved pages associated with the subpool can be used to satisfy part -of the request. But, 2 pages must be obtained from the global pools. To -relay this information to the caller, the value 2 is returned. The caller -is then responsible for attempting to obtain the additional two pages from -the global pools. - +hugepage_subpool_get/put_pages() use the number of huge pages passed to adjust +the subpool 'used page' count. COW and Reservations ==================== diff --git a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst index 20947f8bd0654..ae1f1f31477fc 100644 --- a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst +++ b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst @@ -246,15 +246,8 @@ hugepage_subpool的min_hpages字段中被跟踪。在挂载时，hugetlb_acct_me 被调用以预留指定数量的巨页。如果它们不能被预留，挂载就会失败。当从子池中获取或释放页面时，会调用hugepage_subpool_get/put_pages()函数。 -hugepage_subpool_get/put_pages被传递给巨页数量，以此来调整子池的 “已用页面” 计数 -（get为下降，put为上升）。通常情况下，如果子池中没有足够的页面，它们会返回与传递的相同的值或 -一个错误。 - -然而，如果预留与子池相关联，可能会返回一个小于传递值的返回值。这个返回值表示必须进行的额外全局 -池调整的数量。例如，假设一个子池包含3个预留的巨页，有人要求5个。与子池相关的3个预留页可以用来 -满足部分请求。但是，必须从全局池中获得2个页面。为了向调用者转达这一信息，将返回值2。然后，调用 -者要负责从全局池中获取另外两个页面。 - +它们负责所有子池的统计核算，并跟踪与子池相关联的预留。 +hugepage_subpool_get/put_pages()函数使用传入的巨页数量来调整子池的“已用页面”计数。 COW和预留 ========== diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 7611a8470ea26..5113f743f6fc7 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1109,8 +1109,12 @@ static int hugetlbfs_statfs(struct dentry dentry, struct kstatfs buf) spin_lock_irq(&sbinfo->spool->lock); buf->f_blocks = sbinfo->spool->max_hpages; - free_pages = sbinfo->spool->max_hpages - - sbinfo->spool->used_hpages; + if (sbinfo->spool->max_hpages == -1) { + free_pages = -1; + } else { + free_pages = sbinfo->spool->max_hpages - + sbinfo->spool->used_hpages; + } buf->f_bavail = buf->f_bfree = free_pages; spin_unlock_irq(&sbinfo->spool->lock); buf->f_files = sbinfo->max_inodes; diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 16c4c4caa126c..4551ff3023640 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -39,8 +39,8 @@ struct hugepage_subpool { spinlock_t lock; long count; long max_hpages; /* Maximum huge pages or -1 if no maximum. / - long used_hpages; / Used count against maximum, includes / - / both allocated and reserved pages. / + long used_hpages; / Used page count, includes both / + / allocated and reserved pages. / struct hstate hstate; long min_hpages; /* Minimum huge pages or -1 if no minimum. / long rsv_hpages; / Pages reserved against global pool to / diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4f6f58bf3db6c..1151ad959ffd5 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -130,12 +130,8 @@ static inline bool subpool_is_free(struct hugepage_subpool spool) { if (spool->count) return false; - if (spool->max_hpages != -1) - return spool->used_hpages == 0; - if (spool->min_hpages != -1) - return spool->rsv_hpages == spool->min_hpages; - return true; + return spool->used_hpages == 0; } static inline void unlock_or_release_subpool(struct hugepage_subpool spool, @@ -193,13 +189,18 @@ void hugepage_put_subpool(struct hugepage_subpool spool) unlock_or_release_subpool(spool, flags); } -/* - * Subpool accounting for allocating and reserving pages. - * Return -ENOMEM if there are not enough resources to satisfy the - * request. Otherwise, return the number of pages by which the - * global pools must be adjusted (upward). The returned value may - * only be different than the passed value (delta) in the case where - * a subpool minimum size must be maintained. +/** + * hugepage_subpool_get_pages - Get pages from a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to allocate or reserve + * + * Check and update subpool page usage counts when allocating or + * reserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irq(). + * Return: Non-negative number of reservations that cannot be + * satisfied by the subpool, or -ENOMEM if the subpool maximum + * limit would be exceeded. / static long hugepage_subpool_get_pages(struct hugepage_subpool spool, long delta) @@ -211,15 +212,14 @@ static long hugepage_subpool_get_pages(struct hugepage_subpool spool, spin_lock_irq(&spool->lock); - if (spool->max_hpages != -1) { / maximum size accounting / - if ((spool->used_hpages + delta) <= spool->max_hpages) - spool->used_hpages += delta; - else { - ret = -ENOMEM; - goto unlock_ret; - } + if (spool->max_hpages != -1 && + spool->used_hpages + delta > spool->max_hpages) { + ret = -ENOMEM; + goto unlock_ret; } + spool->used_hpages += delta; + / minimum size accounting / if (spool->min_hpages != -1 && spool->rsv_hpages) { if (delta > spool->rsv_hpages) { @@ -240,11 +240,19 @@ static long hugepage_subpool_get_pages(struct hugepage_subpool spool, return ret; } -/* - * Subpool accounting for freeing and unreserving pages. - * Return the number of global page reservations that must be dropped. - * The return value may only be different than the passed value (delta) - * in the case where a subpool minimum size must be maintained. +/** + * hugepage_subpool_put_pages - Release pages back to a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to free or unreserve + * + * Check and update subpool page usage counts when freeing or + * unreserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irqsave(). May release + * and free @spool if its usage count and references reach + * zero. + * Return: Non-negative number of reservations that the subpool cannot + * absorb. / static long hugepage_subpool_put_pages(struct hugepage_subpool spool, long delta) @@ -257,19 +265,24 @@ static long hugepage_subpool_put_pages(struct hugepage_subpool spool, spin_lock_irqsave(&spool->lock, flags); - if (spool->max_hpages != -1) / maximum size accounting / - spool->used_hpages -= delta; + spool->used_hpages -= delta; / minimum size accounting / if (spool->min_hpages != -1 && spool->used_hpages < spool->min_hpages) { - if (spool->rsv_hpages + delta <= spool->min_hpages) + / + * limit is the maximum number of reservations that + * can be restored to this subpool. + / + long limit = spool->min_hpages - spool->used_hpages; + + if (spool->rsv_hpages + delta <= limit) ret = 0; else - ret = spool->rsv_hpages + delta - spool->min_hpages; + ret = spool->rsv_hpages + delta - limit; spool->rsv_hpages += delta; - if (spool->rsv_hpages > spool->min_hpages) - spool->rsv_hpages = spool->min_hpages; + if (spool->rsv_hpages > limit) + spool->rsv_hpages = limit; } / @@ -2944,7 +2957,7 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, struct hugepage_subpool spool = subpool_vma(vma); struct hstate h = hstate_vma(vma); struct folio folio; - long retval, gbl_chg, gbl_reserve; + long retval, gbl_resv_get; map_chg_state map_chg; struct mempolicy_interpreted mpoli; gfp_t gfp = htlb_alloc_mask(h); @@ -2983,8 +2996,8 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, Or if it can get one from the pool reservation directly. / if (map_chg) { - gbl_chg = hugepage_subpool_get_pages(spool, 1); - if (gbl_chg < 0) { + gbl_resv_get = hugepage_subpool_get_pages(spool, 1); + if (gbl_resv_get < 0) { ret = -ENOSPC; goto out_end_reservation; } @@ -2993,7 +3006,7 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, If we have the vma reservation ready, no need for extra * global reservation. / - gbl_chg = 0; + gbl_resv_get = 0; } / @@ -3004,10 +3017,10 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, alloc_flags \|= HUGETLB_ALLOC_CHARG_CGROUP_RSVD; /* - * gbl_chg == 0 indicates a reservation exists for this + * gbl_resv_get == 0 indicates a reservation exists for this * allocation, so try to use it. / - if (gbl_chg == 0) + if (gbl_resv_get == 0) alloc_flags \|= HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS; / Takes reference on mpol. / @@ -3061,13 +3074,10 @@ struct folio alloc_hugetlb_folio(struct vm_area_struct vma, return folio; out_subpool_put: - / - * put page to subpool iff the quota of subpool's rsv_hpages is used - * during hugepage_subpool_get_pages. - / - if (map_chg && !gbl_chg) { - gbl_reserve = hugepage_subpool_put_pages(spool, 1); - hugetlb_acct_memory(h, -gbl_reserve); + if (map_chg) { + long gbl_resv_put = hugepage_subpool_put_pages(spool, 1); + + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); } out_end_reservation: @@ -6663,12 +6673,15 @@ long hugetlb_reserve_pages(struct inode inode, struct vm_area_struct vma, vma_flags_t vma_flags) { - long chg = -1, add = -1, spool_resv, gbl_resv; + long chg = -1, add = -1; struct hstate h = hstate_inode(inode); struct hugepage_subpool spool = subpool_inode(inode); struct resv_map resv_map; struct hugetlb_cgroup h_cg = NULL; - long gbl_reserve, regions_needed = 0; + long gbl_resv_accted = 0; + long regions_needed = 0; + long gbl_resv_get; + long gbl_resv_put; int err; / This should never happen / @@ -6743,9 +6756,9 @@ long hugetlb_reserve_pages(struct inode inode, * the subpool has a minimum size, there may be some global * reservations already in place (gbl_reserve). / - gbl_reserve = hugepage_subpool_get_pages(spool, chg); - if (gbl_reserve < 0) { - err = gbl_reserve; + gbl_resv_get = hugepage_subpool_get_pages(spool, chg); + if (gbl_resv_get < 0) { + err = gbl_resv_get; goto out_uncharge_cgroup; } @@ -6753,9 +6766,10 @@ long hugetlb_reserve_pages(struct inode inode, * Check enough hugepages are available for the reservation. * Hand the pages back to the subpool if there are not / - err = hugetlb_acct_memory(h, gbl_reserve); + err = hugetlb_acct_memory(h, gbl_resv_get); if (err < 0) goto out_put_pages; + gbl_resv_accted = gbl_resv_get; / * Account for the reservations made. Shared mappings record regions @@ -6772,7 +6786,6 @@ long hugetlb_reserve_pages(struct inode inode, add = region_add(resv_map, from, to, regions_needed, h, h_cg); if (unlikely(add < 0)) { - hugetlb_acct_memory(h, -gbl_reserve); err = add; goto out_put_pages; } else if (unlikely(chg > add)) { @@ -6808,26 +6821,22 @@ long hugetlb_reserve_pages(struct inode inode, } return chg; -out_put_pages: - spool_resv = chg - gbl_reserve; - if (spool_resv) { - /* put sub pool's reservation back, chg - gbl_reserve / - gbl_resv = hugepage_subpool_put_pages(spool, spool_resv); - / - * subpool's reserved pages can not be put back due to race, - * return to hstate. - / - hugetlb_acct_memory(h, -gbl_resv); - } - / Restore used_hpages for pages that failed global reservation / - if (gbl_reserve && spool) { - unsigned long flags; + out_put_pages: + / + * Return all that was requested from the subpool, let subpool + * tell us the new number of reservations that need to be + * returned to the global pool. + / + gbl_resv_put = hugepage_subpool_put_pages(spool, chg); + / + * There may be a difference between the number of + * reservations to consume and the number to restore now if + * there are multiple threads interacting with the subpool - + * restore the difference, taking into account any global + * reservations already acquired. + / + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put - gbl_resv_accted); - spin_lock_irqsave(&spool->lock, flags); - if (spool->max_hpages != -1) - spool->used_hpages -= gbl_reserve; - unlock_or_release_subpool(spool, flags); - } out_uncharge_cgroup: hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h), chg pages_per_huge_page(h), h_cg);
21/3	2026/09/09 22:01	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 7069 output: 37 thoughts: 1047 Thoughts: KMSAN Fuzzing Assessment for Hugetlbfs Patch Okay, let's dive into this patch and decide if we need to bring out the big guns with KMSAN, or if standard KASAN/sanitizers will suffice. First, I need to get a solid grasp of what's changing. The patch touches a handful of files, namely the documentation for hugetlbfs reservation and some core files in the filesystem and memory management subsystems: `Documentation/mm/hugetlbfs_reserv.rst`, `fs/hugetlbfs/inode.c`, `include/linux/hugetlb.h`, and `mm/hugetlb.c`. Specifically, I see changes in the `hugetlbfs_statfs` function within `fs/hugetlbfs/inode.c`. It looks like there's a modification to how free pages are calculated, handling a potential `-1` value for `max_hpages` in the `kstatfs` struct. This is interesting – it's crucial to understand how those counters are used elsewhere and whether a negative value could lead to any unexpected behavior. Then, there are changes in `mm/hugetlb.c` to the subpool functions: `subpool_is_free`, `hugepage_subpool_get_pages`, `hugepage_subpool_put_pages`, `alloc_hugetlb_folio`, and `hugetlb_reserve_pages`. These seem related to changes in the reservation and accounting logic for hugepages within subpools. I need to pay close attention to the accounting modifications in the subpool management functions; that's where uninitialized memory or race conditions can hide. Looking at the code for `alloc_hugetlb_folio`, the key change is in how variables are managed in the `map_chg` conditional branch. The previous logic had a flaw which caused a `gbl_resv` to be assigned conditionally, but was still used in an `if` statement to handle accounting. Now, the code explicitly initializes `gbl_resv_get` if `map_chg` is true, and it should then be safe in the `out_subpool_put` branch, where there might be a put operation performed. I will perform a deeper dive into the `alloc_hugetlb_folio` function to double-check that every variable is properly initialized and used, especially considering the changes to how the global reservation accounting is handled. Reading the full function from lines 2944 to 3080 should give me a better overview of the code, rather than just the snippets provided. Ultimately, I want to confirm there are no uninitialized variables, info leaks, or any other uninitialized memory hazards that might lead to unexpected behavior. Based on this initial review, I'm leaning towards the idea that KASAN and standard sanitizers should be sufficient to catch any potential issues here, but I need to be certain.
22/3	2026/09/09 22:01	tool	read-file	0m Args: { "File": "mm/hugetlb.c", "FirstLine": 2944, "LineCount": 100 } Results: { "Contents": "2944:\t\tMAP_CHG_ENFORCED = 2,\n2945:\t} map_chg_state;\n2946:\t\n2947:\t/\n2948:\t NOTE! \"cow_from_owner\" represents a very hacky usage only used in CoW\n2949:\t * faults of hugetlb private mappings on top of a non-page-cache folio (in\n2950:\t * which case even if there's a private vma resv map it won't cover such\n2951:\t * allocation). New call sites should (probably) never set it to true!!\n2952:\t * When it's set, the allocation will bypass all vma level reservations.\n2953:\t /\n2954:\tstruct folio alloc_hugetlb_folio(struct vm_area_struct vma,\n2955:\t\t\t\t\t unsigned long addr, bool cow_from_owner)\n2956:\t{\n2957:\t\tstruct hugepage_subpool spool = subpool_vma(vma);\n2958:\t\tstruct hstate h = hstate_vma(vma);\n2959:\t\tstruct folio folio;\n2960:\t\tlong retval, gbl_resv_get;\n2961:\t\tmap_chg_state map_chg;\n2962:\t\tstruct mempolicy_interpreted mpoli;\n2963:\t\tgfp_t gfp = htlb_alloc_mask(h);\n2964:\t\tstruct mempolicy mpol;\n2965:\t\tnodemask_t nodemask;\n2966:\t\tu8 alloc_flags = 0;\n2967:\t\tint nid;\n2968:\t\tint ret;\n2969:\t\n2970:\t\t/* Whether we need a separate per-vma reservation? /\n2971:\t\tif (cow_from_owner) {\n2972:\t\t\t/\n2973:\t\t\t * Special case! Since it's a CoW on top of a reserved\n2974:\t\t\t * page, the private resv map doesn't count. So it cannot\n2975:\t\t\t * consume the per-vma resv map even if it's reserved.\n2976:\t\t\t /\n2977:\t\t\tmap_chg = MAP_CHG_ENFORCED;\n2978:\t\t} else {\n2979:\t\t\t/\n2980:\t\t\t * Examine the region/reserve map to determine if the process\n2981:\t\t\t * has a reservation for the page to be allocated. A return\n2982:\t\t\t * code of zero indicates a reservation exists (no change).\n2983:\t\t\t /\n2984:\t\t\tretval = vma_needs_reservation(h, vma, addr);\n2985:\t\t\tif (retval \u003c 0)\n2986:\t\t\t\treturn ERR_PTR(-ENOMEM);\n2987:\t\t\tmap_chg = retval ? MAP_CHG_NEEDED : MAP_CHG_REUSE;\n2988:\t\t}\n2989:\t\n2990:\t\t/\n2991:\t\t * Whether we need a separate global reservation?\n2992:\t\t \n2993:\t\t Processes that did not create the mapping will have no\n2994:\t\t * reserves as indicated by the region/reserve map. Check\n2995:\t\t * that the allocation will not exceed the subpool limit.\n2996:\t\t * Or if it can get one from the pool reservation directly.\n2997:\t\t /\n2998:\t\tif (map_chg) {\n2999:\t\t\tgbl_resv_get = hugepage_subpool_get_pages(spool, 1);\n3000:\t\t\tif (gbl_resv_get \u003c 0) {\n3001:\t\t\t\tret = -ENOSPC;\n3002:\t\t\t\tgoto out_end_reservation;\n3003:\t\t\t}\n3004:\t\t} else {\n3005:\t\t\t/\n3006:\t\t\t * If we have the vma reservation ready, no need for extra\n3007:\t\t\t * global reservation.\n3008:\t\t\t /\n3009:\t\t\tgbl_resv_get = 0;\n3010:\t\t}\n3011:\t\n3012:\t\t/\n3013:\t\t * If allocation doesn't reuse a reservation in the resv_map,\n3014:\t\t * charge for the reservation.\n3015:\t\t /\n3016:\t\tif (map_chg != MAP_CHG_REUSE)\n3017:\t\t\talloc_flags \|= HUGETLB_ALLOC_CHARG_CGROUP_RSVD;\n3018:\t\n3019:\t\t/\n3020:\t\t * gbl_resv_get == 0 indicates a reservation exists for this\n3021:\t\t * allocation, so try to use it.\n3022:\t\t /\n3023:\t\tif (gbl_resv_get == 0)\n3024:\t\t\talloc_flags \|= HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS;\n3025:\t\n3026:\t\t/ Takes reference on mpol. */\n3027:\t\tnid = huge_node(vma, addr, gfp, \u0026mpol, \u0026nodemask);\n3028:\t\tmpoli = (struct mempolicy_interpreted){\n3029:\t\t\t.nid = nid,\n3030:\t#ifdef CONFIG_NUMA\n3031:\t\t\t.mode = mpol ? mpol-\u003emode : MPOL_DEFAULT,\n3032:\t#else\n3033:\t\t\t.mode = MPOL_DEFAULT,\n3034:\t#endif\n3035:\t\t\t.nodemask = nodemask,\n3036:\t\t};\n3037:\t\n3038:\t\tfolio = hugetlb_alloc_folio(h, \u0026mpoli, alloc_flags);\n3039:\t\n3040:\t\tmpol_cond_put(mpol);\n3041:\t\n3042:\t\tif (IS_ERR(folio)) {\n3043:\t\t\tret = PTR_ERR(folio);\n" }
23/3	2026/09/09 22:01	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 10365 output: 36 thoughts: 17 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: Focusing on a Specific Code Block Alright, I'm thinking we need to drill down and analyze a specific chunk of code. My intuition is telling me that the issue might be contained within lines 3044 through 3080. This is a targeted approach; it suggests a suspicion of where the problem lies. It could be based on previous debugging, recent changes, or even just a gut feeling derived from years of experience. I'm choosing to hone in on this section because, based on the context I've seen so far, it presents the best opportunity to observe the interaction and possible error. This is a highly focused diagnostic step.
24/3	2026/09/09 22:01	tool	read-file	0m Args: { "File": "mm/hugetlb.c", "FirstLine": 3044, "LineCount": 40 } Results: { "Contents": "3044:\t\t\tgoto out_subpool_put;\n3045:\t\t}\n3046:\t\n3047:\t\thugetlb_set_folio_subpool(folio, spool);\n3048:\t\n3049:\t\tif (map_chg != MAP_CHG_ENFORCED) {\n3050:\t\t\t/* commit() is only needed if the map_chg is not enforced /\n3051:\t\t\tretval = vma_commit_reservation(h, vma, addr);\n3052:\t\t\t/\n3053:\t\t\t * Check for possible race conditions. When it happens..\n3054:\t\t\t * The page was added to the reservation map between\n3055:\t\t\t * vma_needs_reservation and vma_commit_reservation.\n3056:\t\t\t * This indicates a race with hugetlb_reserve_pages.\n3057:\t\t\t * Adjust for the subpool count incremented above AND\n3058:\t\t\t * in hugetlb_reserve_pages for the same page.\tAlso,\n3059:\t\t\t * the reservation count added in hugetlb_reserve_pages\n3060:\t\t\t * no longer applies.\n3061:\t\t\t */\n3062:\t\t\tif (unlikely(map_chg == MAP_CHG_NEEDED \u0026\u0026 retval == 0)) {\n3063:\t\t\t\tlong rsv_adjust;\n3064:\t\n3065:\t\t\t\trsv_adjust = hugepage_subpool_put_pages(spool, 1);\n3066:\t\t\t\thugetlb_acct_memory(h, -rsv_adjust);\n3067:\t\t\t\tspin_lock_irq(\u0026hugetlb_lock);\n3068:\t\t\t\thugetlb_cgroup_uncharge_folio_rsvd(\n3069:\t\t\t\t hstate_index(h), pages_per_huge_page(h), folio);\n3070:\t\t\t\tspin_unlock_irq(\u0026hugetlb_lock);\n3071:\t\t\t}\n3072:\t\t}\n3073:\t\n3074:\t\treturn folio;\n3075:\t\n3076:\tout_subpool_put:\n3077:\t\tif (map_chg) {\n3078:\t\t\tlong gbl_resv_put = hugepage_subpool_put_pages(spool, 1);\n3079:\t\n3080:\t\t\thugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put);\n3081:\t\t}\n3082:\t\n3083:\tout_end_reservation:\n" }
25/3	2026/09/09 22:01	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 11254 output: 36 thoughts: 27 Thoughts: Here's my summary, as though I'm thinking through this myself, given my expertise: Checking `hugetlb_reserve_pages` - Delving into Memory Management Okay, so I need to zero in on how huge page reservations are handled. The code looks like it's around lines 6670 to 6840. That's a pretty specific range, suggesting a core piece of the reservation logic. I'm guessing that's where the actual allocation of the huge pages takes place, or perhaps where the bookkeeping is done. I'll need to check if there are any race conditions or memory leaks possible there. Given that it's the reservation process, I'm expecting to see calls to `alloc_pages` or something similar. I'll be looking to see if the allocation is atomic and properly synchronized in a multi-threaded system. I'll check how errors are handled - does it gracefully fall back if it can't reserve the requested pages? Are resources freed correctly when the reservation is no longer needed? I suspect I'll be digging into the allocation flags as well to see how the system is behaving under different workloads. This will also give me a clue as to how dynamic the reservation logic is.
26/3	2026/09/09 22:02	tool	read-file	0m Args: { "File": "mm/hugetlb.c", "FirstLine": 6670, "LineCount": 80 } Results: { "Contents": "6670:\t\n6671:\tlong hugetlb_reserve_pages(struct inode inode,\n6672:\t\t\tlong from, long to,\n6673:\t\t\tstruct vm_area_struct vma,\n6674:\t\t\tvma_flags_t vma_flags)\n6675:\t{\n6676:\t\tlong chg = -1, add = -1;\n6677:\t\tstruct hstate h = hstate_inode(inode);\n6678:\t\tstruct hugepage_subpool spool = subpool_inode(inode);\n6679:\t\tstruct resv_map resv_map;\n6680:\t\tstruct hugetlb_cgroup h_cg = NULL;\n6681:\t\tlong gbl_resv_accted = 0;\n6682:\t\tlong regions_needed = 0;\n6683:\t\tlong gbl_resv_get;\n6684:\t\tlong gbl_resv_put;\n6685:\t\tint err;\n6686:\t\n6687:\t\t/* This should never happen /\n6688:\t\tif (from \u003e to) {\n6689:\t\t\tVM_WARN(1, \"%s called with a negative range\\n\", __func__);\n6690:\t\t\treturn -EINVAL;\n6691:\t\t}\n6692:\t\n6693:\t\t/\n6694:\t\t * vma specific semaphore used for pmd sharing and fault/truncation\n6695:\t\t * synchronization\n6696:\t\t /\n6697:\t\thugetlb_vma_lock_alloc(vma);\n6698:\t\n6699:\t\t/\n6700:\t\t * Only apply hugepage reservation if asked. At fault time, an\n6701:\t\t * attempt will be made for VM_NORESERVE to allocate a page\n6702:\t\t * without using reserves\n6703:\t\t /\n6704:\t\tif (vma_flags_test(\u0026vma_flags, VMA_NORESERVE_BIT))\n6705:\t\t\treturn 0;\n6706:\t\n6707:\t\t/\n6708:\t\t * Shared mappings base their reservation on the number of pages that\n6709:\t\t * are already allocated on behalf of the file. Private mappings need\n6710:\t\t * to reserve the full area even if read-only as mprotect() may be\n6711:\t\t * called to make the mapping read-write. Assume !vma is a shm mapping\n6712:\t\t /\n6713:\t\tif (!vma \|\| vma_test(vma, VMA_MAYSHARE_BIT)) {\n6714:\t\t\t/\n6715:\t\t\t * resv_map can not be NULL as hugetlb_reserve_pages is only\n6716:\t\t\t * called for inodes for which resv_maps were created (see\n6717:\t\t\t * hugetlbfs_get_inode).\n6718:\t\t\t /\n6719:\t\t\tresv_map = inode_resv_map(inode);\n6720:\t\n6721:\t\t\tchg = region_chg(resv_map, from, to, \u0026regions_needed);\n6722:\t\t} else {\n6723:\t\t\t/ Private mapping. /\n6724:\t\t\tresv_map = resv_map_alloc();\n6725:\t\t\tif (!resv_map) {\n6726:\t\t\t\terr = -ENOMEM;\n6727:\t\t\t\tgoto out_err;\n6728:\t\t\t}\n6729:\t\n6730:\t\t\tchg = to - from;\n6731:\t\n6732:\t\t\tset_vma_resv_map(vma, resv_map);\n6733:\t\t\tset_vma_resv_flags(vma, HPAGE_RESV_OWNER);\n6734:\t\t}\n6735:\t\n6736:\t\tif (chg \u003c 0) {\n6737:\t\t\t/ region_chg() above can return -ENOMEM /\n6738:\t\t\terr = (chg == -ENOMEM) ? -ENOMEM : -EINVAL;\n6739:\t\t\tgoto out_err;\n6740:\t\t}\n6741:\t\n6742:\t\terr = hugetlb_cgroup_charge_cgroup_rsvd(hstate_index(h),\n6743:\t\t\t\t\tchg pages_per_huge_page(h), \u0026h_cg);\n6744:\t\tif (err \u003c 0)\n6745:\t\t\tgoto out_err;\n6746:\t\n6747:\t\tif (vma \u0026\u0026 !vma_test(vma, VMA_MAYSHARE_BIT) \u0026\u0026 h_cg) {\n6748:\t\t\t/* For private mappings, the hugetlb_cgroup uncharge info hangs\n6749:\t\t\t * of the resv_map.\n" }
27/3	2026/09/09 22:02	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 12849 output: 36 thoughts: 17 Thoughts: Okay, here's my attempt at summarizing the thought process, as requested, targeting an expert audience and using the first person: Analyzing Code Section 6750-6840 Alright, time to dive into lines 6750 through 6840. My immediate thought is, what's the context? What module or function are we within? That range usually points to a significant block of code, probably handling a critical process or data structure. I'm already mentally flagging this as potentially performance-sensitive, or maybe dealing with a tricky edge case based on where it falls in the broader file. Let's assume, for the sake of argument, this is within the `network_handler` module. My first step will be to quickly scan the lines for any immediately obvious red flags: nested loops, excessive memory allocation, recursive calls, or anything that jumps out as an anti-pattern. I'll be looking for any signs of inefficient algorithms. Is there a call to a database, and if so, how is the query constructed? Any chance of SQL injection vulnerabilities? Given the line numbers, I'd expect to see at least a couple of functions called or declarations. Are they well-named? Do they follow the conventions of the project? Badly named functions are a huge warning sign, suggesting either a lack of focus or some sloppy work. I'll also be checking for any undocumented side effects. Furthermore, I'm expecting this section to implement some aspect of a particular function, or even a system. I will look for calls to the operating system or other libraries, and what sort of arguments are being passed, and where they are being used. Are they protected against injection? I'll be paying close attention to any error handling. Is it robust? Does it log errors properly? Or is it a series of catch-all `try...except` blocks that hide underlying issues? Properly handling errors is vital. Finally, I'm going to quickly check for any comments. Are there clear explanations of the logic? Or is it a wall of uncommented code that requires a deep dive into the call graphs to understand? The best comments clearly state the intent, especially for any complex, or unusual functionality.
28/3	2026/09/09 22:02	tool	read-file	0m Args: { "File": "mm/hugetlb.c", "FirstLine": 6750, "LineCount": 90 } Results: { "Contents": "6750:\t\t\t /\n6751:\t\t\tresv_map_set_hugetlb_cgroup_uncharge_info(resv_map, h_cg, h);\n6752:\t\t}\n6753:\t\n6754:\t\t/\n6755:\t\t * There must be enough pages in the subpool for the mapping. If\n6756:\t\t * the subpool has a minimum size, there may be some global\n6757:\t\t * reservations already in place (gbl_reserve).\n6758:\t\t /\n6759:\t\tgbl_resv_get = hugepage_subpool_get_pages(spool, chg);\n6760:\t\tif (gbl_resv_get \u003c 0) {\n6761:\t\t\terr = gbl_resv_get;\n6762:\t\t\tgoto out_uncharge_cgroup;\n6763:\t\t}\n6764:\t\n6765:\t\t/\n6766:\t\t * Check enough hugepages are available for the reservation.\n6767:\t\t * Hand the pages back to the subpool if there are not\n6768:\t\t /\n6769:\t\terr = hugetlb_acct_memory(h, gbl_resv_get);\n6770:\t\tif (err \u003c 0)\n6771:\t\t\tgoto out_put_pages;\n6772:\t\tgbl_resv_accted = gbl_resv_get;\n6773:\t\n6774:\t\t/\n6775:\t\t * Account for the reservations made. Shared mappings record regions\n6776:\t\t * that have reservations as they are shared by multiple VMAs.\n6777:\t\t * When the last VMA disappears, the region map says how much\n6778:\t\t * the reservation was and the page cache tells how much of\n6779:\t\t * the reservation was consumed. Private mappings are per-VMA and\n6780:\t\t * only the consumed reservations are tracked. When the VMA\n6781:\t\t * disappears, the original reservation is the VMA size and the\n6782:\t\t * consumed reservations are stored in the map. Hence, nothing\n6783:\t\t * else has to be done for private mappings here\n6784:\t\t /\n6785:\t\tif (!vma \|\| vma_test(vma, VMA_MAYSHARE_BIT)) {\n6786:\t\t\tadd = region_add(resv_map, from, to, regions_needed, h, h_cg);\n6787:\t\n6788:\t\t\tif (unlikely(add \u003c 0)) {\n6789:\t\t\t\terr = add;\n6790:\t\t\t\tgoto out_put_pages;\n6791:\t\t\t} else if (unlikely(chg \u003e add)) {\n6792:\t\t\t\t/\n6793:\t\t\t\t * pages in this range were added to the reserve\n6794:\t\t\t\t * map between region_chg and region_add. This\n6795:\t\t\t\t * indicates a race with alloc_hugetlb_folio. Adjust\n6796:\t\t\t\t * the subpool and reserve counts modified above\n6797:\t\t\t\t * based on the difference.\n6798:\t\t\t\t /\n6799:\t\t\t\tlong rsv_adjust;\n6800:\t\n6801:\t\t\t\t/\n6802:\t\t\t\t * hugetlb_cgroup_uncharge_cgroup_rsvd() will put the\n6803:\t\t\t\t * reference to h_cg-\u003ecss. See comment below for detail.\n6804:\t\t\t\t /\n6805:\t\t\t\thugetlb_cgroup_uncharge_cgroup_rsvd(\n6806:\t\t\t\t\thstate_index(h),\n6807:\t\t\t\t\t(chg - add) pages_per_huge_page(h), h_cg);\n6808:\t\n6809:\t\t\t\trsv_adjust = hugepage_subpool_put_pages(spool,\n6810:\t\t\t\t\t\t\t\t\tchg - add);\n6811:\t\t\t\thugetlb_acct_memory(h, -rsv_adjust);\n6812:\t\t\t} else if (h_cg) {\n6813:\t\t\t\t/\n6814:\t\t\t\t The file_regions will hold their own reference to\n6815:\t\t\t\t * h_cg-\u003ecss. So we should release the reference held\n6816:\t\t\t\t * via hugetlb_cgroup_charge_cgroup_rsvd() when we are\n6817:\t\t\t\t * done.\n6818:\t\t\t\t /\n6819:\t\t\t\thugetlb_cgroup_put_rsvd_cgroup(h_cg);\n6820:\t\t\t}\n6821:\t\t}\n6822:\t\treturn chg;\n6823:\t\n6824:\t out_put_pages:\n6825:\t\t/\n6826:\t\t * Return all that was requested from the subpool, let subpool\n6827:\t\t * tell us the new number of reservations that need to be\n6828:\t\t * returned to the global pool.\n6829:\t\t /\n6830:\t\tgbl_resv_put = hugepage_subpool_put_pages(spool, chg);\n6831:\t\t/\n6832:\t\t * There may be a difference between the number of\n6833:\t\t * reservations to consume and the number to restore now if\n6834:\t\t * there are multiple threads interacting with the subpool -\n6835:\t\t * restore the difference, taking into account any global\n6836:\t\t * reservations already acquired.\n6837:\t\t */\n6838:\t\thugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put - gbl_resv_accted);\n6839:\t\n" }
29/3	2026/09/09 22:02	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 14839 output: 233 thoughts: 881 Thoughts: Analyzing the Hugetlbfs Subpool Accounting Patch Okay, let's break this down. My initial focus is on the core purpose of this patch: to iron out the subpool accounting logic within hugetlbfs, specifically addressing issues related to minimum and maximum limits, and importantly, ensuring it behaves correctly under concurrent scenarios and within `statfs`. I'm seeing targeted fixes and cleanups across several files. First, a documentation update in `Documentation/mm/hugetlbfs_reserv.rst`—always good to keep the documentation aligned with the code. Then, in `fs/hugetlbfs/inode.c`, the `hugetlbfs_statfs` function gets a tweak to correctly handle the `max_hpages == -1` scenario. The updated comments in `include/linux/hugetlb.h` clarify the use of `used_hpages`. The bulk of the changes seem to be in `mm/hugetlb.c`. I'm noting the optimizations in `subpool_is_free` (replacing branching with a direct comparison), and the simplifications in `hugepage_subpool_get_pages`, where the logic is clarified related to `spool->max_hpages != -1`. The crucial part for me is the fixes in `hugepage_subpool_put_pages`, specifically around the `limit` calculation for the minimum size accounting. The adjustment in `alloc_hugetlb_folio` during memory accounting on failure looks important too. Also the fix in `hugetlb_reserve_pages` for the `out_put_pages` cleanup path, ensuring proper accounting. Now, I need to check for potential vulnerabilities. My primary concerns are uninitialized memory allocations or reads. I've walked through the key functions: * In `hugetlbfs_statfs`, the relevant variables appear to be correctly initialized. `free_pages` gets either -1 or a calculated value based on existing data. The output buffer also looks good. * In `alloc_hugetlb_folio`, `gbl_resv_get` looks initialized in all code paths. * In `hugetlb_reserve_pages`, `gbl_resv_accted` is initialized to 0. `gbl_resv_get` is initialized before use. The flow seems sound here. * I can see no issues with uninitialized reads. No copy-to-user of uninitialized memory; no uninitialized structures passed anywhere; no padding leaks; no syscall interfaces returning kernel memory. This is good. The potential risks, from my experience, would be in incorrect reservation tracking. Integer underflows or overflows, or accounting desync are concerns. Resource exhaustion or OOM or page accounting leaks would be another risk. Standard concurrency issues are always on my mind, but these are all typical logic or accounting bugs. Now, is KMSAN needed here? Absolutely not. KMSAN is for catching uninitialized memory reads or kernel information leaks to userspace. KASAN/LOCKDEP/kernel asserts like VM\_BUG\_ON etc., will catch any memory corruption, use-after-free, or refcounting issues. We're looking at logical accounting here, not uninitialized memory issues. Therefore, this patch does not require KMSAN. The KMSANReasoning is that uninitialized reads and kernel-to-user info leaks aren't relevant here.
30/3	2026/09/09 22:02	tool	set-results	0m Args: { "KMSANReasoning": "The patch modifies the subpool accounting and reservation logic for hugetlbfs (including hugetlb_subpool_get_pages, hugetlb_subpool_put_pages, statfs reporting, and rollback handling in alloc_hugetlb_folio and hugetlb_reserve_pages).\n\nAll local variables introduced or modified (such as gbl_resv_get, gbl_resv_put, gbl_resv_accted, limit, and free_pages) are explicitly initialized before use across all control flow paths. No new structures or buffers are allocated without initialization, no padding bytes are exposed, and no uninitialized kernel memory is passed to user space or used in conditional branching.\n\nPotential risks associated with this patch involve page accounting inaccuracies, concurrency/synchronization under race conditions, or memory exhaustion, which are covered by standard kernel assertions, KASAN, and LOCKDEP. There are no uninitialized memory hazards that would necessitate a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false } Results: { "KMSANReasoning": "The patch modifies the subpool accounting and reservation logic for hugetlbfs (including hugetlb_subpool_get_pages, hugetlb_subpool_put_pages, statfs reporting, and rollback handling in alloc_hugetlb_folio and hugetlb_reserve_pages).\n\nAll local variables introduced or modified (such as gbl_resv_get, gbl_resv_put, gbl_resv_accted, limit, and free_pages) are explicitly initialized before use across all control flow paths. No new structures or buffers are allocated without initialization, no padding bytes are exposed, and no uninitialized kernel memory is passed to user space or used in conditional branching.\n\nPotential risks associated with this patch involve page accounting inaccuracies, concurrency/synchronization under race conditions, or memory exhaustion, which are covered by standard kernel assertions, KASAN, and LOCKDEP. There are no uninitialized memory hazards that would necessitate a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false }

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)