AI Trajectory

null

{
  "EnableConfigs": [
    "ZSWAP",
    "SWAP",
    "ZSWAP_DEFAULT_ON"
  ],
  "FocusSymbols": [
    "zswap_folio_is_writeback_buffer",
    "zswap_lookup_and_clear_shadows",
    "__swap_cache_alloc_folio",
    "workingset_refault",
    "workingset_refault_lru_managed",
    "swapin_sync",
    "zswap_store"
  ],
  "KMSANReasoning": "The patch modifies swap cache and zswap logic to preserve workingset shadow entries during zswap writeback. It does not introduce any new data structures copied to user space, nor does it allocate buffers that could be left uninitialized. The changes involve pointer manipulation, folio state management, and xarray operations. Any potential bugs introduced by these changes would likely be out-of-bounds accesses, use-after-free, or NULL pointer dereferences, which are effectively caught by KASAN and standard kernel debugging tools. There is no risk of uninitialized memory usage or info-leaks that would necessitate a dedicated KMSAN fuzzing session.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the zswap and swap cache logic to properly handle workingset refaults for zswap writeback buffers. It introduces new functions to check if a folio is a writeback buffer and to lookup and clear shadows, and modifies the swap cache allocation and deletion paths to preserve and restore shadows. This is a core memory management change with functional impact that is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit c288a91059cdda76077628323b690235c3c89c44\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Aug 25 18:53:39 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/include/linux/zswap.h b/include/linux/zswap.h\nindex 30c193a1207e1..dfb7153236f5c 100644\n--- a/include/linux/zswap.h\n+++ b/include/linux/zswap.h\n@@ -35,6 +35,8 @@ void zswap_lruvec_state_init(struct lruvec *lruvec);\n void zswap_folio_swapin(struct folio *folio);\n bool zswap_is_enabled(void);\n bool zswap_never_enabled(void);\n+bool zswap_folio_is_writeback_buffer(struct folio *folio);\n+void *zswap_lookup_and_clear_shadows(struct folio *folio);\n #else\n \n struct zswap_lruvec_state {};\n@@ -69,6 +71,16 @@ static inline bool zswap_never_enabled(void)\n \treturn true;\n }\n \n+static inline bool zswap_folio_is_writeback_buffer(struct folio *folio)\n+{\n+\treturn false;\n+}\n+\n+static inline void *zswap_lookup_and_clear_shadows(struct folio *folio)\n+{\n+\treturn NULL;\n+}\n+\n #endif\n \n #endif /* _LINUX_ZSWAP_H */\ndiff --git a/mm/internal.h b/mm/internal.h\nindex 38b1165212c94..c191887c1feda 100644\n--- a/mm/internal.h\n+++ b/mm/internal.h\n@@ -38,6 +38,7 @@ void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages);\n void *workingset_eviction(struct folio *folio,\n \t\t\t  struct mem_cgroup *target_memcg);\n void workingset_refault(struct folio *folio, void *shadow);\n+void workingset_refault_lru_managed(struct folio *folio, void *shadow);\n void workingset_activation(struct folio *folio);\n \n /* mm/folio.c */\ndiff --git a/mm/memory.c b/mm/memory.c\nindex c6a9242d1b5bd..771197b3fcc5c 100644\n--- a/mm/memory.c\n+++ b/mm/memory.c\n@@ -4894,6 +4894,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)\n \tunsigned long page_idx;\n \tunsigned long address;\n \tpte_t *ptep;\n+\tvoid *shadow;\n \n \tif (!pte_unmap_same(vmf))\n \t\tgoto out;\n@@ -5018,6 +5019,10 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)\n \t\tgoto out_page;\n \t}\n \n+\tshadow = zswap_lookup_and_clear_shadows(folio);\n+\tif (shadow)\n+\t\tworkingset_refault_lru_managed(folio, shadow);\n+\n \t/*\n \t * KSM sometimes has to copy on read faults, for example, if\n \t * folio-\u003eindex of non-ksm folios would be nonlinear inside the\ndiff --git a/mm/shmem.c b/mm/shmem.c\nindex 599665a3d6e7b..1ef6cc76605e5 100644\n--- a/mm/shmem.c\n+++ b/mm/shmem.c\n@@ -2266,6 +2266,7 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \tstruct folio *folio = NULL;\n \tint error, nr_pages, order;\n \tpgoff_t offset;\n+\tvoid *shadow;\n \n \tVM_BUG_ON(!*foliop || !xa_is_value(*foliop));\n \tindex_entry = radix_to_swp_entry(*foliop);\n@@ -2377,6 +2378,10 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n \t */\n \tarch_swap_restore(folio_swap(swap, folio), folio);\n \n+\tshadow = zswap_lookup_and_clear_shadows(folio);\n+\tif (shadow)\n+\t\tworkingset_refault_lru_managed(folio, shadow);\n+\n \tif (shmem_should_replace_folio(folio, gfp)) {\n \t\terror = shmem_replace_folio(\u0026folio, gfp, info, index, vma);\n \t\tif (error)\ndiff --git a/mm/swap.h b/mm/swap.h\nindex 90a551a88df63..8679cb61268e5 100644\n--- a/mm/swap.h\n+++ b/mm/swap.h\n@@ -312,9 +312,9 @@ bool swap_cache_has_folio(swp_entry_t entry);\n struct folio *swap_cache_get_folio(swp_entry_t entry);\n void *swap_cache_get_shadow(swp_entry_t entry);\n void swap_cache_del_folio(struct folio *folio);\n-struct folio *swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,\n-\t\t\t\t     unsigned long orders, struct vm_fault *vmf,\n-\t\t\t\t     struct mempolicy *mpol, pgoff_t ilx);\n+struct folio *__swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,\n+\t\t\t\t       unsigned long orders, struct vm_fault *vmf,\n+\t\t\t\t       struct mempolicy *mpol, pgoff_t ilx);\n /* Below helpers require the caller to lock and pass in the swap cluster. */\n void __swap_cache_add_folio(struct swap_cluster_info *ci,\n \t\t\t    struct folio *folio, swp_entry_t entry);\ndiff --git a/mm/swap_state.c b/mm/swap_state.c\nindex b76eb3d876fd7..df9e0452f19b9 100644\n--- a/mm/swap_state.c\n+++ b/mm/swap_state.c\n@@ -24,6 +24,7 @@\n #include \u003clinux/shmem_fs.h\u003e\n #include \u003clinux/sysctl.h\u003e\n #include \u003clinux/swap_ops.h\u003e\n+#include \u003clinux/zswap.h\u003e\n #include \"internal.h\"\n #include \"swap_table.h\"\n #include \"swap.h\"\n@@ -263,12 +264,21 @@ static void __swap_cache_do_del_folio(struct swap_cluster_info *ci,\n \tunsigned int ci_start, ci_off, ci_end;\n \tbool folio_swapped = false, need_free = false;\n \tunsigned long nr_pages = folio_nr_pages(folio);\n+\tvoid *shadow_parked;\n \n \tVM_WARN_ON_ONCE(__swap_entry_to_cluster(entry) != ci);\n \tVM_WARN_ON_ONCE_FOLIO(!folio_test_locked(folio), folio);\n \tVM_WARN_ON_ONCE_FOLIO(!folio_test_swapcache(folio), folio);\n \tVM_WARN_ON_ONCE_FOLIO(folio_test_writeback(folio), folio);\n \n+\t/*\n+\t * A zswap writeback buffer parked the slot's original shadow in the\n+\t * zswap tree: restore it into the slot for later swap-in.\n+\t */\n+\tshadow_parked = zswap_lookup_and_clear_shadows(folio);\n+\tif (shadow_parked)\n+\t\tshadow = shadow_parked;\n+\n \tsi = __swap_entry_to_info(entry);\n \tci_start = swp_cluster_offset(entry);\n \tci_end = ci_start + nr_pages;\n@@ -483,19 +493,15 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,\n \n \t/* memsw uncharges swap when folio is added to swap cache */\n \tmemcg1_swapin(folio);\n-\tif (shadow)\n-\t\tworkingset_refault(folio, shadow);\n \n \tnode_stat_mod_folio(folio, NR_FILE_PAGES, nr_pages);\n \tlruvec_stat_mod_folio(folio, NR_SWAPCACHE, nr_pages);\n \n-\t/* Caller will initiate read into locked new_folio */\n-\tfolio_add_lru(folio);\n \treturn folio;\n }\n \n /**\n- * swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.\n+ * __swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.\n  * @targ_entry: swap entry indicating the target slot\n  * @gfp: memory allocation flags\n  * @orders: allocation orders, must be non zero\n@@ -507,13 +513,17 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,\n  * doing IO (e.g. swap in or zswap writeback). The swap slot indicated by\n  * @targ_entry must have a non-zero swap count (swapped out).\n  *\n+ * The returned folio is locked and is NOT on the LRU. The caller must either\n+ * add it to the LRU with folio_add_lru() so page reclaim can find it, or free\n+ * it directly once done; a folio left off the LRU is unreclaimable and leaks.\n+ *\n  * Context: Caller must protect the swap device with reference count or locks.\n  * Return: Returns the folio if allocation succeeded and folio is in the swap\n  * cache. Returns error code if failed due to race, OOM or invalid arguments.\n  */\n-struct folio *swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,\n-\t\t\t\t     unsigned long orders, struct vm_fault *vmf,\n-\t\t\t\t     struct mempolicy *mpol, pgoff_t ilx)\n+struct folio *__swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,\n+\t\t\t\t       unsigned long orders, struct vm_fault *vmf,\n+\t\t\t\t       struct mempolicy *mpol, pgoff_t ilx)\n {\n \tint order, err;\n \tstruct folio *ret;\n@@ -644,17 +654,27 @@ static struct folio *swap_cache_read_folio(struct swap_io_ctx *ctx,\n \t\tpgoff_t ilx, bool readahead)\n {\n \tstruct folio *folio;\n+\tvoid *shadow = NULL;\n \n \tdo {\n \t\tfolio = swap_cache_get_folio(entry);\n \t\tif (folio)\n \t\t\treturn folio;\n-\t\tfolio = swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);\n+\t\t/*\n+\t\t * Capture the slot's shadow before the allocation overwrites it,\n+\t\t * so a fresh swap-in can be evaluated as a refault below.\n+\t\t */\n+\t\tshadow = swap_cache_get_shadow(entry);\n+\t\tfolio = __swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);\n \t} while (PTR_ERR(folio) == -EEXIST);\n \n \tif (IS_ERR_OR_NULL(folio))\n \t\treturn NULL;\n \n+\tif (shadow)\n+\t\tworkingset_refault(folio, shadow);\n+\n+\tfolio_add_lru(folio);\n \tswap_read_folio(ctx, folio);\n \tif (readahead) {\n \t\tfolio_set_readahead(folio);\n@@ -685,17 +705,27 @@ struct folio *swapin_sync(swp_entry_t entry, gfp_t gfp, unsigned long orders,\n {\n \tstruct swap_io_ctx ctx = {};\n \tstruct folio *folio;\n+\tvoid *shadow = NULL;\n \n \tdo {\n \t\tfolio = swap_cache_get_folio(entry);\n \t\tif (folio)\n \t\t\treturn folio;\n-\t\tfolio = swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);\n+\t\t/*\n+\t\t * Capture the slot's shadow before the allocation overwrites it,\n+\t\t * so a fresh swap-in can be evaluated as a refault below.\n+\t\t */\n+\t\tshadow = swap_cache_get_shadow(entry);\n+\t\tfolio = __swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);\n \t} while (PTR_ERR(folio) == -EEXIST);\n \n \tif (IS_ERR(folio))\n \t\treturn folio;\n \n+\tif (shadow)\n+\t\tworkingset_refault(folio, shadow);\n+\n+\tfolio_add_lru(folio);\n \tswap_read_folio(\u0026ctx, folio);\n \tswap_read_submit(\u0026ctx);\n \treturn folio;\ndiff --git a/mm/vmscan.c b/mm/vmscan.c\nindex 73a81b4a3e164..9905753b7a10c 100644\n--- a/mm/vmscan.c\n+++ b/mm/vmscan.c\n@@ -48,6 +48,7 @@\n #include \u003clinux/prefetch.h\u003e\n #include \u003clinux/printk.h\u003e\n #include \u003clinux/dax.h\u003e\n+#include \u003clinux/zswap.h\u003e\n #include \u003clinux/psi.h\u003e\n #include \u003clinux/pagewalk.h\u003e\n #include \u003clinux/shmem_fs.h\u003e\n@@ -733,7 +734,8 @@ static int __remove_mapping(struct address_space *mapping, struct folio *folio,\n \tif (folio_test_swapcache(folio)) {\n \t\tswp_entry_t swap = folio-\u003eswap;\n \n-\t\tif (reclaimed \u0026\u0026 !mapping_exiting(mapping))\n+\t\tif (reclaimed \u0026\u0026 !mapping_exiting(mapping) \u0026\u0026\n+\t\t    !zswap_folio_is_writeback_buffer(folio))\n \t\t\tshadow = workingset_eviction(folio, target_memcg);\n \t\t__memcg1_swapout(folio, ci);\n \t\t__swap_cache_del_folio(ci, folio, swap, shadow);\ndiff --git a/mm/workingset.c b/mm/workingset.c\nindex 7ac2b88c80ae5..e203d631f61b8 100644\n--- a/mm/workingset.c\n+++ b/mm/workingset.c\n@@ -536,16 +536,8 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset,\n \treturn refault_distance \u003c= workingset_size;\n }\n \n-/**\n- * workingset_refault - Evaluate the refault of a previously evicted folio.\n- * @folio: The freshly allocated replacement folio.\n- * @shadow: Shadow entry of the evicted folio.\n- *\n- * Calculates and evaluates the refault distance of the previously\n- * evicted folio in the context of the node and the memcg whose memory\n- * pressure caused the eviction.\n- */\n-void workingset_refault(struct folio *folio, void *shadow)\n+static void __workingset_refault(struct folio *folio, void *shadow,\n+\t\t\t\t bool lru_managed)\n {\n \tbool file = folio_is_file_lru(folio);\n \tstruct mem_cgroup *memcg;\n@@ -577,7 +569,16 @@ void workingset_refault(struct folio *folio, void *shadow)\n \tif (!workingset_test_recent(shadow, file, \u0026workingset, true))\n \t\tgoto out;\n \n-\tfolio_set_active(folio);\n+\t/*\n+\t * An LRU-managed folio may sit in a per-CPU batch, which cannot be\n+\t * determined here: setting the flag would race the drain and leave it\n+\t * disagreeing with the list. folio_activate() is safe, but misses the\n+\t * activation for such a folio.\n+\t */\n+\tif (lru_managed)\n+\t\tfolio_activate(folio);\n+\telse\n+\t\tfolio_set_active(folio);\n \tworkingset_age_nonresident(lruvec, nr);\n \tmod_lruvec_state(lruvec, WORKINGSET_ACTIVATE_BASE + file, nr);\n \n@@ -590,6 +591,43 @@ void workingset_refault(struct folio *folio, void *shadow)\n \tmem_cgroup_put(memcg);\n }\n \n+/**\n+ * workingset_refault - Evaluate the refault of a previously evicted folio.\n+ * @folio: The freshly allocated replacement folio.\n+ * @shadow: Shadow entry of the evicted folio.\n+ *\n+ * Calculates and evaluates the refault distance of the previously\n+ * evicted folio in the context of the node and the memcg whose memory\n+ * pressure caused the eviction.\n+ *\n+ * Context: @folio must be locked and not on the LRU yet, the caller adds\n+ * it with folio_add_lru() afterwards.\n+ */\n+void workingset_refault(struct folio *folio, void *shadow)\n+{\n+\t__workingset_refault(folio, shadow, false);\n+}\n+\n+/**\n+ * workingset_refault_lru_managed - Evaluate the refault of a previously\n+ * evicted folio that is already on the LRU.\n+ * @folio: The folio the eviction is refaulted into.\n+ * @shadow: Shadow entry of the evicted folio.\n+ *\n+ * Like workingset_refault(), but for a folio the caller has already added\n+ * to the LRU, which has to be activated by moving it between the lists\n+ * rather than by setting PG_active.\n+ *\n+ * The activation is best effort: a folio still sitting in a per-CPU LRU\n+ * batch cannot be moved yet and is left inactive.\n+ *\n+ * Context: @folio must be locked and already added to the LRU.\n+ */\n+void workingset_refault_lru_managed(struct folio *folio, void *shadow)\n+{\n+\t__workingset_refault(folio, shadow, true);\n+}\n+\n /**\n  * workingset_activation - note a page activation\n  * @folio: Folio that is being activated.\ndiff --git a/mm/zswap.c b/mm/zswap.c\nindex 37f34e406c8e3..c1a78edfa0b87 100644\n--- a/mm/zswap.c\n+++ b/mm/zswap.c\n@@ -972,6 +972,79 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)\n /*********************************\n * writeback code\n **********************************/\n+\n+#define ZSWAP_WRITEBACK_NO_SHADOW xa_mk_value(0)\n+\n+/**\n+ * zswap_folio_is_writeback_buffer - is @folio a zswap writeback buffer?\n+ * @folio: the folio being examined (typically a swap cache folio under reclaim)\n+ *\n+ * A folio is a zswap writeback buffer when every one of its swap offsets holds\n+ * a parked writeback shadow (a real shadow or the ZSWAP_WRITEBACK_NO_SHADOW\n+ * sentinel) in the zswap tree rather than a live zswap entry.\n+ *\n+ * Return: true if @folio is a writeback buffer, in which case the reclaim path\n+ * must not mint a fresh workingset shadow for it.\n+ */\n+bool zswap_folio_is_writeback_buffer(struct folio *folio)\n+{\n+\tswp_entry_t swp = folio-\u003eswap;\n+\tunsigned long nr_pages = folio_nr_pages(folio);\n+\tpgoff_t offset = swp_offset(swp);\n+\tunsigned long i;\n+\n+\tif (zswap_never_enabled())\n+\t\treturn false;\n+\n+\tfor (i = 0; i \u003c nr_pages; i++) {\n+\t\tswp_entry_t e = swp_entry(swp_type(swp), offset + i);\n+\n+\t\tif (!xa_is_value(xa_load(swap_zswap_tree(e), offset + i)))\n+\t\t\treturn false;\n+\t}\n+\n+\treturn true;\n+}\n+\n+/**\n+ * zswap_lookup_and_clear_shadows - retrieve and clear @folio's parked shadow(s)\n+ * @folio: the writeback buffer folio (or the swapin folio that consumed it)\n+ *\n+ * Remove any parked writeback shadows for @folio's swap offset(s) from the\n+ * zswap tree.\n+ *\n+ * Return: the preserved workingset shadow, or NULL if the slot(s) had no shadow\n+ * (sentinel only) or nothing parked. The caller either restores the returned\n+ * shadow into the swap slot (buffer dropped) or feeds it to\n+ * workingset_refault_lru_managed() (buffer consumed by a swapin); clearing\n+ * here ensures the two paths never double-count.\n+ */\n+void *zswap_lookup_and_clear_shadows(struct folio *folio)\n+{\n+\tswp_entry_t swp = folio-\u003eswap;\n+\tunsigned long nr_pages = folio_nr_pages(folio);\n+\tpgoff_t offset = swp_offset(swp);\n+\tvoid *shadow = NULL;\n+\tunsigned long i;\n+\n+\tif (zswap_never_enabled())\n+\t\treturn NULL;\n+\n+\tfor (i = 0; i \u003c nr_pages; i++) {\n+\t\tswp_entry_t e = swp_entry(swp_type(swp), offset + i);\n+\t\tstruct xarray *tree = swap_zswap_tree(e);\n+\t\tvoid *parked = xa_load(tree, offset + i);\n+\n+\t\tif (!xa_is_value(parked))\n+\t\t\tcontinue;\n+\t\txa_erase(tree, offset + i);\n+\t\tif (parked != ZSWAP_WRITEBACK_NO_SHADOW)\n+\t\t\tshadow = parked;\n+\t}\n+\n+\treturn shadow;\n+}\n+\n /*\n  * Attempts to free an entry by adding a folio to the swap cache,\n  * decompressing the entry data into the folio, and issuing a\n@@ -987,12 +1060,14 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)\n static int zswap_writeback_entry(struct zswap_entry *entry,\n \t\t\t\t swp_entry_t swpentry)\n {\n+\tstruct swap_cluster_info *ci;\n \tstruct xarray *tree;\n \tpgoff_t offset = swp_offset(swpentry);\n \tstruct folio *folio;\n \tstruct mempolicy *mpol;\n \tstruct swap_info_struct *si;\n \tstruct swap_io_ctx ctx = {};\n+\tvoid *shadow;\n \tint ret = 0;\n \n \t/* try to allocate swap cache folio */\n@@ -1000,9 +1075,11 @@ static int zswap_writeback_entry(struct zswap_entry *entry,\n \tif (!si)\n \t\treturn -EEXIST;\n \n+\tshadow = swap_cache_get_shadow(swpentry);\n+\n \tmpol = get_task_policy(current);\n-\tfolio = swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,\n-\t\t\t\t       NO_INTERLEAVE_INDEX);\n+\tfolio = __swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,\n+\t\t\t\t\t NO_INTERLEAVE_INDEX);\n \tput_swap_device(si);\n \n \t/*\n@@ -1014,6 +1091,7 @@ static int zswap_writeback_entry(struct zswap_entry *entry,\n \t */\n \tif (IS_ERR(folio))\n \t\treturn PTR_ERR(folio);\n+\tfolio_add_lru(folio);\n \n \t/*\n \t * folio is locked, and the swapcache is now secured against\n@@ -1035,7 +1113,12 @@ static int zswap_writeback_entry(struct zswap_entry *entry,\n \t\tgoto out;\n \t}\n \n-\txa_erase(tree, offset);\n+\t/*\n+\t * A slot with no shadow already reads back as ZSWAP_WRITEBACK_NO_SHADOW:\n+\t * the swap table marks a swapped out slot with xa_mk_value(0) and holds\n+\t * the shadow, when there is one, in that same value.\n+\t */\n+\txa_store(tree, offset, shadow, GFP_KERNEL);\n \n \tcount_vm_event(ZSWPWB);\n \tif (entry-\u003eobjcg)\n@@ -1055,7 +1138,15 @@ static int zswap_writeback_entry(struct zswap_entry *entry,\n \n out:\n \tif (ret) {\n-\t\tswap_cache_del_folio(folio);\n+\t\t/*\n+\t\t * The allocation above overwrote the slot's shadow and nothing\n+\t\t * has been parked for it yet, so restore it as the folio leaves\n+\t\t * the swap cache, or the eviction it records is lost.\n+\t\t */\n+\t\tci = swap_cluster_lock(__swap_entry_to_info(swpentry), offset);\n+\t\t__swap_cache_del_folio(ci, folio, swpentry, shadow);\n+\t\tswap_cluster_unlock(ci);\n+\t\tfolio_ref_sub(folio, folio_nr_pages(folio));\n \t\tfolio_unlock(folio);\n \t}\n \tfolio_put(folio);\n@@ -1498,6 +1589,17 @@ bool zswap_store(struct folio *folio)\n \tVM_WARN_ON_ONCE(!folio_test_locked(folio));\n \tVM_WARN_ON_ONCE(!folio_test_swapcache(folio));\n \n+\t/*\n+\t * A writeback buffer whose IO failed is redirtied and left in the\n+\t * swap cache, so reclaim writes it out again. Writeback already\n+\t * decided this data belongs on disk, so send it there instead of\n+\t * compressing it back into zswap. This also leaves the shadow\n+\t * parked for the buffer in place, so it is still restored into\n+\t * the slot once the folio leaves the swap cache.\n+\t */\n+\tif (zswap_folio_is_writeback_buffer(folio))\n+\t\treturn false;\n+\n \tif (!zswap_enabled)\n \t\tgoto check_old;\n \n"
}

best-expensive

null

{
  "EnableConfigs": [
    "ZSWAP",
    "SWAP",
    "ZSWAP_DEFAULT_ON"
  ],
  "FocusSymbols": [
    "zswap_folio_is_writeback_buffer",
    "zswap_lookup_and_clear_shadows",
    "__swap_cache_alloc_folio",
    "workingset_refault",
    "workingset_refault_lru_managed",
    "swapin_sync",
    "zswap_store"
  ],
  "Reasoning": "The patch modifies the zswap and swap cache logic to properly handle workingset refaults for zswap writeback buffers. It introduces new functions to check if a folio is a writeback buffer and to lookup and clear shadows, and modifies the swap cache allocation and deletion paths to preserve and restore shadows. This is a core memory management change with functional impact that is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit c288a91059cdda76077628323b690235c3c89c44
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 25 18:53:39 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/zswap.h b/include/linux/zswap.h
index 30c193a1207e1..dfb7153236f5c 100644
--- a/include/linux/zswap.h
+++ b/include/linux/zswap.h
@@ -35,6 +35,8 @@ void zswap_lruvec_state_init(struct lruvec *lruvec);
 void zswap_folio_swapin(struct folio *folio);
 bool zswap_is_enabled(void);
 bool zswap_never_enabled(void);
+bool zswap_folio_is_writeback_buffer(struct folio *folio);
+void *zswap_lookup_and_clear_shadows(struct folio *folio);
 #else
 
 struct zswap_lruvec_state {};
@@ -69,6 +71,16 @@ static inline bool zswap_never_enabled(void)
 	return true;
 }
 
+static inline bool zswap_folio_is_writeback_buffer(struct folio *folio)
+{
+	return false;
+}
+
+static inline void *zswap_lookup_and_clear_shadows(struct folio *folio)
+{
+	return NULL;
+}
+
 #endif
 
 #endif /* _LINUX_ZSWAP_H */
diff --git a/mm/internal.h b/mm/internal.h
index 38b1165212c94..c191887c1feda 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -38,6 +38,7 @@ void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages);
 void *workingset_eviction(struct folio *folio,
 			  struct mem_cgroup *target_memcg);
 void workingset_refault(struct folio *folio, void *shadow);
+void workingset_refault_lru_managed(struct folio *folio, void *shadow);
 void workingset_activation(struct folio *folio);
 
 /* mm/folio.c */
diff --git a/mm/memory.c b/mm/memory.c
index c6a9242d1b5bd..771197b3fcc5c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4894,6 +4894,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 	unsigned long page_idx;
 	unsigned long address;
 	pte_t *ptep;
+	void *shadow;
 
 	if (!pte_unmap_same(vmf))
 		goto out;
@@ -5018,6 +5019,10 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 		goto out_page;
 	}
 
+	shadow = zswap_lookup_and_clear_shadows(folio);
+	if (shadow)
+		workingset_refault_lru_managed(folio, shadow);
+
 	/*
 	 * KSM sometimes has to copy on read faults, for example, if
 	 * folio->index of non-ksm folios would be nonlinear inside the
diff --git a/mm/shmem.c b/mm/shmem.c
index 599665a3d6e7b..1ef6cc76605e5 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2266,6 +2266,7 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
 	struct folio *folio = NULL;
 	int error, nr_pages, order;
 	pgoff_t offset;
+	void *shadow;
 
 	VM_BUG_ON(!*foliop || !xa_is_value(*foliop));
 	index_entry = radix_to_swp_entry(*foliop);
@@ -2377,6 +2378,10 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
 	 */
 	arch_swap_restore(folio_swap(swap, folio), folio);
 
+	shadow = zswap_lookup_and_clear_shadows(folio);
+	if (shadow)
+		workingset_refault_lru_managed(folio, shadow);
+
 	if (shmem_should_replace_folio(folio, gfp)) {
 		error = shmem_replace_folio(&folio, gfp, info, index, vma);
 		if (error)
diff --git a/mm/swap.h b/mm/swap.h
index 90a551a88df63..8679cb61268e5 100644
--- a/mm/swap.h
+++ b/mm/swap.h
@@ -312,9 +312,9 @@ bool swap_cache_has_folio(swp_entry_t entry);
 struct folio *swap_cache_get_folio(swp_entry_t entry);
 void *swap_cache_get_shadow(swp_entry_t entry);
 void swap_cache_del_folio(struct folio *folio);
-struct folio *swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,
-				     unsigned long orders, struct vm_fault *vmf,
-				     struct mempolicy *mpol, pgoff_t ilx);
+struct folio *__swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,
+				       unsigned long orders, struct vm_fault *vmf,
+				       struct mempolicy *mpol, pgoff_t ilx);
 /* Below helpers require the caller to lock and pass in the swap cluster. */
 void __swap_cache_add_folio(struct swap_cluster_info *ci,
 			    struct folio *folio, swp_entry_t entry);
diff --git a/mm/swap_state.c b/mm/swap_state.c
index b76eb3d876fd7..df9e0452f19b9 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -24,6 +24,7 @@
 #include <linux/shmem_fs.h>
 #include <linux/sysctl.h>
 #include <linux/swap_ops.h>
+#include <linux/zswap.h>
 #include "internal.h"
 #include "swap_table.h"
 #include "swap.h"
@@ -263,12 +264,21 @@ static void __swap_cache_do_del_folio(struct swap_cluster_info *ci,
 	unsigned int ci_start, ci_off, ci_end;
 	bool folio_swapped = false, need_free = false;
 	unsigned long nr_pages = folio_nr_pages(folio);
+	void *shadow_parked;
 
 	VM_WARN_ON_ONCE(__swap_entry_to_cluster(entry) != ci);
 	VM_WARN_ON_ONCE_FOLIO(!folio_test_locked(folio), folio);
 	VM_WARN_ON_ONCE_FOLIO(!folio_test_swapcache(folio), folio);
 	VM_WARN_ON_ONCE_FOLIO(folio_test_writeback(folio), folio);
 
+	/*
+	 * A zswap writeback buffer parked the slot's original shadow in the
+	 * zswap tree: restore it into the slot for later swap-in.
+	 */
+	shadow_parked = zswap_lookup_and_clear_shadows(folio);
+	if (shadow_parked)
+		shadow = shadow_parked;
+
 	si = __swap_entry_to_info(entry);
 	ci_start = swp_cluster_offset(entry);
 	ci_end = ci_start + nr_pages;
@@ -483,19 +493,15 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
 
 	/* memsw uncharges swap when folio is added to swap cache */
 	memcg1_swapin(folio);
-	if (shadow)
-		workingset_refault(folio, shadow);
 
 	node_stat_mod_folio(folio, NR_FILE_PAGES, nr_pages);
 	lruvec_stat_mod_folio(folio, NR_SWAPCACHE, nr_pages);
 
-	/* Caller will initiate read into locked new_folio */
-	folio_add_lru(folio);
 	return folio;
 }
 
 /**
- * swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.
+ * __swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.
  * @targ_entry: swap entry indicating the target slot
  * @gfp: memory allocation flags
  * @orders: allocation orders, must be non zero
@@ -507,13 +513,17 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
  * doing IO (e.g. swap in or zswap writeback). The swap slot indicated by
  * @targ_entry must have a non-zero swap count (swapped out).
  *
+ * The returned folio is locked and is NOT on the LRU. The caller must either
+ * add it to the LRU with folio_add_lru() so page reclaim can find it, or free
+ * it directly once done; a folio left off the LRU is unreclaimable and leaks.
+ *
  * Context: Caller must protect the swap device with reference count or locks.
  * Return: Returns the folio if allocation succeeded and folio is in the swap
  * cache. Returns error code if failed due to race, OOM or invalid arguments.
  */
-struct folio *swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,
-				     unsigned long orders, struct vm_fault *vmf,
-				     struct mempolicy *mpol, pgoff_t ilx)
+struct folio *__swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,
+				       unsigned long orders, struct vm_fault *vmf,
+				       struct mempolicy *mpol, pgoff_t ilx)
 {
 	int order, err;
 	struct folio *ret;
@@ -644,17 +654,27 @@ static struct folio *swap_cache_read_folio(struct swap_io_ctx *ctx,
 		pgoff_t ilx, bool readahead)
 {
 	struct folio *folio;
+	void *shadow = NULL;
 
 	do {
 		folio = swap_cache_get_folio(entry);
 		if (folio)
 			return folio;
-		folio = swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);
+		/*
+		 * Capture the slot's shadow before the allocation overwrites it,
+		 * so a fresh swap-in can be evaluated as a refault below.
+		 */
+		shadow = swap_cache_get_shadow(entry);
+		folio = __swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);
 	} while (PTR_ERR(folio) == -EEXIST);
 
 	if (IS_ERR_OR_NULL(folio))
 		return NULL;
 
+	if (shadow)
+		workingset_refault(folio, shadow);
+
+	folio_add_lru(folio);
 	swap_read_folio(ctx, folio);
 	if (readahead) {
 		folio_set_readahead(folio);
@@ -685,17 +705,27 @@ struct folio *swapin_sync(swp_entry_t entry, gfp_t gfp, unsigned long orders,
 {
 	struct swap_io_ctx ctx = {};
 	struct folio *folio;
+	void *shadow = NULL;
 
 	do {
 		folio = swap_cache_get_folio(entry);
 		if (folio)
 			return folio;
-		folio = swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);
+		/*
+		 * Capture the slot's shadow before the allocation overwrites it,
+		 * so a fresh swap-in can be evaluated as a refault below.
+		 */
+		shadow = swap_cache_get_shadow(entry);
+		folio = __swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);
 	} while (PTR_ERR(folio) == -EEXIST);
 
 	if (IS_ERR(folio))
 		return folio;
 
+	if (shadow)
+		workingset_refault(folio, shadow);
+
+	folio_add_lru(folio);
 	swap_read_folio(&ctx, folio);
 	swap_read_submit(&ctx);
 	return folio;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 73a81b4a3e164..9905753b7a10c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -48,6 +48,7 @@
 #include <linux/prefetch.h>
 #include <linux/printk.h>
 #include <linux/dax.h>
+#include <linux/zswap.h>
 #include <linux/psi.h>
 #include <linux/pagewalk.h>
 #include <linux/shmem_fs.h>
@@ -733,7 +734,8 @@ static int __remove_mapping(struct address_space *mapping, struct folio *folio,
 	if (folio_test_swapcache(folio)) {
 		swp_entry_t swap = folio->swap;
 
-		if (reclaimed && !mapping_exiting(mapping))
+		if (reclaimed && !mapping_exiting(mapping) &&
+		    !zswap_folio_is_writeback_buffer(folio))
 			shadow = workingset_eviction(folio, target_memcg);
 		__memcg1_swapout(folio, ci);
 		__swap_cache_del_folio(ci, folio, swap, shadow);
diff --git a/mm/workingset.c b/mm/workingset.c
index 7ac2b88c80ae5..e203d631f61b8 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -536,16 +536,8 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset,
 	return refault_distance <= workingset_size;
 }
 
-/**
- * workingset_refault - Evaluate the refault of a previously evicted folio.
- * @folio: The freshly allocated replacement folio.
- * @shadow: Shadow entry of the evicted folio.
- *
- * Calculates and evaluates the refault distance of the previously
- * evicted folio in the context of the node and the memcg whose memory
- * pressure caused the eviction.
- */
-void workingset_refault(struct folio *folio, void *shadow)
+static void __workingset_refault(struct folio *folio, void *shadow,
+				 bool lru_managed)
 {
 	bool file = folio_is_file_lru(folio);
 	struct mem_cgroup *memcg;
@@ -577,7 +569,16 @@ void workingset_refault(struct folio *folio, void *shadow)
 	if (!workingset_test_recent(shadow, file, &workingset, true))
 		goto out;
 
-	folio_set_active(folio);
+	/*
+	 * An LRU-managed folio may sit in a per-CPU batch, which cannot be
+	 * determined here: setting the flag would race the drain and leave it
+	 * disagreeing with the list. folio_activate() is safe, but misses the
+	 * activation for such a folio.
+	 */
+	if (lru_managed)
+		folio_activate(folio);
+	else
+		folio_set_active(folio);
 	workingset_age_nonresident(lruvec, nr);
 	mod_lruvec_state(lruvec, WORKINGSET_ACTIVATE_BASE + file, nr);
 
@@ -590,6 +591,43 @@ void workingset_refault(struct folio *folio, void *shadow)
 	mem_cgroup_put(memcg);
 }
 
+/**
+ * workingset_refault - Evaluate the refault of a previously evicted folio.
+ * @folio: The freshly allocated replacement folio.
+ * @shadow: Shadow entry of the evicted folio.
+ *
+ * Calculates and evaluates the refault distance of the previously
+ * evicted folio in the context of the node and the memcg whose memory
+ * pressure caused the eviction.
+ *
+ * Context: @folio must be locked and not on the LRU yet, the caller adds
+ * it with folio_add_lru() afterwards.
+ */
+void workingset_refault(struct folio *folio, void *shadow)
+{
+	__workingset_refault(folio, shadow, false);
+}
+
+/**
+ * workingset_refault_lru_managed - Evaluate the refault of a previously
+ * evicted folio that is already on the LRU.
+ * @folio: The folio the eviction is refaulted into.
+ * @shadow: Shadow entry of the evicted folio.
+ *
+ * Like workingset_refault(), but for a folio the caller has already added
+ * to the LRU, which has to be activated by moving it between the lists
+ * rather than by setting PG_active.
+ *
+ * The activation is best effort: a folio still sitting in a per-CPU LRU
+ * batch cannot be moved yet and is left inactive.
+ *
+ * Context: @folio must be locked and already added to the LRU.
+ */
+void workingset_refault_lru_managed(struct folio *folio, void *shadow)
+{
+	__workingset_refault(folio, shadow, true);
+}
+
 /**
  * workingset_activation - note a page activation
  * @folio: Folio that is being activated.
diff --git a/mm/zswap.c b/mm/zswap.c
index 37f34e406c8e3..c1a78edfa0b87 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -972,6 +972,79 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)
 /*********************************
 * writeback code
 **********************************/
+
+#define ZSWAP_WRITEBACK_NO_SHADOW xa_mk_value(0)
+
+/**
+ * zswap_folio_is_writeback_buffer - is @folio a zswap writeback buffer?
+ * @folio: the folio being examined (typically a swap cache folio under reclaim)
+ *
+ * A folio is a zswap writeback buffer when every one of its swap offsets holds
+ * a parked writeback shadow (a real shadow or the ZSWAP_WRITEBACK_NO_SHADOW
+ * sentinel) in the zswap tree rather than a live zswap entry.
+ *
+ * Return: true if @folio is a writeback buffer, in which case the reclaim path
+ * must not mint a fresh workingset shadow for it.
+ */
+bool zswap_folio_is_writeback_buffer(struct folio *folio)
+{
+	swp_entry_t swp = folio->swap;
+	unsigned long nr_pages = folio_nr_pages(folio);
+	pgoff_t offset = swp_offset(swp);
+	unsigned long i;
+
+	if (zswap_never_enabled())
+		return false;
+
+	for (i = 0; i < nr_pages; i++) {
+		swp_entry_t e = swp_entry(swp_type(swp), offset + i);
+
+		if (!xa_is_value(xa_load(swap_zswap_tree(e), offset + i)))
+			return false;
+	}
+
+	return true;
+}
+
+/**
+ * zswap_lookup_and_clear_shadows - retrieve and clear @folio's parked shadow(s)
+ * @folio: the writeback buffer folio (or the swapin folio that consumed it)
+ *
+ * Remove any parked writeback shadows for @folio's swap offset(s) from the
+ * zswap tree.
+ *
+ * Return: the preserved workingset shadow, or NULL if the slot(s) had no shadow
+ * (sentinel only) or nothing parked. The caller either restores the returned
+ * shadow into the swap slot (buffer dropped) or feeds it to
+ * workingset_refault_lru_managed() (buffer consumed by a swapin); clearing
+ * here ensures the two paths never double-count.
+ */
+void *zswap_lookup_and_clear_shadows(struct folio *folio)
+{
+	swp_entry_t swp = folio->swap;
+	unsigned long nr_pages = folio_nr_pages(folio);
+	pgoff_t offset = swp_offset(swp);
+	void *shadow = NULL;
+	unsigned long i;
+
+	if (zswap_never_enabled())
+		return NULL;
+
+	for (i = 0; i < nr_pages; i++) {
+		swp_entry_t e = swp_entry(swp_type(swp), offset + i);
+		struct xarray *tree = swap_zswap_tree(e);
+		void *parked = xa_load(tree, offset + i);
+
+		if (!xa_is_value(parked))
+			continue;
+		xa_erase(tree, offset + i);
+		if (parked != ZSWAP_WRITEBACK_NO_SHADOW)
+			shadow = parked;
+	}
+
+	return shadow;
+}
+
 /*
  * Attempts to free an entry by adding a folio to the swap cache,
  * decompressing the entry data into the folio, and issuing a
@@ -987,12 +1060,14 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)
 static int zswap_writeback_entry(struct zswap_entry *entry,
 				 swp_entry_t swpentry)
 {
+	struct swap_cluster_info *ci;
 	struct xarray *tree;
 	pgoff_t offset = swp_offset(swpentry);
 	struct folio *folio;
 	struct mempolicy *mpol;
 	struct swap_info_struct *si;
 	struct swap_io_ctx ctx = {};
+	void *shadow;
 	int ret = 0;
 
 	/* try to allocate swap cache folio */
@@ -1000,9 +1075,11 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 	if (!si)
 		return -EEXIST;
 
+	shadow = swap_cache_get_shadow(swpentry);
+
 	mpol = get_task_policy(current);
-	folio = swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,
-				       NO_INTERLEAVE_INDEX);
+	folio = __swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,
+					 NO_INTERLEAVE_INDEX);
 	put_swap_device(si);
 
 	/*
@@ -1014,6 +1091,7 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 	 */
 	if (IS_ERR(folio))
 		return PTR_ERR(folio);
+	folio_add_lru(folio);
 
 	/*
 	 * folio is locked, and the swapcache is now secured against
@@ -1035,7 +1113,12 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 		goto out;
 	}
 
-	xa_erase(tree, offset);
+	/*
+	 * A slot with no shadow already reads back as ZSWAP_WRITEBACK_NO_SHADOW:
+	 * the swap table marks a swapped out slot with xa_mk_value(0) and holds
+	 * the shadow, when there is one, in that same value.
+	 */
+	xa_store(tree, offset, shadow, GFP_KERNEL);
 
 	count_vm_event(ZSWPWB);
 	if (entry->objcg)
@@ -1055,7 +1138,15 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 
 out:
 	if (ret) {
-		swap_cache_del_folio(folio);
+		/*
+		 * The allocation above overwrote the slot's shadow and nothing
+		 * has been parked for it yet, so restore it as the folio leaves
+		 * the swap cache, or the eviction it records is lost.
+		 */
+		ci = swap_cluster_lock(__swap_entry_to_info(swpentry), offset);
+		__swap_cache_del_folio(ci, folio, swpentry, shadow);
+		swap_cluster_unlock(ci);
+		folio_ref_sub(folio, folio_nr_pages(folio));
 		folio_unlock(folio);
 	}
 	folio_put(folio);
@@ -1498,6 +1589,17 @@ bool zswap_store(struct folio *folio)
 	VM_WARN_ON_ONCE(!folio_test_locked(folio));
 	VM_WARN_ON_ONCE(!folio_test_swapcache(folio));
 
+	/*
+	 * A writeback buffer whose IO failed is redirtied and left in the
+	 * swap cache, so reclaim writes it out again. Writeback already
+	 * decided this data belongs on disk, so send it there instead of
+	 * compressing it back into zswap. This also leaves the shadow
+	 * parked for the buffer in place, so it is still restored into
+	 * the slot once the folio leaves the swap cache.
+	 */
+	if (zswap_folio_is_writeback_buffer(folio))
+		return false;
+
 	if (!zswap_enabled)
 		goto check_old;
 

gemini-3.1-pro-preview

null

null

							input: 8547
							output: 25
							thoughts: 591
						

**My Assessment of the Zswap Patch**

Okay, so I've got this patch in front of me, and it's touching some pretty critical areas: zswap, the swap cache, and how the workingset refaults. This looks like a fairly significant modification to core memory management. Given the scope, it's pretty clear that there's some potential for functional impact, and honestly, fuzzing is going to be essential here.

I need to zero in on the key areas. From the diff, I see these functions have been modified: `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `do_swap_page`, `shmem_swapin_folio`, `__swap_cache_do_del_folio`, `__swap_cache_alloc`, `__swap_cache_alloc_folio`, `swap_cache_read_folio`, `swapin_sync`, `__remove_mapping`, `workingset_refault`, `workingset_refault_lru_managed`, `zswap_writeback_entry`, and `zswap_store`.

Alright, I'm going to start by focusing on the new stuff, `zswap_folio_is_writeback_buffer` and `zswap_lookup_and_clear_shadows`. I can see from the file paths that these are both defined in `mm/zswap.c`, and they're both global. Next, let's look at `__swap_cache_alloc_folio` in `mm/swap_state.c` and `swapin_sync`, also in that file. Then `mm/workingset.c` is going to contain `workingset_refault` and `workingset_refault_lru_managed`. Finally, I need to check `zswap_store` in `mm/zswap.c`.

I'm making a mental note that `do_swap_page` and `shmem_swapin_folio` are hot paths, so it might be wise to be extra careful there during testing, and maybe avoid them as initial fuzzing targets.

Obviously, `CONFIG_ZSWAP` is a hard requirement for this to even compile, and I'll need to double-check that `CONFIG_SWAP` is also enabled.

I'm thinking I'll need to use some targeted tools to verify this one, so I will prepare those as well.

{
  "Expression": "zswap_folio_is_writeback_buffer"
}

{
  "Output": "include/linux/zswap.h=37=bool zswap_never_enabled(void);\ninclude/linux/zswap.h:38:bool zswap_folio_is_writeback_buffer(struct folio *folio);\ninclude/linux/zswap.h-39-void *zswap_lookup_and_clear_shadows(struct folio *folio);\n--\ninclude/linux/zswap.h=69=static inline bool zswap_never_enabled(void)\n--\ninclude/linux/zswap.h-73-\ninclude/linux/zswap.h:74:static inline bool zswap_folio_is_writeback_buffer(struct folio *folio)\ninclude/linux/zswap.h-75-{\n--\nmm/vmscan.c=683=static int __remove_mapping(struct address_space *mapping, struct folio *folio,\n--\nmm/vmscan.c-737-\t\tif (reclaimed \u0026\u0026 !mapping_exiting(mapping) \u0026\u0026\nmm/vmscan.c:738:\t\t    !zswap_folio_is_writeback_buffer(folio))\nmm/vmscan.c-739-\t\t\tshadow = workingset_eviction(folio, target_memcg);\n--\nmm/zswap.c=924=static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)\n--\nmm/zswap.c-978-/**\nmm/zswap.c:979: * zswap_folio_is_writeback_buffer - is @folio a zswap writeback buffer?\nmm/zswap.c-980- * @folio: the folio being examined (typically a swap cache folio under reclaim)\n--\nmm/zswap.c-988- */\nmm/zswap.c:989:bool zswap_folio_is_writeback_buffer(struct folio *folio)\nmm/zswap.c-990-{\n--\nmm/zswap.c=1579=bool zswap_store(struct folio *folio)\n--\nmm/zswap.c-1599-\t */\nmm/zswap.c:1600:\tif (zswap_folio_is_writeback_buffer(folio))\nmm/zswap.c-1601-\t\treturn false;\n"
}

gemini-3.1-pro-preview

null

null

							input: 10263
							output: 18
							thoughts: 11
						

Here's my take on those thoughts, tailored for an expert audience:

**Kernel Configuration Deep Dive: Zswap Check**

Okay, so I'm thinking, time to dive into the kernel configuration. The immediate question is around `CONFIG_ZSWAP`. I need to assess whether Zswap is enabled or disabled. This is critical for understanding the memory management behavior of the system, particularly its responsiveness under memory pressure. I need to be able to know how zswap is impacting the overall I/O profile. My immediate mental checklist includes: is it set to 'y', 'm', or undefined? A simple `grep` or looking at the appropriate `.config` file will quickly tell me. Depending on the setting, I know my next steps will change. If it's enabled, I'll want to check the associated parameters like `zswap.max_pool_percent`, and the compression algorithm, as those have big effects. If it's disabled, I'll consider why – is it a deliberate choice to favor swap to disk, or maybe there are resource limitations that preclude Zswap's usage? I'll also be considering the workload and the characteristics of the hardware in order to evaluate its appropriateness. I need to have a good sense of the implications of zswap in order to ensure the best performance characteristics.

{
  "Expression": "config ZSWAP"
}

{
  "Output": "mm/Kconfig=12=menuconfig SWAP\n--\nmm/Kconfig-21-\nmm/Kconfig:22:config ZSWAP\nmm/Kconfig-23-\tbool \"Compressed cache for swap pages\"\n--\nmm/Kconfig-34-\nmm/Kconfig:35:config ZSWAP_DEFAULT_ON\nmm/Kconfig-36-\tbool \"Enable the compressed cache for swap pages by default\"\n--\nmm/Kconfig-44-\nmm/Kconfig:45:config ZSWAP_SHRINKER_DEFAULT_ON\nmm/Kconfig-46-\tbool \"Shrink the zswap pool on memory pressure\"\n--\nmm/Kconfig=59=choice\n--\nmm/Kconfig-76-\nmm/Kconfig:77:config ZSWAP_COMPRESSOR_DEFAULT_DEFLATE\nmm/Kconfig-78-\tbool \"Deflate\"\n--\nmm/Kconfig-82-\nmm/Kconfig:83:config ZSWAP_COMPRESSOR_DEFAULT_LZO\nmm/Kconfig-84-\tbool \"LZO\"\n--\nmm/Kconfig-88-\nmm/Kconfig:89:config ZSWAP_COMPRESSOR_DEFAULT_842\nmm/Kconfig-90-\tbool \"842\"\n--\nmm/Kconfig-94-\nmm/Kconfig:95:config ZSWAP_COMPRESSOR_DEFAULT_LZ4\nmm/Kconfig-96-\tbool \"LZ4\"\n--\nmm/Kconfig-100-\nmm/Kconfig:101:config ZSWAP_COMPRESSOR_DEFAULT_LZ4HC\nmm/Kconfig-102-\tbool \"LZ4HC\"\n--\nmm/Kconfig-106-\nmm/Kconfig:107:config ZSWAP_COMPRESSOR_DEFAULT_ZSTD\nmm/Kconfig-108-\tbool \"zstd\"\n--\nmm/Kconfig=112=endchoice\nmm/Kconfig-113-\nmm/Kconfig:114:config ZSWAP_COMPRESSOR_DEFAULT\nmm/Kconfig-115-       string\n"
}

gemini-3.1-pro-preview

null

null

							input: 11106
							output: 31
							thoughts: 16
						

Here's my take on those thoughts, tailored for an expert audience:

**Examining the ZSWAP Configuration**

Okay, so I'm thinking, "ZSWAP," right? Gotta see how that's handled in the kernel config. The obvious place to start is `mm/Kconfig`. That's where all the memory management-related configurations live, so it's the logical place to look for the "ZSWAP" option's dependencies, defaults, and potentially any associated sub-options or help text. I need to quickly ascertain the current configuration state: is it enabled by default, does it require other features to be enabled, and are there any platform-specific considerations? Understanding the `Kconfig` entry is crucial before I start diving deeper into the code. Time to get familiar with the current kernel's implementation.

{
  "File": "mm/Kconfig",
  "FirstLine": 22,
  "LineCount": 20
}

{
  "Contents": "  22:\tconfig ZSWAP\n  23:\t\tbool \"Compressed cache for swap pages\"\n  24:\t\tdepends on SWAP\n  25:\t\tselect CRYPTO\n  26:\t\tselect ZSMALLOC\n  27:\t\thelp\n  28:\t\t  A lightweight compressed cache for swap pages.  It takes\n  29:\t\t  pages that are in the process of being swapped out and attempts to\n  30:\t\t  compress them into a dynamically allocated RAM-based memory pool.\n  31:\t\t  This can result in a significant I/O reduction on swap device and,\n  32:\t\t  in the case where decompressing from RAM is faster than swap device\n  33:\t\t  reads, can also improve workload performance.\n  34:\t\n  35:\tconfig ZSWAP_DEFAULT_ON\n  36:\t\tbool \"Enable the compressed cache for swap pages by default\"\n  37:\t\tdepends on ZSWAP\n  38:\t\thelp\n  39:\t\t  If selected, the compressed cache for swap pages will be enabled\n  40:\t\t  at boot, otherwise it will be disabled.\n  41:\t\n"
}

gemini-3.1-pro-preview

null

null

							input: 11615
							output: 22
							thoughts: 167
						

**My ZSWAP Considerations**

Okay, so I'm thinking through this `ZSWAP` thing. It clearly relies on `SWAP`, which makes perfect sense. My initial instinct is to include both `ZSWAP` and `SWAP` in `EnableConfigs`. And, thinking about a good user experience, I'll likely add `ZSWAP_DEFAULT_ON` as well. Enabling it by default just feels right.

Now, I need to understand the critical functions to pay attention to. From my previous experience and knowledge, I've identified the core functions I need to scrutinize closely: `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `__swap_cache_alloc_folio`, `workingset_refault`, and `workingset_refault_lru_managed`.

I’ll start with `__swap_cache_alloc_folio`. I need to verify that it's accessible and exported as it is crucial in the overall process. Time to look into `mm/swap_state.c` and confirm its visibility.

{
  "Expression": "__swap_cache_alloc_folio"
}

{
  "Output": "mm/swap.h=314=void swap_cache_del_folio(struct folio *folio);\nmm/swap.h:315:struct folio *__swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,\nmm/swap.h-316-\t\t\t\t       unsigned long orders, struct vm_fault *vmf,\n--\nmm/swap_state.c=419=static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,\n--\nmm/swap_state.c-503-/**\nmm/swap_state.c:504: * __swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.\nmm/swap_state.c-505- * @targ_entry: swap entry indicating the target slot\n--\nmm/swap_state.c-523- */\nmm/swap_state.c:524:struct folio *__swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,\nmm/swap_state.c-525-\t\t\t\t       unsigned long orders, struct vm_fault *vmf,\n--\nmm/swap_state.c=652=static struct folio *swap_cache_read_folio(struct swap_io_ctx *ctx,\n--\nmm/swap_state.c-667-\t\tshadow = swap_cache_get_shadow(entry);\nmm/swap_state.c:668:\t\tfolio = __swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);\nmm/swap_state.c-669-\t} while (PTR_ERR(folio) == -EEXIST);\n--\nmm/swap_state.c=703=struct folio *swapin_sync(swp_entry_t entry, gfp_t gfp, unsigned long orders,\n--\nmm/swap_state.c-718-\t\tshadow = swap_cache_get_shadow(entry);\nmm/swap_state.c:719:\t\tfolio = __swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);\nmm/swap_state.c-720-\t} while (PTR_ERR(folio) == -EEXIST);\n--\nmm/zswap.c=1060=static int zswap_writeback_entry(struct zswap_entry *entry,\n--\nmm/zswap.c-1080-\tmpol = get_task_policy(current);\nmm/zswap.c:1081:\tfolio = __swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,\nmm/zswap.c-1082-\t\t\t\t\t NO_INTERLEAVE_INDEX);\n"
}

gemini-3.1-pro-preview

null

null

							input: 12742
							output: 20
							thoughts: 104
						

**Analyzing Swap Cache Allocation**

Okay, so I'm thinking about how pages get into the swap cache and where the allocation happens. `__swap_cache_alloc_folio` is the key function here, and the call sites are a mix of things. It's called from `swap_cache_read_folio`, which makes sense for the standard swap-in path. I'm also seeing it's used by `swapin_sync`, which I know is a global function, indicating this is a synchronization point for swap operations across the system. And there's `zswap_writeback_entry`, suggesting this function has relevance in compressed swap as well.

Given the potential system-wide implications of `swapin_sync`, I need to understand its behavior. I think it makes sense to dig into the workingset management. That is, I should check how `workingset_refault` and `workingset_refault_lru_managed` interact with this allocation path. These are also global functions, which means their behavior is relevant to the system's overall performance. I need to understand how swapping impacts the workingset and how the LRU is managed in relation to this. I'll start there.

{
  "Expression": "workingset_refault"
}

{
  "Output": "Documentation/admin-guide/cgroup-v2.rst=1426=The following nested keys are defined.\n--\nDocumentation/admin-guide/cgroup-v2.rst-1637-\nDocumentation/admin-guide/cgroup-v2.rst:1638:\t  workingset_refault_anon\nDocumentation/admin-guide/cgroup-v2.rst-1639-\t\tNumber of refaults of previously evicted anonymous pages.\nDocumentation/admin-guide/cgroup-v2.rst-1640-\nDocumentation/admin-guide/cgroup-v2.rst:1641:\t  workingset_refault_file\nDocumentation/admin-guide/cgroup-v2.rst-1642-\t\tNumber of refaults of previously evicted file pages.\n--\nmm/filemap.c=955=int filemap_add_folio(struct address_space *mapping, struct folio *folio,\n--\nmm/filemap.c-986-\t\tif (!(gfp \u0026 __GFP_WRITE) \u0026\u0026 shadow)\nmm/filemap.c:987:\t\t\tworkingset_refault(folio, shadow);\nmm/filemap.c-988-\t\tfolio_add_lru(folio);\n--\nmm/internal.h=38=void *workingset_eviction(struct folio *folio,\nmm/internal.h-39-\t\t\t  struct mem_cgroup *target_memcg);\nmm/internal.h:40:void workingset_refault(struct folio *folio, void *shadow);\nmm/internal.h:41:void workingset_refault_lru_managed(struct folio *folio, void *shadow);\nmm/internal.h-42-void workingset_activation(struct folio *folio);\n--\nmm/memcontrol-v1.c=2193=static const char *const memcg1_stat_names[] = {\n--\nmm/memcontrol-v1.c-2202-\t\"writeback\",\nmm/memcontrol-v1.c:2203:\t\"workingset_refault_anon\",\nmm/memcontrol-v1.c:2204:\t\"workingset_refault_file\",\nmm/memcontrol-v1.c-2205-#ifdef CONFIG_SWAP\n--\nmm/memcontrol.c=1591=static const struct memory_stat memory_stats[] = {\n--\nmm/memcontrol.c-1629-\t/* The memory events */\nmm/memcontrol.c:1630:\t{ \"workingset_refault_anon\",\tWORKINGSET_REFAULT_ANON\t\t},\nmm/memcontrol.c:1631:\t{ \"workingset_refault_file\",\tWORKINGSET_REFAULT_FILE\t\t},\nmm/memcontrol.c-1632-\t{ \"workingset_activate_anon\",\tWORKINGSET_ACTIVATE_ANON\t},\n--\nmm/memory.c=4881=vm_fault_t do_swap_page(struct vm_fault *vmf)\n--\nmm/memory.c-5023-\tif (shadow)\nmm/memory.c:5024:\t\tworkingset_refault_lru_managed(folio, shadow);\nmm/memory.c-5025-\n--\nmm/shmem.c=2254=static int shmem_swapin_folio(struct inode *inode, pgoff_t index,\n--\nmm/shmem.c-2382-\tif (shadow)\nmm/shmem.c:2383:\t\tworkingset_refault_lru_managed(folio, shadow);\nmm/shmem.c-2384-\n--\nmm/swap_state.c=652=static struct folio *swap_cache_read_folio(struct swap_io_ctx *ctx,\n--\nmm/swap_state.c-674-\tif (shadow)\nmm/swap_state.c:675:\t\tworkingset_refault(folio, shadow);\nmm/swap_state.c-676-\n--\nmm/swap_state.c=703=struct folio *swapin_sync(swp_entry_t entry, gfp_t gfp, unsigned long orders,\n--\nmm/swap_state.c-725-\tif (shadow)\nmm/swap_state.c:726:\t\tworkingset_refault(folio, shadow);\nmm/swap_state.c-727-\n--\nmm/vmstat.c=1199=const char * const vmstat_text[] = {\n--\nmm/vmstat.c-1243-\t[I(WORKINGSET_NODES)]\t\t\t= \"workingset_nodes\",\nmm/vmstat.c:1244:\t[I(WORKINGSET_REFAULT_ANON)]\t\t= \"workingset_refault_anon\",\nmm/vmstat.c:1245:\t[I(WORKINGSET_REFAULT_FILE)]\t\t= \"workingset_refault_file\",\nmm/vmstat.c-1246-\t[I(WORKINGSET_ACTIVATE_ANON)]\t\t= \"workingset_activate_anon\",\n--\nmm/workingset.c=430=bool workingset_test_recent(void *shadow, bool file, bool *workingset,\n--\nmm/workingset.c-538-\nmm/workingset.c:539:static void __workingset_refault(struct folio *folio, void *shadow,\nmm/workingset.c-540-\t\t\t\t bool lru_managed)\n--\nmm/workingset.c-594-/**\nmm/workingset.c:595: * workingset_refault - Evaluate the refault of a previously evicted folio.\nmm/workingset.c-596- * @folio: The freshly allocated replacement folio.\n--\nmm/workingset.c-605- */\nmm/workingset.c:606:void workingset_refault(struct folio *folio, void *shadow)\nmm/workingset.c-607-{\nmm/workingset.c:608:\t__workingset_refault(folio, shadow, false);\nmm/workingset.c-609-}\n--\nmm/workingset.c-611-/**\nmm/workingset.c:612: * workingset_refault_lru_managed - Evaluate the refault of a previously\nmm/workingset.c-613- * evicted folio that is already on the LRU.\n--\nmm/workingset.c-616- *\nmm/workingset.c:617: * Like workingset_refault(), but for a folio the caller has already added\nmm/workingset.c-618- * to the LRU, which has to be activated by moving it between the lists\n--\nmm/workingset.c-625- */\nmm/workingset.c:626:void workingset_refault_lru_managed(struct folio *folio, void *shadow)\nmm/workingset.c-627-{\nmm/workingset.c:628:\t__workingset_refault(folio, shadow, true);\nmm/workingset.c-629-}\n--\nmm/zswap.c=989=bool zswap_folio_is_writeback_buffer(struct folio *folio)\n--\nmm/zswap.c-1018- * shadow into the swap slot (buffer dropped) or feeds it to\nmm/zswap.c:1019: * workingset_refault_lru_managed() (buffer consumed by a swapin); clearing\nmm/zswap.c-1020- * here ensures the two paths never double-count.\n"
}

gemini-3.1-pro-preview

null

null

							input: 15051
							output: 26
							thoughts: 113
						

**My Initial Assessment of the Codebase**

Okay, so I'm looking at this code and immediately noticing a pattern. Several functions – `workingset_refault`, `workingset_refault_lru_managed`, `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `__swap_cache_alloc_folio`, `swapin_sync`, and `zswap_store` – are all global in scope. This raises a few immediate questions in my mind, mostly about their intended usage and whether they represent a good encapsulation of function. My next thought is, let's zero in on `__swap_cache_alloc_folio`. I need to understand if this key function is being exported, which could give me more insight into its role in the overall architecture.

no matches

{
  "Expression": "EXPORT_SYMBOL.*__swap_cache_alloc_folio"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 15383
							output: 22
							thoughts: 23
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Navigating Scope and Synchronization**

Hmm, interesting. The code I'm looking at isn't *explicitly* exported, but it's clearly accessible globally. That's a potential area for concern, depending on the architecture. Implicit global variables can be tricky for maintainability and debugging, especially in a large codebase. I need to understand why it's structured this way. Is this by design for performance reasons, or a legacy artifact? Is it a potential source of unintended side effects?

Alright, let's dive into this `swapin_sync` function. It seems critical. I need to understand its exact function. This is likely where the synchronization or data transfer logic related to this global variable is implemented. I want to check for potential race conditions, locking mechanisms, and the overall coherence model here. Understanding this routine will likely shed light on the design choices surrounding the variable's scope. Let's see how it handles the context switches.

no matches

{
  "Expression": "EXPORT_SYMBOL.*swapin_sync"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 15665
							output: 22
							thoughts: 10
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `zswap_store`**

Alright, time to dig in. The mention of `zswap_store` immediately catches my attention. I know this is a critical piece, and likely where I need to focus my efforts. Let's start with a quick examination. I need to understand its role within the larger picture, how it's behaving, and what specific aspects require the most scrutiny, given the current issue at hand.

no matches

{
  "Expression": "EXPORT_SYMBOL.*zswap_store"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 15830
							output: 24
							thoughts: 12
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `workingset_refault`**

Alright, time to dive in. My immediate thought is, "Let's check `workingset_refault`." It's a key metric, and I need to assess its current state and any potential anomalies. My mind automatically starts running through the implications. I'm thinking about what could be causing fluctuations, what the typical baselines look like in this environment, and any potential correlations with other performance indicators I'm tracking. Is it higher than expected? Lower? And critically, what are the upstream and downstream effects, or the likely root causes that might be influencing it? Time to get to work.

no matches

{
  "Expression": "EXPORT_SYMBOL.*workingset_refault"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 16046
							output: 29
							thoughts: 17
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Analyzing `zswap_folio_is_writeback_buffer`**

Right, let's take a look at `zswap_folio_is_writeback_buffer`. It's a key function, obviously, but what specifically am I trying to parse here? It's likely a boolean function or macro, and the naming convention suggests its purpose is to determine if a given folio, within the context of `zswap`, represents a writeback buffer.

So, the implicit question in my head is: *is this folio currently undergoing a writeback operation, and therefore should be treated as such within zswap's management routines?* This distinction is critical for performance and correctness. If it's a writeback buffer, certain optimizations and considerations probably apply, versus a folio simply held within a zswap cache waiting to be paged out. I need to understand its behavior thoroughly, especially given that writeback operations can be asynchronous and their status might not be immediately obvious. I need to know under what conditions this returns true, what that implies about the folio's state, and how `zswap` leverages this information. From here, I can examine its implementation, look at its callers, and understand how the code uses this crucial function.

no matches

{
  "Expression": "EXPORT_SYMBOL.*zswap_folio_is_writeback_buffer"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 16391
							output: 18
							thoughts: 41
						

Okay, here's my interpretation of those thoughts, summarized from my perspective as a kernel expert:

**Investigating Potential Syzkaller Targets**

Right, so we're looking for areas that might be exploitable through syzkaller. The key here is global functions that aren't specifically "exported" in the traditional sense, but are still globally visible within the kernel. This makes them good candidates for syzkaller fuzzing.

My mind immediately jumps to `zswap_store` in `mm/zswap.c`. Zswap, with its memory compression and swapping functionality, is complex and inherently involves interaction with a lot of other subsystems. This makes it a prime candidate for finding interesting, and potentially exploitable, behavior through fuzzing. Let's dig in and see what's there.

{
  "Expression": "zswap_store"
}

{
  "Output": "fs/proc/meminfo.c=34=static int meminfo_proc_show(struct seq_file *m, void *v)\n--\nfs/proc/meminfo.c-93-\tseq_printf(m,  \"Zswapped:       %8lu kB\\n\",\nfs/proc/meminfo.c:94:\t\t   (unsigned long)atomic_long_read(\u0026zswap_stored_pages) \u003c\u003c\nfs/proc/meminfo.c-95-\t\t   (PAGE_SHIFT - 10));\n--\ninclude/linux/zswap.h=8=struct lruvec;\ninclude/linux/zswap.h-9-\ninclude/linux/zswap.h:10:extern atomic_long_t zswap_stored_pages;\ninclude/linux/zswap.h-11-\n--\ninclude/linux/zswap.h=27=unsigned long zswap_total_pages(void);\ninclude/linux/zswap.h:28:bool zswap_store(struct folio *folio);\ninclude/linux/zswap.h-29-int zswap_load(struct folio *folio);\n--\ninclude/linux/zswap.h=42=struct zswap_lruvec_state {};\ninclude/linux/zswap.h-43-\ninclude/linux/zswap.h:44:static inline bool zswap_store(struct folio *folio)\ninclude/linux/zswap.h-45-{\n--\nmm/page_io.c=204=int swap_writeout(struct swap_io_ctx *ctx, struct folio *folio)\n--\nmm/page_io.c-237-\nmm/page_io.c:238:\tif (zswap_store(folio)) {\nmm/page_io.c-239-\t\tcount_mthp_stat(folio_order(folio), MTHP_STAT_ZSWPOUT);\n--\nmm/zswap.c-46-/* The number of pages currently stored in zswap */\nmm/zswap.c:47:atomic_long_t zswap_stored_pages = ATOMIC_LONG_INIT(0);\nmm/zswap.c-48-/* The number of incompressible pages currently stored in zswap */\nmm/zswap.c:49:static atomic_long_t zswap_stored_incompressible_pages = ATOMIC_LONG_INIT(0);\nmm/zswap.c-50-\n--\nmm/zswap.c=765=static void zswap_entry_free(struct zswap_entry *entry)\n--\nmm/zswap.c-774-\tif (entry-\u003elength == PAGE_SIZE)\nmm/zswap.c:775:\t\tatomic_long_dec(\u0026zswap_stored_incompressible_pages);\nmm/zswap.c-776-\tzswap_entry_cache_free(entry);\nmm/zswap.c:777:\tatomic_long_dec(\u0026zswap_stored_pages);\nmm/zswap.c-778-}\n--\nmm/zswap.c=1022=void *zswap_lookup_and_clear_shadows(struct folio *folio)\n--\nmm/zswap.c-1054- * to the swap device.  We are basically resuming the same swap\nmm/zswap.c:1055: * writeback path that was intercepted with the zswap_store()\nmm/zswap.c-1056- * in the first place.  After the folio has been decompressed into\n--\nmm/zswap.c=1283=static unsigned long zswap_shrinker_count(struct shrinker *shrinker,\n--\nmm/zswap.c-1317-\t\tnr_backing = zswap_total_pages();\nmm/zswap.c:1318:\t\tnr_stored = atomic_long_read(\u0026zswap_stored_pages);\nmm/zswap.c-1319-\t}\n--\nmm/zswap.c=1408=static void shrink_worker(struct work_struct *w)\n--\nmm/zswap.c-1498-\nmm/zswap.c:1499:static bool zswap_store_page(struct page *page,\nmm/zswap.c-1500-\t\t\t     struct obj_cgroup *objcg,\n--\nmm/zswap.c-1537-\t * no further possibility of failure. Grab refs to the pool and objcg,\nmm/zswap.c:1538:\t * charge zswap memory, and increment zswap_stored_pages.\nmm/zswap.c-1539-\t * The opposite actions will be performed by zswap_entry_free()\n--\nmm/zswap.c-1546-\t}\nmm/zswap.c:1547:\tatomic_long_inc(\u0026zswap_stored_pages);\nmm/zswap.c-1548-\tif (entry-\u003elength == PAGE_SIZE)\nmm/zswap.c:1549:\t\tatomic_long_inc(\u0026zswap_stored_incompressible_pages);\nmm/zswap.c-1550-\n--\nmm/zswap.c-1578-\nmm/zswap.c:1579:bool zswap_store(struct folio *folio)\nmm/zswap.c-1580-{\n--\nmm/zswap.c-1634-\nmm/zswap.c:1635:\t\tif (!zswap_store_page(page, objcg, pool))\nmm/zswap.c-1636-\t\t\tgoto put_pool;\n--\nmm/zswap.c=1815=static int debugfs_get_stored_pages(void *data, u64 *val)\nmm/zswap.c-1816-{\nmm/zswap.c:1817:\t*val = atomic_long_read(\u0026zswap_stored_pages);\nmm/zswap.c-1818-\treturn 0;\n--\nmm/zswap.c=1822=static int debugfs_get_stored_incompressible_pages(void *data, u64 *val)\nmm/zswap.c-1823-{\nmm/zswap.c:1824:\t*val = atomic_long_read(\u0026zswap_stored_incompressible_pages);\nmm/zswap.c-1825-\treturn 0;\n--\ntools/testing/selftests/cgroup/test_zswap.c=52=static int read_min_free_kb(size_t *value)\n--\ntools/testing/selftests/cgroup/test_zswap.c-56-\ntools/testing/selftests/cgroup/test_zswap.c:57:static int get_zswap_stored_pages(size_t *value)\ntools/testing/selftests/cgroup/test_zswap.c-58-{\n--\ntools/testing/selftests/cgroup/test_zswap.c=558=static int test_no_kmem_bypass(const char *root)\n--\ntools/testing/selftests/cgroup/test_zswap.c-624-\t\tfree(trigger_allocation);\ntools/testing/selftests/cgroup/test_zswap.c:625:\t\tif (get_zswap_stored_pages(\u0026stored_pages))\ntools/testing/selftests/cgroup/test_zswap.c-626-\t\t\tbreak;\n"
}

gemini-3.1-pro-preview

null

null

							input: 18461
							output: 18
							thoughts: 67
						

Here's my summary, as the expert:

**Tracing the Swap Operations**

Alright, so I'm digging into the swap implementation here. My initial assessment is that `zswap_store` is a globally accessible function, and it's called within the context of `swap_writeout`. On the other hand, `swapin_sync` is also global, and its invocation is triggered through `do_swap_page` – specifically, through that `swapin_readahead` path. Now, I want to drill down further into the mechanics of `swapin_sync`. Time to check out `mm/swap_state.c` for the detailed logic of that function. Let's see what's happening there.

{
  "Expression": "swapin_sync"
}

{
  "Output": "mm/memory.c=4881=vm_fault_t do_swap_page(struct vm_fault *vmf)\n--\nmm/memory.c-4970-\t\tif (data_race(si-\u003eflags \u0026 SWP_SYNCHRONOUS_IO))\nmm/memory.c:4971:\t\t\tfolio = swapin_sync(entry, GFP_HIGHUSER_MOVABLE,\nmm/memory.c-4972-\t\t\t\t\t    thp_swapin_suitable_orders(vmf) | BIT(0),\n--\nmm/shmem.c=2043=static struct folio *shmem_swap_alloc_folio(struct inode *inode,\n--\nmm/shmem.c-2057-\tmpol = shmem_get_pgoff_policy(info, index, order, \u0026ilx);\nmm/shmem.c:2058:\tfolio = swapin_sync(entry, gfp, BIT(order), vmf, mpol, ilx);\nmm/shmem.c-2059-\tmpol_cond_put(mpol);\n--\nmm/swap.h=332=struct folio *swapin_readahead(swp_entry_t entry, gfp_t flag,\nmm/swap.h-333-\t\tstruct vm_fault *vmf);\nmm/swap.h:334:struct folio *swapin_sync(swp_entry_t entry, gfp_t flag, unsigned long orders,\nmm/swap.h-335-\t\t\t   struct vm_fault *vmf, struct mempolicy *mpol, pgoff_t ilx);\n--\nmm/swap.h=408=static inline struct folio *swapin_readahead(swp_entry_t swp, gfp_t gfp_mask,\n--\nmm/swap.h-413-\nmm/swap.h:414:static inline struct folio *swapin_sync(\nmm/swap.h-415-\tswp_entry_t entry, gfp_t flag, unsigned long orders,\n--\nmm/swap_state.c=652=static struct folio *swap_cache_read_folio(struct swap_io_ctx *ctx,\n--\nmm/swap_state.c-687-/**\nmm/swap_state.c:688: * swapin_sync - swap-in one or multiple entries skipping readahead.\nmm/swap_state.c-689- * @entry: swap entry indicating the target slot\n--\nmm/swap_state.c-702- */\nmm/swap_state.c:703:struct folio *swapin_sync(swp_entry_t entry, gfp_t gfp, unsigned long orders,\nmm/swap_state.c-704-\t\t\t   struct vm_fault *vmf, struct mempolicy *mpol, pgoff_t ilx)\n"
}

gemini-3.1-pro-preview

null

null

							input: 19412
							output: 17
							thoughts: 1263
						

**Analysis of Modified Swap and Zswap Functionality for Fuzzing**

Okay, so I've been looking at this code and I need to figure out the key functions to target for fuzzing. I'm seeing changes related to swap and zswap, specifically how they interact with workingsets and the swap cache.

Initially, I identified several functions as potential focus points: `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `__swap_cache_alloc_folio`, `workingset_refault`, `workingset_refault_lru_managed`, `swapin_sync`, and `zswap_store`. These seem to represent the core of the modified logic.

I've noted the modifications to existing functions like `swapin_sync`, `zswap_store`, and `__swap_cache_alloc_folio` (formerly `swap_cache_alloc_folio`). Also, `workingset_refault` has been changed. `workingset_refault_lru_managed`, `zswap_folio_is_writeback_buffer`, and `zswap_lookup_and_clear_shadows` are newly introduced functions.

Now, I'm checking which of these are static, because I know that impacts fuzzing. So, I confirmed that none of the candidate functions: `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `__swap_cache_alloc_folio`, `workingset_refault`, `workingset_refault_lru_managed`, `swapin_sync`, and `zswap_store` are static. Therefore, they are all suitable for inclusion in the FocusSymbols list.

I had to remove `do_swap_page` and `shmem_swapin_folio` from my list. Those are hot paths, and I want to avoid them. Similarly, `zswap_store` is also a hot path, but it is the main zswap entry point.

I am checking `zswap_writeback_entry`, `__swap_cache_do_del_folio` and `__swap_cache_alloc`. Those are static. They are not suitable to include in the FocusSymbols list.

So, the definitive list for `FocusSymbols`: `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `__swap_cache_alloc_folio`, `workingset_refault`, `workingset_refault_lru_managed`, `swapin_sync`, and `zswap_store`.

From a configuration perspective, I've confirmed that enabling `ZSWAP`, `SWAP`, and `ZSWAP_DEFAULT_ON` is what I need. `ZSWAP` is the most important config, and the others are dependencies.

In summary, this patch is a significant change to how zswap and swap interact, particularly with how they manage workingset refaults and writeback buffers. New functions are added, and existing ones are modified to ensure that shadows are preserved and restored in swap cache operations. This is definitely worth fuzzing to ensure correctness and stability.

no matches

{
  "Expression": "config WORKINGSET"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 21403
							output: 19
							thoughts: 15
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing `mm/workingset.c` Dependencies**

Okay, time to dive in. First, let's get a handle on the `mm/workingset.c` module. My initial thought is to quickly ascertain its dependencies. I want to build a mental model of how this module interacts with the rest of the memory management subsystem. Are we talking about core page table structures, the physical memory allocator, NUMA considerations, or perhaps interactions with specific CPU features? A thorough understanding of its dependencies is crucial for any potential modifications or debugging efforts. Specifically, I'm trying to determine if I need to consult any other modules or their corresponding documentation to get a full picture. Knowing the dependencies will help ensure I do not break things with changes.

{
  "Expression": "workingset\\.o"
}

{
  "Output": "mm/Makefile=51=obj-y\t\t\t:= filemap.o mempool.o oom_kill.o fadvise.o \\\n--\nmm/Makefile-56-\t\t\t   compaction.o show_mem.o \\\nmm/Makefile:57:\t\t\t   interval_tree.o list_lru.o workingset.o \\\nmm/Makefile-58-\t\t\t   debug.o gup.o mmap_lock.o vma_init.o $(mmu-y)\n"
}

gemini-3.1-pro-preview

null

null

							input: 21739
							output: 17
							thoughts: 22
						

Here's my thought process, as it went down:

**Investigating a Compulsory Compilation**

Okay, so `workingset.o` is *always* getting compiled. That's a bit odd, usually I'd expect conditional compilation based on some configuration option. I need to figure out why. Since the compilation is always happening, I'm thinking maybe it's connected to a core or fundamental feature. What's the most likely suspect? Ah, I should check the `CONFIG_MEMCG` setting first. That seems like a good starting point, as memory cgroups could be influencing things. I'll see if `workingset.o` is somehow tied to the memory management of a container...

{
  "Expression": "config MEMCG"
}

{
  "Output": "init/Kconfig=1067=config CGROUP_FAVOR_DYNMODS\n--\ninit/Kconfig-1076-\ninit/Kconfig:1077:config MEMCG\ninit/Kconfig-1078-\tbool \"Memory controller\"\n--\ninit/Kconfig-1085-\ninit/Kconfig:1086:config MEMCG_NMI_UNSAFE\ninit/Kconfig-1087-\tbool\n--\ninit/Kconfig-1092-\ninit/Kconfig:1093:config MEMCG_NMI_SAFETY_REQUIRES_ATOMIC\ninit/Kconfig-1094-\tbool\n--\ninit/Kconfig-1099-\ninit/Kconfig:1100:config MEMCG_V1\ninit/Kconfig-1101-\tbool \"Legacy cgroup v1 memory controller\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 22159
							output: 205
							thoughts: 249
						

**My Configuration Refinements**

Okay, so I'm thinking about how to best configure this system. `MEMCG` is definitely relevant for tracking memory cgroups and handling workingset refaults. That's a key consideration. Since `workingset.c` is always compiled, I need to make sure I'm managing its interactions effectively.

I'm definitely going to include `ZSWAP`, `SWAP`, and `ZSWAP_DEFAULT_ON`. I checked `mm/Kconfig` to confirm that `ZSWAP_DEFAULT_ON` is a valid config option, so that's good.

I'm re-evaluating `ZSWAP_SHRINKER_DEFAULT_ON`. While it might not be strictly *necessary* for this particular analysis, I'll keep it in mind.

Now, for the key focus symbols – I've finalized these:

*   `zswap_folio_is_writeback_buffer`
*   `zswap_lookup_and_clear_shadows`
*   `__swap_cache_alloc_folio`
*   `workingset_refault`
*   `workingset_refault_lru_managed`
*   `swapin_sync`

I was initially on the fence about `zswap_store`. It's a bit generic and potentially a very hot function, but it's been modified, so it warrants inclusion. I'll add it to the final list.

Alright, with these settings, I'm ready to `set-results`.

{
  "EnableConfigs": [
    "ZSWAP",
    "SWAP",
    "ZSWAP_DEFAULT_ON"
  ],
  "FocusSymbols": [
    "zswap_folio_is_writeback_buffer",
    "zswap_lookup_and_clear_shadows",
    "__swap_cache_alloc_folio",
    "workingset_refault",
    "workingset_refault_lru_managed",
    "swapin_sync",
    "zswap_store"
  ],
  "Reasoning": "The patch modifies the zswap and swap cache logic to properly handle workingset refaults for zswap writeback buffers. It introduces new functions to check if a folio is a writeback buffer and to lookup and clear shadows, and modifies the swap cache allocation and deletion paths to preserve and restore shadows. This is a core memory management change with functional impact that is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "ZSWAP",
    "SWAP",
    "ZSWAP_DEFAULT_ON"
  ],
  "FocusSymbols": [
    "zswap_folio_is_writeback_buffer",
    "zswap_lookup_and_clear_shadows",
    "__swap_cache_alloc_folio",
    "workingset_refault",
    "workingset_refault_lru_managed",
    "swapin_sync",
    "zswap_store"
  ],
  "Reasoning": "The patch modifies the zswap and swap cache logic to properly handle workingset refaults for zswap writeback buffers. It introduces new functions to check if a folio is a writeback buffer and to lookup and clear shadows, and modifies the swap cache allocation and deletion paths to preserve and restore shadows. This is a core memory management change with functional impact that is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

best-expensive

null

{
  "KMSANReasoning": "The patch modifies swap cache and zswap logic to preserve workingset shadow entries during zswap writeback. It does not introduce any new data structures copied to user space, nor does it allocate buffers that could be left uninitialized. The changes involve pointer manipulation, folio state management, and xarray operations. Any potential bugs introduced by these changes would likely be out-of-bounds accesses, use-after-free, or NULL pointer dereferences, which are effectively caught by KASAN and standard kernel debugging tools. There is no risk of uninitialized memory usage or info-leaks that would necessitate a dedicated KMSAN fuzzing session.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit c288a91059cdda76077628323b690235c3c89c44
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 25 18:53:39 2026 +0000

    syz-cluster: applied patch under review

diff --git a/include/linux/zswap.h b/include/linux/zswap.h
index 30c193a1207e1..dfb7153236f5c 100644
--- a/include/linux/zswap.h
+++ b/include/linux/zswap.h
@@ -35,6 +35,8 @@ void zswap_lruvec_state_init(struct lruvec *lruvec);
 void zswap_folio_swapin(struct folio *folio);
 bool zswap_is_enabled(void);
 bool zswap_never_enabled(void);
+bool zswap_folio_is_writeback_buffer(struct folio *folio);
+void *zswap_lookup_and_clear_shadows(struct folio *folio);
 #else
 
 struct zswap_lruvec_state {};
@@ -69,6 +71,16 @@ static inline bool zswap_never_enabled(void)
 	return true;
 }
 
+static inline bool zswap_folio_is_writeback_buffer(struct folio *folio)
+{
+	return false;
+}
+
+static inline void *zswap_lookup_and_clear_shadows(struct folio *folio)
+{
+	return NULL;
+}
+
 #endif
 
 #endif /* _LINUX_ZSWAP_H */
diff --git a/mm/internal.h b/mm/internal.h
index 38b1165212c94..c191887c1feda 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -38,6 +38,7 @@ void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages);
 void *workingset_eviction(struct folio *folio,
 			  struct mem_cgroup *target_memcg);
 void workingset_refault(struct folio *folio, void *shadow);
+void workingset_refault_lru_managed(struct folio *folio, void *shadow);
 void workingset_activation(struct folio *folio);
 
 /* mm/folio.c */
diff --git a/mm/memory.c b/mm/memory.c
index c6a9242d1b5bd..771197b3fcc5c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4894,6 +4894,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 	unsigned long page_idx;
 	unsigned long address;
 	pte_t *ptep;
+	void *shadow;
 
 	if (!pte_unmap_same(vmf))
 		goto out;
@@ -5018,6 +5019,10 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 		goto out_page;
 	}
 
+	shadow = zswap_lookup_and_clear_shadows(folio);
+	if (shadow)
+		workingset_refault_lru_managed(folio, shadow);
+
 	/*
 	 * KSM sometimes has to copy on read faults, for example, if
 	 * folio->index of non-ksm folios would be nonlinear inside the
diff --git a/mm/shmem.c b/mm/shmem.c
index 599665a3d6e7b..1ef6cc76605e5 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2266,6 +2266,7 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
 	struct folio *folio = NULL;
 	int error, nr_pages, order;
 	pgoff_t offset;
+	void *shadow;
 
 	VM_BUG_ON(!*foliop || !xa_is_value(*foliop));
 	index_entry = radix_to_swp_entry(*foliop);
@@ -2377,6 +2378,10 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index,
 	 */
 	arch_swap_restore(folio_swap(swap, folio), folio);
 
+	shadow = zswap_lookup_and_clear_shadows(folio);
+	if (shadow)
+		workingset_refault_lru_managed(folio, shadow);
+
 	if (shmem_should_replace_folio(folio, gfp)) {
 		error = shmem_replace_folio(&folio, gfp, info, index, vma);
 		if (error)
diff --git a/mm/swap.h b/mm/swap.h
index 90a551a88df63..8679cb61268e5 100644
--- a/mm/swap.h
+++ b/mm/swap.h
@@ -312,9 +312,9 @@ bool swap_cache_has_folio(swp_entry_t entry);
 struct folio *swap_cache_get_folio(swp_entry_t entry);
 void *swap_cache_get_shadow(swp_entry_t entry);
 void swap_cache_del_folio(struct folio *folio);
-struct folio *swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,
-				     unsigned long orders, struct vm_fault *vmf,
-				     struct mempolicy *mpol, pgoff_t ilx);
+struct folio *__swap_cache_alloc_folio(swp_entry_t target_entry, gfp_t gfp_mask,
+				       unsigned long orders, struct vm_fault *vmf,
+				       struct mempolicy *mpol, pgoff_t ilx);
 /* Below helpers require the caller to lock and pass in the swap cluster. */
 void __swap_cache_add_folio(struct swap_cluster_info *ci,
 			    struct folio *folio, swp_entry_t entry);
diff --git a/mm/swap_state.c b/mm/swap_state.c
index b76eb3d876fd7..df9e0452f19b9 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -24,6 +24,7 @@
 #include <linux/shmem_fs.h>
 #include <linux/sysctl.h>
 #include <linux/swap_ops.h>
+#include <linux/zswap.h>
 #include "internal.h"
 #include "swap_table.h"
 #include "swap.h"
@@ -263,12 +264,21 @@ static void __swap_cache_do_del_folio(struct swap_cluster_info *ci,
 	unsigned int ci_start, ci_off, ci_end;
 	bool folio_swapped = false, need_free = false;
 	unsigned long nr_pages = folio_nr_pages(folio);
+	void *shadow_parked;
 
 	VM_WARN_ON_ONCE(__swap_entry_to_cluster(entry) != ci);
 	VM_WARN_ON_ONCE_FOLIO(!folio_test_locked(folio), folio);
 	VM_WARN_ON_ONCE_FOLIO(!folio_test_swapcache(folio), folio);
 	VM_WARN_ON_ONCE_FOLIO(folio_test_writeback(folio), folio);
 
+	/*
+	 * A zswap writeback buffer parked the slot's original shadow in the
+	 * zswap tree: restore it into the slot for later swap-in.
+	 */
+	shadow_parked = zswap_lookup_and_clear_shadows(folio);
+	if (shadow_parked)
+		shadow = shadow_parked;
+
 	si = __swap_entry_to_info(entry);
 	ci_start = swp_cluster_offset(entry);
 	ci_end = ci_start + nr_pages;
@@ -483,19 +493,15 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
 
 	/* memsw uncharges swap when folio is added to swap cache */
 	memcg1_swapin(folio);
-	if (shadow)
-		workingset_refault(folio, shadow);
 
 	node_stat_mod_folio(folio, NR_FILE_PAGES, nr_pages);
 	lruvec_stat_mod_folio(folio, NR_SWAPCACHE, nr_pages);
 
-	/* Caller will initiate read into locked new_folio */
-	folio_add_lru(folio);
 	return folio;
 }
 
 /**
- * swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.
+ * __swap_cache_alloc_folio - Allocate folio for swapped out slot in swap cache.
  * @targ_entry: swap entry indicating the target slot
  * @gfp: memory allocation flags
  * @orders: allocation orders, must be non zero
@@ -507,13 +513,17 @@ static struct folio *__swap_cache_alloc(struct swap_cluster_info *ci,
  * doing IO (e.g. swap in or zswap writeback). The swap slot indicated by
  * @targ_entry must have a non-zero swap count (swapped out).
  *
+ * The returned folio is locked and is NOT on the LRU. The caller must either
+ * add it to the LRU with folio_add_lru() so page reclaim can find it, or free
+ * it directly once done; a folio left off the LRU is unreclaimable and leaks.
+ *
  * Context: Caller must protect the swap device with reference count or locks.
  * Return: Returns the folio if allocation succeeded and folio is in the swap
  * cache. Returns error code if failed due to race, OOM or invalid arguments.
  */
-struct folio *swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,
-				     unsigned long orders, struct vm_fault *vmf,
-				     struct mempolicy *mpol, pgoff_t ilx)
+struct folio *__swap_cache_alloc_folio(swp_entry_t targ_entry, gfp_t gfp,
+				       unsigned long orders, struct vm_fault *vmf,
+				       struct mempolicy *mpol, pgoff_t ilx)
 {
 	int order, err;
 	struct folio *ret;
@@ -644,17 +654,27 @@ static struct folio *swap_cache_read_folio(struct swap_io_ctx *ctx,
 		pgoff_t ilx, bool readahead)
 {
 	struct folio *folio;
+	void *shadow = NULL;
 
 	do {
 		folio = swap_cache_get_folio(entry);
 		if (folio)
 			return folio;
-		folio = swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);
+		/*
+		 * Capture the slot's shadow before the allocation overwrites it,
+		 * so a fresh swap-in can be evaluated as a refault below.
+		 */
+		shadow = swap_cache_get_shadow(entry);
+		folio = __swap_cache_alloc_folio(entry, gfp, BIT(0), NULL, mpol, ilx);
 	} while (PTR_ERR(folio) == -EEXIST);
 
 	if (IS_ERR_OR_NULL(folio))
 		return NULL;
 
+	if (shadow)
+		workingset_refault(folio, shadow);
+
+	folio_add_lru(folio);
 	swap_read_folio(ctx, folio);
 	if (readahead) {
 		folio_set_readahead(folio);
@@ -685,17 +705,27 @@ struct folio *swapin_sync(swp_entry_t entry, gfp_t gfp, unsigned long orders,
 {
 	struct swap_io_ctx ctx = {};
 	struct folio *folio;
+	void *shadow = NULL;
 
 	do {
 		folio = swap_cache_get_folio(entry);
 		if (folio)
 			return folio;
-		folio = swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);
+		/*
+		 * Capture the slot's shadow before the allocation overwrites it,
+		 * so a fresh swap-in can be evaluated as a refault below.
+		 */
+		shadow = swap_cache_get_shadow(entry);
+		folio = __swap_cache_alloc_folio(entry, gfp, orders, vmf, mpol, ilx);
 	} while (PTR_ERR(folio) == -EEXIST);
 
 	if (IS_ERR(folio))
 		return folio;
 
+	if (shadow)
+		workingset_refault(folio, shadow);
+
+	folio_add_lru(folio);
 	swap_read_folio(&ctx, folio);
 	swap_read_submit(&ctx);
 	return folio;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 73a81b4a3e164..9905753b7a10c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -48,6 +48,7 @@
 #include <linux/prefetch.h>
 #include <linux/printk.h>
 #include <linux/dax.h>
+#include <linux/zswap.h>
 #include <linux/psi.h>
 #include <linux/pagewalk.h>
 #include <linux/shmem_fs.h>
@@ -733,7 +734,8 @@ static int __remove_mapping(struct address_space *mapping, struct folio *folio,
 	if (folio_test_swapcache(folio)) {
 		swp_entry_t swap = folio->swap;
 
-		if (reclaimed && !mapping_exiting(mapping))
+		if (reclaimed && !mapping_exiting(mapping) &&
+		    !zswap_folio_is_writeback_buffer(folio))
 			shadow = workingset_eviction(folio, target_memcg);
 		__memcg1_swapout(folio, ci);
 		__swap_cache_del_folio(ci, folio, swap, shadow);
diff --git a/mm/workingset.c b/mm/workingset.c
index 7ac2b88c80ae5..e203d631f61b8 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -536,16 +536,8 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset,
 	return refault_distance <= workingset_size;
 }
 
-/**
- * workingset_refault - Evaluate the refault of a previously evicted folio.
- * @folio: The freshly allocated replacement folio.
- * @shadow: Shadow entry of the evicted folio.
- *
- * Calculates and evaluates the refault distance of the previously
- * evicted folio in the context of the node and the memcg whose memory
- * pressure caused the eviction.
- */
-void workingset_refault(struct folio *folio, void *shadow)
+static void __workingset_refault(struct folio *folio, void *shadow,
+				 bool lru_managed)
 {
 	bool file = folio_is_file_lru(folio);
 	struct mem_cgroup *memcg;
@@ -577,7 +569,16 @@ void workingset_refault(struct folio *folio, void *shadow)
 	if (!workingset_test_recent(shadow, file, &workingset, true))
 		goto out;
 
-	folio_set_active(folio);
+	/*
+	 * An LRU-managed folio may sit in a per-CPU batch, which cannot be
+	 * determined here: setting the flag would race the drain and leave it
+	 * disagreeing with the list. folio_activate() is safe, but misses the
+	 * activation for such a folio.
+	 */
+	if (lru_managed)
+		folio_activate(folio);
+	else
+		folio_set_active(folio);
 	workingset_age_nonresident(lruvec, nr);
 	mod_lruvec_state(lruvec, WORKINGSET_ACTIVATE_BASE + file, nr);
 
@@ -590,6 +591,43 @@ void workingset_refault(struct folio *folio, void *shadow)
 	mem_cgroup_put(memcg);
 }
 
+/**
+ * workingset_refault - Evaluate the refault of a previously evicted folio.
+ * @folio: The freshly allocated replacement folio.
+ * @shadow: Shadow entry of the evicted folio.
+ *
+ * Calculates and evaluates the refault distance of the previously
+ * evicted folio in the context of the node and the memcg whose memory
+ * pressure caused the eviction.
+ *
+ * Context: @folio must be locked and not on the LRU yet, the caller adds
+ * it with folio_add_lru() afterwards.
+ */
+void workingset_refault(struct folio *folio, void *shadow)
+{
+	__workingset_refault(folio, shadow, false);
+}
+
+/**
+ * workingset_refault_lru_managed - Evaluate the refault of a previously
+ * evicted folio that is already on the LRU.
+ * @folio: The folio the eviction is refaulted into.
+ * @shadow: Shadow entry of the evicted folio.
+ *
+ * Like workingset_refault(), but for a folio the caller has already added
+ * to the LRU, which has to be activated by moving it between the lists
+ * rather than by setting PG_active.
+ *
+ * The activation is best effort: a folio still sitting in a per-CPU LRU
+ * batch cannot be moved yet and is left inactive.
+ *
+ * Context: @folio must be locked and already added to the LRU.
+ */
+void workingset_refault_lru_managed(struct folio *folio, void *shadow)
+{
+	__workingset_refault(folio, shadow, true);
+}
+
 /**
  * workingset_activation - note a page activation
  * @folio: Folio that is being activated.
diff --git a/mm/zswap.c b/mm/zswap.c
index 37f34e406c8e3..c1a78edfa0b87 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -972,6 +972,79 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)
 /*********************************
 * writeback code
 **********************************/
+
+#define ZSWAP_WRITEBACK_NO_SHADOW xa_mk_value(0)
+
+/**
+ * zswap_folio_is_writeback_buffer - is @folio a zswap writeback buffer?
+ * @folio: the folio being examined (typically a swap cache folio under reclaim)
+ *
+ * A folio is a zswap writeback buffer when every one of its swap offsets holds
+ * a parked writeback shadow (a real shadow or the ZSWAP_WRITEBACK_NO_SHADOW
+ * sentinel) in the zswap tree rather than a live zswap entry.
+ *
+ * Return: true if @folio is a writeback buffer, in which case the reclaim path
+ * must not mint a fresh workingset shadow for it.
+ */
+bool zswap_folio_is_writeback_buffer(struct folio *folio)
+{
+	swp_entry_t swp = folio->swap;
+	unsigned long nr_pages = folio_nr_pages(folio);
+	pgoff_t offset = swp_offset(swp);
+	unsigned long i;
+
+	if (zswap_never_enabled())
+		return false;
+
+	for (i = 0; i < nr_pages; i++) {
+		swp_entry_t e = swp_entry(swp_type(swp), offset + i);
+
+		if (!xa_is_value(xa_load(swap_zswap_tree(e), offset + i)))
+			return false;
+	}
+
+	return true;
+}
+
+/**
+ * zswap_lookup_and_clear_shadows - retrieve and clear @folio's parked shadow(s)
+ * @folio: the writeback buffer folio (or the swapin folio that consumed it)
+ *
+ * Remove any parked writeback shadows for @folio's swap offset(s) from the
+ * zswap tree.
+ *
+ * Return: the preserved workingset shadow, or NULL if the slot(s) had no shadow
+ * (sentinel only) or nothing parked. The caller either restores the returned
+ * shadow into the swap slot (buffer dropped) or feeds it to
+ * workingset_refault_lru_managed() (buffer consumed by a swapin); clearing
+ * here ensures the two paths never double-count.
+ */
+void *zswap_lookup_and_clear_shadows(struct folio *folio)
+{
+	swp_entry_t swp = folio->swap;
+	unsigned long nr_pages = folio_nr_pages(folio);
+	pgoff_t offset = swp_offset(swp);
+	void *shadow = NULL;
+	unsigned long i;
+
+	if (zswap_never_enabled())
+		return NULL;
+
+	for (i = 0; i < nr_pages; i++) {
+		swp_entry_t e = swp_entry(swp_type(swp), offset + i);
+		struct xarray *tree = swap_zswap_tree(e);
+		void *parked = xa_load(tree, offset + i);
+
+		if (!xa_is_value(parked))
+			continue;
+		xa_erase(tree, offset + i);
+		if (parked != ZSWAP_WRITEBACK_NO_SHADOW)
+			shadow = parked;
+	}
+
+	return shadow;
+}
+
 /*
  * Attempts to free an entry by adding a folio to the swap cache,
  * decompressing the entry data into the folio, and issuing a
@@ -987,12 +1060,14 @@ static bool zswap_decompress(struct zswap_entry *entry, struct folio *folio)
 static int zswap_writeback_entry(struct zswap_entry *entry,
 				 swp_entry_t swpentry)
 {
+	struct swap_cluster_info *ci;
 	struct xarray *tree;
 	pgoff_t offset = swp_offset(swpentry);
 	struct folio *folio;
 	struct mempolicy *mpol;
 	struct swap_info_struct *si;
 	struct swap_io_ctx ctx = {};
+	void *shadow;
 	int ret = 0;
 
 	/* try to allocate swap cache folio */
@@ -1000,9 +1075,11 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 	if (!si)
 		return -EEXIST;
 
+	shadow = swap_cache_get_shadow(swpentry);
+
 	mpol = get_task_policy(current);
-	folio = swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,
-				       NO_INTERLEAVE_INDEX);
+	folio = __swap_cache_alloc_folio(swpentry, GFP_KERNEL, BIT(0), NULL, mpol,
+					 NO_INTERLEAVE_INDEX);
 	put_swap_device(si);
 
 	/*
@@ -1014,6 +1091,7 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 	 */
 	if (IS_ERR(folio))
 		return PTR_ERR(folio);
+	folio_add_lru(folio);
 
 	/*
 	 * folio is locked, and the swapcache is now secured against
@@ -1035,7 +1113,12 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 		goto out;
 	}
 
-	xa_erase(tree, offset);
+	/*
+	 * A slot with no shadow already reads back as ZSWAP_WRITEBACK_NO_SHADOW:
+	 * the swap table marks a swapped out slot with xa_mk_value(0) and holds
+	 * the shadow, when there is one, in that same value.
+	 */
+	xa_store(tree, offset, shadow, GFP_KERNEL);
 
 	count_vm_event(ZSWPWB);
 	if (entry->objcg)
@@ -1055,7 +1138,15 @@ static int zswap_writeback_entry(struct zswap_entry *entry,
 
 out:
 	if (ret) {
-		swap_cache_del_folio(folio);
+		/*
+		 * The allocation above overwrote the slot's shadow and nothing
+		 * has been parked for it yet, so restore it as the folio leaves
+		 * the swap cache, or the eviction it records is lost.
+		 */
+		ci = swap_cluster_lock(__swap_entry_to_info(swpentry), offset);
+		__swap_cache_del_folio(ci, folio, swpentry, shadow);
+		swap_cluster_unlock(ci);
+		folio_ref_sub(folio, folio_nr_pages(folio));
 		folio_unlock(folio);
 	}
 	folio_put(folio);
@@ -1498,6 +1589,17 @@ bool zswap_store(struct folio *folio)
 	VM_WARN_ON_ONCE(!folio_test_locked(folio));
 	VM_WARN_ON_ONCE(!folio_test_swapcache(folio));
 
+	/*
+	 * A writeback buffer whose IO failed is redirtied and left in the
+	 * swap cache, so reclaim writes it out again. Writeback already
+	 * decided this data belongs on disk, so send it there instead of
+	 * compressing it back into zswap. This also leaves the shadow
+	 * parked for the buffer in place, so it is still restored into
+	 * the slot once the folio leaves the swap cache.
+	 */
+	if (zswap_folio_is_writeback_buffer(folio))
+		return false;
+
 	if (!zswap_enabled)
 		goto check_old;
 

gemini-3.1-pro-preview

null

null

							input: 8544
							output: 155
							thoughts: 488
						

**KMSAN Check: No Issues Detected**

Alright, let's break this down from a memory management perspective. This patch is solely concerned with refining the interaction between zswap, the swap cache, and workingset refaults. My focus is on ensuring this doesn't introduce any KMSAN concerns.

So, the core of the patch revolves around modifications to `zswap_folio_is_writeback_buffer`, `zswap_lookup_and_clear_shadows`, `do_swap_page`, `shmem_swapin_folio`, `__swap_cache_alloc_folio`, and `zswap_writeback_entry`. Essentially, it's about correctly managing shadow entries within the workingset during zswap writeback. No new user-space data structures are added, which is a major positive.

It's all about familiar structures: `struct folio`, `swp_entry_t`, `struct swap_cluster_info`, and shadow entries represented as `void *` pointers stored within xarrays. This isn't groundbreaking, but the key is how these shadows are handled.

The patch appears to be correctly handling the lifecycle of these shadow pointers. We're either getting them from `swap_cache_get_shadow` or `zswap_lookup_and_clear_shadows`. These are just pointers, and no new uninitialized memory is introduced. Given that, with a good KASAN run on the whole system, the usual bugs -- out-of-bounds, use-after-free, dereferences, etc. -- are handled.

There's no risk of uninitialized memory being read or leaked to user space, nor new buffers allocated and left uninitialized. Therefore, I can confidently conclude that `NeedsKMSAN = false`. This patch is purely memory management internal, focusing on pointer manipulation and the existing swap cache/zswap logic.

{
  "KMSANReasoning": "The patch modifies swap cache and zswap logic to preserve workingset shadow entries during zswap writeback. It does not introduce any new data structures copied to user space, nor does it allocate buffers that could be left uninitialized. The changes involve pointer manipulation, folio state management, and xarray operations. Any potential bugs introduced by these changes would likely be out-of-bounds accesses, use-after-free, or NULL pointer dereferences, which are effectively caught by KASAN and standard kernel debugging tools. There is no risk of uninitialized memory usage or info-leaks that would necessitate a dedicated KMSAN fuzzing session.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch modifies swap cache and zswap logic to preserve workingset shadow entries during zswap writeback. It does not introduce any new data structures copied to user space, nor does it allocate buffers that could be left uninitialized. The changes involve pointer manipulation, folio state management, and xarray operations. Any potential bugs introduced by these changes would likely be out-of-bounds accesses, use-after-free, or NULL pointer dereferences, which are effectively caught by KASAN and standard kernel debugging tools. There is no risk of uninitialized memory usage or info-leaks that would necessitate a dedicated KMSAN fuzzing session.",
  "NeedsKMSAN": false
}