AI Trajectory

null

{
  "EnableConfigs": [
    "COMPACTION",
    "TRANSPARENT_HUGEPAGE"
  ],
  "FocusSymbols": [
    "isolate_freepages_block",
    "fast_isolate_freepages",
    "compaction_alloc_noprof",
    "__split_folio_to_order"
  ],
  "Reasoning": "The patch modifies core memory management logic by removing `set_page_private` calls for free pages and tail pages, and adding checks to ensure `page-\u003eprivate` is 0 during page freeing and THP splitting. This is a functional change affecting compaction, page allocation, and THP, which can trigger warnings or bad page states if violated. It is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 0d69cd83110d5a35c904a2a394b786024e8a6a1b\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jun 29 03:11:08 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/mm/compaction.c b/mm/compaction.c\nindex b776f35ad02007..349838cc6c190f 100644\n--- a/mm/compaction.c\n+++ b/mm/compaction.c\n@@ -644,7 +644,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,\n \t\tisolated = __isolate_free_page(page, order);\n \t\tif (!isolated)\n \t\t\tbreak;\n-\t\tset_page_private(page, order);\n \n \t\tnr_scanned += isolated - 1;\n \t\ttotal_isolated += isolated;\n@@ -1617,7 +1616,6 @@ static void fast_isolate_freepages(struct compact_control *cc)\n \t\t/* Isolate the page if available */\n \t\tif (page) {\n \t\t\tif (__isolate_free_page(page, order)) {\n-\t\t\t\tset_page_private(page, order);\n \t\t\t\tnr_isolated = 1 \u003c\u003c order;\n \t\t\t\tnr_scanned += nr_isolated - 1;\n \t\t\t\ttotal_isolated += nr_isolated;\n@@ -1846,7 +1844,6 @@ static struct folio *compaction_alloc_noprof(struct folio *src, unsigned long da\n \t\tsize \u003e\u003e= 1;\n \n \t\tlist_add(\u0026freepage[size].lru, \u0026cc-\u003efreepages[start_order]);\n-\t\tset_page_private(\u0026freepage[size], start_order);\n \t}\n \tdst = (struct folio *)freepage;\n \ndiff --git a/mm/huge_memory.c b/mm/huge_memory.c\nindex 2bccb0a53a0a60..037d67fbec6e59 100644\n--- a/mm/huge_memory.c\n+++ b/mm/huge_memory.c\n@@ -3594,6 +3594,16 @@ static void __split_folio_to_order(struct folio *folio, int old_order,\n \t\tnew_folio-\u003emapping = folio-\u003emapping;\n \t\tnew_folio-\u003eindex = folio-\u003eindex + i;\n \n+\t\t/*\n+\t\t * page-\u003eprivate should not be set in tail pages. Fix up and warn once\n+\t\t * if private is unexpectedly set. Do it before swap.val assignment\n+\t\t * since private overlaps with swap.val.\n+\t\t */\n+\t\tif (unlikely(new_folio-\u003eprivate)) {\n+\t\t\tVM_WARN_ON_ONCE_PAGE(true, new_head);\n+\t\t\tnew_folio-\u003eprivate = NULL;\n+\t\t}\n+\n \t\tif (folio_test_swapcache(folio))\n \t\t\tnew_folio-\u003eswap.val = folio-\u003eswap.val + i;\n \ndiff --git a/mm/internal.h b/mm/internal.h\nindex 181e79f1d6a207..c96421ce935015 100644\n--- a/mm/internal.h\n+++ b/mm/internal.h\n@@ -895,7 +895,6 @@ static inline void prep_compound_tail(struct page *tail,\n {\n \ttail-\u003emapping = TAIL_MAPPING;\n \tset_compound_head(tail, head, order);\n-\tset_page_private(tail, 0);\n }\n \n static inline void init_compound_tail(struct page *tail,\ndiff --git a/mm/page_alloc.c b/mm/page_alloc.c\nindex ee902a468c2f5b..13c2655e24fbdd 100644\n--- a/mm/page_alloc.c\n+++ b/mm/page_alloc.c\n@@ -1374,15 +1374,21 @@ static __always_inline bool __free_pages_prepare(struct page *page,\n #endif\n \t\t}\n \t\tfor (i = 1; i \u003c (1 \u003c\u003c order); i++) {\n+\t\t\tstruct page *subpage = page + i;\n+\n \t\t\tif (compound)\n-\t\t\t\tbad += free_tail_page_prepare(page, page + i);\n+\t\t\t\tbad += free_tail_page_prepare(page, subpage);\n \t\t\tif (is_check_pages_enabled()) {\n-\t\t\t\tif (free_page_is_bad(page + i)) {\n+\t\t\t\tif (free_page_is_bad(subpage)) {\n \t\t\t\t\tbad++;\n \t\t\t\t\tcontinue;\n \t\t\t\t}\n \t\t\t}\n-\t\t\t(page + i)-\u003eflags.f \u0026= ~PAGE_FLAGS_CHECK_AT_PREP;\n+\t\t\tsubpage-\u003eflags.f \u0026= ~PAGE_FLAGS_CHECK_AT_PREP;\n+\t\t\tif (subpage-\u003eprivate) {\n+\t\t\t\tbad_page(subpage, \"nonzero private\");\n+\t\t\t\treturn false;\n+\t\t\t}\n \t\t}\n \t}\n \tif (folio_test_anon(folio)) {\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "COMPACTION",
    "TRANSPARENT_HUGEPAGE"
  ],
  "FocusSymbols": [
    "isolate_freepages_block",
    "fast_isolate_freepages",
    "compaction_alloc_noprof",
    "__split_folio_to_order"
  ],
  "Reasoning": "The patch modifies core memory management logic by removing `set_page_private` calls for free pages and tail pages, and adding checks to ensure `page-\u003eprivate` is 0 during page freeing and THP splitting. This is a functional change affecting compaction, page allocation, and THP, which can trigger warnings or bad page states if violated. It is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 0d69cd83110d5a35c904a2a394b786024e8a6a1b
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jun 29 03:11:08 2026 +0000

    syz-cluster: applied patch under review

diff --git a/mm/compaction.c b/mm/compaction.c
index b776f35ad02007..349838cc6c190f 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -644,7 +644,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 		isolated = __isolate_free_page(page, order);
 		if (!isolated)
 			break;
-		set_page_private(page, order);
 
 		nr_scanned += isolated - 1;
 		total_isolated += isolated;
@@ -1617,7 +1616,6 @@ static void fast_isolate_freepages(struct compact_control *cc)
 		/* Isolate the page if available */
 		if (page) {
 			if (__isolate_free_page(page, order)) {
-				set_page_private(page, order);
 				nr_isolated = 1 << order;
 				nr_scanned += nr_isolated - 1;
 				total_isolated += nr_isolated;
@@ -1846,7 +1844,6 @@ static struct folio *compaction_alloc_noprof(struct folio *src, unsigned long da
 		size >>= 1;
 
 		list_add(&freepage[size].lru, &cc->freepages[start_order]);
-		set_page_private(&freepage[size], start_order);
 	}
 	dst = (struct folio *)freepage;
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2bccb0a53a0a60..037d67fbec6e59 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3594,6 +3594,16 @@ static void __split_folio_to_order(struct folio *folio, int old_order,
 		new_folio->mapping = folio->mapping;
 		new_folio->index = folio->index + i;
 
+		/*
+		 * page->private should not be set in tail pages. Fix up and warn once
+		 * if private is unexpectedly set. Do it before swap.val assignment
+		 * since private overlaps with swap.val.
+		 */
+		if (unlikely(new_folio->private)) {
+			VM_WARN_ON_ONCE_PAGE(true, new_head);
+			new_folio->private = NULL;
+		}
+
 		if (folio_test_swapcache(folio))
 			new_folio->swap.val = folio->swap.val + i;
 
diff --git a/mm/internal.h b/mm/internal.h
index 181e79f1d6a207..c96421ce935015 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -895,7 +895,6 @@ static inline void prep_compound_tail(struct page *tail,
 {
 	tail->mapping = TAIL_MAPPING;
 	set_compound_head(tail, head, order);
-	set_page_private(tail, 0);
 }
 
 static inline void init_compound_tail(struct page *tail,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ee902a468c2f5b..13c2655e24fbdd 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1374,15 +1374,21 @@ static __always_inline bool __free_pages_prepare(struct page *page,
 #endif
 		}
 		for (i = 1; i < (1 << order); i++) {
+			struct page *subpage = page + i;
+
 			if (compound)
-				bad += free_tail_page_prepare(page, page + i);
+				bad += free_tail_page_prepare(page, subpage);
 			if (is_check_pages_enabled()) {
-				if (free_page_is_bad(page + i)) {
+				if (free_page_is_bad(subpage)) {
 					bad++;
 					continue;
 				}
 			}
-			(page + i)->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
+			subpage->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
+			if (subpage->private) {
+				bad_page(subpage, "nonzero private");
+				return false;
+			}
 		}
 	}
 	if (folio_test_anon(folio)) {

gemini-3.1-pro-preview

null

null

							input: 2861
							output: 26
							thoughts: 402
						

**Analyzing a Memory Management Patch**

Okay, so I've got this patch – a pretty significant one, it seems – that touches some key areas of the memory management subsystem: `mm/compaction.c`, `mm/huge_memory.c`, `mm/internal.h`, and `mm/page_alloc.c`. My initial read suggests this is a functional change.

The core of it is the removal of some `set_page_private()` calls in functions like `isolate_freepages_block`, `fast_isolate_freepages`, and `compaction_alloc_noprof`. That's interesting; I'll need to dig into why those were removed. It also adds a check and warning in `__split_folio_to_order` to clear and ensure `new_folio->private` is not unexpectedly set. And it looks like another `set_page_private()` call is removed in `prep_compound_tail`. Finally, the patch adds a check in `__free_pages_prepare` to call `bad_page()` if `subpage->private` is nonzero. The `__free_pages_prepare` function is a hot path; that definitely needs careful scrutiny.

My first thought is this has the potential to introduce some subtle bugs if not handled correctly. This impacts compaction, huge page splitting, and page allocation, so it's a good candidate for fuzzing. I need to understand the impact of removing those `set_page_private()` calls, especially in `__free_pages_prepare` which is frequently called.

Let's break this down by functions. The key symbols seem to be:
*   `isolate_freepages_block`
*   `fast_isolate_freepages`
*   `compaction_alloc_noprof`
*   `__split_folio_to_order`
*   `__free_pages_prepare`

`__free_pages_prepare` is clearly a performance-sensitive function, whereas `isolate_freepages_block`, `fast_isolate_freepages`, and `compaction_alloc_noprof` appear compaction-related. `__split_folio_to_order` suggests that we are changing how THPs are split.

Now, let's determine the configurations involved to narrow the focus. Compaction is tied to `CONFIG_COMPACTION`, and THP support is linked to `CONFIG_TRANSPARENT_HUGEPAGE`. Time to leverage our Kconfig tool to get a precise picture of these configuration dependencies to determine the possible scope.

{
  "Expression": "CONFIG_COMPACTION",
  "PathPrefix": "mm/"
}

{
  "Output": "mm/compaction.c-28-\nmm/compaction.c:29:#ifdef CONFIG_COMPACTION\nmm/compaction.c-30-/*\n--\nmm/compaction.c=59=static inline bool is_via_compact_memory(int order) { return false; }\n--\nmm/compaction.c-61-\nmm/compaction.c:62:#if defined CONFIG_COMPACTION || defined CONFIG_CMA\nmm/compaction.c-63-\n--\nmm/compaction.c=91=static unsigned long release_free_list(struct list_head *freepages)\n--\nmm/compaction.c-115-\nmm/compaction.c:116:#ifdef CONFIG_COMPACTION\nmm/compaction.c-117-\n--\nmm/compaction.c=490=static bool test_and_set_skip(struct compact_control *cc, struct page *page)\n--\nmm/compaction.c-493-}\nmm/compaction.c:494:#endif /* CONFIG_COMPACTION */\nmm/compaction.c-495-\n--\nmm/compaction.c=1336=isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,\n--\nmm/compaction.c-1371-\nmm/compaction.c:1372:#endif /* CONFIG_COMPACTION || CONFIG_CMA */\nmm/compaction.c:1373:#ifdef CONFIG_COMPACTION\nmm/compaction.c-1374-\n--\nmm/compaction.c=3351=subsys_initcall(kcompactd_init)\nmm/compaction.c-3352-\nmm/compaction.c:3353:#endif /* CONFIG_COMPACTION */\n--\nmm/internal.h=998=static inline void sparse_init_subsection_map(unsigned long pfn,\n--\nmm/internal.h-1003-\nmm/internal.h:1004:#if defined CONFIG_COMPACTION || defined CONFIG_CMA\nmm/internal.h-1005-\n--\nmm/internal.h=1073=void init_cma_reserved_pageblock(struct page *page);\nmm/internal.h-1074-\nmm/internal.h:1075:#endif /* CONFIG_COMPACTION || CONFIG_CMA */\nmm/internal.h-1076-\n--\nmm/mm_init.c=1337=static void __init calculate_node_totalpages(struct pglist_data *pgdat,\n--\nmm/mm_init.c-1379-\nmm/mm_init.c:1380:#ifdef CONFIG_COMPACTION\nmm/mm_init.c-1381-static void pgdat_init_kcompactd(struct pglist_data *pgdat)\n--\nmm/oom_kill.c=456=static void dump_header(struct oom_control *oc)\n--\nmm/oom_kill.c-460-\t\t\tcurrent-\u003esignal-\u003eoom_score_adj);\nmm/oom_kill.c:461:\tif (!IS_ENABLED(CONFIG_COMPACTION) \u0026\u0026 oc-\u003eorder)\nmm/oom_kill.c-462-\t\tpr_warn(\"COMPACTION is disabled!!!\\n\");\n--\nmm/page_alloc.c=710=static inline void set_buddy_order(struct page *page, unsigned int order)\n--\nmm/page_alloc.c-715-\nmm/page_alloc.c:716:#ifdef CONFIG_COMPACTION\nmm/page_alloc.c-717-static inline struct capture_control *task_capc(struct zone *zone)\n--\nmm/page_alloc.c=765=compaction_capture(struct capture_control *capc, struct page *page,\n--\nmm/page_alloc.c-769-}\nmm/page_alloc.c:770:#endif /* CONFIG_COMPACTION */\nmm/page_alloc.c-771-\n--\nmm/page_alloc.c=4053=__alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,\n--\nmm/page_alloc.c-4144-\nmm/page_alloc.c:4145:#ifdef CONFIG_COMPACTION\nmm/page_alloc.c-4146-/* Try memory compaction for high-order allocations before reclaim */\n--\nmm/page_alloc.c=4285=should_compact_retry(gfp_t gfp_mask, struct alloc_context *ac, int order,\n--\nmm/page_alloc.c-4310-}\nmm/page_alloc.c:4311:#endif /* CONFIG_COMPACTION */\nmm/page_alloc.c-4312-\n--\nmm/vmscan.c=6331=static void shrink_zones(struct zonelist *zonelist, struct scan_control *sc)\n--\nmm/vmscan.c-6371-\t\t\t */\nmm/vmscan.c:6372:\t\t\tif (IS_ENABLED(CONFIG_COMPACTION) \u0026\u0026\nmm/vmscan.c-6373-\t\t\t    sc-\u003eorder \u003e PAGE_ALLOC_COSTLY_ORDER \u0026\u0026\n--\nmm/vmstat.c=1042=void memmap_pages_add(long delta)\n--\nmm/vmstat.c-1046-\nmm/vmstat.c:1047:#ifdef CONFIG_COMPACTION\nmm/vmstat.c-1048-\n--\nmm/vmstat.c=1187=const char * const vmstat_text[] = {\n--\nmm/vmstat.c-1370-#endif\nmm/vmstat.c:1371:#ifdef CONFIG_COMPACTION\nmm/vmstat.c-1372-\t[I(COMPACTMIGRATE_SCANNED)]\t\t= \"compact_migrate_scanned\",\n--\nmm/vmstat.c-1496-\nmm/vmstat.c:1497:#if (defined(CONFIG_DEBUG_FS) \u0026\u0026 defined(CONFIG_COMPACTION)) || \\\nmm/vmstat.c-1498-     defined(CONFIG_PROC_FS)\n--\nmm/vmstat.c=2268=void __init init_mm_internals(void)\n--\nmm/vmstat.c-2301-\nmm/vmstat.c:2302:#if defined(CONFIG_DEBUG_FS) \u0026\u0026 defined(CONFIG_COMPACTION)\nmm/vmstat.c-2303-\n--\nmm/zsmalloc.c=199=struct zs_pool {\n--\nmm/zsmalloc.c-213-#endif\nmm/zsmalloc.c:214:#ifdef CONFIG_COMPACTION\nmm/zsmalloc.c-215-\tstruct work_struct free_work;\n--\nmm/zsmalloc.c=360=static bool ZsHugePage(struct zspage *zspage)\n--\nmm/zsmalloc.c-364-\nmm/zsmalloc.c:365:#ifdef CONFIG_COMPACTION\nmm/zsmalloc.c-366-static void kick_deferred_free(struct zs_pool *pool);\n--\nmm/zsmalloc.c=931=static struct zspage *alloc_zspage(struct zs_pool *pool,\n--\nmm/zsmalloc.c-941-\nmm/zsmalloc.c:942:\tif (!IS_ENABLED(CONFIG_COMPACTION))\nmm/zsmalloc.c-943-\t\tgfp \u0026= ~__GFP_MOVABLE;\n--\nmm/zsmalloc.c=1594=static int putback_zspage(struct size_class *class, struct zspage *zspage)\n--\nmm/zsmalloc.c-1603-\nmm/zsmalloc.c:1604:#ifdef CONFIG_COMPACTION\nmm/zsmalloc.c-1605-/*\n--\nmm/zsmalloc.c=1609=static void lock_zspage(struct zspage *zspage)\n--\nmm/zsmalloc.c-1645-}\nmm/zsmalloc.c:1646:#endif /* CONFIG_COMPACTION */\nmm/zsmalloc.c-1647-\nmm/zsmalloc.c:1648:#ifdef CONFIG_COMPACTION\nmm/zsmalloc.c-1649-\n--\nmm/zsmalloc.c=2237=static int __init zs_init(void)\n--\nmm/zsmalloc.c-2244-\nmm/zsmalloc.c:2245:#ifdef CONFIG_COMPACTION\nmm/zsmalloc.c-2246-\trc = set_movable_ops(\u0026zsmalloc_mops, PGTY_zsmalloc);\n--\nmm/zsmalloc.c=2256=static void __exit zs_exit(void)\nmm/zsmalloc.c-2257-{\nmm/zsmalloc.c:2258:#ifdef CONFIG_COMPACTION\nmm/zsmalloc.c-2259-\tset_movable_ops(NULL, PGTY_zsmalloc);\n"
}

gemini-3.1-pro-preview

null

null

							input: 6128
							output: 32
							thoughts: 43
						

Okay, here's my interpretation of those thoughts, presented as my own mental process, given my expertise:

**Diving into Huge Pages: Configs and Kernel Code**

Alright, I'm thinking about these configurations: `COMPACTION` and `TRANSPARENT_HUGEPAGE`. I know these are related to memory management, specifically large pages. Since I have to get into the nitty-gritty, and `TRANSPARENT_HUGEPAGE` is the immediate focus, I'm going to head directly to the source code. Let's see how `TRANSPARENT_HUGEPAGE` is implemented. I'll open up `mm/huge_memory.c` – that's where the core logic for huge page management will be. I expect to find the relevant enablement checks, allocation strategies, and hopefully, some clues about how it interacts with compaction, which is probably related to fragmenting memory. I'm hoping this will provide answers.

{
  "Expression": "CONFIG_TRANSPARENT_HUGEPAGE",
  "PathPrefix": "mm/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 574 lines.\nUse more precise expression if possible.\n\nmm/Makefile=100=obj-$(CONFIG_DEVICE_MIGRATION) += migrate_device.o\nmm/Makefile:101:obj-$(CONFIG_TRANSPARENT_HUGEPAGE) += huge_memory.o khugepaged.o\nmm/Makefile-102-obj-$(CONFIG_PAGE_COUNTER) += page_counter.o\n--\nmm/compaction.c=59=static inline bool is_via_compact_memory(int order) { return false; }\n--\nmm/compaction.c-74- */\nmm/compaction.c:75:#if defined CONFIG_TRANSPARENT_HUGEPAGE\nmm/compaction.c-76-#define COMPACTION_HPAGE_ORDER\tHPAGE_PMD_ORDER\n--\nmm/damon/ops-common.c=75=void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr)\nmm/damon/ops-common.c-76-{\nmm/damon/ops-common.c:77:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/damon/ops-common.c-78-\tpmd_t pmdval = pmdp_get(pmd);\n--\nmm/damon/ops-common.c-99-\tfolio_put(folio);\nmm/damon/ops-common.c:100:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/damon/ops-common.c-101-}\n--\nmm/damon/ops-common.c=194=static bool damon_folio_young_one(struct folio *folio,\n--\nmm/damon/ops-common.c-215-\t\t} else {\nmm/damon/ops-common.c:216:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/damon/ops-common.c-217-\t\t\tpmd_t pmd = pmdp_get(pvmw.pmd);\n--\nmm/damon/ops-common.c-223-\t\t\tWARN_ON_ONCE(1);\nmm/damon/ops-common.c:224:#endif\t/* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/damon/ops-common.c-225-\t\t}\n--\nmm/damon/vaddr.c=392=static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,\n--\nmm/damon/vaddr.c-400-\nmm/damon/vaddr.c:401:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/damon/vaddr.c-402-\tptl = pmd_trans_huge_lock(pmd, walk-\u003evma);\n--\nmm/damon/vaddr.c-419-\t}\nmm/damon/vaddr.c:420:#endif\t/* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/damon/vaddr.c-421-\n--\nmm/damon/vaddr.c=658=static int damos_va_migrate_pmd_entry(pmd_t *pmd, unsigned long addr,\n--\nmm/damon/vaddr.c-669-\nmm/damon/vaddr.c:670:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/damon/vaddr.c-671-\tptl = pmd_trans_huge_lock(pmd, walk-\u003evma);\n--\nmm/damon/vaddr.c-687-\t}\nmm/damon/vaddr.c:688:#endif\t/* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/damon/vaddr.c-689-\n--\nmm/damon/vaddr.c=818=static int damos_va_stat_pmd_entry(pmd_t *pmd, unsigned long addr,\n--\nmm/damon/vaddr.c-829-\nmm/damon/vaddr.c:830:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/damon/vaddr.c-831-\tptl = pmd_trans_huge_lock(pmd, vma);\n--\nmm/debug_vm_pgtable.c=114=static void __init pte_advanced_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-172-\nmm/debug_vm_pgtable.c:173:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/debug_vm_pgtable.c-174-static void __init pmd_basic_tests(struct pgtable_debug_args *args, int idx)\n--\nmm/debug_vm_pgtable.c=423=static void __init pud_leaf_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c-424-#endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */\nmm/debug_vm_pgtable.c:425:#else  /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-426-static void __init pmd_basic_tests(struct pgtable_debug_args *args, int idx) { }\n--\nmm/debug_vm_pgtable.c=431=static void __init pud_leaf_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c:432:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-433-\n--\nmm/debug_vm_pgtable.c=671=static void __init pte_protnone_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-682-\nmm/debug_vm_pgtable.c:683:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/debug_vm_pgtable.c-684-static void __init pmd_protnone_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-698-}\nmm/debug_vm_pgtable.c:699:#else  /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-700-static void __init pmd_protnone_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c:701:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-702-\n--\nmm/debug_vm_pgtable.c=715=static void __init pte_swap_soft_dirty_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-731-\nmm/debug_vm_pgtable.c:732:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/debug_vm_pgtable.c-733-static void __init pmd_soft_dirty_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c=749=static void __init pmd_leaf_soft_dirty_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-767-}\nmm/debug_vm_pgtable.c:768:#else  /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-769-static void __init pmd_soft_dirty_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c=770=static void __init pmd_leaf_soft_dirty_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c:771:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-772-\n--\nmm/debug_vm_pgtable.c=901=static void __init hugetlb_basic_tests(struct pgtable_debug_args *args) { }\n--\nmm/debug_vm_pgtable.c-903-\nmm/debug_vm_pgtable.c:904:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/debug_vm_pgtable.c-905-static void __init pmd_thp_tests(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c=955=static void __init pud_thp_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c-956-#endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */\nmm/debug_vm_pgtable.c:957:#else  /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-958-static void __init pmd_thp_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c=959=static void __init pud_thp_tests(struct pgtable_debug_args *args) { }\nmm/debug_vm_pgtable.c:960:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/debug_vm_pgtable.c-961-\n--\nmm/debug_vm_pgtable.c=987=static void __init destroy_args(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-989-\t/* Free (huge) page */\nmm/debug_vm_pgtable.c:990:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/debug_vm_pgtable.c-991-\t    has_transparent_pud_hugepage() \u0026\u0026\n--\nmm/debug_vm_pgtable.c-998-\nmm/debug_vm_pgtable.c:999:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/debug_vm_pgtable.c-1000-\t    has_transparent_hugepage() \u0026\u0026\n--\nmm/debug_vm_pgtable.c=1143=static int __init init_args(struct pgtable_debug_args *args)\n--\nmm/debug_vm_pgtable.c-1239-\t */\nmm/debug_vm_pgtable.c:1240:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/debug_vm_pgtable.c-1241-\t    has_transparent_pud_hugepage()) {\n--\nmm/debug_vm_pgtable.c-1250-\nmm/debug_vm_pgtable.c:1251:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/debug_vm_pgtable.c-1252-\t    has_transparent_hugepage()) {\n--\nmm/filemap.c=3314=static struct file *do_sync_mmap_readahead(struct vm_fault *vmf)\n--\nmm/filemap.c-3326-\t/* Use the readahead code, even if readahead is disabled */\nmm/filemap.c:3327:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 (vm_flags \u0026 VM_HUGEPAGE)) {\nmm/filemap.c-3328-\t\t/*\n--\nmm/gup.c=701=static struct page *follow_huge_pmd(struct vm_area_struct *vma,\n--\nmm/gup.c-734-\nmm/gup.c:735:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/gup.c-736-\tif (pmd_trans_huge(pmdval) \u0026\u0026 (flags \u0026 FOLL_TOUCH))\nmm/gup.c-737-\t\ttouch_pmd(vma, addr, pmd, flags \u0026 FOLL_WRITE);\nmm/gup.c:738:#endif\t/* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/gup.c-739-\n--\nmm/hmm.c=181=static inline unsigned long hmm_pfn_flags_order(unsigned long order)\n--\nmm/hmm.c-185-\nmm/hmm.c:186:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/hmm.c-187-static inline unsigned long pmd_to_hmm_pfn_flags(struct hmm_range *range,\n--\nmm/hmm.c=197=static int hmm_vma_handle_pmd(struct mm_walk *walk, unsigned long addr,\n--\nmm/hmm.c-220-}\nmm/hmm.c:221:#else /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/hmm.c-222-/* stub to allow the code below to compile */\nmm/hmm.c=223=int hmm_vma_handle_pmd(struct mm_walk *walk, unsigned long addr,\nmm/hmm.c-224-\t\tunsigned long end, unsigned long hmm_pfns[], pmd_t pmd);\nmm/hmm.c:225:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/hmm.c-226-\n--\nmm/huge_memory.c=60=unsigned long transparent_hugepage_flags __read_mostly =\nmm/huge_memory.c:61:#ifdef CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS\nmm/huge_memory.c-62-\t(1\u003c\u003cTRANSPARENT_HUGEPAGE_FLAG)|\nmm/huge_memory.c-63-#endif\nmm/huge_memory.c:64:#ifdef CONFIG_TRANSPARENT_HUGEPAGE_MADVISE\nmm/huge_memory.c-65-\t(1\u003c\u003cTRANSPARENT_HUGEPAGE_REQ_MADV_FLAG)|\n--\nmm/ksm.c=2494=static int ksm_next_page_pmd_entry(pmd_t *pmdp, unsigned long addr, unsigned long end,\n--\nmm/ksm.c-2514-\nmm/ksm.c:2515:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 pmd_leaf(pmd)) {\nmm/ksm.c-2516-\t\tptl = pmd_lock(mm, pmdp);\n--\nmm/madvise.c=354=static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,\n--\nmm/madvise.c-376-\nmm/madvise.c:377:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/madvise.c-378-\tif (pmd_trans_huge(*pmd)) {\n--\nmm/madvise.c=1519=madvise_behavior_valid(int behavior)\n--\nmm/madvise.c-1539-#endif\nmm/madvise.c:1540:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/madvise.c-1541-\tcase MADV_HUGEPAGE:\n--\nmm/memcontrol-v1.c=1866=static const unsigned int memcg1_stats[] = {\n--\nmm/memcontrol-v1.c-1868-\tNR_ANON_MAPPED,\nmm/memcontrol-v1.c:1869:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memcontrol-v1.c-1870-\tNR_ANON_THPS,\n--\nmm/memcontrol-v1.c=1884=static const char *const memcg1_stat_names[] = {\n--\nmm/memcontrol-v1.c-1886-\t\"rss\",\nmm/memcontrol-v1.c:1887:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memcontrol-v1.c-1888-\t\"rss_huge\",\n--\nmm/memcontrol.c=553=static const unsigned int memcg_vm_event_stat[] = {\n--\nmm/memcontrol.c-574-#endif\nmm/memcontrol.c:575:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memcontrol.c-576-\tTHP_FAULT_ALLOC,\n--\nmm/memcontrol.c=1546=static const struct memory_stat memory_stats[] = {\n--\nmm/memcontrol.c-1567-#endif\nmm/memcontrol.c:1568:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memcontrol.c-1569-\t{ \"anon_thp\",\t\t\tNR_ANON_THPS\t\t\t},\n--\nmm/memory-failure.c=679=static int check_hwpoisoned_entry(pte_t pte, unsigned long addr, short shift,\n--\nmm/memory-failure.c-703-\nmm/memory-failure.c:704:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memory-failure.c-705-static int check_hwpoisoned_pmd_entry(pmd_t *pmdp, unsigned long addr,\n--\nmm/memory.c=4067=static vm_fault_t wp_page_shared(struct vm_fault *vmf, struct folio *folio)\n--\nmm/memory.c-4106-\nmm/memory.c:4107:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memory.c-4108-static bool __wp_can_reuse_large_anon_folio(struct folio *folio,\n--\nmm/memory.c-4172-}\nmm/memory.c:4173:#else /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/memory.c-4174-static bool __wp_can_reuse_large_anon_folio(struct folio *folio,\n--\nmm/memory.c-4178-}\nmm/memory.c:4179:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/memory.c-4180-\nmm/memory.c=4181=static bool wp_can_reuse_anon_folio(struct folio *folio,\n--\nmm/memory.c-4183-{\nmm/memory.c:4184:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 folio_test_large(folio))\nmm/memory.c-4185-\t\treturn __wp_can_reuse_large_anon_folio(folio, vma);\n--\nmm/memory.c=4585=static vm_fault_t handle_pte_marker(struct vm_fault *vmf)\n--\nmm/memory.c-4611-\nmm/memory.c:4612:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memory.c-4613-/*\n--\nmm/memory.c=4661=static unsigned long thp_swapin_suitable_orders(struct vm_fault *vmf)\n--\nmm/memory.c-4720-}\nmm/memory.c:4721:#else /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/memory.c-4722-static unsigned long thp_swapin_suitable_orders(struct vm_fault *vmf)\n--\nmm/memory.c-4725-}\nmm/memory.c:4726:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/memory.c-4727-\n--\nmm/memory.c=5161=static struct folio *alloc_anon_folio(struct vm_fault *vmf)\n--\nmm/memory.c-5163-\tstruct vm_area_struct *vma = vmf-\u003evma;\nmm/memory.c:5164:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memory.c-5165-\tunsigned long orders;\n--\nmm/memory.c=5398=static vm_fault_t __do_fault(struct vm_fault *vmf)\n--\nmm/memory.c-5453-\nmm/memory.c:5454:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/memory.c-5455-static void deposit_prealloc_pte(struct vm_fault *vmf)\n--\nmm/memory.c=6242=static vm_fault_t create_huge_pud(struct vm_fault *vmf)\nmm/memory.c-6243-{\nmm/memory.c:6244:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\t\t\t\\\nmm/memory.c-6245-\tdefined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)\n--\nmm/memory.c-6251-\t\treturn vma-\u003evm_ops-\u003ehuge_fault(vmf, PUD_ORDER);\nmm/memory.c:6252:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/memory.c-6253-\treturn VM_FAULT_FALLBACK;\n--\nmm/memory.c=6256=static vm_fault_t wp_huge_pud(struct vm_fault *vmf, pud_t orig_pud)\nmm/memory.c-6257-{\nmm/memory.c:6258:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\t\t\t\\\nmm/memory.c-6259-\tdefined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)\n--\nmm/memory.c-6275-\t__split_huge_pud(vma, vmf-\u003epud, vmf-\u003eaddress);\nmm/memory.c:6276:#endif /* CONFIG_TRANSPARENT_HUGEPAGE \u0026\u0026 CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */\nmm/memory.c-6277-\treturn VM_FAULT_FALLBACK;\n--\nmm/memory.c=7294=EXPORT_SYMBOL(__might_fault);\n--\nmm/memory.c-7296-\nmm/memory.c:7297:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLBFS)\nmm/memory.c-7298-/*\n--\nmm/memory.c=7485=long copy_folio_from_user(struct folio *dst_folio,\n--\nmm/memory.c-7514-}\nmm/memory.c:7515:#endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */\nmm/memory.c-7516-\n--\nmm/mempolicy.c=2445=static struct page *alloc_pages_mpol(gfp_t gfp, unsigned int order,\n--\nmm/mempolicy.c-2455-\nmm/mempolicy.c:2456:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/mempolicy.c-2457-\t    /* filter \"hugepage\" allocation, unless from alloc_pages() */\n--\nmm/migrate.c=1580=static inline int try_split_folio(struct folio *folio, struct list_head *split_folios,\n--\nmm/migrate.c-1598-\nmm/migrate.c:1599:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/migrate.c-1600-#define NR_MAX_BATCHED_MIGRATION\tHPAGE_PMD_NR\n--\nmm/mmap.c=813=__get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,\n--\nmm/mmap.c-844-\t\taddr = get_area(file, addr, len, pgoff, flags);\nmm/mmap.c:845:\t} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 !file\nmm/mmap.c-846-\t\t   \u0026\u0026 !addr /* no hint */\n--\nmm/mremap.c=470=static inline bool move_normal_pud(struct pagetable_move_control *pmc,\n--\nmm/mremap.c-476-\nmm/mremap.c:477:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 defined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)\nmm/mremap.c-478-static bool move_huge_pud(struct pagetable_move_control *pmc,\n--\nmm/mremap.c=596=static bool move_pgt_entry(struct pagetable_move_control *pmc,\n--\nmm/mremap.c-613-\tcase HPAGE_PMD:\nmm/mremap.c:614:\t\tmoved = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/mremap.c-615-\t\t\tmove_huge_pmd(pmc-\u003eold, pmc-\u003eold_addr, pmc-\u003enew_addr, old_entry,\n--\nmm/mremap.c-618-\tcase HPAGE_PUD:\nmm/mremap.c:619:\t\tmoved = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/mremap.c-620-\t\t\tmove_huge_pud(pmc, old_entry, new_entry);\n--\nmm/page_alloc.c=651=static inline unsigned int order_to_pindex(int migratetype, int order)\nmm/page_alloc.c-652-{\nmm/page_alloc.c:653:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {\nmm/page_alloc.c-654-\t\tbool movable = migratetype == MIGRATE_MOVABLE;\n--\nmm/page_alloc.c=663=static inline int pindex_to_order(unsigned int pindex)\n--\nmm/page_alloc.c-666-\nmm/page_alloc.c:667:\tif (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {\nmm/page_alloc.c-668-\t\tif (pindex \u003e= NR_LOWORDER_PCP_LISTS)\n--\nmm/page_alloc.c=675=static inline bool pcp_allowed_order(unsigned int order)\n--\nmm/page_alloc.c-678-\t\treturn true;\nmm/page_alloc.c:679:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/page_alloc.c-680-\tif (is_pmd_order(order))\n--\nmm/page_idle.c=52=static bool page_idle_clear_pte_refs_one(struct folio *folio,\n--\nmm/page_idle.c-72-\t\t\treferenced |= mmu_notifier_clear_young(vma-\u003evm_mm, addr, addr + PAGE_SIZE);\nmm/page_idle.c:73:\t\t} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {\nmm/page_idle.c-74-\t\t\tpmd_t pmdval = pmdp_get(pvmw.pmd);\n--\nmm/page_io.c=305=static inline void count_swpout_vm_event(struct folio *folio)\nmm/page_io.c-306-{\nmm/page_io.c:307:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/page_io.c-308-\tif (unlikely(folio_test_pmd_mappable(folio))) {\n--\nmm/pgtable-generic.c=97=pte_t ptep_clear_flush(struct vm_area_struct *vma, unsigned long address,\n--\nmm/pgtable-generic.c-108-\nmm/pgtable-generic.c:109:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/pgtable-generic.c-110-\n--\nmm/pgtable-generic.c=250=void pte_free_defer(struct mm_struct *mm, pgtable_t pgtable)\n--\nmm/pgtable-generic.c-257-#endif /* pte_free_defer */\nmm/pgtable-generic.c:258:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/pgtable-generic.c-259-\n--\nmm/rmap.c=917=static bool folio_referenced_one(struct folio *folio,\n--\nmm/rmap.c-986-\t\t\t\treferenced++;\nmm/rmap.c:987:\t\t} else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {\nmm/rmap.c-988-\t\t\tif (pmdp_clear_flush_young_notify(vma, address,\n--\nmm/rmap.c=1103=static int page_vma_mkclean_one(struct page_vma_mapped_walk *pvmw)\n--\nmm/rmap.c-1143-\t\t} else {\nmm/rmap.c:1144:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/rmap.c-1145-\t\t\tpmd_t *pmd = pvmw-\u003epmd;\n--\nmm/rmap.c=1616=void folio_add_anon_rmap_pmd(struct folio *folio, struct page *page,\n--\nmm/rmap.c-1618-{\nmm/rmap.c:1619:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/rmap.c-1620-\t__folio_add_anon_rmap(folio, page, HPAGE_PMD_NR, vma, address, flags,\n--\nmm/rmap.c=1745=void folio_add_file_rmap_pmd(struct folio *folio, struct page *page,\n--\nmm/rmap.c-1747-{\nmm/rmap.c:1748:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/rmap.c-1749-\t__folio_add_file_rmap(folio, page, HPAGE_PMD_NR, vma, PGTABLE_LEVEL_PMD);\n--\nmm/rmap.c=1765=void folio_add_file_rmap_pud(struct folio *folio, struct page *page,\n--\nmm/rmap.c-1767-{\nmm/rmap.c:1768:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 \\\nmm/rmap.c-1769-\tdefined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)\n--\nmm/rmap.c=1913=void folio_remove_rmap_pmd(struct folio *folio, struct page *page,\n--\nmm/rmap.c-1915-{\nmm/rmap.c:1916:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/rmap.c-1917-\t__folio_remove_rmap(folio, page, HPAGE_PMD_NR, vma, PGTABLE_LEVEL_PMD);\n--\nmm/rmap.c=1933=void folio_remove_rmap_pud(struct folio *folio, struct page *page,\n--\nmm/rmap.c-1935-{\nmm/rmap.c:1936:#if defined(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026 \\\nmm/rmap.c-1937-\tdefined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)\n--\nmm/shmem.c=113=struct shmem_options {\n--\nmm/shmem.c-136-\nmm/shmem.c:137:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/shmem.c-138-static unsigned long huge_shmem_orders_always __read_mostly;\n--\nmm/shmem.c=520=static int shmem_confirm_swap(struct address_space *mapping, pgoff_t index,\n--\nmm/shmem.c-568-\nmm/shmem.c:569:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/shmem.c-570-/* ifdef here to avoid bloating shmem.o when not necessary */\nmm/shmem.c-571-\nmm/shmem.c:572:#if defined(CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_NEVER)\nmm/shmem.c-573-#define SHMEM_HUGE_DEFAULT SHMEM_HUGE_NEVER\nmm/shmem.c:574:#elif defined(CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS)\nmm/shmem.c-575-#define SHMEM_HUGE_DEFAULT SHMEM_HUGE_ALWAYS\nmm/shmem.c:576:#elif defined(CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_WITHIN_SIZE)\nmm/shmem.c-577-#define SHMEM_HUGE_DEFAULT SHMEM_HUGE_WITHIN_SIZE\nmm/shmem.c:578:#elif defined(CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ADVISE)\nmm/shmem.c-579-#define SHMEM_HUGE_DEFAULT SHMEM_HUGE_ADVISE\n--\nmm/shmem.c=584=static int shmem_huge __read_mostly = SHMEM_HUGE_DEFAULT;\n--\nmm/shmem.c-587-\nmm/shmem.c:588:#if defined(CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_NEVER)\nmm/shmem.c-589-#define TMPFS_HUGE_DEFAULT SHMEM_HUGE_NEVER\nmm/shmem.c:590:#elif defined(CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ALWAYS)\nmm/shmem.c-591-#define TMPFS_HUGE_DEFAULT SHMEM_HUGE_ALWAYS\nmm/shmem.c:592:#elif defined(CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE)\nmm/shmem.c-593-#define TMPFS_HUGE_DEFAULT SHMEM_HUGE_WITHIN_SIZE\nmm/shmem.c:594:#elif defined(CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE)\nmm/shmem.c-595-#define TMPFS_HUGE_DEFAULT SHMEM_HUGE_ADVISE\n--\nmm/shmem.c=845=static long shmem_unused_huge_count(struct super_block *sb,\n--\nmm/shmem.c-850-}\nmm/shmem.c:851:#else /* !CONFIG_TRANSPARENT_HUGEPAGE */\nmm/shmem.c-852-\n--\nmm/shmem.c=861=static unsigned int shmem_huge_global_enabled(struct inode *inode, pgoff_t index,\n--\nmm/shmem.c-867-}\nmm/shmem.c:868:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/shmem.c-869-\n--\nmm/shmem.c=1591=int shmem_writeout(struct folio *folio, struct swap_iocb **plug,\n--\nmm/shmem.c-1633-\nmm/shmem.c:1634:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/shmem.c-1635-\t\tif (order \u003e= HPAGE_PMD_ORDER) {\n--\nmm/shmem.c=1778=static struct folio *shmem_swapin_cluster(swp_entry_t swap, gfp_t gfp,\n--\nmm/shmem.c-1791-\nmm/shmem.c:1792:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/shmem.c-1793-bool shmem_hpage_pmd_enabled(void)\n--\nmm/shmem.c=1891=static unsigned long shmem_suitable_orders(struct inode *inode, struct vm_fault *vmf,\n--\nmm/shmem.c-1896-}\nmm/shmem.c:1897:#endif /* CONFIG_TRANSPARENT_HUGEPAGE */\nmm/shmem.c-1898-\n--\nmm/shmem.c=1913=static struct folio *shmem_alloc_and_add_folio(struct vm_fault *vmf,\n--\nmm/shmem.c-1924-\nmm/shmem.c:1925:\tif (!IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE))\nmm/shmem.c-1926-\t\torders = 0;\n--\nmm/shmem.c=2063=static int shmem_replace_folio(struct folio **foliop, gfp_t gfp,\n--\nmm/shmem.c-2077-\tgfp \u0026= ~GFP_CONSTRAINT_MASK;\nmm/shmem.c:2078:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/shmem.c-2079-\tif (nr_pages \u003e 1) {\n--\nmm/shmem.c=2714=unsigned long shmem_get_unmapped_area(struct file *file,\n--\nmm/shmem.c-2729-\nmm/shmem.c:2730:\tif (!IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE))\nmm/shmem.c-2731-\t\treturn addr;\n--\nmm/shmem.c-2773-\t\t\t */\nmm/shmem.c:2774:#ifdef CONFIG_TRANSPARENT_HUGEPAGE\nmm/shmem.c-2775-\t\t\thpage_orders = READ_ONCE(huge_shmem_orders_always);\n--\nmm/shmem.c=4507=static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param)\n--\nmm/shmem.c-4576-\t\tif (ctx-\u003ehuge != SHMEM_HUGE_NEVER \u0026\u0026\nmm/shmem.c:4577:\t\t    !(IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) \u0026\u0026\nmm/shmem.c-4578-\t\t      has_transparent_hugepage()))\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 16168
							output: 30
							thoughts: 212
						

**Analyzing the Memory Management Patch**

Okay, so this patch is touching a few key areas of the memory management subsystem: `mm/compaction.c`, `mm/huge_memory.c`, `mm/internal.h`, and `mm/page_alloc.c`. My initial scan shows modifications to several functions within these files. In `mm/compaction.c`, I see changes to `isolate_freepages_block`, `fast_isolate_freepages`, and `compaction_alloc_noprof`. `mm/huge_memory.c` has changes to `__split_folio_to_order`. `mm/internal.h` sees a modification to `prep_compound_tail`. Finally, `mm/page_alloc.c` has been updated with changes to `__free_pages_prepare`.

The core of this seems to be functional; they're removing `set_page_private(page, order)` calls for free and tail pages. Then they're adding checks to confirm that `page->private` is 0, implying a reliance on this value for either control or state.

Let's dive into `mm/huge_memory.c` and specifically examine `__split_folio_to_order`. This is where the impact will be most interesting. I'm keen to understand how this relates to compound pages and the freeing path. I'm looking for how this change impacts coalescing, and if there are any subtle performance implications related to the page cache or memory reclaim.

{
  "Expression": "__split_folio_to_order",
  "PathPrefix": "mm/"
}

{
  "Output": "mm/huge_memory.c=3515=static bool page_range_has_hwpoisoned(struct page *page, long nr_pages)\n--\nmm/huge_memory.c-3526- */\nmm/huge_memory.c:3527:static void __split_folio_to_order(struct folio *folio, int old_order,\nmm/huge_memory.c-3528-\t\tint new_order)\n--\nmm/huge_memory.c-3666- * 1. uniform split: @xas is split with no expectation of failure and a single\nmm/huge_memory.c:3667: *    __split_folio_to_order() is called to split the @folio into @new_order\nmm/huge_memory.c-3668- *    along with stats update.\nmm/huge_memory.c-3669- * 2. non-uniform split: folio_order - @new_order calls to\nmm/huge_memory.c:3670: *    __split_folio_to_order() are expected to be made in a for loop to split\nmm/huge_memory.c-3671- *    the @folio to one lower order at a time. The folio containing @split_at\n--\nmm/huge_memory.c=3683=static int __split_unmapped_folio(struct folio *folio, int new_order,\n--\nmm/huge_memory.c-3728-\t\tpgalloc_tag_split(folio, old_order, split_order);\nmm/huge_memory.c:3729:\t\t__split_folio_to_order(folio, old_order, split_order);\nmm/huge_memory.c-3730-\n"
}

gemini-3.1-pro-preview

null

null

							input: 17169
							output: 29
							thoughts: 37
						

Here's my take on the thought process, as if it were my own:

**Navigating the Folio Splitting Logic**

Okay, so I'm tracing the execution flow here. It looks like `__split_folio_to_order` is being invoked by the `__split_unmapped_folio` function. That makes sense, but before I go too far down the rabbit hole of `__split_folio_to_order`, I should probably understand the context that's *triggering* it. Therefore, my next step is definitely going to be to dig into `__split_unmapped_folio`. Understanding *why* we're splitting unmapped folios will give me a better handle on the logic of the secondary split function. Let's see what's going on in there.

{
  "Expression": "__split_unmapped_folio",
  "PathPrefix": "mm/"
}

{
  "Output": "mm/huge_memory.c=3527=static void __split_folio_to_order(struct folio *folio, int old_order,\n--\nmm/huge_memory.c-3642-/**\nmm/huge_memory.c:3643: * __split_unmapped_folio() - splits an unmapped @folio to lower order folios in\nmm/huge_memory.c-3644- * two ways: uniform split or non-uniform split.\n--\nmm/huge_memory.c-3682- */\nmm/huge_memory.c:3683:static int __split_unmapped_folio(struct folio *folio, int new_order,\nmm/huge_memory.c-3684-\t\tstruct page *split_at, struct xa_state *xas,\n--\nmm/huge_memory.c=3810=static int __folio_freeze_and_split_unmapped(struct folio *folio, unsigned int new_order,\n--\nmm/huge_memory.c-3883-\nmm/huge_memory.c:3884:\t\tret = __split_unmapped_folio(folio, new_order, split_at, xas,\nmm/huge_memory.c-3885-\t\t\t\t\t     mapping, split_type);\n--\nmm/huge_memory.c-3973- *\nmm/huge_memory.c:3974: * It calls __split_unmapped_folio() to perform uniform and non-uniform split.\nmm/huge_memory.c-3975- * It is in charge of checking whether the split is supported or not and\nmm/huge_memory.c:3976: * preparing @folio for __split_unmapped_folio().\nmm/huge_memory.c-3977- *\n--\nmm/huge_memory.c=3986=static int __folio_split(struct folio *folio, unsigned int new_order,\n--\nmm/huge_memory.c-4068-\t\t/*\nmm/huge_memory.c:4069:\t\t *__split_unmapped_folio() may need to trim off pages beyond\nmm/huge_memory.c-4070-\t\t * EOF: but on 32-bit, i_size_read() takes an irq-unsafe\n"
}

gemini-3.1-pro-preview

null

null

							input: 17972
							output: 35
							thoughts: 44
						

Here's my analysis of the situation:

**Investigating the Data Splitting Process**

Okay, so I see that the function `__folio_split` is being called from `split_huge_page_to_list_to_order`. My immediate thought is, let's trace this back and understand the whole call stack and the data flow. I need to understand what's triggering `__folio_split` in this specific context.  I'll dive into the code for `split_huge_page_to_list_to_order`.  I'm expecting this function will be handling the logic for taking a very large "page" of data and breaking it down into a more manageable, ordered list of smaller segments. Understanding the algorithm used here is critical to understanding why it's calling `__folio_split`. Is it a partitioning strategy, a block decomposition, or something else entirely?  Knowing the data structures involved and the ordering requirements will be key to making sense of `__folio_split`'s purpose within this workflow. I anticipate that `__folio_split` will be performing the actual splitting operation, but I need to see how `split_huge_page_to_list_to_order` is setting up the parameters and controlling the process.

{
  "Expression": "split_huge_page_to_list_to_order",
  "PathPrefix": "mm/"
}

{
  "Output": "mm/huge_memory.c=4178=int folio_split_unmapped(struct folio *folio, unsigned int new_order)\n--\nmm/huge_memory.c-4244- */\nmm/huge_memory.c:4245:int __split_huge_page_to_list_to_order(struct page *page, struct list_head *list,\nmm/huge_memory.c-4246-\t\t\t\t     unsigned int new_order)\n--\nmm/huge_memory.c-4262- * It has the same prerequisites and returns as\nmm/huge_memory.c:4263: * split_huge_page_to_list_to_order().\nmm/huge_memory.c-4264- *\n--\nmm/huge_memory.c=4312=int split_folio_to_list(struct folio *folio, struct list_head *list)\nmm/huge_memory.c-4313-{\nmm/huge_memory.c:4314:\treturn split_huge_page_to_list_to_order(\u0026folio-\u003epage, list, 0);\nmm/huge_memory.c-4315-}\n--\nmm/huge_memory.c=4598=static int split_huge_pages_pid(int pid, unsigned long vaddr_start,\n--\nmm/huge_memory.c-4667-\t\t/*\nmm/huge_memory.c:4668:\t\t * For folios with private, split_huge_page_to_list_to_order()\nmm/huge_memory.c-4669-\t\t * will try to drop it before split and then check if the folio\n"
}

gemini-3.1-pro-preview

null

null

							input: 18738
							output: 29
							thoughts: 114
						

**Analyzing the Core Functions**

Okay, so I'm looking at `split_huge_page_to_list_to_order`. It's a public API, so it's a critical entry point. My mind immediately jumps to the internal functions that likely drive its behavior. I need to understand the dependencies and the flow. The key symbols that seem relevant are: `isolate_freepages_block`, `fast_isolate_freepages`, `compaction_alloc_noprof`, and `__split_folio_to_order`. These feel like the guts of the operation, the low-level building blocks.

Wait a second...I just caught that `__split_folio_to_order` is a static function. That might present some interesting challenges for testing or potential future modifications. Given its status, I think the next logical step would be to drill down into the internals of `isolate_freepages_block` and `fast_isolate_freepages`. They're the non-static functions, and they're likely the ones directly handling the folio isolation within the context of the public API, but `__split_folio_to_order` could potentially perform the underlying logic. So I'll need to go deeper into those to understand the overall picture.

{
  "Expression": "isolate_freepages_block",
  "PathPrefix": "mm/"
}

{
  "Output": "mm/compaction.c=551=static bool compact_unlock_should_abort(spinlock_t *lock,\n--\nmm/compaction.c-573- */\nmm/compaction.c:574:static unsigned long isolate_freepages_block(struct compact_control *cc,\nmm/compaction.c-575-\t\t\t\tunsigned long *start_pfn,\n--\nmm/compaction.c=712=isolate_freepages_range(struct compact_control *cc,\n--\nmm/compaction.c-729-\t\t\t\tblock_end_pfn += pageblock_nr_pages) {\nmm/compaction.c:730:\t\t/* Protect pfn from changing by isolate_freepages_block */\nmm/compaction.c-731-\t\tunsigned long isolate_start_pfn = pfn;\n--\nmm/compaction.c-748-\nmm/compaction.c:749:\t\tisolated = isolate_freepages_block(cc, \u0026isolate_start_pfn,\nmm/compaction.c-750-\t\t\t\t\tblock_end_pfn, cc-\u003efreepages, 0, true);\n--\nmm/compaction.c-752-\t\t/*\nmm/compaction.c:753:\t\t * In strict mode, isolate_freepages_block() returns 0 if\nmm/compaction.c-754-\t\t * there are any holes in the block (ie. invalid PFNs or\n--\nmm/compaction.c=1474=fast_isolate_around(struct compact_control *cc, unsigned long pfn)\n--\nmm/compaction.c-1494-\nmm/compaction.c:1495:\tisolate_freepages_block(cc, \u0026start_pfn, end_pfn, cc-\u003efreepages, 1, false);\nmm/compaction.c-1496-\n--\nmm/compaction.c=1692=static void isolate_freepages(struct compact_control *cc)\n--\nmm/compaction.c-1763-\t\t/* Found a block suitable for isolating free pages from. */\nmm/compaction.c:1764:\t\tnr_isolated = isolate_freepages_block(cc, \u0026isolate_start_pfn,\nmm/compaction.c-1765-\t\t\t\t\tblock_end_pfn, cc-\u003efreepages, stride, false);\n--\nmm/compaction.c-1801-\t * broke from the loop and set isolate_start_pfn based on the last\nmm/compaction.c:1802:\t * call to isolate_freepages_block(), or we met the migration scanner\nmm/compaction.c-1803-\t * and the loop terminated due to isolate_start_pfn \u003c low_pfn\n"
}

gemini-3.1-pro-preview

null

null

							input: 19852
							output: 28
							thoughts: 163
						

**Analyzing Memory Compaction for Potential Fuzzing Targets**

Okay, let's take a look at these changes in `mm/compaction.c`. I need to figure out which functions are worth targeting for fuzzing. The key symbols seem to be `isolate_freepages_block`, `fast_isolate_freepages`, `compaction_alloc_noprof`, and `__split_folio_to_order`. Those are the ones the diff is focusing on. Hmm, but wait, `__free_pages_prepare` is in that list, and that's a *very* hot path. Fuzzing that directly might not yield much, since it's already so well-exercised, but the change itself is worth noting. I should double check to see if there are other functions involved here. 

Alright, I see `prep_compound_tail` as another modified function. Let me switch gears, and check out `__free_pages_prepare` more closely, specifically, let's go over to `mm/page_alloc.c` and take a deeper look.

{
  "Expression": "__free_pages_prepare",
  "PathPrefix": "mm/"
}

{
  "Output": "mm/page_alloc.c=1308=static inline void pgalloc_tag_sub_pages(struct alloc_tag *tag, unsigned int nr) {}\n--\nmm/page_alloc.c-1311-\nmm/page_alloc.c:1312:static __always_inline bool __free_pages_prepare(struct page *page,\nmm/page_alloc.c-1313-\t\tunsigned int order, fpi_t fpi_flags)\n--\nmm/page_alloc.c=1455=bool free_pages_prepare(struct page *page, unsigned int order)\nmm/page_alloc.c-1456-{\nmm/page_alloc.c:1457:\treturn __free_pages_prepare(page, order, FPI_NONE);\nmm/page_alloc.c-1458-}\n--\nmm/page_alloc.c=1584=static void __free_pages_ok(struct page *page, unsigned int order,\n--\nmm/page_alloc.c-1589-\nmm/page_alloc.c:1590:\tif (__free_pages_prepare(page, order, fpi_flags))\nmm/page_alloc.c-1591-\t\tfree_one_page(zone, page, pfn, order, fpi_flags);\n--\nmm/page_alloc.c=2943=static void __free_frozen_pages(struct page *page, unsigned int order,\n--\nmm/page_alloc.c-2955-\nmm/page_alloc.c:2956:\tif (!__free_pages_prepare(page, order, fpi_flags))\nmm/page_alloc.c-2957-\t\treturn;\n--\nmm/page_alloc.c=3005=void free_unref_folios(struct folio_batch *folios)\n--\nmm/page_alloc.c-3016-\nmm/page_alloc.c:3017:\t\tif (!__free_pages_prepare(\u0026folio-\u003epage, order, FPI_NONE))\nmm/page_alloc.c-3018-\t\t\tcontinue;\n"
}

gemini-3.1-pro-preview

null

null

							input: 20812
							output: 166
							thoughts: 471
						

**Focus Symbol and Configuration Selection**

Okay, so I'm analyzing this patch and its potential impact for fuzzing. I've identified some critical functions and configurations. Firstly, I've decided to exclude `__free_pages_prepare` from FocusSymbols because it's a hot path, and including it isn't the best use of resources. However, I will include `isolate_freepages_block`, `fast_isolate_freepages`, `compaction_alloc_noprof`, and `__split_folio_to_order`. Wait, `__split_folio_to_order` is static. That's fine, syzkaller can handle static functions if they're in the symbol table, so that's not a blocker.

I needed to check a few configurations. I confirmed `CONFIG_COMPACTION` and `CONFIG_TRANSPARENT_HUGEPAGE` are the relevant ones for this patch.

My reasoning is this: the patch modifies how we handle the `page->private` field during page freeing and THP splitting. It's a functional change within core memory management – specifically compaction, page allocation, and THP – which impacts page state. It could potentially trigger warnings or bad page states if the changes are violated, making it reachable and prime for fuzzing.

Therefore, the focus symbols are:
- `isolate_freepages_block`
- `fast_isolate_freepages`
- `compaction_alloc_noprof`
- `__split_folio_to_order`

And the enabled configurations are:
- `COMPACTION`
- `TRANSPARENT_HUGEPAGE`

Just to be absolutely sure, I've re-verified that I got the function names right: `__split_folio_to_order`, `compaction_alloc_noprof`, `isolate_freepages_block`, and `fast_isolate_freepages` are all correct.

Now, I'm going to call `set-results`.

{
  "EnableConfigs": [
    "COMPACTION",
    "TRANSPARENT_HUGEPAGE"
  ],
  "FocusSymbols": [
    "isolate_freepages_block",
    "fast_isolate_freepages",
    "compaction_alloc_noprof",
    "__split_folio_to_order"
  ],
  "Reasoning": "The patch modifies core memory management logic by removing `set_page_private` calls for free pages and tail pages, and adding checks to ensure `page-\u003eprivate` is 0 during page freeing and THP splitting. This is a functional change affecting compaction, page allocation, and THP, which can trigger warnings or bad page states if violated. It is reachable and worth fuzzing.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "COMPACTION",
    "TRANSPARENT_HUGEPAGE"
  ],
  "FocusSymbols": [
    "isolate_freepages_block",
    "fast_isolate_freepages",
    "compaction_alloc_noprof",
    "__split_folio_to_order"
  ],
  "Reasoning": "The patch modifies core memory management logic by removing `set_page_private` calls for free pages and tail pages, and adding checks to ensure `page-\u003eprivate` is 0 during page freeing and THP splitting. This is a functional change affecting compaction, page allocation, and THP, which can trigger warnings or bad page states if violated. It is reachable and worth fuzzing.",
  "WorthFuzzing": true
}