syzbot


ID Workflow Result Correct Bug Created Started Finished Revision Error
d7ed7475-22cd-4cf1-83f2-e84c5dd3e621 assessment-kcsan Benign: ❌  KCSAN: data-race in __filemap_add_folio / invalidate_bdev (10) 2026/01/12 18:24 2026/01/12 18:25 2026/01/12 18:28 dc57dbf3ee402bd8ad9c3037d56ee9d9940a9bc6
Benign: ❌   

Explanation:
The bug report indicates a data race on `mapping->nrpages` (a field of type `unsigned long`) between `__filemap_add_folio` (writer) and `invalidate_bdev` (reader).

The report is **actionable** and the data race is **harmful**.

**Analysis:**

1.  **Consistency:** The report provides two stack traces that access the same memory location (`0xffff888100483138`).
    *   The writer is `__filemap_add_folio` in `mm/filemap.c`, specifically the line `mapping->nrpages += nr;` (line 931 in the report, corresponding to the increment). This function is responsible for adding folios to the page cache and updates the page count under `xas_lock` (spinlock).
    *   The reader is `invalidate_bdev` in `block/bdev.c`, at line 99. This corresponds to the check `if (mapping->nrpages)` at the beginning of `invalidate_bdev`. This function attempts to invalidate all pages associated with the block device.
    *   The subsystems involved (`mm` and `block`) interact via `struct address_space` (`mapping`), which is expected. The variable `nrpages` tracks the number of pages in the mapping.

2.  **Harmfulness:**
    *   `invalidate_bdev` uses the lockless check `if (mapping->nrpages)` as an optimization to return early if the cache is empty.
    *   `__filemap_add_folio` increments `mapping->nrpages` while holding the xarray lock (`xas_lock_irq`), but `invalidate_bdev` does not take this lock.
    *   If `invalidate_bdev` runs concurrently with a read operation (which calls `__filemap_add_folio`), it might observe `nrpages` as 0 (before the increment is visible), even though a page has just been added (or is being added) to the page cache.
    *   If `invalidate_bdev` incorrectly sees 0 and returns early, it skips calling `invalidate_mapping_pages`. Consequently, the newly added page remains in the page cache.
    *   This is particularly problematic in the context of the reported trace (`loop_set_status`), which reconfigures the loop device. If a concurrent read adds a page based on the old configuration, and `invalidate_bdev` fails to flush it due to this race, the cache will contain stale data. Subsequent reads will see this stale data instead of reading from the new backing file/configuration, leading to data corruption or inconsistency.
    *   Therefore, the race is not benign; it compromises the guarantee that the device cache is flushed.

**Conclusion:**
The report is valid. The `invalidate_bdev` function relies on a racy check of `mapping->nrpages` which can lead to missed invalidations of pages added concurrently, potentially resulting in stale data persistence. The fix would involve removing the optimization or ensuring proper synchronization.

Crash report:
==================================================================
BUG: KCSAN: data-race in __filemap_add_folio / invalidate_bdev

read-write to 0xffff888100483138 of 8 bytes by task 3303 on cpu 0:
 __filemap_add_folio+0x5b9/0x7d0 mm/filemap.c:931
 filemap_add_folio+0x1d9/0x360 mm/filemap.c:978
 page_cache_ra_unbounded+0x203/0x450 mm/readahead.c:280
 do_page_cache_ra mm/readahead.c:332 [inline]
 force_page_cache_ra mm/readahead.c:361 [inline]
 page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579
 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2638
 filemap_read+0x231/0xa00 mm/filemap.c:2748
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:859
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x64c/0x770 fs/read_write.c:572
 ksys_read+0xda/0x1a0 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:722
 x64_sys_call+0x27c0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100483138 of 8 bytes by task 10300 on cpu 1:
 invalidate_bdev+0x25/0x70 block/bdev.c:99
 bdev_disk_changed+0xeb/0xcb0 block/partitions/core.c:657
 loop_reread_partitions drivers/block/loop.c:449 [inline]
 loop_set_status+0x5d2/0x6a0 drivers/block/loop.c:1278
 loop_set_status64 drivers/block/loop.c:1374 [inline]
 lo_ioctl+0x671/0x12b0 drivers/block/loop.c:1560
 blkdev_ioctl+0x356/0x440 block/ioctl.c:705
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1816/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000000000000d -> 0x000000000000000e

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 10300 Comm: syz.6.2066 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
==================================================================
 loop6: p1 p2 p3 p4
loop6: p3 start 331777 is beyond EOD, truncated
loop6: p4 size 262144 extends beyond EOD, truncated

Trajectory:
Seq Timestamp Type Name Duration
0/0 2026/01/12 18:25 flow assessment-kcsan
3m Model:
unknown

Results:
map[Benign:false Explanation:The bug report indicates a data race on `mapping->nrpages` (a field of type `unsigned long`) between `__filemap_add_folio` (writer) and `invalidate_bdev` (reader).

The report is **actionable** and the data race is **harmful**.

**Analysis:**

1.  **Consistency:** The report provides two stack traces that access the same memory location (`0xffff888100483138`).
    *   The writer is `__filemap_add_folio` in `mm/filemap.c`, specifically the line `mapping->nrpages += nr;` (line 931 in the report, corresponding to the increment). This function is responsible for adding folios to the page cache and updates the page count under `xas_lock` (spinlock).
    *   The reader is `invalidate_bdev` in `block/bdev.c`, at line 99. This corresponds to the check `if (mapping->nrpages)` at the beginning of `invalidate_bdev`. This function attempts to invalidate all pages associated with the block device.
    *   The subsystems involved (`mm` and `block`) interact via `struct address_space` (`mapping`), which is expected. The variable `nrpages` tracks the number of pages in the mapping.

2.  **Harmfulness:**
    *   `invalidate_bdev` uses the lockless check `if (mapping->nrpages)` as an optimization to return early if the cache is empty.
    *   `__filemap_add_folio` increments `mapping->nrpages` while holding the xarray lock (`xas_lock_irq`), but `invalidate_bdev` does not take this lock.
    *   If `invalidate_bdev` runs concurrently with a read operation (which calls `__filemap_add_folio`), it might observe `nrpages` as 0 (before the increment is visible), even though a page has just been added (or is being added) to the page cache.
    *   If `invalidate_bdev` incorrectly sees 0 and returns early, it skips calling `invalidate_mapping_pages`. Consequently, the newly added page remains in the page cache.
    *   This is particularly problematic in the context of the reported trace (`loop_set_status`), which reconfigures the loop device. If a concurrent read adds a page based on the old configuration, and `invalidate_bdev` fails to flush it due to this race, the cache will contain stale data. Subsequent reads will see this stale data instead of reading from the new backing file/configuration, leading to data corruption or inconsistency.
    *   Therefore, the race is not benign; it compromises the guarantee that the device cache is flushed.

**Conclusion:**
The report is valid. The `invalidate_bdev` function relies on a racy check of `mapping->nrpages` which can lead to missed invalidations of pages added concurrently, potentially resulting in stale data persistence. The fix would involve removing the optimization or ensuring proper synchronization.]

1/1 2026/01/12 18:25 action kernel-checkouter
0m Model:
unknown

Results:
map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/14f11b2e082c8a123c1647b54397ffbdaf0f2d6f]

2/1 2026/01/12 18:25 action kernel-builder
0m Model:
unknown

Results:
map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/519ff091818fa17fa4250947c56fe2552a0892dd]

3/1 2026/01/12 18:25 action codesearch-prepare
0m Model:
unknown

Results:
map[Index:codesearch-index]

4/1 2026/01/12 18:25 agent expert
3m Model:
unknown

Results:
map[Benign:false]

Instruction:
You are an experienced Linux kernel developer tasked with determining if the given kernel bug
report is actionable or not. Actionable means that it contains enough info to root cause
the underlying bug, and that the report is self-consistent and makes sense, rather than
a one-off nonsensical crash induced by a previous memory corruption.

Use the provided tools to confirm any assumptions, what variables/fields being accessed, etc.
In particular, don't make assumptions about the kernel source code,
use codesearch tools to read the actual source code.

The bug report is a data race report from KCSAN tool.
It contains 2 stack traces of the memory accesses that constitute a data race.
The report would be inconsistent, if the stacks point to different subsystems,
or if they access different fields.
The report would be non-actionable, if the underlysing data race is "benign".
That is, the race is on a simple int/bool or similar field, and the accesses
are not supposed to be protected by any mutual exclusion primitives.
Common examples of such "benign" data races are accesses to various flags fields,
statistics counters, and similar.
An actionable race is "harmful", that is can lead to corruption/crash even with
a conservative compiler that compiles memory accesses to primitive types
effectively as atomic. A common example of a "harmful" data races is race on
a complex container (list/hashmap/etc), where accesses are supposed to be protected
by a mutual exclusion primitive.
In the final reply explain why you think the report is consistent and the data race is harmful.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:
The bug report is:

==================================================================
BUG: KCSAN: data-race in __filemap_add_folio / invalidate_bdev

read-write to 0xffff888100483138 of 8 bytes by task 3303 on cpu 0:
 __filemap_add_folio+0x5b9/0x7d0 mm/filemap.c:931
 filemap_add_folio+0x1d9/0x360 mm/filemap.c:978
 page_cache_ra_unbounded+0x203/0x450 mm/readahead.c:280
 do_page_cache_ra mm/readahead.c:332 [inline]
 force_page_cache_ra mm/readahead.c:361 [inline]
 page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579
 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2638
 filemap_read+0x231/0xa00 mm/filemap.c:2748
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:859
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x64c/0x770 fs/read_write.c:572
 ksys_read+0xda/0x1a0 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:722
 x64_sys_call+0x27c0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100483138 of 8 bytes by task 10300 on cpu 1:
 invalidate_bdev+0x25/0x70 block/bdev.c:99
 bdev_disk_changed+0xeb/0xcb0 block/partitions/core.c:657
 loop_reread_partitions drivers/block/loop.c:449 [inline]
 loop_set_status+0x5d2/0x6a0 drivers/block/loop.c:1278
 loop_set_status64 drivers/block/loop.c:1374 [inline]
 lo_ioctl+0x671/0x12b0 drivers/block/loop.c:1560
 blkdev_ioctl+0x356/0x440 block/ioctl.c:705
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1816/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000000000000d -> 0x000000000000000e

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 10300 Comm: syz.6.2066 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
==================================================================
 loop6: p1 p2 p3 p4
loop6: p3 start 331777 is beyond EOD, truncated
loop6: p4 size 262144 extends beyond EOD, truncated


Reply:
The bug report indicates a data race on `mapping->nrpages` (a field of type `unsigned long`) between `__filemap_add_folio` (writer) and `invalidate_bdev` (reader).

The report is **actionable** and the data race is **harmful**.

**Analysis:**

1.  **Consistency:** The report provides two stack traces that access the same memory location (`0xffff888100483138`).
    *   The writer is `__filemap_add_folio` in `mm/filemap.c`, specifically the line `mapping->nrpages += nr;` (line 931 in the report, corresponding to the increment). This function is responsible for adding folios to the page cache and updates the page count under `xas_lock` (spinlock).
    *   The reader is `invalidate_bdev` in `block/bdev.c`, at line 99. This corresponds to the check `if (mapping->nrpages)` at the beginning of `invalidate_bdev`. This function attempts to invalidate all pages associated with the block device.
    *   The subsystems involved (`mm` and `block`) interact via `struct address_space` (`mapping`), which is expected. The variable `nrpages` tracks the number of pages in the mapping.

2.  **Harmfulness:**
    *   `invalidate_bdev` uses the lockless check `if (mapping->nrpages)` as an optimization to return early if the cache is empty.
    *   `__filemap_add_folio` increments `mapping->nrpages` while holding the xarray lock (`xas_lock_irq`), but `invalidate_bdev` does not take this lock.
    *   If `invalidate_bdev` runs concurrently with a read operation (which calls `__filemap_add_folio`), it might observe `nrpages` as 0 (before the increment is visible), even though a page has just been added (or is being added) to the page cache.
    *   If `invalidate_bdev` incorrectly sees 0 and returns early, it skips calling `invalidate_mapping_pages`. Consequently, the newly added page remains in the page cache.
    *   This is particularly problematic in the context of the reported trace (`loop_set_status`), which reconfigures the loop device. If a concurrent read adds a page based on the old configuration, and `invalidate_bdev` fails to flush it due to this race, the cache will contain stale data. Subsequent reads will see this stale data instead of reading from the new backing file/configuration, leading to data corruption or inconsistency.
    *   Therefore, the race is not benign; it compromises the guarantee that the device cache is flushed.

**Conclusion:**
The report is valid. The `invalidate_bdev` function relies on a racy check of `mapping->nrpages` which can lead to missed invalidations of pages added concurrently, potentially resulting in stale data persistence. The fix would involve removing the optimization or ensuring proper synchronization.

5/2 2026/01/12 18:25 llm expert
0m Model:
unknown

6/2 2026/01/12 18:25 tool codesearch-file-index
0m Model:
unknown

Args:
map[SourceFile:mm/filemap.c]

Results:
map[Entities:[map[Kind:function Name:__do_sys_cachestat] map[Kind:function Name:__do_sys_cachestat] map[Kind:function Name:__filemap_add_folio] map[Kind:function Name:__filemap_fdatawait_range] map[Kind:function Name:__filemap_fdatawrite] map[Kind:function Name:__filemap_fdatawrite_range] map[Kind:function Name:__filemap_get_folio] map[Kind:function Name:__filemap_get_folio] map[Kind:function Name:__filemap_remove_folio] map[Kind:function Name:__filemap_set_wb_err] map[Kind:function Name:__filemap_set_wb_err] map[Kind:function Name:__folio_lock] map[Kind:function Name:__folio_lock] map[Kind:function Name:__folio_lock_async] map[Kind:function Name:__folio_lock_killable] map[Kind:function Name:__folio_lock_killable] map[Kind:function Name:__folio_lock_or_retry] map[Kind:function Name:__generic_file_write_iter] map[Kind:function Name:__generic_file_write_iter] map[Kind:function Name:__ia32_sys_cachestat] map[Kind:function Name:__se_sys_cachestat] map[Kind:function Name:__x64_sys_cachestat] map[Kind:function Name:can_do_cachestat] map[Kind:function Name:delete_from_page_cache_batch] map[Kind:function Name:dio_warn_stale_pagecache] map[Kind:function Name:do_async_mmap_readahead] map[Kind:function Name:do_read_cache_folio] map[Kind:function Name:do_read_cache_page] map[Kind:function Name:do_sync_mmap_readahead] map[Kind:function Name:file_check_and_advance_wb_err] map[Kind:function Name:file_check_and_advance_wb_err] map[Kind:function Name:file_fdatawait_range] map[Kind:function Name:file_fdatawait_range] map[Kind:function Name:file_write_and_wait_range] map[Kind:function Name:file_write_and_wait_range] map[Kind:function Name:filemap_add_folio] map[Kind:function Name:filemap_add_folio] map[Kind:function Name:filemap_alloc_folio_noprof] map[Kind:function Name:filemap_alloc_folio_noprof] map[Kind:function Name:filemap_cachestat] map[Kind:function Name:filemap_check_and_keep_errors] map[Kind:function Name:filemap_check_errors] map[Kind:function Name:filemap_check_errors] map[Kind:function Name:filemap_create_folio] map[Kind:function Name:filemap_end_dropbehind] map[Kind:function Name:filemap_end_dropbehind_read] map[Kind:function Name:filemap_fault] map[Kind:function Name:filemap_fault] map[Kind:function Name:filemap_fault_recheck_pte_none] map[Kind:function Name:filemap_fdatawait_keep_errors] map[Kind:function Name:filemap_fdatawait_keep_errors] map[Kind:function Name:filemap_fdatawait_range] map[Kind:function Name:filemap_fdatawait_range] map[Kind:function Name:filemap_fdatawait_range_keep_errors] map[Kind:function Name:filemap_fdatawait_range_keep_errors] map[Kind:function Name:filemap_fdatawrite] map[Kind:function Name:filemap_fdatawrite] map[Kind:function Name:filemap_fdatawrite_range] map[Kind:function Name:filemap_fdatawrite_range] map[Kind:function Name:filemap_fdatawrite_range_kick] map[Kind:function Name:filemap_fdatawrite_range_kick] map[Kind:function Name:filemap_fdatawrite_wbc] map[Kind:function Name:filemap_fdatawrite_wbc] map[Kind:function Name:filemap_flush] map[Kind:function Name:filemap_flush] map[Kind:function Name:filemap_free_folio] map[Kind:function Name:filemap_get_entry] map[Kind:function Name:filemap_get_folios] map[Kind:function Name:filemap_get_folios] map[Kind:function Name:filemap_get_folios_contig] map[Kind:function Name:filemap_get_folios_contig] map[Kind:function Name:filemap_get_folios_tag] map[Kind:function Name:filemap_get_folios_tag] map[Kind:function Name:filemap_get_pages] map[Kind:function Name:filemap_get_read_batch] map[Kind:function Name:filemap_invalidate_inode] map[Kind:function Name:filemap_invalidate_inode] map[Kind:function Name:filemap_invalidate_lock_two] map[Kind:function Name:filemap_invalidate_lock_two] map[Kind:function Name:filemap_invalidate_pages] map[Kind:function Name:filemap_invalidate_unlock_two] map[Kind:function Name:filemap_invalidate_unlock_two] map[Kind:function Name:filemap_map_folio_range] map[Kind:function Name:filemap_map_order0_folio] map[Kind:function Name:filemap_map_pages] map[Kind:function Name:filemap_map_pages] map[Kind:function Name:filemap_map_pmd] map[Kind:function Name:filemap_page_mkwrite] map[Kind:function Name:filemap_page_mkwrite] map[Kind:function Name:filemap_range_has_page] map[Kind:function Name:filemap_range_has_page] map[Kind:function Name:filemap_range_has_writeback] map[Kind:function Name:filemap_range_has_writeback] map[Kind:function Name:filemap_range_uptodate] map[Kind:function Name:filemap_read] map[Kind:function Name:filemap_read] map[Kind:function Name:filemap_read_folio] map[Kind:function Name:filemap_readahead] map[Kind:function Name:filemap_release_folio] map[Kind:function Name:filemap_release_folio] map[Kind:function Name:filemap_remove_folio] map[Kind:function Name:filemap_splice_read] map[Kind:function Name:filemap_splice_read] map[Kind:function Name:filemap_unaccount_folio] map[Kind:function Name:filemap_update_page] map[Kind:function Name:filemap_write_and_wait_range] map[Kind:function Name:filemap_write_and_wait_range] map[Kind:function Name:find_get_entries] map[Kind:function Name:find_get_entry] map[Kind:function Name:find_lock_entries] map[Kind:function Name:folio_end_dropbehind] map[Kind:function Name:folio_end_dropbehind] map[Kind:function Name:folio_end_private_2] map[Kind:function Name:folio_end_private_2] map[Kind:function Name:folio_end_read] map[Kind:function Name:folio_end_read] map[Kind:function Name:folio_end_writeback] map[Kind:function Name:folio_end_writeback] map[Kind:function Name:folio_end_writeback_no_dropbehind] map[Kind:function Name:folio_end_writeback_no_dropbehind] map[Kind:function Name:folio_put_wait_locked] map[Kind:function Name:folio_seek_hole_data] map[Kind:function Name:folio_trylock_flag] map[Kind:function Name:folio_unlock] map[Kind:function Name:folio_unlock] map[Kind:function Name:folio_wait_bit] map[Kind:function Name:folio_wait_bit] map[Kind:function Name:folio_wait_bit_common] map[Kind:function Name:folio_wait_bit_killable] map[Kind:function Name:folio_wait_bit_killable] map[Kind:function Name:folio_wait_private_2] map[Kind:function Name:folio_wait_private_2] map[Kind:function Name:folio_wait_private_2_killable] map[Kind:function Name:folio_wait_private_2_killable] map[Kind:function Name:folio_waitqueue] map[Kind:function Name:folio_wake_bit] map[Kind:function Name:generic_file_direct_write] map[Kind:function Name:generic_file_direct_write] map[Kind:function Name:generic_file_mmap] map[Kind:function Name:generic_file_mmap] map[Kind:function Name:generic_file_mmap_prepare] map[Kind:function Name:generic_file_mmap_prepare] map[Kind:function Name:generic_file_read_iter] map[Kind:function Name:generic_file_read_iter] map[Kind:function Name:generic_file_readonly_mmap] map[Kind:function Name:generic_file_readonly_mmap] map[Kind:function Name:generic_file_readonly_mmap_prepare] map[Kind:function Name:generic_file_readonly_mmap_prepare] map[Kind:function Name:generic_file_write_iter] map[Kind:function Name:generic_file_write_iter] map[Kind:function Name:generic_perform_write] map[Kind:function Name:generic_perform_write] map[Kind:function Name:kiocb_invalidate_pages] map[Kind:function Name:kiocb_invalidate_pages] map[Kind:function Name:kiocb_invalidate_post_direct_write] map[Kind:function Name:kiocb_write_and_wait] map[Kind:function Name:kiocb_write_and_wait] map[Kind:function Name:lock_folio_maybe_drop_mmap] map[Kind:function Name:mapping_needs_writeback] map[Kind:function Name:mapping_read_folio_gfp] map[Kind:function Name:mapping_read_folio_gfp] map[Kind:function Name:mapping_seek_hole_data] map[Kind:function Name:migration_entry_wait_on_locked] map[Kind:function Name:next_uptodate_folio] map[Kind:function Name:page_cache_delete] map[Kind:function Name:page_cache_delete_batch] map[Kind:function Name:page_cache_next_miss] map[Kind:function Name:page_cache_next_miss] map[Kind:function Name:page_cache_prev_miss] map[Kind:function Name:page_cache_prev_miss] map[Kind:function Name:pagecache_init] map[Kind:function Name:pos_same_folio] map[Kind:function Name:read_cache_folio] map[Kind:function Name:read_cache_folio] map[Kind:function Name:read_cache_page] map[Kind:function Name:read_cache_page] map[Kind:function Name:read_cache_page_gfp] map[Kind:function Name:read_cache_page_gfp] map[Kind:function Name:replace_page_cache_folio] map[Kind:function Name:replace_page_cache_folio] map[Kind:function Name:seek_folio_size] map[Kind:function Name:shrink_readahead_size_eio] map[Kind:function Name:splice_folio_into_pipe] map[Kind:function Name:wake_page_function]] Missing:false]

7/2 2026/01/12 18:25 llm expert
0m Model:
unknown

8/2 2026/01/12 18:25 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:__filemap_add_folio SourceFile:mm/filemap.c]

Results:
map[Missing:false SourceCode: 859:	noinline int __filemap_add_folio(struct address_space *mapping,
 860:			struct folio *folio, pgoff_t index, gfp_t gfp, void **shadowp)
 861:	{
 862:		XA_STATE_ORDER(xas, &mapping->i_pages, index, folio_order(folio));
 863:		bool huge;
 864:		long nr;
 865:		unsigned int forder = folio_order(folio);
 866:	
 867:		VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
 868:		VM_BUG_ON_FOLIO(folio_test_swapbacked(folio), folio);
 869:		VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping),
 870:				folio);
 871:		mapping_set_update(&xas, mapping);
 872:	
 873:		VM_BUG_ON_FOLIO(index & (folio_nr_pages(folio) - 1), folio);
 874:		huge = folio_test_hugetlb(folio);
 875:		nr = folio_nr_pages(folio);
 876:	
 877:		gfp &= GFP_RECLAIM_MASK;
 878:		folio_ref_add(folio, nr);
 879:		folio->mapping = mapping;
 880:		folio->index = xas.xa_index;
 881:	
 882:		for (;;) {
 883:			int order = -1;
 884:			void *entry, *old = NULL;
 885:	
 886:			xas_lock_irq(&xas);
 887:			xas_for_each_conflict(&xas, entry) {
 888:				old = entry;
 889:				if (!xa_is_value(entry)) {
 890:					xas_set_err(&xas, -EEXIST);
 891:					goto unlock;
 892:				}
 893:				/*
 894:				 * If a larger entry exists,
 895:				 * it will be the first and only entry iterated.
 896:				 */
 897:				if (order == -1)
 898:					order = xas_get_order(&xas);
 899:			}
 900:	
 901:			if (old) {
 902:				if (order > 0 && order > forder) {
 903:					unsigned int split_order = max(forder,
 904:							xas_try_split_min_order(order));
 905:	
 906:					/* How to handle large swap entries? */
 907:					BUG_ON(shmem_mapping(mapping));
 908:	
 909:					while (order > forder) {
 910:						xas_set_order(&xas, index, split_order);
 911:						xas_try_split(&xas, old, order);
 912:						if (xas_error(&xas))
 913:							goto unlock;
 914:						order = split_order;
 915:						split_order =
 916:							max(xas_try_split_min_order(
 917:								    split_order),
 918:							    forder);
 919:					}
 920:					xas_reset(&xas);
 921:				}
 922:				if (shadowp)
 923:					*shadowp = old;
 924:			}
 925:	
 926:			xas_store(&xas, folio);
 927:			if (xas_error(&xas))
 928:				goto unlock;
 929:	
 930:			mapping->nrpages += nr;
 931:	
 932:			/* hugetlb pages do not participate in page cache accounting */
 933:			if (!huge) {
 934:				__lruvec_stat_mod_folio(folio, NR_FILE_PAGES, nr);
 935:				if (folio_test_pmd_mappable(folio))
 936:					__lruvec_stat_mod_folio(folio,
 937:							NR_FILE_THPS, nr);
 938:			}
 939:	
 940:	unlock:
 941:			xas_unlock_irq(&xas);
 942:	
 943:			if (!xas_nomem(&xas, gfp))
 944:				break;
 945:		}
 946:	
 947:		if (xas_error(&xas))
 948:			goto error;
 949:	
 950:		trace_mm_filemap_add_to_page_cache(folio);
 951:		return 0;
 952:	error:
 953:		folio->mapping = NULL;
 954:		/* Leave folio->index set: truncation relies upon it */
 955:		folio_put_refs(folio, nr);
 956:		return xas_error(&xas);
 957:	}
 SourceFile:mm/filemap.c]

9/2 2026/01/12 18:25 llm expert
0m Model:
unknown

10/2 2026/01/12 18:25 tool codesearch-file-index
0m Model:
unknown

Args:
map[SourceFile:block/bdev.c]

Results:
map[Entities:[map[Kind:function Name:BDEV_I] map[Kind:function Name:BD_INODE] map[Kind:function Name:I_BDEV] map[Kind:function Name:I_BDEV] map[Kind:function Name:bd_abort_claiming] map[Kind:function Name:bd_abort_claiming] map[Kind:function Name:bd_clear_claiming] map[Kind:function Name:bd_end_claim] map[Kind:function Name:bd_finish_claiming] map[Kind:function Name:bd_init_fs_context] map[Kind:function Name:bd_may_claim] map[Kind:function Name:bd_prepare_to_claim] map[Kind:function Name:bd_prepare_to_claim] map[Kind:function Name:bd_yield_claim] map[Kind:function Name:bdev_add] map[Kind:function Name:bdev_alloc] map[Kind:function Name:bdev_alloc_inode] map[Kind:function Name:bdev_block_writes] map[Kind:function Name:bdev_cache_init] map[Kind:function Name:bdev_claim_write_access] map[Kind:function Name:bdev_drop] map[Kind:function Name:bdev_evict_inode] map[Kind:function Name:bdev_file_open_by_dev] map[Kind:function Name:bdev_file_open_by_dev] map[Kind:function Name:bdev_file_open_by_path] map[Kind:function Name:bdev_file_open_by_path] map[Kind:function Name:bdev_fput] map[Kind:function Name:bdev_fput] map[Kind:function Name:bdev_free_inode] map[Kind:function Name:bdev_freeze] map[Kind:function Name:bdev_freeze] map[Kind:function Name:bdev_mark_dead] map[Kind:function Name:bdev_mark_dead] map[Kind:function Name:bdev_may_open] map[Kind:function Name:bdev_open] map[Kind:function Name:bdev_permission] map[Kind:function Name:bdev_release] map[Kind:function Name:bdev_set_nr_sectors] map[Kind:function Name:bdev_statx] map[Kind:function Name:bdev_thaw] map[Kind:function Name:bdev_thaw] map[Kind:function Name:bdev_unblock_writes] map[Kind:function Name:bdev_unclaimed] map[Kind:function Name:bdev_unhash] map[Kind:function Name:bdev_validate_blocksize] map[Kind:function Name:bdev_validate_blocksize] map[Kind:function Name:bdev_write_inode] map[Kind:function Name:bdev_writes_blocked] map[Kind:function Name:bdev_yield_write_access] map[Kind:function Name:blk_to_file_flags] map[Kind:function Name:blkdev_flush_mapping] map[Kind:function Name:blkdev_get_no_open] map[Kind:function Name:blkdev_get_part] map[Kind:function Name:blkdev_get_whole] map[Kind:function Name:blkdev_put_no_open] map[Kind:function Name:blkdev_put_part] map[Kind:function Name:blkdev_put_whole] map[Kind:function Name:block_size] map[Kind:function Name:block_size] map[Kind:function Name:disk_live] map[Kind:function Name:disk_live] map[Kind:function Name:file_bdev] map[Kind:function Name:file_bdev] map[Kind:function Name:init_once] map[Kind:function Name:invalidate_bdev] map[Kind:function Name:invalidate_bdev] map[Kind:function Name:kill_bdev] map[Kind:function Name:lookup_bdev] map[Kind:function Name:lookup_bdev] map[Kind:function Name:nr_blockdev_pages] map[Kind:function Name:sb_min_blocksize] map[Kind:function Name:sb_min_blocksize] map[Kind:function Name:sb_set_blocksize] map[Kind:function Name:sb_set_blocksize] map[Kind:function Name:set_blocksize] map[Kind:function Name:set_blocksize] map[Kind:function Name:set_init_blocksize] map[Kind:function Name:setup_bdev_allow_write_mounted] map[Kind:function Name:sync_bdevs] map[Kind:function Name:sync_blockdev] map[Kind:function Name:sync_blockdev] map[Kind:function Name:sync_blockdev_nowait] map[Kind:function Name:sync_blockdev_nowait] map[Kind:function Name:sync_blockdev_range] map[Kind:function Name:sync_blockdev_range] map[Kind:function Name:truncate_bdev_range]] Missing:false]

11/2 2026/01/12 18:25 llm expert
0m Model:
unknown

12/2 2026/01/12 18:25 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:invalidate_bdev SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 104:	EXPORT_SYMBOL(invalidate_bdev);
 SourceFile:block/bdev.c]

13/2 2026/01/12 18:25 llm expert
0m Model:
unknown

14/2 2026/01/12 18:25 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:invalidate_bdev SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 104:	EXPORT_SYMBOL(invalidate_bdev);
 SourceFile:block/bdev.c]

15/2 2026/01/12 18:25 llm expert
0m Model:
unknown

16/2 2026/01/12 18:25 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:nr_blockdev_pages SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 515:	long nr_blockdev_pages(void)
 516:	{
 517:		struct inode *inode;
 518:		long ret = 0;
 519:	
 520:		spin_lock(&blockdev_superblock->s_inode_list_lock);
 521:		list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list)
 522:			ret += inode->i_mapping->nrpages;
 523:		spin_unlock(&blockdev_superblock->s_inode_list_lock);
 524:	
 525:		return ret;
 526:	}
 SourceFile:block/bdev.c]

17/2 2026/01/12 18:25 llm expert
0m Model:
unknown

18/2 2026/01/12 18:25 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:set_init_blocksize SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 139:	static void set_init_blocksize(struct block_device *bdev)
 140:	{
 141:		unsigned int bsize = bdev_logical_block_size(bdev);
 142:		loff_t size = i_size_read(BD_INODE(bdev));
 143:	
 144:		while (bsize < PAGE_SIZE) {
 145:			if (size & bsize)
 146:				break;
 147:			bsize <<= 1;
 148:		}
 149:		BD_INODE(bdev)->i_blkbits = blksize_bits(bsize);
 150:		mapping_set_folio_min_order(BD_INODE(bdev)->i_mapping,
 151:					    get_order(bsize));
 152:	}
 SourceFile:block/bdev.c]

19/2 2026/01/12 18:25 llm expert
0m Model:
unknown

20/2 2026/01/12 18:26 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:bdev_writes_blocked SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 846:	static bool bdev_writes_blocked(struct block_device *bdev)
 847:	{
 848:		return bdev->bd_writers < 0;
 849:	}
 SourceFile:block/bdev.c]

21/2 2026/01/12 18:26 llm expert
0m Model:
unknown

22/2 2026/01/12 18:26 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:sb_min_blocksize SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 233:	int __must_check sb_min_blocksize(struct super_block *sb, int size)
 234:	{
 235:		int minsize = bdev_logical_block_size(sb->s_bdev);
 236:		if (size < minsize)
 237:			size = minsize;
 238:		return sb_set_blocksize(sb, size);
 239:	}
 SourceFile:block/bdev.c]

23/2 2026/01/12 18:26 llm expert
0m Model:
unknown

24/2 2026/01/12 18:26 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:block_size SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode:1352:	unsigned int block_size(struct block_device *bdev)
1353:	{
1354:		return 1 << BD_INODE(bdev)->i_blkbits;
1355:	}
 SourceFile:block/bdev.c]

25/2 2026/01/12 18:26 llm expert
0m Model:
unknown

26/2 2026/01/12 18:26 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:I_BDEV SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode:  51:	struct block_device *I_BDEV(struct inode *inode)
  52:	{
  53:		return &BDEV_I(inode)->bdev;
  54:	}
 SourceFile:block/bdev.c]

27/2 2026/01/12 18:26 llm expert
0m Model:
unknown

28/2 2026/01/12 18:26 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:file_bdev SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode:  57:	struct block_device *file_bdev(struct file *bdev_file)
  58:	{
  59:		return I_BDEV(bdev_file->f_mapping->host);
  60:	}
 SourceFile:block/bdev.c]

29/2 2026/01/12 18:26 llm expert
0m Model:
unknown

30/2 2026/01/12 18:26 tool codesearch-definition-comment
0m Model:
unknown

Args:
map[Name:invalidate_bdev SourceFile:block/bdev.c]

Results:
map[Comment: Kind:function Missing:false]

31/2 2026/01/12 18:26 llm expert
0m Model:
unknown

32/2 2026/01/12 18:26 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:bd_abort_claiming SourceFile:block/bdev.c]

Results:
map[Missing:false SourceCode: 655:	/**
 656:	 * bd_abort_claiming - abort claiming of a block device
 657:	 * @bdev: block device of interest
 658:	 * @holder: holder that has claimed @bdev
 659:	 *
 660:	 * Abort claiming of a block device when the exclusive open failed. This can be
 661:	 * also used when exclusive open is not actually desired and we just needed
 662:	 * to block other exclusive openers for a while.
 663:	 */
 664:	void bd_abort_claiming(struct block_device *bdev, void *holder)
 665:	{
 666:		mutex_lock(&bdev_lock);
 667:		bd_clear_claiming(bdev_whole(bdev), holder);
 668:		mutex_unlock(&bdev_lock);
 669:	}
 SourceFile:block/bdev.c]

33/2 2026/01/12 18:26 llm expert
1m Model:
unknown

34/2 2026/01/12 18:28 tool codesearch-definition-source
0m Model:
unknown

Args:
map[IncludeLines:true Name:address_space SourceFile:include/linux/fs.h]

Results:
map[Missing:true SourceCode: SourceFile:]

35/2 2026/01/12 18:28 llm expert
0m Model:
unknown

36/2 2026/01/12 18:28 tool set-results
0m Model:
unknown

Args:
map[Benign:false]

Results:
map[Benign:false]

37/2 2026/01/12 18:28 llm expert
0m Model:
unknown

LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)