syzbot |
sign-in | mailing list | source | docs |
| ID | Workflow | Result | Correct | Bug | Created | Started | Finished | Revision | Error |
|---|---|---|---|---|---|---|---|---|---|
| d7ed7475-22cd-4cf1-83f2-e84c5dd3e621 | assessment-kcsan | Benign: ❌ | ❌ | KCSAN: data-race in __filemap_add_folio / invalidate_bdev (10) | 2026/01/12 18:24 | 2026/01/12 18:25 | 2026/01/12 18:28 | dc57dbf3ee402bd8ad9c3037d56ee9d9940a9bc6 |
The bug report indicates a data race on `mapping->nrpages` (a field of type `unsigned long`) between `__filemap_add_folio` (writer) and `invalidate_bdev` (reader).
The report is **actionable** and the data race is **harmful**.
**Analysis:**
1. **Consistency:** The report provides two stack traces that access the same memory location (`0xffff888100483138`).
* The writer is `__filemap_add_folio` in `mm/filemap.c`, specifically the line `mapping->nrpages += nr;` (line 931 in the report, corresponding to the increment). This function is responsible for adding folios to the page cache and updates the page count under `xas_lock` (spinlock).
* The reader is `invalidate_bdev` in `block/bdev.c`, at line 99. This corresponds to the check `if (mapping->nrpages)` at the beginning of `invalidate_bdev`. This function attempts to invalidate all pages associated with the block device.
* The subsystems involved (`mm` and `block`) interact via `struct address_space` (`mapping`), which is expected. The variable `nrpages` tracks the number of pages in the mapping.
2. **Harmfulness:**
* `invalidate_bdev` uses the lockless check `if (mapping->nrpages)` as an optimization to return early if the cache is empty.
* `__filemap_add_folio` increments `mapping->nrpages` while holding the xarray lock (`xas_lock_irq`), but `invalidate_bdev` does not take this lock.
* If `invalidate_bdev` runs concurrently with a read operation (which calls `__filemap_add_folio`), it might observe `nrpages` as 0 (before the increment is visible), even though a page has just been added (or is being added) to the page cache.
* If `invalidate_bdev` incorrectly sees 0 and returns early, it skips calling `invalidate_mapping_pages`. Consequently, the newly added page remains in the page cache.
* This is particularly problematic in the context of the reported trace (`loop_set_status`), which reconfigures the loop device. If a concurrent read adds a page based on the old configuration, and `invalidate_bdev` fails to flush it due to this race, the cache will contain stale data. Subsequent reads will see this stale data instead of reading from the new backing file/configuration, leading to data corruption or inconsistency.
* Therefore, the race is not benign; it compromises the guarantee that the device cache is flushed.
**Conclusion:**
The report is valid. The `invalidate_bdev` function relies on a racy check of `mapping->nrpages` which can lead to missed invalidations of pages added concurrently, potentially resulting in stale data persistence. The fix would involve removing the optimization or ensuring proper synchronization.================================================================== BUG: KCSAN: data-race in __filemap_add_folio / invalidate_bdev read-write to 0xffff888100483138 of 8 bytes by task 3303 on cpu 0: __filemap_add_folio+0x5b9/0x7d0 mm/filemap.c:931 filemap_add_folio+0x1d9/0x360 mm/filemap.c:978 page_cache_ra_unbounded+0x203/0x450 mm/readahead.c:280 do_page_cache_ra mm/readahead.c:332 [inline] force_page_cache_ra mm/readahead.c:361 [inline] page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2638 filemap_read+0x231/0xa00 mm/filemap.c:2748 blkdev_read_iter+0x22d/0x2e0 block/fops.c:859 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x64c/0x770 fs/read_write.c:572 ksys_read+0xda/0x1a0 fs/read_write.c:715 __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x40/0x50 fs/read_write.c:722 x64_sys_call+0x27c0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff888100483138 of 8 bytes by task 10300 on cpu 1: invalidate_bdev+0x25/0x70 block/bdev.c:99 bdev_disk_changed+0xeb/0xcb0 block/partitions/core.c:657 loop_reread_partitions drivers/block/loop.c:449 [inline] loop_set_status+0x5d2/0x6a0 drivers/block/loop.c:1278 loop_set_status64 drivers/block/loop.c:1374 [inline] lo_ioctl+0x671/0x12b0 drivers/block/loop.c:1560 blkdev_ioctl+0x356/0x440 block/ioctl.c:705 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583 x64_sys_call+0x1816/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x000000000000000d -> 0x000000000000000e Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 10300 Comm: syz.6.2066 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 ================================================================== loop6: p1 p2 p3 p4 loop6: p3 start 331777 is beyond EOD, truncated loop6: p4 size 262144 extends beyond EOD, truncated
| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/01/12 18:25 | flow | assessment-kcsan |
3mModel:unknown Results: map[Benign:false Explanation:The bug report indicates a data race on `mapping->nrpages` (a field of type `unsigned long`) between `__filemap_add_folio` (writer) and `invalidate_bdev` (reader).
The report is **actionable** and the data race is **harmful**.
**Analysis:**
1. **Consistency:** The report provides two stack traces that access the same memory location (`0xffff888100483138`).
* The writer is `__filemap_add_folio` in `mm/filemap.c`, specifically the line `mapping->nrpages += nr;` (line 931 in the report, corresponding to the increment). This function is responsible for adding folios to the page cache and updates the page count under `xas_lock` (spinlock).
* The reader is `invalidate_bdev` in `block/bdev.c`, at line 99. This corresponds to the check `if (mapping->nrpages)` at the beginning of `invalidate_bdev`. This function attempts to invalidate all pages associated with the block device.
* The subsystems involved (`mm` and `block`) interact via `struct address_space` (`mapping`), which is expected. The variable `nrpages` tracks the number of pages in the mapping.
2. **Harmfulness:**
* `invalidate_bdev` uses the lockless check `if (mapping->nrpages)` as an optimization to return early if the cache is empty.
* `__filemap_add_folio` increments `mapping->nrpages` while holding the xarray lock (`xas_lock_irq`), but `invalidate_bdev` does not take this lock.
* If `invalidate_bdev` runs concurrently with a read operation (which calls `__filemap_add_folio`), it might observe `nrpages` as 0 (before the increment is visible), even though a page has just been added (or is being added) to the page cache.
* If `invalidate_bdev` incorrectly sees 0 and returns early, it skips calling `invalidate_mapping_pages`. Consequently, the newly added page remains in the page cache.
* This is particularly problematic in the context of the reported trace (`loop_set_status`), which reconfigures the loop device. If a concurrent read adds a page based on the old configuration, and `invalidate_bdev` fails to flush it due to this race, the cache will contain stale data. Subsequent reads will see this stale data instead of reading from the new backing file/configuration, leading to data corruption or inconsistency.
* Therefore, the race is not benign; it compromises the guarantee that the device cache is flushed.
**Conclusion:**
The report is valid. The `invalidate_bdev` function relies on a racy check of `mapping->nrpages` which can lead to missed invalidations of pages added concurrently, potentially resulting in stale data persistence. The fix would involve removing the optimization or ensuring proper synchronization.] |
| 1/1 | 2026/01/12 18:25 | action | kernel-checkouter |
0mModel:unknown Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/14f11b2e082c8a123c1647b54397ffbdaf0f2d6f] |
| 2/1 | 2026/01/12 18:25 | action | kernel-builder |
0mModel:unknown Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/519ff091818fa17fa4250947c56fe2552a0892dd] |
| 3/1 | 2026/01/12 18:25 | action | codesearch-prepare |
0mModel:unknown Results: map[Index:codesearch-index] |
| 4/1 | 2026/01/12 18:25 | agent | expert |
3mModel:unknown Results: map[Benign:false] Instruction: You are an experienced Linux kernel developer tasked with determining if the given kernel bug report is actionable or not. Actionable means that it contains enough info to root cause the underlying bug, and that the report is self-consistent and makes sense, rather than a one-off nonsensical crash induced by a previous memory corruption. Use the provided tools to confirm any assumptions, what variables/fields being accessed, etc. In particular, don't make assumptions about the kernel source code, use codesearch tools to read the actual source code. The bug report is a data race report from KCSAN tool. It contains 2 stack traces of the memory accesses that constitute a data race. The report would be inconsistent, if the stacks point to different subsystems, or if they access different fields. The report would be non-actionable, if the underlysing data race is "benign". That is, the race is on a simple int/bool or similar field, and the accesses are not supposed to be protected by any mutual exclusion primitives. Common examples of such "benign" data races are accesses to various flags fields, statistics counters, and similar. An actionable race is "harmful", that is can lead to corruption/crash even with a conservative compiler that compiles memory accesses to primitive types effectively as atomic. A common example of a "harmful" data races is race on a complex container (list/hashmap/etc), where accesses are supposed to be protected by a mutual exclusion primitive. In the final reply explain why you think the report is consistent and the data race is harmful. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: The bug report is: ================================================================== BUG: KCSAN: data-race in __filemap_add_folio / invalidate_bdev read-write to 0xffff888100483138 of 8 bytes by task 3303 on cpu 0: __filemap_add_folio+0x5b9/0x7d0 mm/filemap.c:931 filemap_add_folio+0x1d9/0x360 mm/filemap.c:978 page_cache_ra_unbounded+0x203/0x450 mm/readahead.c:280 do_page_cache_ra mm/readahead.c:332 [inline] force_page_cache_ra mm/readahead.c:361 [inline] page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2638 filemap_read+0x231/0xa00 mm/filemap.c:2748 blkdev_read_iter+0x22d/0x2e0 block/fops.c:859 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x64c/0x770 fs/read_write.c:572 ksys_read+0xda/0x1a0 fs/read_write.c:715 __do_sys_read fs/read_write.c:724 [inline] __se_sys_read fs/read_write.c:722 [inline] __x64_sys_read+0x40/0x50 fs/read_write.c:722 x64_sys_call+0x27c0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff888100483138 of 8 bytes by task 10300 on cpu 1: invalidate_bdev+0x25/0x70 block/bdev.c:99 bdev_disk_changed+0xeb/0xcb0 block/partitions/core.c:657 loop_reread_partitions drivers/block/loop.c:449 [inline] loop_set_status+0x5d2/0x6a0 drivers/block/loop.c:1278 loop_set_status64 drivers/block/loop.c:1374 [inline] lo_ioctl+0x671/0x12b0 drivers/block/loop.c:1560 blkdev_ioctl+0x356/0x440 block/ioctl.c:705 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583 x64_sys_call+0x1816/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x000000000000000d -> 0x000000000000000e Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 10300 Comm: syz.6.2066 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 ================================================================== loop6: p1 p2 p3 p4 loop6: p3 start 331777 is beyond EOD, truncated loop6: p4 size 262144 extends beyond EOD, truncated Reply: The bug report indicates a data race on `mapping->nrpages` (a field of type `unsigned long`) between `__filemap_add_folio` (writer) and `invalidate_bdev` (reader).
The report is **actionable** and the data race is **harmful**.
**Analysis:**
1. **Consistency:** The report provides two stack traces that access the same memory location (`0xffff888100483138`).
* The writer is `__filemap_add_folio` in `mm/filemap.c`, specifically the line `mapping->nrpages += nr;` (line 931 in the report, corresponding to the increment). This function is responsible for adding folios to the page cache and updates the page count under `xas_lock` (spinlock).
* The reader is `invalidate_bdev` in `block/bdev.c`, at line 99. This corresponds to the check `if (mapping->nrpages)` at the beginning of `invalidate_bdev`. This function attempts to invalidate all pages associated with the block device.
* The subsystems involved (`mm` and `block`) interact via `struct address_space` (`mapping`), which is expected. The variable `nrpages` tracks the number of pages in the mapping.
2. **Harmfulness:**
* `invalidate_bdev` uses the lockless check `if (mapping->nrpages)` as an optimization to return early if the cache is empty.
* `__filemap_add_folio` increments `mapping->nrpages` while holding the xarray lock (`xas_lock_irq`), but `invalidate_bdev` does not take this lock.
* If `invalidate_bdev` runs concurrently with a read operation (which calls `__filemap_add_folio`), it might observe `nrpages` as 0 (before the increment is visible), even though a page has just been added (or is being added) to the page cache.
* If `invalidate_bdev` incorrectly sees 0 and returns early, it skips calling `invalidate_mapping_pages`. Consequently, the newly added page remains in the page cache.
* This is particularly problematic in the context of the reported trace (`loop_set_status`), which reconfigures the loop device. If a concurrent read adds a page based on the old configuration, and `invalidate_bdev` fails to flush it due to this race, the cache will contain stale data. Subsequent reads will see this stale data instead of reading from the new backing file/configuration, leading to data corruption or inconsistency.
* Therefore, the race is not benign; it compromises the guarantee that the device cache is flushed.
**Conclusion:**
The report is valid. The `invalidate_bdev` function relies on a racy check of `mapping->nrpages` which can lead to missed invalidations of pages added concurrently, potentially resulting in stale data persistence. The fix would involve removing the optimization or ensuring proper synchronization. |
| 5/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 6/2 | 2026/01/12 18:25 | tool | codesearch-file-index |
0mModel:unknown Args: map[SourceFile:mm/filemap.c] Results: map[Entities:[map[Kind:function Name:__do_sys_cachestat] map[Kind:function Name:__do_sys_cachestat] map[Kind:function Name:__filemap_add_folio] map[Kind:function Name:__filemap_fdatawait_range] map[Kind:function Name:__filemap_fdatawrite] map[Kind:function Name:__filemap_fdatawrite_range] map[Kind:function Name:__filemap_get_folio] map[Kind:function Name:__filemap_get_folio] map[Kind:function Name:__filemap_remove_folio] map[Kind:function Name:__filemap_set_wb_err] map[Kind:function Name:__filemap_set_wb_err] map[Kind:function Name:__folio_lock] map[Kind:function Name:__folio_lock] map[Kind:function Name:__folio_lock_async] map[Kind:function Name:__folio_lock_killable] map[Kind:function Name:__folio_lock_killable] map[Kind:function Name:__folio_lock_or_retry] map[Kind:function Name:__generic_file_write_iter] map[Kind:function Name:__generic_file_write_iter] map[Kind:function Name:__ia32_sys_cachestat] map[Kind:function Name:__se_sys_cachestat] map[Kind:function Name:__x64_sys_cachestat] map[Kind:function Name:can_do_cachestat] map[Kind:function Name:delete_from_page_cache_batch] map[Kind:function Name:dio_warn_stale_pagecache] map[Kind:function Name:do_async_mmap_readahead] map[Kind:function Name:do_read_cache_folio] map[Kind:function Name:do_read_cache_page] map[Kind:function Name:do_sync_mmap_readahead] map[Kind:function Name:file_check_and_advance_wb_err] map[Kind:function Name:file_check_and_advance_wb_err] map[Kind:function Name:file_fdatawait_range] map[Kind:function Name:file_fdatawait_range] map[Kind:function Name:file_write_and_wait_range] map[Kind:function Name:file_write_and_wait_range] map[Kind:function Name:filemap_add_folio] map[Kind:function Name:filemap_add_folio] map[Kind:function Name:filemap_alloc_folio_noprof] map[Kind:function Name:filemap_alloc_folio_noprof] map[Kind:function Name:filemap_cachestat] map[Kind:function Name:filemap_check_and_keep_errors] map[Kind:function Name:filemap_check_errors] map[Kind:function Name:filemap_check_errors] map[Kind:function Name:filemap_create_folio] map[Kind:function Name:filemap_end_dropbehind] map[Kind:function Name:filemap_end_dropbehind_read] map[Kind:function Name:filemap_fault] map[Kind:function Name:filemap_fault] map[Kind:function Name:filemap_fault_recheck_pte_none] map[Kind:function Name:filemap_fdatawait_keep_errors] map[Kind:function Name:filemap_fdatawait_keep_errors] map[Kind:function Name:filemap_fdatawait_range] map[Kind:function Name:filemap_fdatawait_range] map[Kind:function Name:filemap_fdatawait_range_keep_errors] map[Kind:function Name:filemap_fdatawait_range_keep_errors] map[Kind:function Name:filemap_fdatawrite] map[Kind:function Name:filemap_fdatawrite] map[Kind:function Name:filemap_fdatawrite_range] map[Kind:function Name:filemap_fdatawrite_range] map[Kind:function Name:filemap_fdatawrite_range_kick] map[Kind:function Name:filemap_fdatawrite_range_kick] map[Kind:function Name:filemap_fdatawrite_wbc] map[Kind:function Name:filemap_fdatawrite_wbc] map[Kind:function Name:filemap_flush] map[Kind:function Name:filemap_flush] map[Kind:function Name:filemap_free_folio] map[Kind:function Name:filemap_get_entry] map[Kind:function Name:filemap_get_folios] map[Kind:function Name:filemap_get_folios] map[Kind:function Name:filemap_get_folios_contig] map[Kind:function Name:filemap_get_folios_contig] map[Kind:function Name:filemap_get_folios_tag] map[Kind:function Name:filemap_get_folios_tag] map[Kind:function Name:filemap_get_pages] map[Kind:function Name:filemap_get_read_batch] map[Kind:function Name:filemap_invalidate_inode] map[Kind:function Name:filemap_invalidate_inode] map[Kind:function Name:filemap_invalidate_lock_two] map[Kind:function Name:filemap_invalidate_lock_two] map[Kind:function Name:filemap_invalidate_pages] map[Kind:function Name:filemap_invalidate_unlock_two] map[Kind:function Name:filemap_invalidate_unlock_two] map[Kind:function Name:filemap_map_folio_range] map[Kind:function Name:filemap_map_order0_folio] map[Kind:function Name:filemap_map_pages] map[Kind:function Name:filemap_map_pages] map[Kind:function Name:filemap_map_pmd] map[Kind:function Name:filemap_page_mkwrite] map[Kind:function Name:filemap_page_mkwrite] map[Kind:function Name:filemap_range_has_page] map[Kind:function Name:filemap_range_has_page] map[Kind:function Name:filemap_range_has_writeback] map[Kind:function Name:filemap_range_has_writeback] map[Kind:function Name:filemap_range_uptodate] map[Kind:function Name:filemap_read] map[Kind:function Name:filemap_read] map[Kind:function Name:filemap_read_folio] map[Kind:function Name:filemap_readahead] map[Kind:function Name:filemap_release_folio] map[Kind:function Name:filemap_release_folio] map[Kind:function Name:filemap_remove_folio] map[Kind:function Name:filemap_splice_read] map[Kind:function Name:filemap_splice_read] map[Kind:function Name:filemap_unaccount_folio] map[Kind:function Name:filemap_update_page] map[Kind:function Name:filemap_write_and_wait_range] map[Kind:function Name:filemap_write_and_wait_range] map[Kind:function Name:find_get_entries] map[Kind:function Name:find_get_entry] map[Kind:function Name:find_lock_entries] map[Kind:function Name:folio_end_dropbehind] map[Kind:function Name:folio_end_dropbehind] map[Kind:function Name:folio_end_private_2] map[Kind:function Name:folio_end_private_2] map[Kind:function Name:folio_end_read] map[Kind:function Name:folio_end_read] map[Kind:function Name:folio_end_writeback] map[Kind:function Name:folio_end_writeback] map[Kind:function Name:folio_end_writeback_no_dropbehind] map[Kind:function Name:folio_end_writeback_no_dropbehind] map[Kind:function Name:folio_put_wait_locked] map[Kind:function Name:folio_seek_hole_data] map[Kind:function Name:folio_trylock_flag] map[Kind:function Name:folio_unlock] map[Kind:function Name:folio_unlock] map[Kind:function Name:folio_wait_bit] map[Kind:function Name:folio_wait_bit] map[Kind:function Name:folio_wait_bit_common] map[Kind:function Name:folio_wait_bit_killable] map[Kind:function Name:folio_wait_bit_killable] map[Kind:function Name:folio_wait_private_2] map[Kind:function Name:folio_wait_private_2] map[Kind:function Name:folio_wait_private_2_killable] map[Kind:function Name:folio_wait_private_2_killable] map[Kind:function Name:folio_waitqueue] map[Kind:function Name:folio_wake_bit] map[Kind:function Name:generic_file_direct_write] map[Kind:function Name:generic_file_direct_write] map[Kind:function Name:generic_file_mmap] map[Kind:function Name:generic_file_mmap] map[Kind:function Name:generic_file_mmap_prepare] map[Kind:function Name:generic_file_mmap_prepare] map[Kind:function Name:generic_file_read_iter] map[Kind:function Name:generic_file_read_iter] map[Kind:function Name:generic_file_readonly_mmap] map[Kind:function Name:generic_file_readonly_mmap] map[Kind:function Name:generic_file_readonly_mmap_prepare] map[Kind:function Name:generic_file_readonly_mmap_prepare] map[Kind:function Name:generic_file_write_iter] map[Kind:function Name:generic_file_write_iter] map[Kind:function Name:generic_perform_write] map[Kind:function Name:generic_perform_write] map[Kind:function Name:kiocb_invalidate_pages] map[Kind:function Name:kiocb_invalidate_pages] map[Kind:function Name:kiocb_invalidate_post_direct_write] map[Kind:function Name:kiocb_write_and_wait] map[Kind:function Name:kiocb_write_and_wait] map[Kind:function Name:lock_folio_maybe_drop_mmap] map[Kind:function Name:mapping_needs_writeback] map[Kind:function Name:mapping_read_folio_gfp] map[Kind:function Name:mapping_read_folio_gfp] map[Kind:function Name:mapping_seek_hole_data] map[Kind:function Name:migration_entry_wait_on_locked] map[Kind:function Name:next_uptodate_folio] map[Kind:function Name:page_cache_delete] map[Kind:function Name:page_cache_delete_batch] map[Kind:function Name:page_cache_next_miss] map[Kind:function Name:page_cache_next_miss] map[Kind:function Name:page_cache_prev_miss] map[Kind:function Name:page_cache_prev_miss] map[Kind:function Name:pagecache_init] map[Kind:function Name:pos_same_folio] map[Kind:function Name:read_cache_folio] map[Kind:function Name:read_cache_folio] map[Kind:function Name:read_cache_page] map[Kind:function Name:read_cache_page] map[Kind:function Name:read_cache_page_gfp] map[Kind:function Name:read_cache_page_gfp] map[Kind:function Name:replace_page_cache_folio] map[Kind:function Name:replace_page_cache_folio] map[Kind:function Name:seek_folio_size] map[Kind:function Name:shrink_readahead_size_eio] map[Kind:function Name:splice_folio_into_pipe] map[Kind:function Name:wake_page_function]] Missing:false] |
| 7/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 8/2 | 2026/01/12 18:25 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:__filemap_add_folio SourceFile:mm/filemap.c] Results: map[Missing:false SourceCode: 859: noinline int __filemap_add_folio(struct address_space *mapping,
860: struct folio *folio, pgoff_t index, gfp_t gfp, void **shadowp)
861: {
862: XA_STATE_ORDER(xas, &mapping->i_pages, index, folio_order(folio));
863: bool huge;
864: long nr;
865: unsigned int forder = folio_order(folio);
866:
867: VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
868: VM_BUG_ON_FOLIO(folio_test_swapbacked(folio), folio);
869: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping),
870: folio);
871: mapping_set_update(&xas, mapping);
872:
873: VM_BUG_ON_FOLIO(index & (folio_nr_pages(folio) - 1), folio);
874: huge = folio_test_hugetlb(folio);
875: nr = folio_nr_pages(folio);
876:
877: gfp &= GFP_RECLAIM_MASK;
878: folio_ref_add(folio, nr);
879: folio->mapping = mapping;
880: folio->index = xas.xa_index;
881:
882: for (;;) {
883: int order = -1;
884: void *entry, *old = NULL;
885:
886: xas_lock_irq(&xas);
887: xas_for_each_conflict(&xas, entry) {
888: old = entry;
889: if (!xa_is_value(entry)) {
890: xas_set_err(&xas, -EEXIST);
891: goto unlock;
892: }
893: /*
894: * If a larger entry exists,
895: * it will be the first and only entry iterated.
896: */
897: if (order == -1)
898: order = xas_get_order(&xas);
899: }
900:
901: if (old) {
902: if (order > 0 && order > forder) {
903: unsigned int split_order = max(forder,
904: xas_try_split_min_order(order));
905:
906: /* How to handle large swap entries? */
907: BUG_ON(shmem_mapping(mapping));
908:
909: while (order > forder) {
910: xas_set_order(&xas, index, split_order);
911: xas_try_split(&xas, old, order);
912: if (xas_error(&xas))
913: goto unlock;
914: order = split_order;
915: split_order =
916: max(xas_try_split_min_order(
917: split_order),
918: forder);
919: }
920: xas_reset(&xas);
921: }
922: if (shadowp)
923: *shadowp = old;
924: }
925:
926: xas_store(&xas, folio);
927: if (xas_error(&xas))
928: goto unlock;
929:
930: mapping->nrpages += nr;
931:
932: /* hugetlb pages do not participate in page cache accounting */
933: if (!huge) {
934: __lruvec_stat_mod_folio(folio, NR_FILE_PAGES, nr);
935: if (folio_test_pmd_mappable(folio))
936: __lruvec_stat_mod_folio(folio,
937: NR_FILE_THPS, nr);
938: }
939:
940: unlock:
941: xas_unlock_irq(&xas);
942:
943: if (!xas_nomem(&xas, gfp))
944: break;
945: }
946:
947: if (xas_error(&xas))
948: goto error;
949:
950: trace_mm_filemap_add_to_page_cache(folio);
951: return 0;
952: error:
953: folio->mapping = NULL;
954: /* Leave folio->index set: truncation relies upon it */
955: folio_put_refs(folio, nr);
956: return xas_error(&xas);
957: }
SourceFile:mm/filemap.c] |
| 9/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 10/2 | 2026/01/12 18:25 | tool | codesearch-file-index |
0mModel:unknown Args: map[SourceFile:block/bdev.c] Results: map[Entities:[map[Kind:function Name:BDEV_I] map[Kind:function Name:BD_INODE] map[Kind:function Name:I_BDEV] map[Kind:function Name:I_BDEV] map[Kind:function Name:bd_abort_claiming] map[Kind:function Name:bd_abort_claiming] map[Kind:function Name:bd_clear_claiming] map[Kind:function Name:bd_end_claim] map[Kind:function Name:bd_finish_claiming] map[Kind:function Name:bd_init_fs_context] map[Kind:function Name:bd_may_claim] map[Kind:function Name:bd_prepare_to_claim] map[Kind:function Name:bd_prepare_to_claim] map[Kind:function Name:bd_yield_claim] map[Kind:function Name:bdev_add] map[Kind:function Name:bdev_alloc] map[Kind:function Name:bdev_alloc_inode] map[Kind:function Name:bdev_block_writes] map[Kind:function Name:bdev_cache_init] map[Kind:function Name:bdev_claim_write_access] map[Kind:function Name:bdev_drop] map[Kind:function Name:bdev_evict_inode] map[Kind:function Name:bdev_file_open_by_dev] map[Kind:function Name:bdev_file_open_by_dev] map[Kind:function Name:bdev_file_open_by_path] map[Kind:function Name:bdev_file_open_by_path] map[Kind:function Name:bdev_fput] map[Kind:function Name:bdev_fput] map[Kind:function Name:bdev_free_inode] map[Kind:function Name:bdev_freeze] map[Kind:function Name:bdev_freeze] map[Kind:function Name:bdev_mark_dead] map[Kind:function Name:bdev_mark_dead] map[Kind:function Name:bdev_may_open] map[Kind:function Name:bdev_open] map[Kind:function Name:bdev_permission] map[Kind:function Name:bdev_release] map[Kind:function Name:bdev_set_nr_sectors] map[Kind:function Name:bdev_statx] map[Kind:function Name:bdev_thaw] map[Kind:function Name:bdev_thaw] map[Kind:function Name:bdev_unblock_writes] map[Kind:function Name:bdev_unclaimed] map[Kind:function Name:bdev_unhash] map[Kind:function Name:bdev_validate_blocksize] map[Kind:function Name:bdev_validate_blocksize] map[Kind:function Name:bdev_write_inode] map[Kind:function Name:bdev_writes_blocked] map[Kind:function Name:bdev_yield_write_access] map[Kind:function Name:blk_to_file_flags] map[Kind:function Name:blkdev_flush_mapping] map[Kind:function Name:blkdev_get_no_open] map[Kind:function Name:blkdev_get_part] map[Kind:function Name:blkdev_get_whole] map[Kind:function Name:blkdev_put_no_open] map[Kind:function Name:blkdev_put_part] map[Kind:function Name:blkdev_put_whole] map[Kind:function Name:block_size] map[Kind:function Name:block_size] map[Kind:function Name:disk_live] map[Kind:function Name:disk_live] map[Kind:function Name:file_bdev] map[Kind:function Name:file_bdev] map[Kind:function Name:init_once] map[Kind:function Name:invalidate_bdev] map[Kind:function Name:invalidate_bdev] map[Kind:function Name:kill_bdev] map[Kind:function Name:lookup_bdev] map[Kind:function Name:lookup_bdev] map[Kind:function Name:nr_blockdev_pages] map[Kind:function Name:sb_min_blocksize] map[Kind:function Name:sb_min_blocksize] map[Kind:function Name:sb_set_blocksize] map[Kind:function Name:sb_set_blocksize] map[Kind:function Name:set_blocksize] map[Kind:function Name:set_blocksize] map[Kind:function Name:set_init_blocksize] map[Kind:function Name:setup_bdev_allow_write_mounted] map[Kind:function Name:sync_bdevs] map[Kind:function Name:sync_blockdev] map[Kind:function Name:sync_blockdev] map[Kind:function Name:sync_blockdev_nowait] map[Kind:function Name:sync_blockdev_nowait] map[Kind:function Name:sync_blockdev_range] map[Kind:function Name:sync_blockdev_range] map[Kind:function Name:truncate_bdev_range]] Missing:false] |
| 11/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 12/2 | 2026/01/12 18:25 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:invalidate_bdev SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 104: EXPORT_SYMBOL(invalidate_bdev); SourceFile:block/bdev.c] |
| 13/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 14/2 | 2026/01/12 18:25 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:invalidate_bdev SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 104: EXPORT_SYMBOL(invalidate_bdev); SourceFile:block/bdev.c] |
| 15/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 16/2 | 2026/01/12 18:25 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:nr_blockdev_pages SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 515: long nr_blockdev_pages(void)
516: {
517: struct inode *inode;
518: long ret = 0;
519:
520: spin_lock(&blockdev_superblock->s_inode_list_lock);
521: list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list)
522: ret += inode->i_mapping->nrpages;
523: spin_unlock(&blockdev_superblock->s_inode_list_lock);
524:
525: return ret;
526: }
SourceFile:block/bdev.c] |
| 17/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 18/2 | 2026/01/12 18:25 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:set_init_blocksize SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 139: static void set_init_blocksize(struct block_device *bdev)
140: {
141: unsigned int bsize = bdev_logical_block_size(bdev);
142: loff_t size = i_size_read(BD_INODE(bdev));
143:
144: while (bsize < PAGE_SIZE) {
145: if (size & bsize)
146: break;
147: bsize <<= 1;
148: }
149: BD_INODE(bdev)->i_blkbits = blksize_bits(bsize);
150: mapping_set_folio_min_order(BD_INODE(bdev)->i_mapping,
151: get_order(bsize));
152: }
SourceFile:block/bdev.c] |
| 19/2 | 2026/01/12 18:25 | llm | expert |
0mModel:unknown |
| 20/2 | 2026/01/12 18:26 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:bdev_writes_blocked SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 846: static bool bdev_writes_blocked(struct block_device *bdev)
847: {
848: return bdev->bd_writers < 0;
849: }
SourceFile:block/bdev.c] |
| 21/2 | 2026/01/12 18:26 | llm | expert |
0mModel:unknown |
| 22/2 | 2026/01/12 18:26 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:sb_min_blocksize SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 233: int __must_check sb_min_blocksize(struct super_block *sb, int size)
234: {
235: int minsize = bdev_logical_block_size(sb->s_bdev);
236: if (size < minsize)
237: size = minsize;
238: return sb_set_blocksize(sb, size);
239: }
SourceFile:block/bdev.c] |
| 23/2 | 2026/01/12 18:26 | llm | expert |
0mModel:unknown |
| 24/2 | 2026/01/12 18:26 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:block_size SourceFile:block/bdev.c] Results: map[Missing:false SourceCode:1352: unsigned int block_size(struct block_device *bdev)
1353: {
1354: return 1 << BD_INODE(bdev)->i_blkbits;
1355: }
SourceFile:block/bdev.c] |
| 25/2 | 2026/01/12 18:26 | llm | expert |
0mModel:unknown |
| 26/2 | 2026/01/12 18:26 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:I_BDEV SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 51: struct block_device *I_BDEV(struct inode *inode)
52: {
53: return &BDEV_I(inode)->bdev;
54: }
SourceFile:block/bdev.c] |
| 27/2 | 2026/01/12 18:26 | llm | expert |
0mModel:unknown |
| 28/2 | 2026/01/12 18:26 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:file_bdev SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 57: struct block_device *file_bdev(struct file *bdev_file)
58: {
59: return I_BDEV(bdev_file->f_mapping->host);
60: }
SourceFile:block/bdev.c] |
| 29/2 | 2026/01/12 18:26 | llm | expert |
0mModel:unknown |
| 30/2 | 2026/01/12 18:26 | tool | codesearch-definition-comment |
0mModel:unknown Args: map[Name:invalidate_bdev SourceFile:block/bdev.c] Results: map[Comment: Kind:function Missing:false] |
| 31/2 | 2026/01/12 18:26 | llm | expert |
0mModel:unknown |
| 32/2 | 2026/01/12 18:26 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:bd_abort_claiming SourceFile:block/bdev.c] Results: map[Missing:false SourceCode: 655: /**
656: * bd_abort_claiming - abort claiming of a block device
657: * @bdev: block device of interest
658: * @holder: holder that has claimed @bdev
659: *
660: * Abort claiming of a block device when the exclusive open failed. This can be
661: * also used when exclusive open is not actually desired and we just needed
662: * to block other exclusive openers for a while.
663: */
664: void bd_abort_claiming(struct block_device *bdev, void *holder)
665: {
666: mutex_lock(&bdev_lock);
667: bd_clear_claiming(bdev_whole(bdev), holder);
668: mutex_unlock(&bdev_lock);
669: }
SourceFile:block/bdev.c] |
| 33/2 | 2026/01/12 18:26 | llm | expert |
1mModel:unknown |
| 34/2 | 2026/01/12 18:28 | tool | codesearch-definition-source |
0mModel:unknown Args: map[IncludeLines:true Name:address_space SourceFile:include/linux/fs.h] Results: map[Missing:true SourceCode: SourceFile:] |
| 35/2 | 2026/01/12 18:28 | llm | expert |
0mModel:unknown |
| 36/2 | 2026/01/12 18:28 | tool | set-results |
0mModel:unknown Args: map[Benign:false] Results: map[Benign:false] |
| 37/2 | 2026/01/12 18:28 | llm | expert |
0mModel:unknown |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|