syzbot

map[ReproOpts:{"threaded":true,"collide":true,"repeat":true,"procs":6} ReproSyz:mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000080)='./d0/s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f00000000c0)='./d0/t0\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f0000000100)='./d0/t1\x00', 0x1ff)
close(r3)
mkdir(&(0x7f0000000140)='./d1\x00', 0x1ff)
r4 = creat(&(0x7f0000000180)='./d1/s0\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f00000001c0)='./d1/s1\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000200)='./d1/t0\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f0000000240)='./d1/t1\x00', 0x1ff)
close(r7)
rename(&(0x7f0000000040)='./d0/s0\x00', &(0x7f00000000c0)='./d0/t0\x00') (async)
rename(&(0x7f0000000080)='./d0/s1\x00', &(0x7f0000000100)='./d0/t1\x00') (async)
rename(&(0x7f0000000180)='./d1/s0\x00', &(0x7f0000000200)='./d1/t0\x00') (async)
rename(&(0x7f00000001c0)='./d1/s1\x00', &(0x7f0000000240)='./d1/t1\x00') SyzkallerCommit:86914af9098a80da53c3c5d46be980c572ee29f8]

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/70333b4949b3a7f871136260f388c7a82390216c]

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/fb1c054b543937610e3fcae633b044e9c04efe6a]

map[Index:codesearch-index]

gemini-3-pro-preview

map[ReproOpts:{"threaded":true,"collide":true,"repeat":true,"procs":6} ReproSyz:mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000080)='./d0/s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f00000000c0)='./d0/t0\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f0000000100)='./d0/t1\x00', 0x1ff)
close(r3)
mkdir(&(0x7f0000000140)='./d1\x00', 0x1ff)
r4 = creat(&(0x7f0000000180)='./d1/s0\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f00000001c0)='./d1/s1\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000200)='./d1/t0\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f0000000240)='./d1/t1\x00', 0x1ff)
close(r7)
rename(&(0x7f0000000040)='./d0/s0\x00', &(0x7f00000000c0)='./d0/t0\x00') (async)
rename(&(0x7f0000000080)='./d0/s1\x00', &(0x7f0000000100)='./d0/t1\x00') (async)
rename(&(0x7f0000000180)='./d1/s0\x00', &(0x7f0000000200)='./d1/t0\x00') (async)
rename(&(0x7f00000001c0)='./d1/s1\x00', &(0x7f0000000240)='./d1/t1\x00')]

You are an expert in the Linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.

Don't make assumptions about the kernel source code, use the provided codesearch tools
to examine the kernel code instead.

Document about syzkaller program syntax:
===
# Program syntax

Syzkaller uses a compact domain-specific language (DSL) for programs
to log executed programs, test its code, and persist programs in the
corpus. This page provides a brief description of the corresponding
syntax. Some useful information can also be found in the
[existing examples](/sys/linux/test) and in the program
[deserialization code](/prog/encoding.go).

Together with execution options, the DSL provides everything that
syz-executor needs to run a program.

For example, consider the program:
```
r0 = syz_open_dev$loop(&(0x7f00000011c0), 0x0, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)
```

Each line in this program describes a particular syscall invocation,
with the first two calls saving the result in temporary variables `r0`
and `r1`, which are passed to the third call.

```
line = assignment | call
assignment = variable " = " call
call = syscall-name "(" [arg ["," arg]*] ")"  ["(" [call-prop ["," call-prop*] ")"]
arg = "nil" | "AUTO" | const-arg | resource-arg | result-arg | pointer-arg | string-arg | struct-arg | array-arg | union-arg
const-arg = integer
resource-arg = variable ["/" hex-integer] ["+" hex-integer]
result-arg = "<" variable "=>" arg
pointer-arg = "&" pointer-arg-addr ["=ANY"] "=" arg
pointer-arg-addr = "AUTO" | "(" pointer-addr ["/" region-size] ")"
string-arg = "'" escaped-string "'" | "\"" escaped-string "\"" | "\"$" escaped-string "\""
struct-arg =  "{" [arg ["," arg]*] "}"
array-arg = "[" [arg ["," arg]*] "]"
union-arg = "@" field-name ["=" arg]
call-prop = prop-name ": " prop-value
variable = "r" dec-integer
pointer-addr = integer
region-size = integer
integer = dec-integer | oct-integer | "0x" hex-integer
```

Programs may also contain blank lines and comments.
```
# Obtain a file handle
r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)

# Perform a write operation
write(r0, &AUTO="01010101", 0x4)
```

### Memory management

Memory management is performed by syzkaller itself. It will allocate
virtual memory regions of the necessary size and set the final values
of pointer arguments.

By using the `AUTO` keyword, programs can give syzkaller the full
control over storing the data. This may be convenient e.g. when a
parameter must be passed by reference, but the exact location of its
value is not of particular importance.

```
r1 = syz_genetlink_get_family_id$nl80211(&AUTO='nl80211\x00', 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &AUTO={'wlan0\x00', <r2=>0x0})
```

Alternatively, some data can be "anchored" to specific addresses. It
may be especially important when a memory region must be shared
between multiple calls.  In this case, pointer addresses must be given
at the 0x7f0000000000 offset. Before the actual execution, syzkaller
will adjust pointers to the start of the actual mmap'ed region.

### Call properties

Call properties specify extra information about how a specific call
must be executed. Each call within a program has its own set of call
properties. If no properties are provided, syzkaller takes the default
ones.

Currently, syzkaller supports the following call properties.

#### Fault injection
Syntax: `fail_nth: N`.

It takes an integer (base 10) argument `N`. If the argument is
non-negative, a fault will be injected into the `N`-th occasion.

```
r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r0) (fail_nth: 5)
```

#### Async
Syntax: `async`.

Instructs `syz-executor` not to wait until the call completes and
to proceed immediately to the next call.

```
r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)
write(r0, &AUTO="01010101", 0x4) (async)
read(r0, &AUTO=""/4, 0x4)
close(r0)
```

When setting `async` flags be aware of the following considerations:
* Such programs should only be executed in threaded mode (i.e. `-threaded`
flag must be passed to `syz-executor`.
* Each `async` call is executed in a separate thread and there's a
limited number of available threads (`kMaxThreads = 16`).
* If an `async` call produces a resource, keep in mind that some other call
might take it as input and `syz-executor` will just pass 0 if the resource-
producing call has not finished by that time.

===

Document about syzlang system call descriptions syntax:
===
# Syscall description language

aka `syzlang` (`[siːzˈlæŋg]`)

Pseudo-formal grammar of syscall description:

```
syscallname "(" [arg ["," arg]*] ")" [type] ["(" attribute* ")"]
arg = argname type
argname = identifier
type = typename [ "[" type-options "]" ]
typename = "const" | "intN" | "intptr" | "flags" | "array" | "ptr" |
	   "string" | "filename" | "glob" | "len" |
	   "bytesize" | "bytesizeN" | "bitsize" | "vma" | "proc" |
	   "compressed_image"
type-options = [type-opt ["," type-opt]]
```

common type-options include:

```
"opt" - the argument is optional (like mmap fd argument, or accept peer argument)
```

rest of the type-options are type-specific:

```
"const": integer constant, type-options:
	value, underlying type (one of "intN", "intptr")
"intN"/"intptr": an integer without a particular meaning, type-options:
	either an optional range of values (e.g. "5:10", or "100:200")
	or a reference to flags description (see below),
	or a single value
	optionally followed by an alignment parameter if using a range
"flags": a set of values, type-options:
	reference to flags description (see below), underlying int type (e.g. "int32")
"array": a variable/fixed-length array, type-options:
	type of elements, optional size (fixed "5", or ranged "5:10", boundaries inclusive)
"ptr"/"ptr64": a pointer to an object, type-options:
	direction (in/out/inout); type of the object
	ptr64 has size of 8 bytes regardless of target pointer size
"string": a zero-terminated memory buffer (no pointer indirection implied), type-options:
	either a string value in quotes for constant strings (e.g. "foo" or `deadbeef` for hex literal),
	or a reference to string flags (special value `filename` produces file names),
	optionally followed by a buffer size (string values will be padded with \x00 to that size)
"stringnoz": a non-zero-terminated memory buffer (no pointer indirection implied), type-options:
	either a string value in quotes for constant strings (e.g. "foo" or `deadbeef` for hex literal),
	or a reference to string flags,
"glob": glob pattern to match on the target files, type-options:
	a pattern string in quotes (syntax: https://golang.org/pkg/path/filepath/#Match)
	(e.g. "/sys/" or "/sys/**/*"),
	or include exclude glob too (e.g. "/sys/**/*:-/sys/power/state")
"fmt": a string representation of an integer (not zero-terminated), type-options:
	format (one of "dec", "hex", "oct") and the value (a resource, int, flags or proc)
	the resulting data is always fixed-size (formatted as "%020llu", "0x%016llx" or "%023llo", respectively)
"len": length of another field (for array it is number of elements), type-options:
	argname of the object
"bytesize": similar to "len", but always denotes the size in bytes, type-options:
	argname of the object
"bitsize": similar to "len", but always denotes the size in bits, type-options:
	argname of the object
"offsetof": offset of the field from the beginning of the parent struct, type-options:
	field
"vma"/"vma64": a pointer to a set of pages (used as input for mmap/munmap/mremap/madvise), type-options:
	optional number of pages (e.g. vma[7]), or a range of pages (e.g. vma[2-4])
	vma64 has size of 8 bytes regardless of target pointer size
"proc": per process int (see description below), type-options:
	value range start, how many values per process, underlying type
"compressed_image": zlib-compressed disk image
	syscalls accepting compressed images must be marked with `no_generate`
	and `no_minimize` call attributes. if the content of the decompressed image
	can be checked by a `fsck`-like command, use the `fsck` syscall attribute
"text": machine code of the specified type, type-options:
	text type (x86_real, x86_16, x86_32, x86_64, arm64)
"void": type with static size 0
	mostly useful inside of templates and varlen unions, can't be syscall argument
```

flags/len/flags also have trailing underlying type type-option when used in structs/unions/pointers.

Flags are described as:

```
flagname = const ["," const]*
```

or for string flags as:

```
flagname = "\"" literal "\"" ["," "\"" literal "\""]*
```

Call attributes are:

```
"disabled": the call will not be used in fuzzing; useful to temporary disable some calls
	or prohibit particular argument combinations.
"timeout[N]": additional execution timeout (in ms) for the call on top of some default value.
"prog_timeout[N]": additional execution timeout (in ms) for the whole program if it contains this call;
	if a program contains several such calls, the max value is used.
"ignore_return": ignore return value of this syscall in fallback feedback; need to be used for calls
	that don't return fixed error codes but rather something else (e.g. the current time).
"breaks_returns": ignore return values of all subsequent calls in the program in fallback feedback (can't be trusted).
"no_generate": do not try to generate this syscall, i.e. use only seed descriptions to produce it.
"no_minimize": do not modify instances of this syscall when trying to minimize a crashing program.
"no_squash": do not attempt to pass squashed arguments to this syscall.
	Without that, the fuzzer will sometimes attempt to replace complex structures with arrays of bytes,
	possibly triggering interesting mutations, but also making programs hard to reason about.
"fsck": the content of the compressed buffer argument for this syscall is a file system and the
	string argument is a fsck-like command that will be called to verify the filesystem.
"remote_cover": wait longer to collect remote coverage for this call.
"kfuzz_test": the call is a kfuzztest target.
"snapshot": the call is enabled by default only in snapshot fuzzing mode, but can also be enabled in
    the non-snasphot mode when listed in "enable_syscalls" with its full name (as opposed to a wildcard match).
    It can also always be disabled via "disable_syscalls".
    The attribute is generally used to mark calls that are not safe to execute in non-snapshot mode
	(can lead to false positives, or lost connections to test machines.
```

## Ints

`int8`, `int16`, `int32` and `int64` denote an integer of the corresponding size.
`intptr` denotes a pointer-sized integer, i.e. C `long` type.

By appending `be` suffix (e.g. `int16be`) integers become big-endian.

It's possible to specify a range of values for an integer in the format of `int32[0:100]` or `int32[0:4096, 512]` for a 512-aligned int.

Integers can also take a reference to flags description or a value as its first type-option.
In that case, the alignment parameter is not supported.

To denote a bitfield of size N use `int64:N`.

It's possible to use these various kinds of ints as base types for `const`, `flags`, `len` and `proc`.

```
example_struct {
	f0	int8			# random 1-byte integer
	f1	const[0x42, int16be]	# const 2-byte integer with value 0x4200 (big-endian 0x42)
	f2	int32[0:100]		# random 4-byte integer with values from 0 to 100 inclusive
	f3	int32[1:10, 2]		# random 4-byte integer with values {1, 3, 5, 7, 9}
	f4	int64:20		# random 20-bit bitfield
	f5	int8[10]		# const 1-byte integer with value 10
	f6	int32[flagname]		# random 4-byte integer from the set of values referenced by flagname
}
```

## Structs

Structs are described as:

```
structname "{" "\n"
	(fieldname type ("(" fieldattribute* ")")? (if[expression])? "\n")+
"}" ("[" attribute* "]")?
```

Fields can have attributes specified in parentheses after the field, independent
of their type. `in/out/inout` attribute specify per-field direction, for example:

```
foo {
	field0	const[1, int32]	(in)
	field1	int32		(inout)
	field2	fd		(out)
}
```

You may specify conditions that determine whether a field will be included:

```
foo {
	field0	int32
	field1	int32 (if[value[field0] == 0x1])
}
```

See [the corresponding section](syscall_descriptions_syntax.md#conditional-fields)
for more details.

`out_overlay` attribute allows to have separate input and output layouts for the struct.
Fields before the `out_overlay` field are input, fields starting from `out_overlay` are output.
Input and output fields overlap in memory (both start from the beginning of the struct in memory).
For example:

```
foo {
	in0	const[1, int32]
	in1	flags[bar, int8]
	in2	ptr[in, string]
	out0	fd	(out_overlay)
	out1	int32
}
```

Structs can have attributes specified in square brackets after the struct.
Attributes are:

- `packed`: the struct does not have paddings between fields and has alignment 1; this is similar to GNU C `__attribute__((packed))`; struct alignment can be overridden with `align` attribute
- `align[N]`: the struct has alignment N and padded up to multiple of `N`; contents of the padding are unspecified (though, frequently are zeros); similar to GNU C `__attribute__((aligned(N)))`
- `size[N]`: the struct is padded up to the specified size `N`; contents of the padding are unspecified (though, frequently are zeros)

## Unions

Unions are described as:

```
unionname "[" "\n"
	(fieldname type (if[expression])? "\n")+
"]" ("[" attribute* "]")?
```

During fuzzing, syzkaller randomly picks one of the union options.

You may also specify conditions that determine whether the corresponding
option may or may not be selected, depending on values of other fields. See
[the corresponding section](syscall_descriptions_syntax.md#conditional-fields)
for more details.

Unions can have attributes specified in square brackets after the union.
Attributes are:

- `varlen`: union size is the size of the particular chosen option (not statically known); without this attribute unions are statically sized as maximum of all options (similar to C unions)
- `size[N]`: the union is padded up to the specified size `N`; contents of the padding are unspecified (though, frequently are zeros)

## Resources

Resources represent values that need to be passed from output of one syscall to input of another syscall. For example, `close` syscall requires an input value (fd) previously returned by `open` or `pipe` syscall. To achieve this, `fd` is declared as a resource. This is a way of modelling dependencies between syscalls, as defining a syscall as the producer of a resource and another syscall as the consumer defines a loose sense of ordering between them. Resources are described as:

```
"resource" identifier "[" underlying_type "]" [ ":" const ("," const)* ]
```

`underlying_type` is either one of `int8`, `int16`, `int32`, `int64`, `intptr` or another resource (which models inheritance, for example, a socket is a subtype of fd). The optional set of constants represent resource special values, for example, `0xffffffffffffffff` (-1) for "no fd", or `AT_FDCWD` for "the current dir". Special values are used once in a while as resource values. If no special values specified, special value of `0` is used. Resources can then be used as types, for example:

```
resource fd[int32]: 0xffffffffffffffff, AT_FDCWD, 1000000
resource sock[fd]
resource sock_unix[sock]

socket(...) sock
accept(fd sock, ...) sock
listen(fd sock, backlog int32)
```

Resources don't have to be necessarily returned by a syscall. They can be used as any other data type. For example:

```
resource my_resource[int32]

request_producer(..., arg ptr[out, my_resource])
request_consumer(..., arg ptr[inout, test_struct])

test_struct {
	...
	attr	my_resource
}
```

For more complex producer/consumer scenarios, field attributes can be utilized.
For example:

```
resource my_resource_1[int32]
resource my_resource_2[int32]

request_produce1_consume2(..., arg ptr[inout, test_struct])

test_struct {
	...
	field0	my_resource_1	(out)
	field1	my_resource_2	(in)
}
```

Each resource type must be "produced" (used as an output) by at least one syscall
(outside of unions and optional pointers) and "consumed" (used as an input)
by at least one syscall.

## Type Aliases

Complex types that are often repeated can be given short type aliases using the
following syntax:

```
type identifier underlying_type
```

For example:

```
type signalno int32[0:65]
type net_port proc[20000, 4, int16be]
```

Then, type alias can be used instead of the underlying type in any contexts.
Underlying type needs to be described as if it's a struct field, that is,
with the base type if it's required. However, type alias can be used as syscall
arguments as well. Underlying types are currently restricted to integer types,
`ptr`, `ptr64`, `const`, `flags` and `proc` types.

There are some builtin type aliases:

```
type bool8	int8[0:1]
type bool16	int16[0:1]
type bool32	int32[0:1]
type bool64	int64[0:1]
type boolptr	intptr[0:1]

type fileoff[BASE] BASE

type filename string[filename]

type buffer[DIR] ptr[DIR, array[int8]]
```

## Type Templates

Type templates can be declared as follows:

```
type buffer[DIR] ptr[DIR, array[int8]]
type fileoff[BASE] BASE
type nlattr[TYPE, PAYLOAD] {
	nla_len		len[parent, int16]
	nla_type	const[TYPE, int16]
	payload		PAYLOAD
} [align_4]
```

and later used as follows:

```
syscall(a buffer[in], b fileoff[int64], c ptr[in, nlattr[FOO, int32]])
```

There is builtin type template `optional` defined as:

```
type optional[T] [
	val	T
	void	void
] [varlen]
```

## Length

You can specify length of a particular field in struct or a named argument by
using `len`, `bytesize` and `bitsize` types, for example:

```
write(fd fd, buf ptr[in, array[int8]], count len[buf])

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}
```

If `len`'s argument is a pointer, then the length of the pointee argument is used.

To denote the length of a field in N-byte words use `bytesizeN`, possible values
for N are 1, 2, 4 and 8.

To denote the length of the parent struct, you can use `len[parent, int8]`.
To denote the length of the higher level parent when structs are embedded into
one another, you can specify the type name of the particular parent:

```
s1 {
    f0      len[s2]  # length of s2
}

s2 {
    f0      s1
    f1      array[int32]
    f2      len[parent, int32]
}
```

`len` argument can also be a path expression which allows more complex
addressing. Path expressions are similar to C field references, but also allow
referencing parent and sibling elements. A special reference `syscall` used
in the beginning of the path allows to refer directly to the syscall arguments.
For example:

```
s1 {
	a	ptr[in, s2]
	b	ptr[in, s3]
	c	array[int8]
}

s2 {
	d	array[int8]
}

s3 {
# This refers to the array c in the parent s1.
	e	len[s1:c, int32]
# This refers to the array d in the sibling s2.
	f	len[s1:a:d, int32]
# This refers to the array k in the child s4.
	g	len[i:j, int32]
# This refers to syscall argument l.
	h	len[syscall:l, int32]
	i	ptr[in, s4]
}

s4 {
	j	array[int8]
}

foo(k ptr[in, s1], l ptr[in, array[int8]])
```

## Proc

The `proc` type can be used to denote per process integers.
The idea is to have a separate range of values for each executor, so they don't interfere.

The simplest example is a port number.
The `proc[20000, 4, int16be]` type means that we want to generate an `int16be`
integer starting from `20000` and assign `4` values for each process.
As a result the executor number `n` will get values in the `[20000 + n * 4, 20000 + (n + 1) * 4)` range.

## Integer Constants

Integer constants can be specified as decimal literals, as `0x`-prefixed
hex literals, as `'`-surrounded char literals, or as symbolic constants
extracted from kernel headers or defined by `define` directives. For example:

```
foo(a const[10], b const[-10])
foo(a const[0xabcd])
foo(a int8['a':'z'])
foo(a const[PATH_MAX])
foo(a int32[PATH_MAX])
foo(a ptr[in, array[int8, MY_PATH_MAX]])
define MY_PATH_MAX	PATH_MAX + 2
```

## Conditional fields

### In structures

In syzlang, it's possible to specify a condition for every struct field that
determines whether the field should be included or omitted:

```
header_fields {
  magic       const[0xabcd, int16]
  haveInteger int8
} [packed]

packet {
  header  header_fields
  integer int64  (if[value[header:haveInteger] == 0x1])
  body    array[int8]
} [packed]

some_call(a ptr[in, packet])
```

In this example, the `packet` structure will include the field `integer` only
if `header.haveInteger == 1`. In memory, `packet` will have the following
layout:

| header.magic = 0xabcd | header.haveInteger = 0x1 | integer | body |
| --------------------- | ------------------------ | ------- | ---- |

That corresponds to e.g. the following program:

```
some_call(&AUTO={{AUTO, 0x1}, @value=0xabcd, []})
```

If `header.haveInteger` is not `1`, syzkaller will just pretend that the field
`integer` does not exist.

```
some_call(&AUTO={{AUTO, 0x0}, @void, []})
```

| header.magic = 0xabcd | header.haveInteger = 0x0 | body |
| --------------------- | ------------------------ | ---- |

Every conditional field is assumed to be of variable length and so is the struct
to which this field belongs.

When a variable length field appears in the middle of a structure, the structure
must be marked with `[packed].`

Conditions on bitfields are prohibited:

```
struct {
  f0 int
  f1 int:3 (if[value[f0] == 0x1])  # It will not compile.
}
```

But you may reference bitfields in your conditions:

```
struct {
  f0 int:1
  f1 int:7
  f2 int   (if[value[f0] == value[f1]])
} [packed]
```

### In unions

Let's consider the following example.

```
struct {
  type int
  body alternatives
}

alternatives [
  int     int64 (if[value[struct:type] == 0x1])
  arr     array[int64, 5] (if[value[struct:type] == 0x2])
  default int32
] [varlen]

some_call(a ptr[in, struct])
```

In this case, the union option will be selected depending on the value of the
`type` field. For example, if `type` is `0x1`, then it can be either `int` or
`default`:

```
some_call(&AUTO={0x1, @int=0x123})
some_call(&AUTO={0x1, @default=0x123})
```

If `type` is `0x2`, it can be either `arr` or `default`.

If `type` is neither `0x1` nor `0x2`, syzkaller may only select `default`:

```
some_call(&AUTO={0x0, @default=0xabcd})
```

To ensure that a union can always be constructed, the last union field **must always
have no condition**.

Thus, the following definition would fail to compile:

```
alternatives [
  int int64 (if[value[struct:type] == 0x1])
  arr array[int64, 5] (if[value[struct:type] == 0x1])
] [varlen]
```

During prog mutation and generation syzkaller will select a random union field
whose condition is satisfied.

### Expression syntax

Currently, only `==`, `!=`, `&` and `||` operators are supported. However, the
functionality was designed in such a way that adding more operators is easy.
Feel free to file a GitHub issue or write us an email in case it's needed.

Expressions are evaluated as `int64` values. If the final result of an
expression is not 0, it's assumed to be satisfied.

If you want to reference a field's value, you can do it via
`value[path:to:field]`, which is similar to the `len[]` argument.

```
sub_struct {
  f0 int
  # Reference a field in a parent struct.
  f1 int (if[value[struct:f2]]) # Same as if[value[struct:f2] != 0].
}

struct {
  f2 int
  f3 sub_struct
  f4 int (if[value[f2] == 0x2]) # Reference a sibling field.
  f5 int (if[value[f3:f0] == 0x1]) # Reference a nested field.
  f6 int (if[value[f3:f0] == 0x1 || value[f3:f0] == 0x2]) # Reference a nested field which either equals to 0x1 or 0x2.
} [packed]

call(a ptr[in, struct])
```

The referenced field must be of integer type and there must be no
conditional fields in the path to it. For example, the following
descriptions will not compile.

```
struct {
  f0 int
  f1 int (if[value[f0] == 0x1])
  f2 int (if[value[f1] == 0x1])
}
```

You may also reference constants in expressions:

```
struct {
  f0 int
  f1 int
  f2 int (if[value[f0] & SOME_CONST == OTHER_CONST])
}
```

## Meta

Description files can also contain `meta` directives that specify meta-information for the whole file.

```
meta noextract
```

Tells `make extract` to not extract constants for this file.
Though, `syz-extract` can still be invoked manually on this file.

```
meta arches["arch1", "arch2"]
```

Restricts this file only to the given set of architectures.
`make extract` and `make generate` will not use it on other architectures.

## Misc

Description files also contain `include` directives that refer to Linux kernel header files,
`incdir` directives that refer to custom Linux kernel header directories
and `define` directives that define symbolic constant values.

The syzkaller executor defines some [pseudo system calls](./pseudo_syscalls.md)
that can be used as any other syscall in a description file. These pseudo
system calls expand to literal C code and can perform user-defined
custom actions. You can find some examples in
[executor/common_linux.h](../executor/common_linux.h).

Also see [tips](syscall_descriptions.md#tips) on writing good descriptions.

===

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug title: KCSAN: data-race in __dentry_kill / d_make_discardable

The bug report to reproduce:
==================================================================
BUG: KCSAN: data-race in __dentry_kill / d_make_discardable

write to 0xffff888107b73cc0 of 4 bytes by task 3303 on cpu 0:
 d_make_discardable+0x4f/0xa0 fs/dcache.c:936
 simple_unlink+0x68/0x80 fs/libfs.c:809
 shmem_unlink+0x12d/0x140 mm/shmem.c:4005
 shmem_rename2+0x18e/0x310 mm/shmem.c:4086
 vfs_rename+0x97f/0xad0 fs/namei.c:6026
 filename_renameat2+0x3b6/0x6e0 fs/namei.c:6144
 __do_sys_rename fs/namei.c:6188 [inline]
 __se_sys_rename+0x4a/0x1c0 fs/namei.c:6184
 __x64_sys_rename+0x31/0x40 fs/namei.c:6184
 x64_sys_call+0x2b3/0x3020 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888107b73cc0 of 4 bytes by task 3718 on cpu 1:
 dentry_unlist fs/dcache.c:640 [inline]
 __dentry_kill+0x25c/0x460 fs/dcache.c:684
 finish_dput+0x2b/0x200 fs/dcache.c:879
 dput+0x52/0x60 fs/dcache.c:928
 end_renaming fs/namei.c:4096 [inline]
 filename_renameat2+0x493/0x6e0 fs/namei.c:6146
 __do_sys_rename fs/namei.c:6188 [inline]
 __se_sys_rename+0x4a/0x1c0 fs/namei.c:6184
 __x64_sys_rename+0x31/0x40 fs/namei.c:6184
 x64_sys_call+0x2b3/0x3020 arch/x86/include/generated/asm/syscalls_64.h:83
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x08200080 -> 0x00200180

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3718 Comm: udevd Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_nilfs2.txt
fs_ioctl_ocfs2.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

gemini-3-pro-preview

							input: 13290
							output: 20
							thoughts: 742
						

**Analyzing a Data Race in `__dentry_kill` / `d_make_discardable`**

Okay, so we've got a data race to tackle. The bug report is pointing to a write to `0xffff888107b73cc0`, a 4-byte write by task 3303 on CPU 0, conflicting with a read of the same address by task 3718 on CPU 1. Both are triggered by `rename` syscalls, which is a good starting point. The trace reveals a sequence: the write path is `shmem_rename2` -> `shmem_unlink` -> `simple_unlink` -> `d_make_discardable` and the read path is `end_renaming` -> `dput` -> `finish_dput` -> `__dentry_kill` -> `dentry_unlist`. We should dive into `fs/dcache.c`, `fs/namei.c`, and potentially `mm/shmem.c` since `shmem_rename2` is involved, and this seems to be happening on a tmpfs/shmem filesystem.

So, the race is between `d_make_discardable` and `dentry_unlist`. Let's clarify what's being modified by `d_make_discardable`? It seems like we are messing with the dentry flags, the value looks like it's changing from `0x08200080` to `0x00200180` and that's likely the `d_flags` field. We will need to investigate the dentry structure and those functions. Time to look into `fs/dcache.c` and specifically at `d_make_discardable`. It's time to build a syzkaller program to reproduce and expose this condition.

map[Expression:d_make_discardable]

map[Output:fs/autofs/root.c=630=static int autofs_dir_unlink(struct inode *dir, struct dentry *dentry)
--
fs/autofs/root.c-636-	p_ino->count--;
fs/autofs/root.c:637:	d_make_discardable(dentry);
fs/autofs/root.c-638-
--
fs/autofs/root.c=698=static int autofs_dir_rmdir(struct inode *dir, struct dentry *dentry)
--
fs/autofs/root.c-718-	p_ino->count--;
fs/autofs/root.c:719:	d_make_discardable(dentry);
fs/autofs/root.c-720-	d_inode(dentry)->i_size = 0;
--
fs/dcache.c=930=EXPORT_SYMBOL(dput);
fs/dcache.c-931-
fs/dcache.c:932:void d_make_discardable(struct dentry *dentry)
fs/dcache.c-933-{
--
fs/dcache.c-940-}
fs/dcache.c:941:EXPORT_SYMBOL(d_make_discardable);
fs/dcache.c-942-
--
fs/devpts/inode.c=553=void devpts_pty_kill(struct dentry *dentry)
--
fs/devpts/inode.c-560-	fsnotify_unlink(d_inode(dentry->d_parent), dentry);
fs/devpts/inode.c:561:	d_make_discardable(dentry);
fs/devpts/inode.c-562-}
--
fs/libfs.c=599=static void __simple_recursive_removal(struct dentry *dentry,
--
fs/libfs.c-626-				fsnotify_delete(inode, d_inode(victim), victim);
fs/libfs.c:627:				d_make_discardable(victim);
fs/libfs.c-628-			}
--
fs/libfs.c=806=int simple_unlink(struct inode *dir, struct dentry *dentry)
--
fs/libfs.c-808-	__simple_unlink(dir, dentry);
fs/libfs.c:809:	d_make_discardable(dentry);
fs/libfs.c-810-	return 0;
--
fs/libfs.c=814=int simple_rmdir(struct inode *dir, struct dentry *dentry)
--
fs/libfs.c-819-	__simple_rmdir(dir, dentry);
fs/libfs.c:820:	d_make_discardable(dentry);
fs/libfs.c-821-	return 0;
--
fs/tracefs/event_inode.c=892=void eventfs_remove_events_dir(struct eventfs_inode *ei)
--
fs/tracefs/event_inode.c-912-	d_invalidate(dentry);
fs/tracefs/event_inode.c:913:	d_make_discardable(dentry);
fs/tracefs/event_inode.c-914-}
--
include/linux/dcache.h=615=struct dentry *d_make_persistent(struct dentry *, struct inode *);
include/linux/dcache.h:616:void d_make_discardable(struct dentry *dentry);
include/linux/dcache.h-617-
]

gemini-3-pro-preview

							input: 15378
							output: 41
							thoughts: 21
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into `d_make_discardable`**

Alright, let's pull up the source for `d_make_discardable` in `fs/dcache.c`. I need to refresh my understanding of the exact mechanics of making a dentry discardable, specifically how it interacts with the broader dcache lifecycle and memory management. I suspect I'm looking for the conditions that *allow* a dentry to be eligible for eviction. Is it solely based on reference counts, or are there more subtle flags or usage patterns at play? I'm particularly interested in how this interacts with things like shared mappings, open files, or recently accessed data. I'm wondering if this function handles the full process of actually *making* it discardable, or just flags it as such. I'll be looking for where the actual memory release or cache invalidation takes place, because that's what is most interesting. Understanding the fine-grained locking is also a high priority. Gotta make sure I'm clear on how concurrent operations are handled. I need to see how the kernel balances the need to retain frequently used dentries with the imperative of freeing memory, especially in the context of memory pressure.

map[ContextFile:fs/dcache.c IncludeLines:true Name:d_make_discardable]

map[SourceCode: 932:	void d_make_discardable(struct dentry *dentry)
 933:	{
 934:		spin_lock(&dentry->d_lock);
 935:		WARN_ON(!(dentry->d_flags & DCACHE_PERSISTENT));
 936:		dentry->d_flags &= ~DCACHE_PERSISTENT;
 937:		dentry->d_lockref.count--;
 938:		rcu_read_lock();
 939:		finish_dput(dentry);
 940:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 15886
							output: 40
							thoughts: 218
						

**Analyzing a Potential Race Condition in the Dentry Cache**

Okay, so I'm looking at this report and immediately my attention is drawn to the interaction with `d_make_discardable` and `dentry->d_flags`. It's modifying those flags, specifically with the `&= ~DCACHE_PERSISTENT` operation, and it's doing so under the protection of `spin_lock(&dentry->d_lock)`. That's standard practice, of course.

The report highlights a write to a specific memory address, `0xffff888107b73cc0`, a four-byte write by task 3303 on CPU 0. The stack trace points directly to `d_make_discardable` at `fs/dcache.c:936`. Confirmed. It *is* setting that `DCACHE_PERSISTENT` flag.

Now the interesting part. We have a *read* from the *same* address, `0xffff888107b73cc0`, again a four-byte operation, this time by task 3718 on CPU 1. This looks like a race condition possibility. The trace shows `dentry_unlist` (which is inline) called, and that leads to `__dentry_kill` at `fs/dcache.c:684`. Time to dig into `__dentry_kill` and see what it's doing with those flags. This definitely smells like a potential concurrency bug, so let's check what that function does.

map[ContextFile:fs/dcache.c IncludeLines:true Name:__dentry_kill]

map[SourceCode: 646:	static struct dentry *__dentry_kill(struct dentry *dentry)
 647:	{
 648:		struct dentry *parent = NULL;
 649:		bool can_free = true;
 650:	
 651:		/*
 652:		 * The dentry is now unrecoverably dead to the world.
 653:		 */
 654:		lockref_mark_dead(&dentry->d_lockref);
 655:	
 656:		/*
 657:		 * inform the fs via d_prune that this dentry is about to be
 658:		 * unhashed and destroyed.
 659:		 */
 660:		if (dentry->d_flags & DCACHE_OP_PRUNE)
 661:			dentry->d_op->d_prune(dentry);
 662:	
 663:		if (dentry->d_flags & DCACHE_LRU_LIST) {
 664:			if (!(dentry->d_flags & DCACHE_SHRINK_LIST))
 665:				d_lru_del(dentry);
 666:		}
 667:		/* if it was on the hash then remove it */
 668:		__d_drop(dentry);
 669:		if (dentry->d_inode)
 670:			dentry_unlink_inode(dentry);
 671:		else
 672:			spin_unlock(&dentry->d_lock);
 673:		this_cpu_dec(nr_dentry);
 674:		if (dentry->d_op && dentry->d_op->d_release)
 675:			dentry->d_op->d_release(dentry);
 676:	
 677:		cond_resched();
 678:		/* now that it's negative, ->d_parent is stable */
 679:		if (!IS_ROOT(dentry)) {
 680:			parent = dentry->d_parent;
 681:			spin_lock(&parent->d_lock);
 682:		}
 683:		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
 684:		dentry_unlist(dentry);
 685:		if (dentry->d_flags & DCACHE_SHRINK_LIST)
 686:			can_free = false;
 687:		spin_unlock(&dentry->d_lock);
 688:		if (likely(can_free))
 689:			dentry_free(dentry);
 690:		if (parent && --parent->d_lockref.count) {
 691:			spin_unlock(&parent->d_lock);
 692:			return NULL;
 693:		}
 694:		return parent;
 695:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 17291
							output: 39
							thoughts: 19
						

Okay, let's dive into this. Here's my thought process on this:

**Investigating `dentry_unlist` in `fs/dcache.c`**

Alright, I'm thinking, let's get right into the heart of the matter. I need to understand what's happening with the dentry unlisting process. My initial plan is to take a look at the `dentry_unlist` function. That seems like the logical starting point. The file it's located in is `fs/dcache.c`, so I'll be sure to check that out. Hopefully, that gives me a clear picture of its behavior. I know where to look. Let's do this!

map[ContextFile:fs/dcache.c IncludeLines:true Name:dentry_unlist]

map[SourceCode: 608:	static inline void dentry_unlist(struct dentry *dentry)
 609:	{
 610:		struct dentry *next;
 611:		/*
 612:		 * Inform d_walk() and shrink_dentry_list() that we are no longer
 613:		 * attached to the dentry tree
 614:		 */
 615:		dentry->d_flags |= DCACHE_DENTRY_KILLED;
 616:		if (unlikely(hlist_unhashed(&dentry->d_sib)))
 617:			return;
 618:		__hlist_del(&dentry->d_sib);
 619:		/*
 620:		 * Cursors can move around the list of children.  While we'd been
 621:		 * a normal list member, it didn't matter - ->d_sib.next would've
 622:		 * been updated.  However, from now on it won't be and for the
 623:		 * things like d_walk() it might end up with a nasty surprise.
 624:		 * Normally d_walk() doesn't care about cursors moving around -
 625:		 * ->d_lock on parent prevents that and since a cursor has no children
 626:		 * of its own, we get through it without ever unlocking the parent.
 627:		 * There is one exception, though - if we ascend from a child that
 628:		 * gets killed as soon as we unlock it, the next sibling is found
 629:		 * using the value left in its ->d_sib.next.  And if _that_
 630:		 * pointed to a cursor, and cursor got moved (e.g. by lseek())
 631:		 * before d_walk() regains parent->d_lock, we'll end up skipping
 632:		 * everything the cursor had been moved past.
 633:		 *
 634:		 * Solution: make sure that the pointer left behind in ->d_sib.next
 635:		 * points to something that won't be moving around.  I.e. skip the
 636:		 * cursors.
 637:		 */
 638:		while (dentry->d_sib.next) {
 639:			next = hlist_entry(dentry->d_sib.next, struct dentry, d_sib);
 640:			if (likely(!(next->d_flags & DCACHE_DENTRY_CURSOR)))
 641:				break;
 642:			dentry->d_sib.next = next->d_sib.next;
 643:		}
 644:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 18225
							output: 37
							thoughts: 1691
						

**Data Race in `dentry_unlist` - Analysis and Reproduction**

Okay, so here's the breakdown of what I'm seeing: `dentry_unlist` is reading `next->d_flags` without holding `next->d_lock`, and `next` is a sibling dentry. Now, `dentry_unlist` is called with the parent's `d_lock` held.  Crucially, `d_make_discardable` modifies `dentry->d_flags` with *its own* lock, not the parent's, which is where the race condition kicks in. That means the read in `dentry_unlist` can race with a write in `d_make_discardable` on the same flags. This is a known issue, and `dentry_unlist` has a check for the `DCACHE_DENTRY_CURSOR` flag.

I see that `DCACHE_DENTRY_CURSOR` is `0x00200000`, `DCACHE_PERSISTENT` is `0x08000000`, and I'm seeing changes in the flag values: `0x08200080` becomes `0x00200180`. Let me decode that. The first value has `DCACHE_PERSISTENT`, `DCACHE_DENTRY_CURSOR`, and some other flag. The second has `DCACHE_DENTRY_CURSOR` and the other flag. This is when a dentry is being modified by `d_make_discardable`, and it's a sibling of the dentry being killed.

So `d_make_discardable` is being called on a dentry that's being unlinked. This means we have two dentries in the same directory: one is being "killed" (like during a `dput` after a rename) and the other is being unlinked (`shmem_rename2` -> `shmem_unlink` -> `simple_unlink` -> `d_make_discardable`).  `shmem_rename2` specifically unlinks the target if it exists, so, a rename where "b" already exists. "b" is unlinked, and `d_make_discardable` is called on "b". Simultaneously, `end_renaming` calls `dput` on both the old and new dentries.

Now, if either `dput` call drops the last reference, `__dentry_kill` gets called, which in turn calls `dentry_unlist`.  `dentry_unlist` iterates through the sibling list, reading `next->d_flags` to skip any cursors.  And that `next` *could* be the other dentry being unlinked! So if one dentry is being killed and its `d_sib.next` points to another that's being unlinked, we have the race condition.

To trigger it, we need a `rename` operation that replaces an existing file concurrently with another operation that kills a sibling dentry. `shmem_rename2` is used for `tmpfs`. So if we have `rename("dir/a", "dir/b")` and `dir/b` exists, `vfs_rename` calls `shmem_rename2`, which unlinks `dir/b` via `d_make_discardable(b)`. Then, `end_renaming` happens, calling `dput` on both old and new. If `dput` calls `__dentry_kill` on "b", the race between `d_make_discardable(b)` and `__dentry_kill(c)` emerges where `c` is a sibling of `b`. Or it could be two concurrent renames.

Specifically, it looks like:
Thread 1: `rename("file1", "file2")` where `file2` exists.
Thread 2: `rename("file3", "file4")` where `file4` exists.

I think running concurrent renames on files within the same tmpfs directory is the way to trigger this. I can use syzkaller to generate the test case. Syzkaller's working directory is usually tmpfs. So, I need to write a simple syzkaller program that mounts a `tmpfs` and then does a bunch of concurrent renames.  

map[ContextFile:sys/linux/sys.txt IncludeLines:false Name:mount]

map[SourceCode:struct mount {
	struct hlist_node mnt_hash;
	struct mount *mnt_parent;
	struct dentry *mnt_mountpoint;
	struct vfsmount mnt;
	union {
		struct rb_node mnt_node; /* node in the ns->mounts rbtree */
		struct rcu_head mnt_rcu;
		struct llist_node mnt_llist;
	};
#ifdef CONFIG_SMP
	struct mnt_pcp __percpu *mnt_pcp;
#else
	int mnt_count;
	int mnt_writers;
#endif
	struct list_head mnt_mounts;	/* list of children, anchored here */
	struct list_head mnt_child;	/* and going through their mnt_child */
	struct mount *mnt_next_for_sb;	/* the next two fields are hlist_node, */
	struct mount * __aligned(1) *mnt_pprev_for_sb;
					/* except that LSB of pprev is stolen */
#define WRITE_HOLD 1			/* ... for use by mnt_hold_writers() */
	const char *mnt_devname;	/* Name of device e.g. /dev/dsk/hda1 */
	struct list_head mnt_list;
	struct list_head mnt_expire;	/* link in fs-specific expiry list */
	struct list_head mnt_share;	/* circular list of shared mounts */
	struct hlist_head mnt_slave_list;/* list of slave mounts */
	struct hlist_node mnt_slave;	/* slave list entry */
	struct mount *mnt_master;	/* slave is on master->mnt_slave_list */
	struct mnt_namespace *mnt_ns;	/* containing namespace */
	struct mountpoint *mnt_mp;	/* where is it mounted */
	union {
		struct hlist_node mnt_mp_list;	/* list mounts with the same mountpoint */
		struct hlist_node mnt_umount;
	};
#ifdef CONFIG_FSNOTIFY
	struct fsnotify_mark_connector __rcu *mnt_fsnotify_marks;
	__u32 mnt_fsnotify_mask;
	struct list_head to_notify;	/* need to queue notification */
	struct mnt_namespace *prev_ns;	/* previous namespace (NULL if none) */
#endif
	int mnt_t_flags;		/* namespace_sem-protected flags */
	int mnt_id;			/* mount identifier, reused */
	u64 mnt_id_unique;		/* mount ID unique until reboot */
	int mnt_group_id;		/* peer group identifier */
	int mnt_expiry_mark;		/* true if marked for expiry */
	struct hlist_head mnt_pins;
	struct hlist_head mnt_stuck_children;
	struct mount *overmount;	/* mounted on ->mnt_root */
} __randomize_layout;
 SourceFile:fs/mount.h]

gemini-3-pro-preview

							input: 21631
							output: 37
							thoughts: 15
						

Okay, here's my thought process as if I were considering the question of the `mount` syscall definition within the context of syzkaller:

**Accessing the Syzkaller Definition of the 'mount' System Call**

Right, so I need the syzkaller definition of the `mount` system call. I want to make sure I'm working with the canonical, syzkaller-specific version. This means I'm not just looking for a generic kernel-level definition, but the one optimized for fuzzing within the syzkaller framework. I know the nuances are important. The exact way syzkaller models arguments, handles return values, and considers error conditions is crucial for generating effective test cases. I don't want to rely on my general understanding, I need the precise syzkaller perspective. This definition is probably critical for crafting effective fuzzing targets related to mounting filesystems, bind mounts, and all of the associated edge cases that are exposed within that area. I need this to be certain of correct data representation within the fuzzer.

map[ContextFile:sys/linux/sys.txt IncludeLines:false Name:mount]

map[SourceCode:struct mount {
	struct hlist_node mnt_hash;
	struct mount *mnt_parent;
	struct dentry *mnt_mountpoint;
	struct vfsmount mnt;
	union {
		struct rb_node mnt_node; /* node in the ns->mounts rbtree */
		struct rcu_head mnt_rcu;
		struct llist_node mnt_llist;
	};
#ifdef CONFIG_SMP
	struct mnt_pcp __percpu *mnt_pcp;
#else
	int mnt_count;
	int mnt_writers;
#endif
	struct list_head mnt_mounts;	/* list of children, anchored here */
	struct list_head mnt_child;	/* and going through their mnt_child */
	struct mount *mnt_next_for_sb;	/* the next two fields are hlist_node, */
	struct mount * __aligned(1) *mnt_pprev_for_sb;
					/* except that LSB of pprev is stolen */
#define WRITE_HOLD 1			/* ... for use by mnt_hold_writers() */
	const char *mnt_devname;	/* Name of device e.g. /dev/dsk/hda1 */
	struct list_head mnt_list;
	struct list_head mnt_expire;	/* link in fs-specific expiry list */
	struct list_head mnt_share;	/* circular list of shared mounts */
	struct hlist_head mnt_slave_list;/* list of slave mounts */
	struct hlist_node mnt_slave;	/* slave list entry */
	struct mount *mnt_master;	/* slave is on master->mnt_slave_list */
	struct mnt_namespace *mnt_ns;	/* containing namespace */
	struct mountpoint *mnt_mp;	/* where is it mounted */
	union {
		struct hlist_node mnt_mp_list;	/* list mounts with the same mountpoint */
		struct hlist_node mnt_umount;
	};
#ifdef CONFIG_FSNOTIFY
	struct fsnotify_mark_connector __rcu *mnt_fsnotify_marks;
	__u32 mnt_fsnotify_mask;
	struct list_head to_notify;	/* need to queue notification */
	struct mnt_namespace *prev_ns;	/* previous namespace (NULL if none) */
#endif
	int mnt_t_flags;		/* namespace_sem-protected flags */
	int mnt_id;			/* mount identifier, reused */
	u64 mnt_id_unique;		/* mount ID unique until reboot */
	int mnt_group_id;		/* peer group identifier */
	int mnt_expiry_mark;		/* true if marked for expiry */
	struct hlist_head mnt_pins;
	struct hlist_head mnt_stuck_children;
	struct mount *overmount;	/* mounted on ->mnt_root */
} __randomize_layout;
 SourceFile:fs/mount.h]

gemini-3-pro-preview

							input: 22642
							output: 16
							thoughts: 31
						

Okay, here's my summary, in the first person, as requested:

**Navigating the Codebase**

Alright, that's it, I've got the `struct` I was looking for. Now the real work begins. Let's dig into how this thing actually *mounts* itself. Since it's Linux, I'll bet the action is initiated through a system call. Time to pull out the trusty `grepper` and search for "mount" within the `sys/linux/sys.txt` file. I'm expecting to find the relevant system call definition in there, and hopefully the corresponding function. Let's see what we can find.

map[Expression:^mount]

map[Output:Documentation/accounting/psi.rst=181=In a system with a CONFIG_CGROUPS=y kernel and the cgroup2 filesystem
Documentation/accounting/psi.rst:182:mounted, pressure stall information is also tracked for tasks grouped
Documentation/accounting/psi.rst-183-into cgroups. Each subdirectory in the cgroupfs mountpoint contains
--
Documentation/admin-guide/LSM/SafeSetID.rst=102=safesetid/gid_allowlist_policy files at the location where securityfs is
Documentation/admin-guide/LSM/SafeSetID.rst:103:mounted. The format for adding a policy is '<UID>:<UID>' or '<GID>:<GID>',
Documentation/admin-guide/LSM/SafeSetID.rst-104-using literal numbers, and ending with a newline character such as '123:456\n'.
--
Documentation/admin-guide/acpi/ssdt-overlays.rst=172=interface. The CONFIG_ACPI_CONFIGFS option must be select and configfs must be
Documentation/admin-guide/acpi/ssdt-overlays.rst:173:mounted. In the following examples, we assume that configfs has been mounted in
Documentation/admin-guide/acpi/ssdt-overlays.rst-174-/sys/kernel/config.
--
Documentation/admin-guide/cgroup-v1/cgroups.rst=210=options.  By default, mounting the cgroup filesystem attempts to
Documentation/admin-guide/cgroup-v1/cgroups.rst:211:mount a hierarchy containing all registered subsystems.
Documentation/admin-guide/cgroup-v1/cgroups.rst-212-
--
Documentation/admin-guide/cgroup-v1/cgroups.rst=465=Note: Since every task is always a member of exactly one cgroup in each
Documentation/admin-guide/cgroup-v1/cgroups.rst:466:mounted hierarchy, to remove a task from its current cgroup you must
Documentation/admin-guide/cgroup-v1/cgroups.rst-467-move it into a new cgroup (possibly the root cgroup) by writing to the
--
Documentation/admin-guide/cgroup-v1/cgroups.rst=477=associates the given name with the hierarchy.  This can be used when
Documentation/admin-guide/cgroup-v1/cgroups.rst:478:mounting a pre-existing hierarchy, in order to refer to it by name
Documentation/admin-guide/cgroup-v1/cgroups.rst-479-rather than by its set of active subsystems.  Each hierarchy is either
--
Documentation/admin-guide/cgroup-v2.rst=3035=A cgroup namespace is alive as long as there are processes inside or
Documentation/admin-guide/cgroup-v2.rst:3036:mounts pinning it.  When the last usage goes away, the cgroup
Documentation/admin-guide/cgroup-v2.rst-3037-namespace is destroyed.  The cgroupns root and the actual cgroups
--
Documentation/admin-guide/cgroup-v2.rst=3129=filesystem root.  The process needs CAP_SYS_ADMIN against its user and
Documentation/admin-guide/cgroup-v2.rst:3130:mount namespaces.
Documentation/admin-guide/cgroup-v2.rst-3131-
--
Documentation/admin-guide/cifs/usage.rst=109=though to be able to pass the suid flag to mount requires rebuilding
Documentation/admin-guide/cifs/usage.rst:110:mount.cifs with the following flag: CIFS_ALLOW_USR_SUID
Documentation/admin-guide/cifs/usage.rst-111-
--
Documentation/admin-guide/cifs/usage.rst=120=umount.cifs is placed in /sbin, umount can invoke the cifs umount helper
Documentation/admin-guide/cifs/usage.rst-121-(at least for most versions of the umount utility) for umount of cifs
Documentation/admin-guide/cifs/usage.rst:122:mounts, unless umount is invoked with -i (which will avoid invoking a umount
Documentation/admin-guide/cifs/usage.rst-123-helper). As with mount.cifs, to enable user unmounts umount.cifs must be marked
--
Documentation/admin-guide/cifs/usage.rst=212=Before -o the option -v may be specified to make the mount.cifs
Documentation/admin-guide/cifs/usage.rst:213:mount helper display the mount steps more verbosely.
Documentation/admin-guide/cifs/usage.rst-214-After -o the following commonly used cifs vfs specific options
--
Documentation/admin-guide/cifs/usage.rst=719=open_files		List all the open file handles on all active SMB sessions.
Documentation/admin-guide/cifs/usage.rst:720:mount_params            List of all mount parameters available for the module
Documentation/admin-guide/cifs/usage.rst-721-======================= =======================================================
--
Documentation/admin-guide/media/si470x.rst=131=After loading the module, you still have access to some of them in the sysfs
Documentation/admin-guide/media/si470x.rst:132:mount under /sys/module/radio_si470x/parameters. The contents of read-only files
Documentation/admin-guide/media/si470x.rst-133-(0444) are not updated, even if space, band and de are changed using private
--
Documentation/admin-guide/mm/damon/start.rst=33=detail) of DAMON, you should ensure :doc:`sysfs </filesystems/sysfs>` is
Documentation/admin-guide/mm/damon/start.rst:34:mounted.
Documentation/admin-guide/mm/damon/start.rst-35-
--
Documentation/admin-guide/sysctl/fs.rst=123=more.
--
Documentation/admin-guide/sysctl/fs.rst-125-
Documentation/admin-guide/sysctl/fs.rst:126:mount-max
Documentation/admin-guide/sysctl/fs.rst-127----------
--
Documentation/admin-guide/ufs.rst=2=Using UFS
--
Documentation/admin-guide/ufs.rst-4-
Documentation/admin-guide/ufs.rst:5:mount -t ufs -o ufstype=type_of_ufs device dir
Documentation/admin-guide/ufs.rst-6-
--
Documentation/admin-guide/xfs.rst=408=The configuration files are organized into the following hierarchy for each
Documentation/admin-guide/xfs.rst:409:mounted filesystem:
Documentation/admin-guide/xfs.rst-410-
--
Documentation/dev-tools/gcov.rst=45=Profiling data will only become accessible once debugfs has been
Documentation/dev-tools/gcov.rst:46:mounted::
Documentation/dev-tools/gcov.rst-47-
--
Documentation/dev-tools/kmemleak.rst=17=number of new unreferenced objects found. If the ``debugfs`` isn't already
Documentation/dev-tools/kmemleak.rst:18:mounted, mount with::
Documentation/dev-tools/kmemleak.rst-19-
--
Documentation/dev-tools/kunit/run_manual.rst=64=If ``CONFIG_KUNIT_DEBUGFS`` is enabled, the KUnit debugfs filesystem is
Documentation/dev-tools/kunit/run_manual.rst:65:mounted at /sys/kernel/debug/kunit. You can use this filesystem to perform
Documentation/dev-tools/kunit/run_manual.rst-66-the following actions.
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=26=interact with the environment using an accelerometer, gyroscope or magnetometer
Documentation/devicetree/bindings/iio/mount-matrix.txt:27:mounted on the same chassis as this screen, will likely take the screen as
Documentation/devicetree/bindings/iio/mount-matrix.txt-28-reference to (x,y,z) orientation, with (x,y) corresponding to these axes on the
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=183=mechanically mounted in an ideal way and we need no transformation):
Documentation/devicetree/bindings/iio/mount-matrix.txt-184-
Documentation/devicetree/bindings/iio/mount-matrix.txt:185:mount-matrix = "1", "0", "0",
Documentation/devicetree/bindings/iio/mount-matrix.txt-186-               "0", "1", "0",
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=190=compensate by performing a -30 degrees rotation around the X axis:
Documentation/devicetree/bindings/iio/mount-matrix.txt-191-
Documentation/devicetree/bindings/iio/mount-matrix.txt:192:mount-matrix = "1", "0", "0",
Documentation/devicetree/bindings/iio/mount-matrix.txt-193-               "0", "0.866", "0.5",
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=197=upside-down:
Documentation/devicetree/bindings/iio/mount-matrix.txt-198-
Documentation/devicetree/bindings/iio/mount-matrix.txt:199:mount-matrix = "0.998", "0.054", "0",
Documentation/devicetree/bindings/iio/mount-matrix.txt-200-               "-0.054", "0.998", "0",
--
Documentation/driver-api/driver-model/porting.rst=25=doing so, they will exported via the sysfs filesystem. sysfs can be
Documentation/driver-api/driver-model/porting.rst:26:mounted by doing::
Documentation/driver-api/driver-model/porting.rst-27-
--
Documentation/filesystems/9p.rst=51=where mount_tag is the tag generated by the server to each of the exported
Documentation/filesystems/9p.rst:52:mount points. Each 9P export is seen by the client as a virtio device with an
Documentation/filesystems/9p.rst-53-associated "mount_tag" property. Available mount tags can be
--
Documentation/filesystems/afs.rst=123=This can be used by the administrator to attempt to unmount the whole AFS tree
Documentation/filesystems/afs.rst:124:mounted on /afs in one go by doing::
Documentation/filesystems/afs.rst-125-
--
Documentation/filesystems/autofs-mount-control.rst=19=certain types of autofs triggered mounts can end up covering an autofs
Documentation/filesystems/autofs-mount-control.rst:20:mount itself which prevents us being able to use open(2) to obtain a
Documentation/filesystems/autofs-mount-control.rst-21-file descriptor for these operations if we don't already have one open.
--
Documentation/filesystems/autofs-mount-control.rst=30=The actual problem with autofs is that it can't reconnect to existing
Documentation/filesystems/autofs-mount-control.rst:31:mounts. Immediately one thinks of just adding the ability to remount
Documentation/filesystems/autofs-mount-control.rst-32-autofs file systems would solve it, but alas, that can't work. This is
--
Documentation/filesystems/autofs-mount-control.rst=60=For the above indirect map an autofs file system is mounted on /test and
Documentation/filesystems/autofs-mount-control.rst:61:mounts are triggered for each sub-directory key by the inode lookup
Documentation/filesystems/autofs-mount-control.rst-62-operation. So we see a mount of shark:/autofs/export1 on /test/g1, for
--
Documentation/filesystems/autofs-mount-control.rst=163=appropriate status to the daemon. At the moment we just expire one
Documentation/filesystems/autofs-mount-control.rst:164:mount at a time. A Generic Netlink implementation would exclude this
Documentation/filesystems/autofs-mount-control.rst-165-possibility for future development due to the requirements of the
--
Documentation/filesystems/autofs-mount-control.rst=205=optionally be used to check a specific mount corresponding to a given
Documentation/filesystems/autofs-mount-control.rst:206:mount point file descriptor, and when requesting the uid and gid of the
Documentation/filesystems/autofs-mount-control.rst-207-last successful mount on a directory within the autofs file system.
--
Documentation/filesystems/autofs-mount-control.rst=290=to the wait queue token number, received by user space in the foregoing
Documentation/filesystems/autofs-mount-control.rst:291:mount or expire request. The status field of struct args_fail is set to
Documentation/filesystems/autofs-mount-control.rst-292-the errno of the operation. It is set to 0 on success.
--
Documentation/filesystems/autofs-mount-control.rst=302=incorrectly setting the pipe descriptor we also require that the autofs
Documentation/filesystems/autofs-mount-control.rst:303:mount be catatonic (see next call).
Documentation/filesystems/autofs-mount-control.rst-304-
--
Documentation/filesystems/autofs-mount-control.rst=336=Return the uid and gid of the last process to successfully trigger a the
Documentation/filesystems/autofs-mount-control.rst:337:mount on the given path dentry.
Documentation/filesystems/autofs-mount-control.rst-338-
--
Documentation/filesystems/autofs-mount-control.rst=400=a mountpoint or contains a mount, such as a multi-mount without a root
Documentation/filesystems/autofs-mount-control.rst:401:mount. In this case we return 1 if the descriptor corresponds to a mount
Documentation/filesystems/autofs-mount-control.rst-402-point and also returns the super magic of the covering mount if there
--
Documentation/filesystems/autofs.rst=50=created with a regular `symlink` system call, while directories and
Documentation/filesystems/autofs.rst:51:mount traps are created with `mkdir`.  The determination of whether a
Documentation/filesystems/autofs.rst-52-directory should be a mount trap is based on a master map. This master
--
Documentation/filesystems/autofs.rst=57=If neither the *direct* or *offset* mount options are given (so the
Documentation/filesystems/autofs.rst:58:mount is considered to be *indirect*), then the root directory is
Documentation/filesystems/autofs.rst-59-always a regular directory, otherwise it is a mount trap when it is
--
Documentation/filesystems/autofs.rst=102=everything is ready.  It will then return "`NULL`" indicating that the
Documentation/filesystems/autofs.rst:103:mount has already happened.  The VFS doesn't try to mount anything but
Documentation/filesystems/autofs.rst-104-follows down the mount that is already there.
--
Documentation/filesystems/autofs.rst=108=reflected on the client.  However it is not sufficient for autofs.  As
Documentation/filesystems/autofs.rst:109:mounting onto a directory is considered to be "beyond a `stat`", the
Documentation/filesystems/autofs.rst-110-automount daemon would not be able to mount a filesystem on the 'trap'
--
Documentation/filesystems/autofs.rst=187=VFS that this is a directory that doesn't require d_automount.  If
Documentation/filesystems/autofs.rst-188-`rcu_walk` sees a dentry with DCACHE_NEED_AUTOMOUNT set but nothing
Documentation/filesystems/autofs.rst:189:mounted, it *will* fall back to REF-walk.  `d_manage()` cannot make the
Documentation/filesystems/autofs.rst-190-VFS remain in RCU-walk mode, but can only tell it to get out of
--
Documentation/filesystems/autofs.rst=193=So `d_manage()`, when called with `rcu_walk` set, should either return
Documentation/filesystems/autofs.rst-194--ECHILD if there is any reason to believe it is unsafe to enter the
Documentation/filesystems/autofs.rst:195:mounted filesystem, otherwise it should return 0.
Documentation/filesystems/autofs.rst-196-
--
Documentation/filesystems/autofs.rst=206=This is guided by the MNT_SHRINKABLE flag.  This only applies to
Documentation/filesystems/autofs.rst:207:mounts that were created by `d_automount()` returning a filesystem to be
Documentation/filesystems/autofs.rst:208:mounted.  As autofs doesn't return such a filesystem but leaves the
Documentation/filesystems/autofs.rst:209:mounting to the automount daemon, it must involve the automount daemon
Documentation/filesystems/autofs.rst-210-in unmounting as well.  This also means that autofs has more control
--
Documentation/filesystems/autofs.rst=271=compares it with the "timeout" value set when the filesystem was
Documentation/filesystems/autofs.rst:272:mounted, though this check is ignored in some cases. It also checks if
Documentation/filesystems/autofs.rst-273-the directory or anything below it is in use.  For symbolic links,
--
Documentation/filesystems/autofs.rst=280=use the **AUTOFS_IOC_EXPIRE** ioctl.  This only works for indirect
Documentation/filesystems/autofs.rst:281:mounts.  If it finds something in the root directory to expire it will
Documentation/filesystems/autofs.rst-282-return the name of that thing.  Once a name has been returned the
--
Documentation/filesystems/autofs.rst=284=name normally.  As described above, this is unsafe for non-toplevel
Documentation/filesystems/autofs.rst:285:mounts in a version-5 autofs.  For this reason the current `automount(8)`
Documentation/filesystems/autofs.rst-286-does not use this ioctl.
--
Documentation/filesystems/autofs.rst=438=is restarted there is no way for it to regain control of existing
Documentation/filesystems/autofs.rst:439:mounts using any of the above communication channels.  To address this
Documentation/filesystems/autofs.rst-440-need there is a "miscellaneous" character device (major 10, minor 235)
--
Documentation/filesystems/autofs.rst=554=to applications that the mount entry should be ignored when displaying
Documentation/filesystems/autofs.rst:555:mount information.
Documentation/filesystems/autofs.rst-556-
--
Documentation/filesystems/autofs.rst=562=This is intended to be used by user space programs to exclude autofs
Documentation/filesystems/autofs.rst:563:mounts from consideration when reading the mounts list.
Documentation/filesystems/autofs.rst-564-
--
Documentation/filesystems/automount-support.rst=42=Automatic expiration of mountpoints is easy, provided you've mounted the
Documentation/filesystems/automount-support.rst:43:mountpoint to be expired in the automounting procedure outlined separately.
Documentation/filesystems/automount-support.rst-44-
--
Documentation/filesystems/automount-support.rst=67=will only happen on the second expiration request after the last time the
Documentation/filesystems/automount-support.rst:68:mountpoint was accessed.
Documentation/filesystems/automount-support.rst-69-
Documentation/filesystems/automount-support.rst=70=If a mountpoint is moved, it gets removed from the expiration list. If a bind
Documentation/filesystems/automount-support.rst:71:mount is made on an expirable mount, the new vfsmount will not be on the
Documentation/filesystems/automount-support.rst-72-expiration list and will not expire.
--
Documentation/filesystems/automount-support.rst=82=As an alternative, it is possible for userspace to request expiry of any
Documentation/filesystems/automount-support.rst:83:mountpoint (though some will be rejected - the current process's idea of the
Documentation/filesystems/automount-support.rst-84-rootfs for example). It does this by passing the MNT_EXPIRE flag to
--
Documentation/filesystems/automount-support.rst=88=umount() or its parent mountpoint, an EBUSY error will be returned and the
Documentation/filesystems/automount-support.rst:89:mountpoint will not be marked for expiration or unmounted.
Documentation/filesystems/automount-support.rst-90-
--
Documentation/filesystems/caching/cachefiles.rst=152=kernel module contains its own very cut-down path walking facility that ignores
Documentation/filesystems/caching/cachefiles.rst:153:mountpoints, but the daemon can't avoid them.
Documentation/filesystems/caching/cachefiles.rst-154-
--
Documentation/filesystems/ecryptfs.rst=77=or (2) directories containing files only created by eCryptfs. If you
Documentation/filesystems/ecryptfs.rst:78:mount a directory that has pre-existing files not created by eCryptfs,
Documentation/filesystems/ecryptfs.rst-79-then behavior is undefined. Do not run eCryptfs in higher verbosity
--
Documentation/filesystems/f2fs.rst=620=F2FS adopts the checkpointing scheme to maintain file system consistency. At
Documentation/filesystems/f2fs.rst:621:mount time, F2FS first tries to find the last valid checkpoint data by scanning
Documentation/filesystems/f2fs.rst-622-CP area. In order to reduce the scanning time, F2FS uses only two copies of CP.
--
Documentation/filesystems/fsverity.rst=608=Originally, an ext4 filesystem with the "verity" feature could only be
Documentation/filesystems/fsverity.rst:609:mounted when its block size was equal to the system page size
Documentation/filesystems/fsverity.rst-610-(typically 4096 bytes).  In Linux v6.3, this limitation was removed.
--
Documentation/filesystems/fuse/fuse.rst=304=measures, that system processes will never enter non-privileged
Documentation/filesystems/fuse/fuse.rst:305:mounts, it can relax the last limitation in several ways:
Documentation/filesystems/fuse/fuse.rst-306-
--
Documentation/filesystems/idmappings.rst=440=Note that while this example is less common, because most filesystem can't be
Documentation/filesystems/idmappings.rst:441:mounted with non-initial idmappings this is a general problem as we can see in
Documentation/filesystems/idmappings.rst-442-the next examples.
--
Documentation/filesystems/idmappings.rst=635=However, it is perfectly possible to combine idmapped mounts with filesystems
Documentation/filesystems/idmappings.rst:636:mountable inside user namespaces. We will touch on this further below.
Documentation/filesystems/idmappings.rst-637-
--
Documentation/filesystems/idmappings.rst=945=workloads. The consequence is as we have seen that for both, filesystem's
Documentation/filesystems/idmappings.rst:946:mounted with the initial idmapping and filesystems mounted with non-initial
Documentation/filesystems/idmappings.rst-947-idmappings, access to the filesystem isn't working because the kernel ids can't
--
Documentation/filesystems/idmappings.rst=967=Idmapped mounts allow to solve this problem. A user can create an idmapped
Documentation/filesystems/idmappings.rst:968:mount for their home directory on their work computer or their computer at home
Documentation/filesystems/idmappings.rst-969-depending on what ownership they would prefer to end up on the portable storage
--
Documentation/filesystems/mount_api.rst=201=The filesystem is also allowed to allocate resources and pin them with the
Documentation/filesystems/mount_api.rst:202:mount context.  For instance, NFS might pin the appropriate protocol version
Documentation/filesystems/mount_api.rst-203-module.
--
Documentation/filesystems/nfs/pnfs.rst=34=nfs4_deviceid_cache).  The cache itself is referenced across each
Documentation/filesystems/nfs/pnfs.rst:35:mount.  The entries (struct nfs4_deviceid) themselves are held across
Documentation/filesystems/nfs/pnfs.rst-36-the lifetime of each lseg referencing them.
--
Documentation/filesystems/ocfs2-online-filecheck.rst=50=Here, <devname> indicates the name of OCFS2 volume device which has been already
Documentation/filesystems/ocfs2-online-filecheck.rst:51:mounted. The file above would accept inode numbers. This could be used to
Documentation/filesystems/ocfs2-online-filecheck.rst-52-communicate with kernel space, tell which file(inode number) will be checked or
--
Documentation/filesystems/overlayfs.rst=303=Starting with kernel v6.15 it is possible to use the "override_creds"
Documentation/filesystems/overlayfs.rst:304:mount option which will cause the credentials of the calling task to be
Documentation/filesystems/overlayfs.rst-305-recorded. Note that "override_creds" is only meaningful when used with
--
Documentation/filesystems/overlayfs.rst=559=For the "metacopy" feature, there is no verification mechanism at
Documentation/filesystems/overlayfs.rst:560:mount time. So if same upper is mounted with different set of lower, mount
Documentation/filesystems/overlayfs.rst-561-probably will succeed but expect the unexpected later on. So don't do it.
--
Documentation/filesystems/overlayfs.rst=571=It is possible to use a lower directory that is stored on an overlayfs
Documentation/filesystems/overlayfs.rst:572:mount. For regular files this does not need any special care. However, files
Documentation/filesystems/overlayfs.rst-573-that have overlayfs attributes, such as whiteouts or "overlay.*" xattrs, will
--
Documentation/filesystems/overlayfs.rst=583=A lower dir with a regular whiteout will always be handled by the overlayfs
Documentation/filesystems/overlayfs.rst:584:mount, so to support storing an effective whiteout file in an overlayfs mount an
Documentation/filesystems/overlayfs.rst-585-alternative form of whiteout is supported. This form is a regular, zero-size
--
Documentation/filesystems/overlayfs.rst=790=guaranteed to survive a crash.  It is strongly recommended that volatile
Documentation/filesystems/overlayfs.rst:791:mounts are only used if data written to the overlay can be recreated
Documentation/filesystems/overlayfs.rst-792-without significant effort.
--
Documentation/filesystems/path-lookup.rst=335=reference to the mounted dentry, but not the mounted-on dentry.
Documentation/filesystems/path-lookup.rst-336-
Documentation/filesystems/path-lookup.rst:337:mount_lock
Documentation/filesystems/path-lookup.rst-338-~~~~~~~~~~
--
Documentation/filesystems/path-lookup.rst=545=If this flag has been set, then the filesystem has requested that the
Documentation/filesystems/path-lookup.rst-546-``d_manage()`` dentry operation be called before handling any possible
Documentation/filesystems/path-lookup.rst:547:mount point.  This can perform two particular services:
Documentation/filesystems/path-lookup.rst-548-
--
Documentation/filesystems/path-lookup.rst=554=It can selectively allow only some processes to transit through a
Documentation/filesystems/path-lookup.rst:555:mount point.  When a server process is managing automounts, it may
Documentation/filesystems/path-lookup.rst-556-need to access a directory without triggering normal automount
--
Documentation/filesystems/path-lookup.rst=777=check if we have landed on a mount point and, if so, must find that
Documentation/filesystems/path-lookup.rst:778:mount point and follow the ``mnt->mnt_root`` link.  This would imply a
Documentation/filesystems/path-lookup.rst-779-somewhat unusual, but certainly possible, circumstance where the
--
Documentation/filesystems/path-lookup.txt=62=refer to), switching from the mount point path to the root of the particular
Documentation/filesystems/path-lookup.txt:63:mounted vfsmount. These behaviours are variously modified depending on the
Documentation/filesystems/path-lookup.txt-64-exact path walking flags.
--
Documentation/filesystems/porting.rst=1008=Because the holder of the block device was the file_system_type any concurrent
Documentation/filesystems/porting.rst:1009:mounter could open the block devices of any superblock of the same
Documentation/filesystems/porting.rst-1010-file_system_type without risking seeing EBUSY because the block device was
--
Documentation/filesystems/proc.rst=2012=file has been created with [see open(2) for details] and 'mnt_id' represents
Documentation/filesystems/proc.rst:2013:mount ID of the file system containing the opened file [see 3.5
Documentation/filesystems/proc.rst-2014-/proc/<pid>/mountinfo for details]. 'ino' represents the inode number of
--
Documentation/filesystems/proc.rst=2420=each pid namespace. So, procfs mount options are global among all
Documentation/filesystems/proc.rst:2421:mountpoints within the same namespace::
Documentation/filesystems/proc.rst-2422-
--
Documentation/filesystems/proc.rst=2434=and only after remounting procfs mount options will change at all
Documentation/filesystems/proc.rst:2435:mountpoints::
Documentation/filesystems/proc.rst-2436-
--
Documentation/filesystems/propagate_umount.txt=5=that set - anything with the same mountpoint as one of the removed
Documentation/filesystems/propagate_umount.txt:6:mounts and with parent that would receive events from the parent of that
Documentation/filesystems/propagate_umount.txt:7:mount.  However, there are some constraints the resulting set must
Documentation/filesystems/propagate_umount.txt-8-satisfy.
--
Documentation/filesystems/propagate_umount.txt=158=is the first element that doesn't belong to Trim(S, m) and the
Documentation/filesystems/propagate_umount.txt:159:mountpoint of x_1 is strictly inside x.  If mount r belongs to S, it must
Documentation/filesystems/propagate_umount.txt-160-have been removed by Trim(S, m), i.e. it was forbidden in S by m.
--
Documentation/filesystems/resctrl.rst=38=To use the feature mount the file system::
--
Documentation/filesystems/resctrl.rst-41-
Documentation/filesystems/resctrl.rst:42:mount options are:
Documentation/filesystems/resctrl.rst-43-
--
Documentation/filesystems/tmpfs.rst=16=unneeded pages out to swap space, if swap was enabled for the tmpfs
Documentation/filesystems/tmpfs.rst:17:mount. tmpfs also supports THP.
Documentation/filesystems/tmpfs.rst-18-
--
Documentation/filesystems/tmpfs.rst=95=if nr_inodes=0, inodes will not be limited.  It is generally unwise to
Documentation/filesystems/tmpfs.rst:96:mount with such options, since it allows any user with write access to
Documentation/filesystems/tmpfs.rst-97-use up all the memory on the machine; but enhances the scalability of
--
Documentation/filesystems/tmpfs.rst=206=online, then it is advisable to omit the mpol option from automatic
Documentation/filesystems/tmpfs.rst:207:mount options.  It can be added later, when the tmpfs is already mounted
Documentation/filesystems/tmpfs.rst-208-on MountPoint, by 'mount -o remount,mpol=Policy:NodeList MountPoint'.
--
Documentation/filesystems/tmpfs.rst=258=empty directory. Nevertheless, new directories will inherit the attribute. The
Documentation/filesystems/tmpfs.rst:259:mountpoint itself cannot be made case-insensitive.
Documentation/filesystems/tmpfs.rst-260-
--
Documentation/filesystems/ubifs-authentication.rst=150=a commit is initiated. This also writes a commit start node so that during
Documentation/filesystems/ubifs-authentication.rst:151:mount, UBIFS will seek for the most recent commit start node and just replay
Documentation/filesystems/ubifs-authentication.rst-152-every reference node after that. Every reference node before the commit start
--
Documentation/filesystems/xfs/xfs-delayed-logging-design.rst=1083=can basically switch between delayed logging and the existing mechanism with a
Documentation/filesystems/xfs/xfs-delayed-logging-design.rst:1084:mount option. Fundamentally, there is no reason why the log manager would not
Documentation/filesystems/xfs/xfs-delayed-logging-design.rst-1085-be able to swap methods automatically and transparently depending on load
--
Documentation/filesystems/zonefs.rst=70=persistently stores a magic number and optional feature flags and values. On
Documentation/filesystems/zonefs.rst:71:mount, zonefs uses blkdev_report_zones() to obtain the device zone configuration
Documentation/filesystems/zonefs.rst-72-and populates the mount point with a static file tree solely based on this
--
Documentation/i2c/gpio-fault-injection.rst=11=Once the Kconfig option I2C_GPIO_FAULT_INJECTOR is enabled, there will be an
Documentation/i2c/gpio-fault-injection.rst-12-'i2c-fault-injector' subdirectory in the Kernel debugfs filesystem, usually
Documentation/i2c/gpio-fault-injection.rst:13:mounted at /sys/kernel/debug. There will be a separate subdirectory per GPIO
Documentation/i2c/gpio-fault-injection.rst-14-driven I2C bus. Each subdirectory will contain files to trigger the fault
--
Documentation/networking/netconsole.rst=111=Some examples follow (where configfs is mounted at the /sys/kernel/config
Documentation/networking/netconsole.rst:112:mountpoint).
Documentation/networking/netconsole.rst-113-
--
Documentation/power/userland-swsusp.rst=141=a file on a partition that is unmounted before SNAPSHOT_CREATE_IMAGE and
Documentation/power/userland-swsusp.rst:142:mounted afterwards.
Documentation/power/userland-swsusp.rst-143-
--
Documentation/process/changes.rst=358=information would be given to the kernel by ``mountd`` when the client
Documentation/process/changes.rst:359:mounted the filesystem, or by ``exportfs`` at system startup.  exportfs
Documentation/process/changes.rst-360-would take information about active clients from ``/var/lib/nfs/rmtab``.
--
Documentation/security/self-protection.rst=223=Since the location of kernel memory is almost always instrumental in
Documentation/security/self-protection.rst:224:mounting a successful attack, making the location non-deterministic
Documentation/security/self-protection.rst-225-raises the difficulty of an exploit. (Note that this in turn makes
--
Documentation/target/target-export-device=42=lsmod | grep -q target_core_mod || modprobe target_core_mod
Documentation/target/target-export-device:43:mount | grep -q ^configfs || mount -t configfs none $CONFIGFS
Documentation/target/target-export-device-44-mkdir -p $ISCSI_DIR
--
Documentation/usb/functionfs.rst=18=From user space point of view it is a file system which when
Documentation/usb/functionfs.rst:19:mounted provides an "ep0" file.  User space driver need to
Documentation/usb/functionfs.rst-20-write descriptors and strings to that file.  It does not need
--
Documentation/usb/gadget-testing.rst=357=host: dmesg, see the USB drives appear (if system configured to automatically
Documentation/usb/gadget-testing.rst:358:mount)
Documentation/usb/gadget-testing.rst-359-
--
Documentation/userspace-api/media/drivers/camera-sensor.rst=93=Some systems have the camera sensor mounted upside down compared to its natural
Documentation/userspace-api/media/drivers/camera-sensor.rst:94:mounting rotation. In such cases, drivers shall expose the information to
Documentation/userspace-api/media/drivers/camera-sensor.rst-95-userspace with the :ref:`V4L2_CID_CAMERA_SENSOR_ROTATION
--
Documentation/virt/uml/user_mode_linux_howto_v2.rst=131=Set the root password - the easiest way to do that is to chroot into the
Documentation/virt/uml/user_mode_linux_howto_v2.rst:132:mounted image::
Documentation/virt/uml/user_mode_linux_howto_v2.rst-133-
--
fs/namespace.c=873=static int get_mountpoint(struct dentry *dentry, struct pinned_mountpoint *m)
--
fs/namespace.c-882-			return -ENOENT;
fs/namespace.c:883:mountpoint:
fs/namespace.c-884-		read_seqlock_excl(&mount_lock);
--
fs/xfs/xfs_sysfs.c=144=STATIC ssize_t
fs/xfs/xfs_sysfs.c:145:mount_delay_store(
fs/xfs/xfs_sysfs.c-146-	struct kobject	*kobject,
--
fs/xfs/xfs_sysfs.c=165=STATIC ssize_t
fs/xfs/xfs_sysfs.c:166:mount_delay_show(
fs/xfs/xfs_sysfs.c-167-	struct kobject	*kobject,
--
init/Makefile=17=obj-y                          += init_task.o
init/Makefile-18-
init/Makefile:19:mounts-y			:= do_mounts.o
init/Makefile:20:mounts-$(CONFIG_BLK_DEV_RAM)	+= do_mounts_rd.o
init/Makefile:21:mounts-$(CONFIG_BLK_DEV_INITRD)	+= do_mounts_initrd.o
init/Makefile-22-
--
samples/bpf/run_cookie_uid_helper_example.sh=13=trap on_exit EXIT
samples/bpf/run_cookie_uid_helper_example.sh:14:mount -t bpf bpf ${mnt_dir}
samples/bpf/run_cookie_uid_helper_example.sh-15-./per_socket_stats_example ${mnt_dir}/bpf_prog $1
--
scripts/gdb/linux/proc.py=130=MNT_INFO = {constants.LX_MNT_NOSUID: ",nosuid",
--
scripts/gdb/linux/proc.py-136-
scripts/gdb/linux/proc.py:137:mount_type = utils.CachedType("struct mount")
scripts/gdb/linux/proc.py:138:mount_ptr_type = mount_type.get_type().pointer()
scripts/gdb/linux/proc.py-139-
--
scripts/selinux/install_policy.sh=74=$SF -F file_contexts /
scripts/selinux/install_policy.sh-75-
scripts/selinux/install_policy.sh:76:mounts=`cat /proc/$$/mounts | \
scripts/selinux/install_policy.sh-77-	grep -E "ext[234]|jfs|xfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \
--
tools/perf/Makefile.perf=656=$(mremap_flags_array): $(linux_uapi_dir)/mman.h $(mremap_flags_tbl)
--
tools/perf/Makefile.perf-658-
tools/perf/Makefile.perf:659:mount_flags_array := $(beauty_outdir)/mount_flags_array.c
tools/perf/Makefile.perf:660:mount_flags_tbl := $(srctree)/tools/perf/trace/beauty/mount_flags.sh
tools/perf/Makefile.perf-661-
--
tools/testing/selftests/bpf/vmtest.sh=169=recompile_kernel()
--
tools/testing/selftests/bpf/vmtest.sh-179-
tools/testing/selftests/bpf/vmtest.sh:180:mount_image()
tools/testing/selftests/bpf/vmtest.sh-181-{
--
tools/testing/selftests/filesystems/fat/run_fat_tests.sh=26=create_loopback()
--
tools/testing/selftests/filesystems/fat/run_fat_tests.sh-34-
tools/testing/selftests/filesystems/fat/run_fat_tests.sh:35:mount_image()
tools/testing/selftests/filesystems/fat/run_fat_tests.sh-36-{
--
tools/testing/selftests/filesystems/fat/run_fat_tests.sh=76=create_loopback
tools/testing/selftests/filesystems/fat/run_fat_tests.sh:77:mount_image
tools/testing/selftests/filesystems/fat/run_fat_tests.sh-78-rename_exchange_test
--
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc=9=local mount_point=$(get_mount_point)
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc-10-
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc:11:mount_options=$(get_mnt_options "$mount_point")
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc-12-
--
tools/testing/selftests/kexec/kexec_common_lib.sh=139=get_kconfig()
--
tools/testing/selftests/kexec/kexec_common_lib.sh-178-# Make sure that securityfs is mounted
tools/testing/selftests/kexec/kexec_common_lib.sh:179:mount_securityfs()
tools/testing/selftests/kexec/kexec_common_lib.sh-180-{
--
tools/testing/selftests/mount_setattr/.gitignore:1:mount_setattr_test
--
tools/testing/selftests/pstore/pstore_post_reboot_tests=22=prlog -n "Mounting pstore filesystem ... "
tools/testing/selftests/pstore/pstore_post_reboot_tests:23:mount_info=`grep pstore /proc/mounts`
tools/testing/selftests/pstore/pstore_post_reboot_tests-24-if [ $? -eq 0 ]; then
]

gemini-3-pro-preview

							input: 33846
							output: 37
							thoughts: 64
						

**My Line of Inquiry: Unraveling the 'mount' System Call**

Okay, so I'm diving into this `sys/linux/sys.txt` file and need to get a clear picture of what's happening with `mount`. I was initially thinking I'd use `codesearch-definition-source` to find every instance of "mount" in there, but then I had a thought – it's a syscall, right? So, chasing down every mention might be overkill. Best to just go straight for the jugular – find the *definition* of the `mount` syscall itself within that file using `codesearch-definition-source`. That should give me the core information I need.

map[ContextFile:sys/linux/sys.txt IncludeLines:false Name:mount]

map[SourceCode:struct mount {
	struct hlist_node mnt_hash;
	struct mount *mnt_parent;
	struct dentry *mnt_mountpoint;
	struct vfsmount mnt;
	union {
		struct rb_node mnt_node; /* node in the ns->mounts rbtree */
		struct rcu_head mnt_rcu;
		struct llist_node mnt_llist;
	};
#ifdef CONFIG_SMP
	struct mnt_pcp __percpu *mnt_pcp;
#else
	int mnt_count;
	int mnt_writers;
#endif
	struct list_head mnt_mounts;	/* list of children, anchored here */
	struct list_head mnt_child;	/* and going through their mnt_child */
	struct mount *mnt_next_for_sb;	/* the next two fields are hlist_node, */
	struct mount * __aligned(1) *mnt_pprev_for_sb;
					/* except that LSB of pprev is stolen */
#define WRITE_HOLD 1			/* ... for use by mnt_hold_writers() */
	const char *mnt_devname;	/* Name of device e.g. /dev/dsk/hda1 */
	struct list_head mnt_list;
	struct list_head mnt_expire;	/* link in fs-specific expiry list */
	struct list_head mnt_share;	/* circular list of shared mounts */
	struct hlist_head mnt_slave_list;/* list of slave mounts */
	struct hlist_node mnt_slave;	/* slave list entry */
	struct mount *mnt_master;	/* slave is on master->mnt_slave_list */
	struct mnt_namespace *mnt_ns;	/* containing namespace */
	struct mountpoint *mnt_mp;	/* where is it mounted */
	union {
		struct hlist_node mnt_mp_list;	/* list mounts with the same mountpoint */
		struct hlist_node mnt_umount;
	};
#ifdef CONFIG_FSNOTIFY
	struct fsnotify_mark_connector __rcu *mnt_fsnotify_marks;
	__u32 mnt_fsnotify_mask;
	struct list_head to_notify;	/* need to queue notification */
	struct mnt_namespace *prev_ns;	/* previous namespace (NULL if none) */
#endif
	int mnt_t_flags;		/* namespace_sem-protected flags */
	int mnt_id;			/* mount identifier, reused */
	u64 mnt_id_unique;		/* mount ID unique until reboot */
	int mnt_group_id;		/* peer group identifier */
	int mnt_expiry_mark;		/* true if marked for expiry */
	struct hlist_head mnt_pins;
	struct hlist_head mnt_stuck_children;
	struct mount *overmount;	/* mounted on ->mnt_root */
} __randomize_layout;
 SourceFile:fs/mount.h]

gemini-3-pro-preview

							input: 34835
							output: 17
							thoughts: 25
						

Okay, here's my interpretation of those thoughts, framed as if they're my own:

**Analyzing System Mount Points**

Right, let's get down to brass tacks. I'm thinking I need to understand the current mount points within this Linux system, specifically where things are mounted and how. To do that, I'm going to leverage my existing knowledge of system file analysis. My immediate plan is to use the `read-file` command, which I'm familiar with – it's going to quickly grab the contents of `sys/linux/sys.txt`. I'm assuming that this text file will be a good source of system information.

Now, once I have the file contents, I'm going to refine this. I'll need to filter the output and zero in on the mount points. Therefore, a good approach will be to pipe the output into `grep`. My target search term for `grep` is going to be `mount(`, as a preliminary step, to catch calls or configuration references to mounting. That should quickly get me some actionable information.

no matches

map[Expression:^mount\(]

map[Output:]

gemini-3-pro-preview

							input: 35120
							output: 17
							thoughts: 35
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience:

**Investigating the Location of the `mount` System Call**

Alright, that's interesting. I just saw mention of `mount` within the context of `sys/linux/sys.txt`. That immediately triggers a mental flag. I'm going to quickly verify where the relevant system call definition resides. Since it's in a system file, I need to check the exact file, which is `sys/linux/sys.txt`, and I'm looking for the system call identifier relating to "mount". Of course, I need to use a regex to ensure I'm getting the complete and accurate call name, I'll search specifically for `mount$`. This approach should quickly locate the relevant entry.

no matches

map[Expression:^mount\$]

map[Output:]

gemini-3-pro-preview

							input: 35353
							output: 16
							thoughts: 27
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating Mount Point Configuration**

Right, let's get down to brass tacks. I'm thinking, where would this specific mounting configuration be most likely documented in the system's files? Given the typical structure, my gut feeling leans towards a couple of key areas. My initial thought is to dive into either `sys/linux/filesystem.txt` or `sys/linux/sys.txt`. These two files are usually pretty comprehensive when it comes to low-level system configuration and operational details on a Linux system.

The core of what I'm looking for, of course, is any information related to the 'mount' command or its associated configurations. I'm expecting to find details about mount options, available file systems, and perhaps even some examples or explanations of common mounting scenarios. I'm anticipating that these locations should contain the core technical specifications and potential caveats surrounding mounting strategies on this kernel. I anticipate that the documentation related to `mount` will be there.

map[Expression:^mount]

map[Output:Documentation/accounting/psi.rst=181=In a system with a CONFIG_CGROUPS=y kernel and the cgroup2 filesystem
Documentation/accounting/psi.rst:182:mounted, pressure stall information is also tracked for tasks grouped
Documentation/accounting/psi.rst-183-into cgroups. Each subdirectory in the cgroupfs mountpoint contains
--
Documentation/admin-guide/LSM/SafeSetID.rst=102=safesetid/gid_allowlist_policy files at the location where securityfs is
Documentation/admin-guide/LSM/SafeSetID.rst:103:mounted. The format for adding a policy is '<UID>:<UID>' or '<GID>:<GID>',
Documentation/admin-guide/LSM/SafeSetID.rst-104-using literal numbers, and ending with a newline character such as '123:456\n'.
--
Documentation/admin-guide/acpi/ssdt-overlays.rst=172=interface. The CONFIG_ACPI_CONFIGFS option must be select and configfs must be
Documentation/admin-guide/acpi/ssdt-overlays.rst:173:mounted. In the following examples, we assume that configfs has been mounted in
Documentation/admin-guide/acpi/ssdt-overlays.rst-174-/sys/kernel/config.
--
Documentation/admin-guide/cgroup-v1/cgroups.rst=210=options.  By default, mounting the cgroup filesystem attempts to
Documentation/admin-guide/cgroup-v1/cgroups.rst:211:mount a hierarchy containing all registered subsystems.
Documentation/admin-guide/cgroup-v1/cgroups.rst-212-
--
Documentation/admin-guide/cgroup-v1/cgroups.rst=465=Note: Since every task is always a member of exactly one cgroup in each
Documentation/admin-guide/cgroup-v1/cgroups.rst:466:mounted hierarchy, to remove a task from its current cgroup you must
Documentation/admin-guide/cgroup-v1/cgroups.rst-467-move it into a new cgroup (possibly the root cgroup) by writing to the
--
Documentation/admin-guide/cgroup-v1/cgroups.rst=477=associates the given name with the hierarchy.  This can be used when
Documentation/admin-guide/cgroup-v1/cgroups.rst:478:mounting a pre-existing hierarchy, in order to refer to it by name
Documentation/admin-guide/cgroup-v1/cgroups.rst-479-rather than by its set of active subsystems.  Each hierarchy is either
--
Documentation/admin-guide/cgroup-v2.rst=3035=A cgroup namespace is alive as long as there are processes inside or
Documentation/admin-guide/cgroup-v2.rst:3036:mounts pinning it.  When the last usage goes away, the cgroup
Documentation/admin-guide/cgroup-v2.rst-3037-namespace is destroyed.  The cgroupns root and the actual cgroups
--
Documentation/admin-guide/cgroup-v2.rst=3129=filesystem root.  The process needs CAP_SYS_ADMIN against its user and
Documentation/admin-guide/cgroup-v2.rst:3130:mount namespaces.
Documentation/admin-guide/cgroup-v2.rst-3131-
--
Documentation/admin-guide/cifs/usage.rst=109=though to be able to pass the suid flag to mount requires rebuilding
Documentation/admin-guide/cifs/usage.rst:110:mount.cifs with the following flag: CIFS_ALLOW_USR_SUID
Documentation/admin-guide/cifs/usage.rst-111-
--
Documentation/admin-guide/cifs/usage.rst=120=umount.cifs is placed in /sbin, umount can invoke the cifs umount helper
Documentation/admin-guide/cifs/usage.rst-121-(at least for most versions of the umount utility) for umount of cifs
Documentation/admin-guide/cifs/usage.rst:122:mounts, unless umount is invoked with -i (which will avoid invoking a umount
Documentation/admin-guide/cifs/usage.rst-123-helper). As with mount.cifs, to enable user unmounts umount.cifs must be marked
--
Documentation/admin-guide/cifs/usage.rst=212=Before -o the option -v may be specified to make the mount.cifs
Documentation/admin-guide/cifs/usage.rst:213:mount helper display the mount steps more verbosely.
Documentation/admin-guide/cifs/usage.rst-214-After -o the following commonly used cifs vfs specific options
--
Documentation/admin-guide/cifs/usage.rst=719=open_files		List all the open file handles on all active SMB sessions.
Documentation/admin-guide/cifs/usage.rst:720:mount_params            List of all mount parameters available for the module
Documentation/admin-guide/cifs/usage.rst-721-======================= =======================================================
--
Documentation/admin-guide/media/si470x.rst=131=After loading the module, you still have access to some of them in the sysfs
Documentation/admin-guide/media/si470x.rst:132:mount under /sys/module/radio_si470x/parameters. The contents of read-only files
Documentation/admin-guide/media/si470x.rst-133-(0444) are not updated, even if space, band and de are changed using private
--
Documentation/admin-guide/mm/damon/start.rst=33=detail) of DAMON, you should ensure :doc:`sysfs </filesystems/sysfs>` is
Documentation/admin-guide/mm/damon/start.rst:34:mounted.
Documentation/admin-guide/mm/damon/start.rst-35-
--
Documentation/admin-guide/sysctl/fs.rst=123=more.
--
Documentation/admin-guide/sysctl/fs.rst-125-
Documentation/admin-guide/sysctl/fs.rst:126:mount-max
Documentation/admin-guide/sysctl/fs.rst-127----------
--
Documentation/admin-guide/ufs.rst=2=Using UFS
--
Documentation/admin-guide/ufs.rst-4-
Documentation/admin-guide/ufs.rst:5:mount -t ufs -o ufstype=type_of_ufs device dir
Documentation/admin-guide/ufs.rst-6-
--
Documentation/admin-guide/xfs.rst=408=The configuration files are organized into the following hierarchy for each
Documentation/admin-guide/xfs.rst:409:mounted filesystem:
Documentation/admin-guide/xfs.rst-410-
--
Documentation/dev-tools/gcov.rst=45=Profiling data will only become accessible once debugfs has been
Documentation/dev-tools/gcov.rst:46:mounted::
Documentation/dev-tools/gcov.rst-47-
--
Documentation/dev-tools/kmemleak.rst=17=number of new unreferenced objects found. If the ``debugfs`` isn't already
Documentation/dev-tools/kmemleak.rst:18:mounted, mount with::
Documentation/dev-tools/kmemleak.rst-19-
--
Documentation/dev-tools/kunit/run_manual.rst=64=If ``CONFIG_KUNIT_DEBUGFS`` is enabled, the KUnit debugfs filesystem is
Documentation/dev-tools/kunit/run_manual.rst:65:mounted at /sys/kernel/debug/kunit. You can use this filesystem to perform
Documentation/dev-tools/kunit/run_manual.rst-66-the following actions.
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=26=interact with the environment using an accelerometer, gyroscope or magnetometer
Documentation/devicetree/bindings/iio/mount-matrix.txt:27:mounted on the same chassis as this screen, will likely take the screen as
Documentation/devicetree/bindings/iio/mount-matrix.txt-28-reference to (x,y,z) orientation, with (x,y) corresponding to these axes on the
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=183=mechanically mounted in an ideal way and we need no transformation):
Documentation/devicetree/bindings/iio/mount-matrix.txt-184-
Documentation/devicetree/bindings/iio/mount-matrix.txt:185:mount-matrix = "1", "0", "0",
Documentation/devicetree/bindings/iio/mount-matrix.txt-186-               "0", "1", "0",
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=190=compensate by performing a -30 degrees rotation around the X axis:
Documentation/devicetree/bindings/iio/mount-matrix.txt-191-
Documentation/devicetree/bindings/iio/mount-matrix.txt:192:mount-matrix = "1", "0", "0",
Documentation/devicetree/bindings/iio/mount-matrix.txt-193-               "0", "0.866", "0.5",
--
Documentation/devicetree/bindings/iio/mount-matrix.txt=197=upside-down:
Documentation/devicetree/bindings/iio/mount-matrix.txt-198-
Documentation/devicetree/bindings/iio/mount-matrix.txt:199:mount-matrix = "0.998", "0.054", "0",
Documentation/devicetree/bindings/iio/mount-matrix.txt-200-               "-0.054", "0.998", "0",
--
Documentation/driver-api/driver-model/porting.rst=25=doing so, they will exported via the sysfs filesystem. sysfs can be
Documentation/driver-api/driver-model/porting.rst:26:mounted by doing::
Documentation/driver-api/driver-model/porting.rst-27-
--
Documentation/filesystems/9p.rst=51=where mount_tag is the tag generated by the server to each of the exported
Documentation/filesystems/9p.rst:52:mount points. Each 9P export is seen by the client as a virtio device with an
Documentation/filesystems/9p.rst-53-associated "mount_tag" property. Available mount tags can be
--
Documentation/filesystems/afs.rst=123=This can be used by the administrator to attempt to unmount the whole AFS tree
Documentation/filesystems/afs.rst:124:mounted on /afs in one go by doing::
Documentation/filesystems/afs.rst-125-
--
Documentation/filesystems/autofs-mount-control.rst=19=certain types of autofs triggered mounts can end up covering an autofs
Documentation/filesystems/autofs-mount-control.rst:20:mount itself which prevents us being able to use open(2) to obtain a
Documentation/filesystems/autofs-mount-control.rst-21-file descriptor for these operations if we don't already have one open.
--
Documentation/filesystems/autofs-mount-control.rst=30=The actual problem with autofs is that it can't reconnect to existing
Documentation/filesystems/autofs-mount-control.rst:31:mounts. Immediately one thinks of just adding the ability to remount
Documentation/filesystems/autofs-mount-control.rst-32-autofs file systems would solve it, but alas, that can't work. This is
--
Documentation/filesystems/autofs-mount-control.rst=60=For the above indirect map an autofs file system is mounted on /test and
Documentation/filesystems/autofs-mount-control.rst:61:mounts are triggered for each sub-directory key by the inode lookup
Documentation/filesystems/autofs-mount-control.rst-62-operation. So we see a mount of shark:/autofs/export1 on /test/g1, for
--
Documentation/filesystems/autofs-mount-control.rst=163=appropriate status to the daemon. At the moment we just expire one
Documentation/filesystems/autofs-mount-control.rst:164:mount at a time. A Generic Netlink implementation would exclude this
Documentation/filesystems/autofs-mount-control.rst-165-possibility for future development due to the requirements of the
--
Documentation/filesystems/autofs-mount-control.rst=205=optionally be used to check a specific mount corresponding to a given
Documentation/filesystems/autofs-mount-control.rst:206:mount point file descriptor, and when requesting the uid and gid of the
Documentation/filesystems/autofs-mount-control.rst-207-last successful mount on a directory within the autofs file system.
--
Documentation/filesystems/autofs-mount-control.rst=290=to the wait queue token number, received by user space in the foregoing
Documentation/filesystems/autofs-mount-control.rst:291:mount or expire request. The status field of struct args_fail is set to
Documentation/filesystems/autofs-mount-control.rst-292-the errno of the operation. It is set to 0 on success.
--
Documentation/filesystems/autofs-mount-control.rst=302=incorrectly setting the pipe descriptor we also require that the autofs
Documentation/filesystems/autofs-mount-control.rst:303:mount be catatonic (see next call).
Documentation/filesystems/autofs-mount-control.rst-304-
--
Documentation/filesystems/autofs-mount-control.rst=336=Return the uid and gid of the last process to successfully trigger a the
Documentation/filesystems/autofs-mount-control.rst:337:mount on the given path dentry.
Documentation/filesystems/autofs-mount-control.rst-338-
--
Documentation/filesystems/autofs-mount-control.rst=400=a mountpoint or contains a mount, such as a multi-mount without a root
Documentation/filesystems/autofs-mount-control.rst:401:mount. In this case we return 1 if the descriptor corresponds to a mount
Documentation/filesystems/autofs-mount-control.rst-402-point and also returns the super magic of the covering mount if there
--
Documentation/filesystems/autofs.rst=50=created with a regular `symlink` system call, while directories and
Documentation/filesystems/autofs.rst:51:mount traps are created with `mkdir`.  The determination of whether a
Documentation/filesystems/autofs.rst-52-directory should be a mount trap is based on a master map. This master
--
Documentation/filesystems/autofs.rst=57=If neither the *direct* or *offset* mount options are given (so the
Documentation/filesystems/autofs.rst:58:mount is considered to be *indirect*), then the root directory is
Documentation/filesystems/autofs.rst-59-always a regular directory, otherwise it is a mount trap when it is
--
Documentation/filesystems/autofs.rst=102=everything is ready.  It will then return "`NULL`" indicating that the
Documentation/filesystems/autofs.rst:103:mount has already happened.  The VFS doesn't try to mount anything but
Documentation/filesystems/autofs.rst-104-follows down the mount that is already there.
--
Documentation/filesystems/autofs.rst=108=reflected on the client.  However it is not sufficient for autofs.  As
Documentation/filesystems/autofs.rst:109:mounting onto a directory is considered to be "beyond a `stat`", the
Documentation/filesystems/autofs.rst-110-automount daemon would not be able to mount a filesystem on the 'trap'
--
Documentation/filesystems/autofs.rst=187=VFS that this is a directory that doesn't require d_automount.  If
Documentation/filesystems/autofs.rst-188-`rcu_walk` sees a dentry with DCACHE_NEED_AUTOMOUNT set but nothing
Documentation/filesystems/autofs.rst:189:mounted, it *will* fall back to REF-walk.  `d_manage()` cannot make the
Documentation/filesystems/autofs.rst-190-VFS remain in RCU-walk mode, but can only tell it to get out of
--
Documentation/filesystems/autofs.rst=193=So `d_manage()`, when called with `rcu_walk` set, should either return
Documentation/filesystems/autofs.rst-194--ECHILD if there is any reason to believe it is unsafe to enter the
Documentation/filesystems/autofs.rst:195:mounted filesystem, otherwise it should return 0.
Documentation/filesystems/autofs.rst-196-
--
Documentation/filesystems/autofs.rst=206=This is guided by the MNT_SHRINKABLE flag.  This only applies to
Documentation/filesystems/autofs.rst:207:mounts that were created by `d_automount()` returning a filesystem to be
Documentation/filesystems/autofs.rst:208:mounted.  As autofs doesn't return such a filesystem but leaves the
Documentation/filesystems/autofs.rst:209:mounting to the automount daemon, it must involve the automount daemon
Documentation/filesystems/autofs.rst-210-in unmounting as well.  This also means that autofs has more control
--
Documentation/filesystems/autofs.rst=271=compares it with the "timeout" value set when the filesystem was
Documentation/filesystems/autofs.rst:272:mounted, though this check is ignored in some cases. It also checks if
Documentation/filesystems/autofs.rst-273-the directory or anything below it is in use.  For symbolic links,
--
Documentation/filesystems/autofs.rst=280=use the **AUTOFS_IOC_EXPIRE** ioctl.  This only works for indirect
Documentation/filesystems/autofs.rst:281:mounts.  If it finds something in the root directory to expire it will
Documentation/filesystems/autofs.rst-282-return the name of that thing.  Once a name has been returned the
--
Documentation/filesystems/autofs.rst=284=name normally.  As described above, this is unsafe for non-toplevel
Documentation/filesystems/autofs.rst:285:mounts in a version-5 autofs.  For this reason the current `automount(8)`
Documentation/filesystems/autofs.rst-286-does not use this ioctl.
--
Documentation/filesystems/autofs.rst=438=is restarted there is no way for it to regain control of existing
Documentation/filesystems/autofs.rst:439:mounts using any of the above communication channels.  To address this
Documentation/filesystems/autofs.rst-440-need there is a "miscellaneous" character device (major 10, minor 235)
--
Documentation/filesystems/autofs.rst=554=to applications that the mount entry should be ignored when displaying
Documentation/filesystems/autofs.rst:555:mount information.
Documentation/filesystems/autofs.rst-556-
--
Documentation/filesystems/autofs.rst=562=This is intended to be used by user space programs to exclude autofs
Documentation/filesystems/autofs.rst:563:mounts from consideration when reading the mounts list.
Documentation/filesystems/autofs.rst-564-
--
Documentation/filesystems/automount-support.rst=42=Automatic expiration of mountpoints is easy, provided you've mounted the
Documentation/filesystems/automount-support.rst:43:mountpoint to be expired in the automounting procedure outlined separately.
Documentation/filesystems/automount-support.rst-44-
--
Documentation/filesystems/automount-support.rst=67=will only happen on the second expiration request after the last time the
Documentation/filesystems/automount-support.rst:68:mountpoint was accessed.
Documentation/filesystems/automount-support.rst-69-
Documentation/filesystems/automount-support.rst=70=If a mountpoint is moved, it gets removed from the expiration list. If a bind
Documentation/filesystems/automount-support.rst:71:mount is made on an expirable mount, the new vfsmount will not be on the
Documentation/filesystems/automount-support.rst-72-expiration list and will not expire.
--
Documentation/filesystems/automount-support.rst=82=As an alternative, it is possible for userspace to request expiry of any
Documentation/filesystems/automount-support.rst:83:mountpoint (though some will be rejected - the current process's idea of the
Documentation/filesystems/automount-support.rst-84-rootfs for example). It does this by passing the MNT_EXPIRE flag to
--
Documentation/filesystems/automount-support.rst=88=umount() or its parent mountpoint, an EBUSY error will be returned and the
Documentation/filesystems/automount-support.rst:89:mountpoint will not be marked for expiration or unmounted.
Documentation/filesystems/automount-support.rst-90-
--
Documentation/filesystems/caching/cachefiles.rst=152=kernel module contains its own very cut-down path walking facility that ignores
Documentation/filesystems/caching/cachefiles.rst:153:mountpoints, but the daemon can't avoid them.
Documentation/filesystems/caching/cachefiles.rst-154-
--
Documentation/filesystems/ecryptfs.rst=77=or (2) directories containing files only created by eCryptfs. If you
Documentation/filesystems/ecryptfs.rst:78:mount a directory that has pre-existing files not created by eCryptfs,
Documentation/filesystems/ecryptfs.rst-79-then behavior is undefined. Do not run eCryptfs in higher verbosity
--
Documentation/filesystems/f2fs.rst=620=F2FS adopts the checkpointing scheme to maintain file system consistency. At
Documentation/filesystems/f2fs.rst:621:mount time, F2FS first tries to find the last valid checkpoint data by scanning
Documentation/filesystems/f2fs.rst-622-CP area. In order to reduce the scanning time, F2FS uses only two copies of CP.
--
Documentation/filesystems/fsverity.rst=608=Originally, an ext4 filesystem with the "verity" feature could only be
Documentation/filesystems/fsverity.rst:609:mounted when its block size was equal to the system page size
Documentation/filesystems/fsverity.rst-610-(typically 4096 bytes).  In Linux v6.3, this limitation was removed.
--
Documentation/filesystems/fuse/fuse.rst=304=measures, that system processes will never enter non-privileged
Documentation/filesystems/fuse/fuse.rst:305:mounts, it can relax the last limitation in several ways:
Documentation/filesystems/fuse/fuse.rst-306-
--
Documentation/filesystems/idmappings.rst=440=Note that while this example is less common, because most filesystem can't be
Documentation/filesystems/idmappings.rst:441:mounted with non-initial idmappings this is a general problem as we can see in
Documentation/filesystems/idmappings.rst-442-the next examples.
--
Documentation/filesystems/idmappings.rst=635=However, it is perfectly possible to combine idmapped mounts with filesystems
Documentation/filesystems/idmappings.rst:636:mountable inside user namespaces. We will touch on this further below.
Documentation/filesystems/idmappings.rst-637-
--
Documentation/filesystems/idmappings.rst=945=workloads. The consequence is as we have seen that for both, filesystem's
Documentation/filesystems/idmappings.rst:946:mounted with the initial idmapping and filesystems mounted with non-initial
Documentation/filesystems/idmappings.rst-947-idmappings, access to the filesystem isn't working because the kernel ids can't
--
Documentation/filesystems/idmappings.rst=967=Idmapped mounts allow to solve this problem. A user can create an idmapped
Documentation/filesystems/idmappings.rst:968:mount for their home directory on their work computer or their computer at home
Documentation/filesystems/idmappings.rst-969-depending on what ownership they would prefer to end up on the portable storage
--
Documentation/filesystems/mount_api.rst=201=The filesystem is also allowed to allocate resources and pin them with the
Documentation/filesystems/mount_api.rst:202:mount context.  For instance, NFS might pin the appropriate protocol version
Documentation/filesystems/mount_api.rst-203-module.
--
Documentation/filesystems/nfs/pnfs.rst=34=nfs4_deviceid_cache).  The cache itself is referenced across each
Documentation/filesystems/nfs/pnfs.rst:35:mount.  The entries (struct nfs4_deviceid) themselves are held across
Documentation/filesystems/nfs/pnfs.rst-36-the lifetime of each lseg referencing them.
--
Documentation/filesystems/ocfs2-online-filecheck.rst=50=Here, <devname> indicates the name of OCFS2 volume device which has been already
Documentation/filesystems/ocfs2-online-filecheck.rst:51:mounted. The file above would accept inode numbers. This could be used to
Documentation/filesystems/ocfs2-online-filecheck.rst-52-communicate with kernel space, tell which file(inode number) will be checked or
--
Documentation/filesystems/overlayfs.rst=303=Starting with kernel v6.15 it is possible to use the "override_creds"
Documentation/filesystems/overlayfs.rst:304:mount option which will cause the credentials of the calling task to be
Documentation/filesystems/overlayfs.rst-305-recorded. Note that "override_creds" is only meaningful when used with
--
Documentation/filesystems/overlayfs.rst=559=For the "metacopy" feature, there is no verification mechanism at
Documentation/filesystems/overlayfs.rst:560:mount time. So if same upper is mounted with different set of lower, mount
Documentation/filesystems/overlayfs.rst-561-probably will succeed but expect the unexpected later on. So don't do it.
--
Documentation/filesystems/overlayfs.rst=571=It is possible to use a lower directory that is stored on an overlayfs
Documentation/filesystems/overlayfs.rst:572:mount. For regular files this does not need any special care. However, files
Documentation/filesystems/overlayfs.rst-573-that have overlayfs attributes, such as whiteouts or "overlay.*" xattrs, will
--
Documentation/filesystems/overlayfs.rst=583=A lower dir with a regular whiteout will always be handled by the overlayfs
Documentation/filesystems/overlayfs.rst:584:mount, so to support storing an effective whiteout file in an overlayfs mount an
Documentation/filesystems/overlayfs.rst-585-alternative form of whiteout is supported. This form is a regular, zero-size
--
Documentation/filesystems/overlayfs.rst=790=guaranteed to survive a crash.  It is strongly recommended that volatile
Documentation/filesystems/overlayfs.rst:791:mounts are only used if data written to the overlay can be recreated
Documentation/filesystems/overlayfs.rst-792-without significant effort.
--
Documentation/filesystems/path-lookup.rst=335=reference to the mounted dentry, but not the mounted-on dentry.
Documentation/filesystems/path-lookup.rst-336-
Documentation/filesystems/path-lookup.rst:337:mount_lock
Documentation/filesystems/path-lookup.rst-338-~~~~~~~~~~
--
Documentation/filesystems/path-lookup.rst=545=If this flag has been set, then the filesystem has requested that the
Documentation/filesystems/path-lookup.rst-546-``d_manage()`` dentry operation be called before handling any possible
Documentation/filesystems/path-lookup.rst:547:mount point.  This can perform two particular services:
Documentation/filesystems/path-lookup.rst-548-
--
Documentation/filesystems/path-lookup.rst=554=It can selectively allow only some processes to transit through a
Documentation/filesystems/path-lookup.rst:555:mount point.  When a server process is managing automounts, it may
Documentation/filesystems/path-lookup.rst-556-need to access a directory without triggering normal automount
--
Documentation/filesystems/path-lookup.rst=777=check if we have landed on a mount point and, if so, must find that
Documentation/filesystems/path-lookup.rst:778:mount point and follow the ``mnt->mnt_root`` link.  This would imply a
Documentation/filesystems/path-lookup.rst-779-somewhat unusual, but certainly possible, circumstance where the
--
Documentation/filesystems/path-lookup.txt=62=refer to), switching from the mount point path to the root of the particular
Documentation/filesystems/path-lookup.txt:63:mounted vfsmount. These behaviours are variously modified depending on the
Documentation/filesystems/path-lookup.txt-64-exact path walking flags.
--
Documentation/filesystems/porting.rst=1008=Because the holder of the block device was the file_system_type any concurrent
Documentation/filesystems/porting.rst:1009:mounter could open the block devices of any superblock of the same
Documentation/filesystems/porting.rst-1010-file_system_type without risking seeing EBUSY because the block device was
--
Documentation/filesystems/proc.rst=2012=file has been created with [see open(2) for details] and 'mnt_id' represents
Documentation/filesystems/proc.rst:2013:mount ID of the file system containing the opened file [see 3.5
Documentation/filesystems/proc.rst-2014-/proc/<pid>/mountinfo for details]. 'ino' represents the inode number of
--
Documentation/filesystems/proc.rst=2420=each pid namespace. So, procfs mount options are global among all
Documentation/filesystems/proc.rst:2421:mountpoints within the same namespace::
Documentation/filesystems/proc.rst-2422-
--
Documentation/filesystems/proc.rst=2434=and only after remounting procfs mount options will change at all
Documentation/filesystems/proc.rst:2435:mountpoints::
Documentation/filesystems/proc.rst-2436-
--
Documentation/filesystems/propagate_umount.txt=5=that set - anything with the same mountpoint as one of the removed
Documentation/filesystems/propagate_umount.txt:6:mounts and with parent that would receive events from the parent of that
Documentation/filesystems/propagate_umount.txt:7:mount.  However, there are some constraints the resulting set must
Documentation/filesystems/propagate_umount.txt-8-satisfy.
--
Documentation/filesystems/propagate_umount.txt=158=is the first element that doesn't belong to Trim(S, m) and the
Documentation/filesystems/propagate_umount.txt:159:mountpoint of x_1 is strictly inside x.  If mount r belongs to S, it must
Documentation/filesystems/propagate_umount.txt-160-have been removed by Trim(S, m), i.e. it was forbidden in S by m.
--
Documentation/filesystems/resctrl.rst=38=To use the feature mount the file system::
--
Documentation/filesystems/resctrl.rst-41-
Documentation/filesystems/resctrl.rst:42:mount options are:
Documentation/filesystems/resctrl.rst-43-
--
Documentation/filesystems/tmpfs.rst=16=unneeded pages out to swap space, if swap was enabled for the tmpfs
Documentation/filesystems/tmpfs.rst:17:mount. tmpfs also supports THP.
Documentation/filesystems/tmpfs.rst-18-
--
Documentation/filesystems/tmpfs.rst=95=if nr_inodes=0, inodes will not be limited.  It is generally unwise to
Documentation/filesystems/tmpfs.rst:96:mount with such options, since it allows any user with write access to
Documentation/filesystems/tmpfs.rst-97-use up all the memory on the machine; but enhances the scalability of
--
Documentation/filesystems/tmpfs.rst=206=online, then it is advisable to omit the mpol option from automatic
Documentation/filesystems/tmpfs.rst:207:mount options.  It can be added later, when the tmpfs is already mounted
Documentation/filesystems/tmpfs.rst-208-on MountPoint, by 'mount -o remount,mpol=Policy:NodeList MountPoint'.
--
Documentation/filesystems/tmpfs.rst=258=empty directory. Nevertheless, new directories will inherit the attribute. The
Documentation/filesystems/tmpfs.rst:259:mountpoint itself cannot be made case-insensitive.
Documentation/filesystems/tmpfs.rst-260-
--
Documentation/filesystems/ubifs-authentication.rst=150=a commit is initiated. This also writes a commit start node so that during
Documentation/filesystems/ubifs-authentication.rst:151:mount, UBIFS will seek for the most recent commit start node and just replay
Documentation/filesystems/ubifs-authentication.rst-152-every reference node after that. Every reference node before the commit start
--
Documentation/filesystems/xfs/xfs-delayed-logging-design.rst=1083=can basically switch between delayed logging and the existing mechanism with a
Documentation/filesystems/xfs/xfs-delayed-logging-design.rst:1084:mount option. Fundamentally, there is no reason why the log manager would not
Documentation/filesystems/xfs/xfs-delayed-logging-design.rst-1085-be able to swap methods automatically and transparently depending on load
--
Documentation/filesystems/zonefs.rst=70=persistently stores a magic number and optional feature flags and values. On
Documentation/filesystems/zonefs.rst:71:mount, zonefs uses blkdev_report_zones() to obtain the device zone configuration
Documentation/filesystems/zonefs.rst-72-and populates the mount point with a static file tree solely based on this
--
Documentation/i2c/gpio-fault-injection.rst=11=Once the Kconfig option I2C_GPIO_FAULT_INJECTOR is enabled, there will be an
Documentation/i2c/gpio-fault-injection.rst-12-'i2c-fault-injector' subdirectory in the Kernel debugfs filesystem, usually
Documentation/i2c/gpio-fault-injection.rst:13:mounted at /sys/kernel/debug. There will be a separate subdirectory per GPIO
Documentation/i2c/gpio-fault-injection.rst-14-driven I2C bus. Each subdirectory will contain files to trigger the fault
--
Documentation/networking/netconsole.rst=111=Some examples follow (where configfs is mounted at the /sys/kernel/config
Documentation/networking/netconsole.rst:112:mountpoint).
Documentation/networking/netconsole.rst-113-
--
Documentation/power/userland-swsusp.rst=141=a file on a partition that is unmounted before SNAPSHOT_CREATE_IMAGE and
Documentation/power/userland-swsusp.rst:142:mounted afterwards.
Documentation/power/userland-swsusp.rst-143-
--
Documentation/process/changes.rst=358=information would be given to the kernel by ``mountd`` when the client
Documentation/process/changes.rst:359:mounted the filesystem, or by ``exportfs`` at system startup.  exportfs
Documentation/process/changes.rst-360-would take information about active clients from ``/var/lib/nfs/rmtab``.
--
Documentation/security/self-protection.rst=223=Since the location of kernel memory is almost always instrumental in
Documentation/security/self-protection.rst:224:mounting a successful attack, making the location non-deterministic
Documentation/security/self-protection.rst-225-raises the difficulty of an exploit. (Note that this in turn makes
--
Documentation/target/target-export-device=42=lsmod | grep -q target_core_mod || modprobe target_core_mod
Documentation/target/target-export-device:43:mount | grep -q ^configfs || mount -t configfs none $CONFIGFS
Documentation/target/target-export-device-44-mkdir -p $ISCSI_DIR
--
Documentation/usb/functionfs.rst=18=From user space point of view it is a file system which when
Documentation/usb/functionfs.rst:19:mounted provides an "ep0" file.  User space driver need to
Documentation/usb/functionfs.rst-20-write descriptors and strings to that file.  It does not need
--
Documentation/usb/gadget-testing.rst=357=host: dmesg, see the USB drives appear (if system configured to automatically
Documentation/usb/gadget-testing.rst:358:mount)
Documentation/usb/gadget-testing.rst-359-
--
Documentation/userspace-api/media/drivers/camera-sensor.rst=93=Some systems have the camera sensor mounted upside down compared to its natural
Documentation/userspace-api/media/drivers/camera-sensor.rst:94:mounting rotation. In such cases, drivers shall expose the information to
Documentation/userspace-api/media/drivers/camera-sensor.rst-95-userspace with the :ref:`V4L2_CID_CAMERA_SENSOR_ROTATION
--
Documentation/virt/uml/user_mode_linux_howto_v2.rst=131=Set the root password - the easiest way to do that is to chroot into the
Documentation/virt/uml/user_mode_linux_howto_v2.rst:132:mounted image::
Documentation/virt/uml/user_mode_linux_howto_v2.rst-133-
--
fs/namespace.c=873=static int get_mountpoint(struct dentry *dentry, struct pinned_mountpoint *m)
--
fs/namespace.c-882-			return -ENOENT;
fs/namespace.c:883:mountpoint:
fs/namespace.c-884-		read_seqlock_excl(&mount_lock);
--
fs/xfs/xfs_sysfs.c=144=STATIC ssize_t
fs/xfs/xfs_sysfs.c:145:mount_delay_store(
fs/xfs/xfs_sysfs.c-146-	struct kobject	*kobject,
--
fs/xfs/xfs_sysfs.c=165=STATIC ssize_t
fs/xfs/xfs_sysfs.c:166:mount_delay_show(
fs/xfs/xfs_sysfs.c-167-	struct kobject	*kobject,
--
init/Makefile=17=obj-y                          += init_task.o
init/Makefile-18-
init/Makefile:19:mounts-y			:= do_mounts.o
init/Makefile:20:mounts-$(CONFIG_BLK_DEV_RAM)	+= do_mounts_rd.o
init/Makefile:21:mounts-$(CONFIG_BLK_DEV_INITRD)	+= do_mounts_initrd.o
init/Makefile-22-
--
samples/bpf/run_cookie_uid_helper_example.sh=13=trap on_exit EXIT
samples/bpf/run_cookie_uid_helper_example.sh:14:mount -t bpf bpf ${mnt_dir}
samples/bpf/run_cookie_uid_helper_example.sh-15-./per_socket_stats_example ${mnt_dir}/bpf_prog $1
--
scripts/gdb/linux/proc.py=130=MNT_INFO = {constants.LX_MNT_NOSUID: ",nosuid",
--
scripts/gdb/linux/proc.py-136-
scripts/gdb/linux/proc.py:137:mount_type = utils.CachedType("struct mount")
scripts/gdb/linux/proc.py:138:mount_ptr_type = mount_type.get_type().pointer()
scripts/gdb/linux/proc.py-139-
--
scripts/selinux/install_policy.sh=74=$SF -F file_contexts /
scripts/selinux/install_policy.sh-75-
scripts/selinux/install_policy.sh:76:mounts=`cat /proc/$$/mounts | \
scripts/selinux/install_policy.sh-77-	grep -E "ext[234]|jfs|xfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \
--
tools/perf/Makefile.perf=656=$(mremap_flags_array): $(linux_uapi_dir)/mman.h $(mremap_flags_tbl)
--
tools/perf/Makefile.perf-658-
tools/perf/Makefile.perf:659:mount_flags_array := $(beauty_outdir)/mount_flags_array.c
tools/perf/Makefile.perf:660:mount_flags_tbl := $(srctree)/tools/perf/trace/beauty/mount_flags.sh
tools/perf/Makefile.perf-661-
--
tools/testing/selftests/bpf/vmtest.sh=169=recompile_kernel()
--
tools/testing/selftests/bpf/vmtest.sh-179-
tools/testing/selftests/bpf/vmtest.sh:180:mount_image()
tools/testing/selftests/bpf/vmtest.sh-181-{
--
tools/testing/selftests/filesystems/fat/run_fat_tests.sh=26=create_loopback()
--
tools/testing/selftests/filesystems/fat/run_fat_tests.sh-34-
tools/testing/selftests/filesystems/fat/run_fat_tests.sh:35:mount_image()
tools/testing/selftests/filesystems/fat/run_fat_tests.sh-36-{
--
tools/testing/selftests/filesystems/fat/run_fat_tests.sh=76=create_loopback
tools/testing/selftests/filesystems/fat/run_fat_tests.sh:77:mount_image
tools/testing/selftests/filesystems/fat/run_fat_tests.sh-78-rename_exchange_test
--
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc=9=local mount_point=$(get_mount_point)
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc-10-
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc:11:mount_options=$(get_mnt_options "$mount_point")
tools/testing/selftests/ftrace/test.d/00basic/test_ownership.tc-12-
--
tools/testing/selftests/kexec/kexec_common_lib.sh=139=get_kconfig()
--
tools/testing/selftests/kexec/kexec_common_lib.sh-178-# Make sure that securityfs is mounted
tools/testing/selftests/kexec/kexec_common_lib.sh:179:mount_securityfs()
tools/testing/selftests/kexec/kexec_common_lib.sh-180-{
--
tools/testing/selftests/mount_setattr/.gitignore:1:mount_setattr_test
--
tools/testing/selftests/pstore/pstore_post_reboot_tests=22=prlog -n "Mounting pstore filesystem ... "
tools/testing/selftests/pstore/pstore_post_reboot_tests:23:mount_info=`grep pstore /proc/mounts`
tools/testing/selftests/pstore/pstore_post_reboot_tests-24-if [ $? -eq 0 ]; then
]

gemini-3-pro-preview

							input: 46630
							output: 18
							thoughts: 33
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Navigating the File System**

Hmm, interesting. It seems I've stumbled upon `mount` buried within the `sys/linux/sys.txt` file. A little unexpected, but not entirely out of the realm of possibility considering its kernel-level responsibilities. Instead of digging in blind, it's probably best to take a more systematic approach. Let's start with `read-description` for `sys.txt`. A description will likely be more revealing than simply scanning the contents, especially when encountering something like `mount` in a potentially context-rich location. We'll be able to infer what it's doing there and proceed from there.

map[File:sys.txt]

map[Output:# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# Description of syscall arguments. See README.md for details.

include <linux/socket.h>
include <linux/ptrace.h>
include <linux/resource.h>
include <linux/stat.h>
include <linux/mman.h>
include <linux/time.h>
include <linux/mount.h>
include <linux/fs.h>
include <linux/eventpoll.h>
include <linux/signalfd.h>
include <linux/eventfd.h>
include <linux/timerfd.h>
include <linux/personality.h>
include <linux/wait.h>
include <linux/user.h>
include <linux/un.h>
include <linux/ioctl.h>
include <linux/fadvise.h>
include <linux/falloc.h>
include <linux/kexec.h>
include <linux/elf.h>
include <linux/fiemap.h>
include <linux/kd.h>
include <linux/vt.h>
include <linux/if_alg.h>
include <linux/nfc.h>
include <linux/sockios.h>
include <linux/net_tstamp.h>
include <linux/termios.h>
include <linux/fcntl.h>
include <linux/sched.h>
include <linux/mqueue.h>
include <linux/mempolicy.h>
include <linux/in.h>
include <linux/ip.h>
include <linux/tcp.h>
include <linux/udp.h>
include <linux/kcmp.h>
include <linux/nfs.h>
include <linux/syslog.h>
include <linux/exportfs.h>
include <linux/splice.h>
include <linux/filelock.h>
include <fs/overlayfs/overlayfs.h>
include <uapi/linux/memfd.h>
include <uapi/linux/module.h>
include <linux/ioprio.h>
include <linux/membarrier.h>
include <uapi/linux/kcov.h>
include <uapi/linux/membarrier.h>
include <uapi/linux/capability.h>
include <uapi/linux/seccomp.h>
include <uapi/linux/wait.h>
include <uapi/linux/watch_queue.h>
include <kernel/sched/sched.h>
include <uapi/linux/close_range.h>
include <uapi/linux/netfilter/xt_cgroup.h>
include <fs/smb/client/cifsglob.h>
include <xen/interface/io/xs_wire.h>
include <uapi/linux/prctl.h>
include <asm/prctl.h>
include <linux/reboot.h>
include <linux/swap.h>

resource fd[int32]: -1
resource fd_dir[fd]: AT_FDCWD

# alignptr/align32/align64/padto64 can be used when ABI uses int64/intptr to hold a smaller type.
# E.g. pid/uid stored as intptr/int64.
type alignptr[T] {
	v	T
} [align[PTR_SIZE]]

type align32[T] {
	v	T
} [align[4]]

type align64[T] {
	v	T
} [align[8]]

type padto32[T] {
	v	T
} [size[4]]

type padto64[T] {
	v	T
} [size[8]]

type signalno int32[0:65]
type signalnoptr intptr[0:65]

# syz_execute_func caused multiple problems:
# 1. First it lead to corpus explosion. The program used existing values in registers
# to pollute output area. We tried to zero registers (though, not reliably).
# 2. It lead to explosion again. The exact mechanics are unknown, here is one sample:
# syz_execute_func(&(0x7f0000000440)="f2af91930f0124eda133fa20430fbafce842f66188d0d4
#	430fc7f314c1ab5bf9e2f9660f3a0fae5e090000ba023c1fb63ac4817d73d74ec482310d46f44
#	9f216c863fa438036a91bdbae95aaaa420f383c02c401405c6bfd49d768d768f833fefbab6464
#	660f38323c8f26dbc1a1fe5ff6f6df0804f4c4efa59c0f01c4288ba6452e000054c4431d5cc100")
# 3. The code can also execute syscalls (and it is know to), but it's not subject to
# target.SanitizeCall. As the result it can do things that programs are not supposed to do.
# 4. Besides linux, corpus explosion also happens on freebsd and is clearly attributable
# to syz_execute_func based on corpus contents. Mechanics are also not known.
# It also did not cause finding of any new bugs (at least not that I know of).
# So it's disabled on all OSes until we figure out how to resolve all these problems.
syz_execute_func(text ptr[in, text[target]]) (disabled)

# Exclude /sys/power/state as reported in https://lkml.org/lkml/2021/5/27/653
openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*:-/sys/power/state"]], flags flags[open_flags], mode flags[open_mode]) fd

open(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd (automatic_helper)
# Just so that we have something that creates fd_dir resources.
open$dir(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat$dir(fd const[AT_FDCWD], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat(fd fd_dir[opt], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd
openat2$dir(fd const[AT_FDCWD], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd_dir (automatic_helper)
openat2(fd fd_dir[opt], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd
creat(file ptr[in, filename], mode flags[open_mode]) fd
close(fd fd)
read(fd fd, buf buffer[out], count len[buf])
pread64(fd fd, buf buffer[out], count len[buf], pos fileoff)
readv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec])
preadv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32)
preadv2(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
write(fd fd, buf buffer[in], count len[buf])
pwrite64(fd fd, buf buffer[in], count len[buf], pos fileoff)
writev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec])
pwritev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32)
pwritev2(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
# lseek can return negative offsets when the file has FMODE_UNSIGNED_OFFSET flag:
# https://elixir.bootlin.com/linux/v6.11-rc7/source/fs/read_write.c#L56
# It's unclear how it's then even possible to distinguish error from valid offset, but it's not our problem.
# We just have to ignore return values of lseek.
lseek(fd fd, offset fileoff, whence flags[seek_whence]) (ignore_return)
copy_file_range(fd_in fd, off_in ptr[inout, fileoff[int64], opt], fd_out fd, off_out ptr[inout, fileoff[int64], opt], len intptr, flags flags[copy_file_range_flags])

rwf_flags = RWF_DSYNC, RWF_HIPRI, RWF_SYNC, RWF_NOWAIT, RWF_APPEND
copy_file_range_flags = 0

dup(oldfd fd) fd
dup2(oldfd fd, newfd fd) fd
dup3(oldfd fd, newfd fd, flags flags[dup_flags]) fd

pipe(pipefd ptr[out, pipefd])
pipe2(pipefd ptr[out, pipefd], flags flags[pipe_flags])

tee(fdin fd, fdout fd, len intptr, f flags[splice_flags])
splice(fdin fd, offin ptr[in, fileoff[int64]], fdout fd, offout ptr[in, fileoff[int64]], len intptr, f flags[splice_flags])
vmsplice(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], f flags[splice_flags])
sendfile(fdout fd, fdin fd, off ptr[inout, fileoff[intptr], opt], count intptr)
sendfile64(fdout fd, fdin fd, off ptr[inout, fileoff[int64], opt], count intptr)

cachestat_range {
	off	fileoff[int64]
	len	int64
}

cachestat {
	nr_cache		int64
	nr_dirty		int64
	nr_writeback		int64
	nr_evicted		int64
	nr_recently_evicted	int64
}

stat(file ptr[in, filename], statbuf ptr[out, stat])
lstat(file ptr[in, filename], statbuf ptr[out, stat])
fstat(fd fd, statbuf ptr[out, stat])
newfstatat(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat], flag flags[statx_flags])
stat64(file ptr[in, filename], statbuf ptr[out, stat64])
lstat64(file ptr[in, filename], statbuf ptr[out, stat64])
fstat64(fd fd, statbuf ptr[out, stat64])
fstatat64(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat64], flag flags[statx_flags])
statx(fd fd_dir, file ptr[in, filename], flags flags[statx_flags], mask flags[statx_mask], statxbuf ptr[out, statx])
cachestat(fd fd, cstat_range ptr[in, cachestat_range], cstat ptr[out, cachestat], flags const[0])

poll(fds ptr[in, array[pollfd]], nfds len[fds], timeout int32)
ppoll(fds ptr[in, array[pollfd]], nfds len[fds], tsp ptr[in, timespec], sigmask ptr[in, sigset_t], size len[sigmask])
select(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timeval])
pselect6(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timespec], sig ptr[in, sigset_size])

resource fd_epoll[fd]
epoll_create(size int32) fd_epoll
epoll_create1(flags flags[epoll_flags]) fd_epoll
epoll_ctl$EPOLL_CTL_ADD(epfd fd_epoll, op const[EPOLL_CTL_ADD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_MOD(epfd fd_epoll, op const[EPOLL_CTL_MOD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_DEL(epfd fd_epoll, op const[EPOLL_CTL_DEL], fd fd)
epoll_wait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32)
epoll_pwait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32, sigmask ptr[in, sigset_t], size bytesize[sigmask])
epoll_pwait2(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout ptr[in, timespec], sigmask ptr[in, sigset_t], size bytesize[sigmask])

resource fd_timer[fd]
signalfd(fd fd, mask ptr[in, sigset_t], size len[mask]) fd
signalfd4(fd fd, mask ptr[in, sigset_t], size len[mask], flags flags[signalfd_flags]) fd
timerfd_create(clockid flags[clock_type], flags flags[timerfd_create_flags]) fd_timer
timerfd_settime(fd fd_timer, flags flags[timerfd_settime_flags], new ptr[in, itimerspec], old ptr[out, itimerspec])
timerfd_gettime(fd fd_timer, cur ptr[out, itimerspec])
ioctl$TFD_IOC_SET_TICKS(fd fd_timer, cmd const[TFD_IOC_SET_TICKS], arg ptr[in, int64])

resource fd_event[fd]
eventfd(initval int32) fd_event
eventfd2(initval int32, flags flags[eventfd_flags]) fd_event
read$eventfd(fd fd_event, val ptr[out, int64], len len[val])
write$eventfd(fd fd_event, val ptr[in, int64], len len[val])

brk(brk intptr)
mmap(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd, offset intptr[0:0xffffffff, 0x1000])
munmap(addr vma, len len[addr])
mremap(addr vma, len len[addr], newlen len[newaddr], flags flags[mremap_flags], newaddr vma)
remap_file_pages(addr vma, size len[addr], prot flags[mmap_prot], pgoff intptr, flags flags[mmap_flags])
mprotect(addr vma, len len[addr], prot flags[mmap_prot])
msync(addr vma, len len[addr], f flags[msync_flags])
madvise(addr vma, len len[addr], advice flags[madvise_flags])
process_madvise(pidfd fd_pidfd, vec ptr[in, array[iovec_in]], vlen len[vec], advice flags[madvise_flags], flags const[0])
process_mrelease(pidfd fd_pidfd, flags const[0])
fadvise64(fd fd, offset fileoff, len intptr, advice flags[fadvise_flags])
readahead(fd fd, off intptr, count intptr)
mbind(addr vma, len len[addr], mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr, flags flags[mbind_flags])
move_pages(pid pid, nr len[pages], pages ptr[in, array[vma]], nodes ptr[in, array[int32], opt], status ptr[out, array[int32]], flags flags[move_pages_flags])
migrate_pages(pid pid, maxnode intptr, old ptr[in, int64], new ptr[in, int64])
set_mempolicy(mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr)
get_mempolicy(mode ptr[out, int32], nodemask ptr[out, int64], maxnode intptr, addr vma, flags flags[mempolicy_flags])
set_mempolicy_home_node(addr vma, len len[addr], home_node intptr[0:3], flags const[0])
mincore(addr vma, size len[addr], vec buffer[out])
mlock(addr vma, size len[addr])
mlock2(addr vma, size len[addr], flags flags[mlock_flags])
munlock(addr vma, size len[addr])
mlockall(flags flags[mlockall_flags])
munlockall()
kcmp(pid1 pid, pid2 pid, type flags[kcmp_flags], fd1 fd, fd2 fd)
kcmp$KCMP_EPOLL_TFD(pid1 pid, pid2 pid, type const[KCMP_EPOLL_TFD], fd1 fd, idx2 ptr[in, kcmp_epoll_slot])

resource fd_memfd[fd]
memfd_create(name ptr[in, string], flags flags[memfd_flags]) fd_memfd
memfd_flags = MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB
_ = MFD_HUGE_SHIFT, MFD_HUGE_MASK, MFD_HUGE_64KB, MFD_HUGE_512KB, MFD_HUGE_1MB, MFD_HUGE_2MB, MFD_HUGE_8MB, MFD_HUGE_16MB

memfd_secret(flags flags[memfd_secret_flags]) fd
memfd_secret_flags = O_CLOEXEC

resource pkey[int32]: -1
pkey_alloc(flags const[0], val flags[pkey_flags]) pkey
pkey_free(key pkey)
pkey_mprotect(addr vma, len len[addr], prot flags[mmap_prot], key pkey)
syz_pkey_set(key pkey, val flags[pkey_flags])

pkey_flags = PKEY_DISABLE_ACCESS, PKEY_DISABLE_WRITE

restart_syscall()

# Almighty!
ioctl(fd fd, cmd int32, arg buffer[in])

ioctl$int_in(fd fd, cmd flags[ioctl_int_in], v ptr[in, int64])
ioctl$int_out(fd fd, cmd flags[ioctl_int_out], v ptr[out, intptr])

ioctl$FIOCLEX(fd fd, cmd const[FIOCLEX])
ioctl$FIONCLEX(fd fd, cmd const[FIONCLEX])
ioctl$FITHAW(fd fd, cmd const[FITHAW])

# FIFREEZE is enabled in sandbox mode only because it can easily kill the machine.
ioctl$FIFREEZE(fd fd, cmd const[FIFREEZE]) (snapshot)

fcntl$dupfd(fd fd, cmd flags[fcntl_dupfd], arg fd) fd
fcntl$getflags(fd fd, cmd flags[fcntl_getflags])
fcntl$setflags(fd fd, cmd const[F_SETFD], flags flags[fcntl_flags])
fcntl$setstatus(fd fd, cmd const[F_SETFL], flags flags[fcntl_status])
fcntl$lock(fd fd, cmd flags[fcntl_lock], lock ptr[in, flock])
fcntl$getown(fd fd, cmd const[F_GETOWN]) pid (automatic_helper)
fcntl$setown(fd fd, cmd const[F_SETOWN], pid pid)
fcntl$getownex(fd fd, cmd const[F_GETOWN_EX], arg ptr[out, f_owner_ex])
fcntl$setownex(fd fd, cmd const[F_SETOWN_EX], arg ptr[in, f_owner_ex])
fcntl$setsig(fd fd, cmd const[F_SETSIG], sig signalnoptr)
fcntl$setlease(fd fd, cmd const[F_SETLEASE], typ flags[flock_type])
fcntl$notify(fd fd, cmd const[F_NOTIFY], typ flags[fcntl_notify])
fcntl$setpipe(fd fd, cmd const[F_SETPIPE_SZ], sz intptr)
fcntl$addseals(fd fd, cmd const[F_ADD_SEALS], seals flags[seal_types])
fcntl$F_GET_RW_HINT(fd fd, cmd const[F_GET_RW_HINT], hint ptr[out, int64])
fcntl$F_GET_FILE_RW_HINT(fd fd, cmd const[F_GET_FILE_RW_HINT], hint ptr[out, int64])
fcntl$F_SET_RW_HINT(fd fd, cmd const[F_SET_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])
fcntl$F_SET_FILE_RW_HINT(fd fd, cmd const[F_SET_FILE_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])

# Only some commands break return values.
# When/if we have stricter enforcement of arguments, we may remove some of breaks_returns attributes.
ptrace(req flags[ptrace_req], pid pid) (breaks_returns)
ptrace$peek(req flags[ptrace_req_peek], pid pid, addr ptr[out, intptr]) (breaks_returns)
ptrace$poke(req flags[ptrace_req_poke], pid pid, addr ptr[out, intptr], data intptr) (breaks_returns)
ptrace$peekuser(req const[PTRACE_PEEKUSR], pid pid, addr intptr) (breaks_returns)
ptrace$pokeuser(req const[PTRACE_POKEUSR], pid pid, addr intptr, data intptr) (breaks_returns)
ptrace$getregs(req flags[ptrace_req_getregs], pid pid, ignored intptr, data buffer[out]) (breaks_returns)
ptrace$getregset(req const[PTRACE_GETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_out]) (breaks_returns)
ptrace$setregs(req flags[ptrace_req_setregs], pid pid, ignored intptr, data buffer[in]) (breaks_returns)
ptrace$setregset(req const[PTRACE_SETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_in]) (breaks_returns)
ptrace$getsig(req const[PTRACE_GETSIGINFO], pid pid, ignored intptr, data ptr[out, siginfo]) (breaks_returns)
ptrace$setsig(req const[PTRACE_SETSIGINFO], pid pid, ignored intptr, data ptr[in, siginfo]) (breaks_returns)
ptrace$setopts(req flags[ptrace_req_setopts], pid pid, ignored intptr, flags flags[ptrace_options]) (breaks_returns)
ptrace$getenv(req const[PTRACE_GETEVENTMSG], pid pid, ignored intptr, data ptr[out, intptr]) (breaks_returns)
ptrace$cont(req flags[ptrace_req_cont], pid pid, ignored intptr, data intptr) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_FILTER(req const[PTRACE_SECCOMP_GET_FILTER], pid pid, addr intptr, data ptr[out, array[int8]]) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_METADATA(req const[PTRACE_SECCOMP_GET_METADATA], pid pid, addr len[data], data ptr[in, seccomp_metadata]) (breaks_returns)
ptrace$PTRACE_SETSIGMASK(req const[PTRACE_SETSIGMASK], pid pid, size bytesize[data], data ptr[in, sigset_t]) (breaks_returns)
ptrace$PTRACE_GETSIGMASK(req const[PTRACE_GETSIGMASK], pid pid, size bytesize[data], data ptr[out, sigset_t]) (breaks_returns)
ptrace$ARCH_GET_FS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_FS]) (breaks_returns)
ptrace$ARCH_GET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_GS]) (breaks_returns)
ptrace$ARCH_SET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_SET_GS]) (breaks_returns)
ptrace$ARCH_GET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], code const[ARCH_GET_CPUID]) (breaks_returns)
ptrace$ARCH_SET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg boolptr, code const[ARCH_SET_CPUID]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_X32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_X32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_64(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_64]) (breaks_returns)
ptrace$ARCH_SHSTK_STATUS(req const[PTRACE_ARCH_PRCTL], pid pid, res ptr[out, intptr], cmd const[ARCH_SHSTK_STATUS]) (breaks_returns)
ptrace$ARCH_SHSTK_LOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_LOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_UNLOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_UNLOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_ENABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_ENABLE]) (breaks_returns)
ptrace$ARCH_SHSTK_DISABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_DISABLE]) (breaks_returns)
ptrace$ARCH_GET_UNTAG_MASK(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_UNTAG_MASK]) (breaks_returns)
ptrace$ARCH_GET_MAX_TAG_BITS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_MAX_TAG_BITS]) (breaks_returns)
ptrace$ARCH_ENABLE_TAGGED_ADDR(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr[1:6], cmd const[ARCH_ENABLE_TAGGED_ADDR]) (breaks_returns)
ptrace$ARCH_FORCE_TAGGED_SVA(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], cmd const[ARCH_FORCE_TAGGED_SVA]) (breaks_returns)

map_shadow_stack(addr vma, size bytesize[addr], flags boolptr)

seccomp_metadata {
	filter_off	int64
	flags		const[0, int64]
}

ptrace_peeksiginfo_args {
	off	int64
	flags	flags[ptrace_peeksiginfo_flags, int32]
	nr	len[syscall:data, int32]
}

ptrace$peeksig(req const[PTRACE_PEEKSIGINFO], pid pid, args ptr[in, ptrace_peeksiginfo_args], data ptr[out, array[siginfo]])

capget(hdr ptr[in, cap_header], data ptr[in, cap_data])
capset(hdr ptr[in, cap_header], data ptr[in, cap_data])

resource fd_mq[fd]
mq_open(name ptr[in, string], flags flags[mq_open_flags], mode flags[open_mode], attr ptr[in, mq_attr]) fd_mq
mq_timedsend(mqd fd_mq, msg buffer[in], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_timedreceive(mqd fd_mq, msg buffer[out], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_notify(mqd fd_mq, notif ptr[in, sigevent])
mq_getsetattr(mqd fd_mq, attr ptr[in, mq_attr], oldattr ptr[out, mq_attr, opt])
mq_unlink(name ptr[in, string])

mknod(file ptr[in, filename], mode flags[mknod_mode], dev int32)
mknod$loop(file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$loop(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$null(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev const[0x103])
mknodat(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev int32)
chmod(file ptr[in, filename], mode flags[open_mode])
fchmod(fd fd, mode flags[open_mode])
fchmodat(dirfd fd_dir, file ptr[in, filename], mode flags[open_mode])
chown(file ptr[in, filename], uid uid, gid gid)
lchown(file ptr[in, filename], uid uid, gid gid)
fchown(fd fd, uid uid, gid gid)
fchownat(dirfd fd_dir, file ptr[in, filename], uid uid, gid gid, flags flags[at_flags])
fallocate(fd fd, mode flags[fallocate_mode], off intptr, len intptr)
faccessat(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode])
faccessat2(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode], flags flags[faccessat_flags])
utime(filename ptr[in, filename], times ptr[in, utimbuf])
utimes(filename ptr[in, filename], times ptr[in, itimerval])
futimesat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval])
utimensat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval], flags flags[utimensat_flags])

# Small trick - syzkaller cannot give the proper stack pointer to clone(), but we can do it with the aid of pseudo syscalls.
syz_clone(flags flags[clone_flags], stack buffer[in], stack_len bytesize[stack], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) pid (automatic_helper)

syz_clone3(args ptr[in, clone_args], size bytesize[args]) pid (automatic_helper)

# We need these disabled definitions to simplify the presence and the NR checking.
clone(flags flags[clone_flags], sp buffer[in], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) (breaks_returns, disabled)
clone3(args ptr[in, clone_args], size bytesize[args]) pid (breaks_returns, disabled)

clone_args {
	flags		flags[clone3_flags, int64]
	pidfd		ptr64[out, fd_pidfd]
	child_tid	ptr64[out, pid]
	parent_tid	ptr64[out, pid]
	exit_signal	align64[signalno]
	stack		ptr64[out, array[int8]]
	stack_size	bytesize[stack, int64]
	tls		ptr64[out, array[int8]]
	set_tid		ptr64[in, array[pid]]
	set_tid_size	len[set_tid, int64]
	cgroup		align64[fd_cgroup]
}

resource pid[int32]: 0, -1
resource uid[int32]: 0, -1, 0xee00, 0xee01
resource gid[int32]: 0, -1, 0xee00, 0xee01

getgid() gid (automatic_helper)
getegid() gid (automatic_helper)
setuid(uid uid)
setgid(gid gid)
getuid() uid (automatic_helper)
geteuid() uid (automatic_helper)
setpgid(pid pid, pgid pid)
getpgid(pid pid) pid (automatic_helper)
getpgrp(pid pid) pid (automatic_helper)
getpid() pid (automatic_helper)
gettid() pid (automatic_helper)
setreuid(ruid uid, euid uid)
setregid(rgid gid, egid gid)
setresuid(ruid uid, euid uid, suid uid)
setresgid(rgid gid, egid gid, sgid gid)
getresuid(ruid ptr[out, uid], euid ptr[out, uid], suid ptr[out, uid])
getresgid(rgid ptr[out, gid], egid ptr[out, gid], sgid ptr[out, gid])
setfsuid(fsuid uid)
setfsgid(fsgid gid)
getgroups(size len[list], list ptr[inout, array[gid]])
setgroups(size len[list], list ptr[in, array[gid]])
personality(persona flags[personality_flags])
# Don't mess with parent (fuzzer). If we ptrace attach to it, it will hang.
# If we setrlimit for parent, it will misbehave. Killing - the same. Nothing good.
#getppid() pid
#getsid(pid pid) pid
#setsid() pid

link(old ptr[in, filename], new ptr[in, filename])
linkat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[linkat_flags])
symlinkat(old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
symlink(old ptr[in, filename], new ptr[in, filename])
unlink(path ptr[in, filename])
unlinkat(fd fd_dir, path ptr[in, filename], flags flags[unlinkat_flags])
readlink(path ptr[in, filename], buf buffer[out], siz len[buf])
readlinkat(fd fd_dir, path ptr[in, filename], buf buffer[out], siz len[buf])
rename(old ptr[in, filename], new ptr[in, filename])
renameat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
renameat2(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[renameat2_flags])
mkdir(path ptr[in, filename], mode flags[open_mode])
mkdirat(fd fd_dir[opt], path ptr[in, filename], mode flags[open_mode])
rmdir(path ptr[in, filename])
truncate(file ptr[in, filename], len intptr)
ftruncate(fd fd, len intptr)
flock(fd fd, op flags[flock_op])
fsync(fd fd)
fdatasync(fd fd)
sync()
syncfs(fd fd)
sync_file_range(fd fd, off intptr, nbytes intptr, flags flags[sync_file_flags])
lookup_dcookie(cookie intptr, buf buffer[out], len len[buf])
getdents(fd fd_dir, ent buffer[out], count len[ent])
getdents64(fd fd_dir, ent buffer[out], count len[ent])
name_to_handle_at(fd fd_dir, file ptr[in, filename], handle ptr[in, file_handle], mnt ptr[out, int32], flags flags[name_to_handle_at_flags])
open_by_handle_at(mountdirfd fd, handle ptr[in, file_handle], flags flags[open_flags])
chroot(dir ptr[in, filename])
getcwd(buf buffer[out], size len[buf])
chdir(dir ptr[in, filename])
fchdir(fd fd)
pivot_root(new_root ptr[in, filename], put_old ptr[in, filename])

sysfs$1(option const[1], fsname ptr[in, string])
sysfs$2(option const[2], fsindex intptr, fsname buffer[out])
sysfs$3(option const[3])
statfs(path ptr[in, filename], buf buffer[out])
fstatfs(fd fd, buf buffer[out])

uselib(lib ptr_binfmt_file)
init_module(mod ptr[in, binfmt_elf64], len len[mod], args ptr[in, string])
finit_module(fd fd_binfmt, args ptr[in, string], flags flags[finit_module_flags])
delete_module(name ptr[in, string], flags flags[delete_module_flags])
kexec_load(entry intptr, nr_segments len[segments], segments ptr[in, array[kexec_segment]], flags flags[kexec_load_flags])
syslog(cmd flags[syslog_cmd], buf ptr[out, array[int8], opt], len len[buf])
uname(buf buffer[out])
sysinfo(info buffer[out])
ustat(dev intptr, buf ptr[out, ustat])
acct(filename ptr[in, filename, opt])

getrusage(who flags[rusage_who], usage ptr[out, rusage])
getrlimit(res flags[rlimit_type], rlim ptr[out, rlimit])
setrlimit(res flags[rlimit_type], rlim ptr[in, rlimit])
prlimit64(pid pid, res flags[rlimit_type], new ptr[in, rlimit, opt], old ptr[out, rlimit, opt])

iopl(level int8)
ioperm(from intptr, num intptr, on intptr)
ioprio_get$pid(which flags[ioprio_which_pid], who pid)
ioprio_get$uid(which flags[ioprio_which_uid], who uid)
ioprio_set$pid(which flags[ioprio_which_pid], who pid, ioprio flags[ioprio_priorities])
ioprio_set$uid(which flags[ioprio_which_uid], who uid, ioprio flags[ioprio_priorities])

# NEED: we can express the construction of integers using structs with flags
# and bitfields, which are normally obtained using a combination of bitwise
# operations with the help of macros. However, structs can't be directly passed
# as a syscall argument; therefore, such constructions can't be directly passed either.
# One example is ioprio argument for ioprio_set, where we could have expressed the
# construction less messy. For now, some subset of valid values are enumerated as
# in ioprio_priorities.

# ioprio priority values are obtained using IOPRIO_PRIO_VALUE(class, data) macro.
# the behaviour of the macro is mimicked below and some priority values are enumerated.
ioprio_priorities = IOPRIO_CLASS_NONE_PRIO, IOPRIO_CLASS_IDLE_PRIO, IOPRIO_CLASS_RT_HIGH_PRIO, IOPRIO_CLASS_BE_HIGH_PRIO, IOPRIO_CLASS_RT_MID_PRIO, IOPRIO_CLASS_BE_MID_PRIO, IOPRIO_CLASS_RT_LOW_PRIO, IOPRIO_CLASS_BE_LOW_PRIO

# The classes RT and BE take data values from the range [0:7]. Use a subset of the available
# values (0, 4, 7) to ease collisions, and to avoid redundancy. The classes NONE and IDLE
# have only one valid priority value each with data set to 0.
define IOPRIO_CLASS_NONE_PRIO	(IOPRIO_CLASS_NONE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_IDLE_PRIO	(IOPRIO_CLASS_IDLE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_HIGH_PRIO	(IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_BE_HIGH_PRIO	(IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_MID_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_BE_MID_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_RT_LOW_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 7)
define IOPRIO_CLASS_BE_LOW_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 7)

resource timerid[int32]
timer_create(id flags[clock_id], ev ptr[in, sigevent], timerid ptr[out, timerid])
timer_gettime(timerid timerid, setting ptr[out, itimerspec])
timer_getoverrun(timerid timerid)
timer_settime(timerid timerid, flags flags[timer_flags], new ptr[in, itimerspec], old ptr[out, itimerspec, opt])
timer_delete(timerid timerid)

time(t ptr[out, intptr])
clock_gettime(id flags[clock_id], tp ptr[out, timespec])
clock_settime(id flags[clock_id], tp ptr[in, timespec])
clock_adjtime(id flags[clock_id], tx ptr[in, timex])
clock_getres(id flags[clock_id], tp ptr[out, timespec])
clock_nanosleep(id flags[clock_id], flags flags[timer_flags], rqtp ptr[in, timespec], rmtp ptr[out, timespec, opt])
rt_sigaction(sig signalno, act ptr[in, sigaction], oact ptr[out, sigaction, opt], sigsetsize len[fake], fake ptr[out, sigset_t])
rt_sigprocmask(how flags[sigprocmask_how], nset ptr[in, sigset_t], oset ptr[out, sigset_t, opt], sigsetsize len[nset])
rt_sigreturn()
rt_sigpending(set ptr[out, sigset_t], sigsetsize len[set])
rt_sigtimedwait(these ptr[in, sigset_t], info ptr[out, siginfo, opt], ts ptr[in, timespec], sigsetsize len[these])
rt_sigsuspend(new ptr[in, sigset_t], sigsetsize len[new])
rt_sigqueueinfo(pid pid, sig signalno, info ptr[in, siginfo])
rt_tgsigqueueinfo(gid pid, tid pid, sig signalno, info ptr[in, siginfo])
sigaltstack(ss ptr[in, sigaltstack], oss ptr[out, sigaltstack, opt])
tgkill(gid pid, tid pid, sig signalno)
tkill(tid pid, sig signalno)
pause()
alarm(seconds intptr)
nanosleep(req ptr[in, timespec], rem ptr[out, timespec, opt])
getitimer(which flags[getitimer_which], cur ptr[out, itimerval])
setitimer(which flags[getitimer_which], new ptr[in, itimerval], old ptr[out, itimerval, opt])
exit(code intptr)
exit_group(code intptr)
waitid(which flags[waitid_which], pid pid, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
waitid$P_PIDFD(which const[P_PIDFD], pidfd fd_pidfd, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
wait4(pid pid, status ptr[out, int32, opt], options flags[wait_options], ru ptr[out, rusage, opt])
times(buf ptr[out, tms])
# Can send signals to all processes (pid=-1) so it's enabled only in snapshot mode.
kill(pid pid, sig signalno) (snapshot)

set_thread_area(info ptr[in, user_desc])
get_thread_area(info ptr[in, user_desc])
modify_ldt$read(func const[0], buf buffer[out], len len[buf])
modify_ldt$write(func const[1], buf ptr[in, user_desc], len len[buf])
modify_ldt$read_default(func const[2], buf buffer[out], len len[buf])
modify_ldt$write2(func const[17], buf ptr[in, user_desc], len len[buf])
process_vm_readv(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
process_vm_writev(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
set_tid_address(tidptr ptr[out, int32])
getpriority(which flags[priority_which], who pid)
setpriority(which flags[priority_which], who pid, prio intptr)
sched_getscheduler(pid pid)
sched_setscheduler(pid pid, policy flags[sched_policy], prio ptr[in, int32])
sched_rr_get_interval(pid pid, tp ptr[out, timespec])
sched_getparam(pid pid, prio ptr[out, int32])
sched_setparam(pid pid, prio ptr[in, int32])
sched_getaffinity(pid pid, cpusetsize len[mask], mask ptr[out, int64])
sched_setaffinity(pid pid, cpusetsize len[mask], mask ptr[in, int64])
sched_getattr(pid pid, attr ptr[out, sched_attr], size len[attr], flags const[0])
sched_setattr(pid pid, attr ptr[in, sched_attr], flags const[0])
sched_yield()
getrandom(buf buffer[out], len len[buf], flags flags[getrandom_flags])

reboot(magic1 const[LINUX_REBOOT_MAGIC1], magic2 const[LINUX_REBOOT_MAGIC2], cmd flags[reboot_commands], arg const[0]) (snapshot)

reboot_commands = LINUX_REBOOT_CMD_RESTART, LINUX_REBOOT_CMD_HALT, LINUX_REBOOT_CMD_CAD_ON, LINUX_REBOOT_CMD_CAD_OFF, LINUX_REBOOT_CMD_POWER_OFF, LINUX_REBOOT_CMD_RESTART2, LINUX_REBOOT_CMD_SW_SUSPEND, LINUX_REBOOT_CMD_KEXEC

swapon(specialfile ptr[in, filename], swap_flags flags[swap_flags]) (snapshot)
swapoff(specialfile ptr[in, filename]) (snapshot)

swap_flags = SWAP_FLAG_PRIO_MASK, SWAP_FLAG_PREFER, SWAP_FLAG_DISCARD, SWAP_FLAG_DISCARD_ONCE, SWAP_FLAG_DISCARD_PAGES

sethostname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)
setdomainname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)

gettimeofday(tv ptr[out, timeval], tz ptr[out, timezone])
settimeofday(tv ptr[out, timeval], tz ptr[out, timezone]) (snapshot)
adjtimex(txc_p ptr[in, __kernel_timex]) (snapshot)

timezone {
	tz_minuteswest	int32
	tz_dsttime	int32
}

__kernel_timex {
	modes		flags[adjtimex_modes, int32]
	pad0		const[0, int32]
	offset		int64
	freq		int64
	maxerror	int64
	esterror	int64
	status		int32
	pad1		const[0, int32]
	constant	int64
	precision	int64
	tolerance	int64
	int		timeval
	tick		int64
	ppsfreq		int64
	jitter		int64
	shift		int32
	pad2		const[0, int32]
	stabil		int64
	jitcnt		int64
	calcnt		int64
	errcnt		int64
	stbcnt		int64
	tai		int32
	pad3		array[const[0, int32], 11]
}

adjtimex_modes = ADJ_OFFSET, ADJ_FREQUENCY, ADJ_MAXERROR, ADJ_ESTERROR, ADJ_STATUS, ADJ_TIMECONST, ADJ_TAI, ADJ_SETOFFSET, ADJ_MICRO, ADJ_NANO, ADJ_TICK

membarrier(cmd flags[membarrier_cmd], flags const[0])

membarrier_cmd = MEMBARRIER_CMD_GLOBAL, MEMBARRIER_CMD_GLOBAL_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_QUERY, MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED, MEMBARRIER_CMD_SHARED

rseq(rseq ptr[in, rseq], rseq_len bytesize[rseq], flags boolptr, sig const[0])

rseq {
	cpu_id_start	const[0, int32]
	cpu_id		const[0, int32]
	rseq_cs		ptr64[in, rseq_cs, opt]
	flags		flags[rseq_cs_flags, int32]
} [align[32]]

rseq_cs {
	version			const[0, int32]
	flags			flags[rseq_cs_flags, int32]
	start_ip		int64
	post_commit_offset	int64
	abort_ip		int64
} [align[32]]

rseq_cs_flags = RSEQ_CS_FLAG_NO_RESTART_ON_PREEMPT, RSEQ_CS_FLAG_NO_RESTART_ON_SIGNAL, RSEQ_CS_FLAG_NO_RESTART_ON_MIGRATE

# start/end are unused for now, no definition of SYS_RISCV_FLUSH_ICACHE_LOCAL in uapi headers.
riscv_flush_icache(start const[0], end const[0], flags bool32)

syz_open_procfs(pid pid, file ptr[in, string[procfs_proc_file]]) fd

# TODO: some of net files are only available in the init namespace (e.g. bluetooth bnep and hci).
# We could find some way to open these files in the init namespace
# esp. taking into account that we create bluetooth sockets in init namespace.
procfs_proc_file = "auxv", "cmdline", "environ", "autogroup", "cgroup", "clear_refs", "comm", "coredump_filter", "cpuset", "gid_map", "io", "limits", "loginuid", "maps", "mountinfo", "mounts", "mountstats", "numa_maps", "oom_adj", "oom_score", "oom_score_adj", "pagemap", "personality", "projid_map", "sched", "schedstat", "sessionid", "setgroups", "smaps", "smaps_rollup", "totmaps", "stack", "stat", "statm", "status", "syscall", "timers", "uid_map", "wchan", "map_files", "attr", "attr/current", "attr/exec", "attr/fscreate", "attr/keycreate", "attr/prev", "attr/sockcreate", "ns", "children", "task", "fd", "fd/3", "fd/4", "fdinfo", "fdinfo/3", "fdinfo/4", "net", "net/anycast6", "net/arp", "net/bnep", "net/connector", "net/dev", "net/dev_mcast", "net/dev_snmp6", "net/fib_trie", "net/fib_triestat", "net/hci", "net/icmp", "net/icmp6", "net/if_inet6", "net/igmp", "net/igmp6", "net/ip6_flowlabel", "net/ip6_mr_cache", "net/ip6_mr_vif", "net/ip6_tables_matches", "net/ip6_tables_names", "net/ip6_tables_targets", "net/ip_mr_cache", "net/ip_mr_vif", "net/ip_tables_matches", "net/ip_tables_names", "net/ip_tables_targets", "net/ipv6_route", "net/l2cap", "net/llc/core", "net/llc/socket", "net/mcfilter", "net/mcfilter6", "net/netfilter", "net/netlink", "net/netstat", "net/nfsfs", "net/packet", "net/protocols", "net/psched", "net/ptype", "net/raw", "net/raw6", "net/rfcomm", "net/route", "net/rpc", "net/rt6_stats", "net/rt_acct", "net/rt_cache", "net/sco", "net/sctp", "net/snmp", "net/snmp6", "net/sockstat", "net/sockstat6", "net/softnet_stat", "net/stat", "net/tcp", "net/tcp6", "net/udp", "net/udp6", "net/udplite", "net/udplite6", "net/unix", "net/wireless", "net/xfrm_stat", "net/ip_vs", "net/ip_vs_stats", "net/ip_vs_stats_percpu", "net/nf_conntrack", "net/nf_conntrack_expect", "net/vlan/config", "net/vlan/vlan0", "net/vlan/vlan1", "net/kcm", "net/psched", "timerslack_ns"

openat$procfs(fd const[AT_FDCWD], file ptr[in, string[procfs_file]], flags const[O_RDONLY], mode const[0]) fd

procfs_file = "/proc/keys", "/proc/key-users", "/proc/crypto", "/proc/consoles", "/proc/cgroups", "/proc/zoneinfo", "/proc/vmstat", "/proc/vmallocinfo", "/proc/tty/drivers", "/proc/tty/ldiscs", "/proc/timer_list", "/proc/sysvipc/sem", "/proc/sysvipc/msg", "/proc/sysvipc/shm", "/proc/stat", "/proc/slabinfo", "/proc/schedstat", "/proc/partitions", "/proc/meminfo", "/proc/mdstat", "/proc/locks", "/proc/diskstats", "/proc/cpuinfo", "/proc/consoles", "/proc/bus/input/devices", "/proc/bus/input/handlers", "/proc/asound/seq/clients", "/proc/asound/seq/clients", "/proc/asound/seq/timer", "/proc/asound/timers"

resource fd_yama_ptrace_scope[fd]

# 0 - YAMA_SCOPE_DISABLED
# 1 - YAMA_SCOPE_RELATIONAL
# 2 - YAMA_SCOPE_CAPABILITY
# 3 - YAMA_SCOPE_NO_ATTACH
yama_modes = "0", "1", "2", "3"

openat$yama_ptrace_scope(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/kernel/yama/ptrace_scope"]], flags const[O_RDWR], mode const[0]) fd_yama_ptrace_scope
write$yama_ptrace_scope(fd fd_yama_ptrace_scope, data ptr[in, string[yama_modes]], count len[data])

# Write into some interesting sysct's and sysfs/procfs files.
resource fd_sysctl[fd]

openat$sysctl(fd const[AT_FDCWD], file ptr[in, string[sysctl_file]], flags const[O_WRONLY], mode const[0]) fd_sysctl
write$sysctl(fd fd_sysctl, val ptr[in, string[sysctl_value]], len len[val])

sysctl_file = "/sys/kernel/mm/ksm/run", "/proc/sys/vm/compact_memory", "/proc/sys/vm/drop_caches", "/proc/sys/net/ipv4/tcp_timestamps", "/proc/sys/net/ipv4/tcp_sack", "/proc/sys/net/ipv4/tcp_dsack", "/proc/sys/net/ipv4/tcp_window_scaling", "/proc/sys/net/ipv4/tcp_syncookies", "/proc/sys/net/ipv4/tcp_recovery", "/proc/sys/net/ipv4/tcp_mtu_probing", "/proc/sys/net/ipv4/tcp_rfc1337", "/proc/self/clear_refs"
# Most of these values are suitable for all sysctl_file files.
sysctl_value = "0", "1", "2", "3", "4", "5", "6", "7"

# Write to this file triggers khugepaged scan.
# We don't want to write small values as we only want the explicitly triggered scan.
resource fd_khugepaged_scan[fd]

openat$khugepaged_scan(fd const[AT_FDCWD], file ptr[in, string["/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs"]], flags const[O_WRONLY], mode const[0]) fd_khugepaged_scan
write$khugepaged_scan(fd fd_khugepaged_scan, val ptr[in, string["1000000"]], len len[val])

resource fd_tcp_congestion[fd]

openat$tcp_congestion(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/net/ipv4/tcp_congestion_control"]], flags const[O_WRONLY], mode const[0]) fd_tcp_congestion
write$tcp_congestion(fd fd_tcp_congestion, val ptr[in, string[tcp_congestion]], len len[val])

tcp_congestion = "reno", "bbr", "bic", "cdg", "cubic", "dctcp", "westwood", "highspeed", "hybla", "htcp", "vegas", "nv", "veno", "scalable", "lp", "yeah", "illinois"

resource fd_tcp_mem[fd]

openat$tcp_mem(fd const[AT_FDCWD], file ptr[in, string[tcp_mem_files]], flags const[O_WRONLY], mode const[0]) fd_tcp_mem
write$tcp_mem(fd fd_tcp_mem, val ptr[in, tcp_mem_values], len len[val])

tcp_mem_files = "/proc/sys/net/ipv4/tcp_rmem", "/proc/sys/net/ipv4/tcp_wmem"

tcp_mem_values {
	v0	fmt[oct, int64]
	sp0	const[' ', int8]
	v1	fmt[oct, int64]
	sp1	const[' ', int8]
	v2	fmt[oct, int64]
	z	const[0, int8]
} [packed]

# /proc/self/reclaim is ChromeOS-specific:
# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/4c3ad28b9c913%5E%21/
resource fd_proc_reclaim[fd]

openat$proc_reclaim(fd const[AT_FDCWD], file ptr[in, string["/proc/self/reclaim"]], flags const[O_WRONLY], mode const[0]) fd_proc_reclaim
write$proc_reclaim(fd fd_proc_reclaim, val ptr[in, string[proc_reclaim_vals]], len len[val])

proc_reclaim_vals = "file", "anon", "all"

resource fd_pidfd[fd]

openat$pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/self"]], flags flags[open_flags], mode const[0]) fd_pidfd
openat$thread_pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/thread-self"]], flags flags[open_flags], mode const[0]) fd_pidfd
pidfd_send_signal(fd fd_pidfd, sig signalno, info ptr[in, siginfo], flags const[0])

# pidfd_open is dangerous, so we use syz_pidfd_open instead.
pidfd_open(pid pid, flags const[0]) fd_pidfd (disabled)
syz_pidfd_open(pid pid, flags const[0]) fd_pidfd
pidfd_getfd(pidfd fd_pidfd, fd fd, flags const[0]) fd

close_range(fd fd, max_fd fd, flags flags[close_range_flags])

# Uncomment on your own account.
#syz_open_dev$char(dev const[0xc], major intptr, minor intptr) fd
#syz_open_dev$block(dev const[0xb], major intptr, minor intptr) fd

# /dev/console known to cause problems on at least two different kernels.
# It can turn off all output or produce massive amounts of garbage on console.
# Disable it for now.
#syz_open_dev$console(dev ptr[in, string["/dev/console"]], id const[0], flags flags[open_flags]) fd

resource fd_autofs[fd]

# These devices are relatively safe (don't reboot and don't corrupt kernel memory).
# They need a more comprehensive support. But let at least open them for now,
# maybe fuzzer will be able to skrew them in a useful way.
# TODO: all these devices returning just fd need proper interface descriptions.
openat$vcs(fd const[AT_FDCWD], file ptr[in, string["/dev/vcs"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsn(dev ptr[in, string["/dev/vcs#"]], id intptr, flags flags[open_flags]) fd
openat$vcsa(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsa"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsa(dev ptr[in, string["/dev/vcsa#"]], id intptr, flags flags[open_flags]) fd
openat$vcsu(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsu"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsu(dev ptr[in, string["/dev/vcsu#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$ircomm(dev ptr[in, string["/dev/ircomm#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$audion(dev ptr[in, string["/dev/audio#"]], id intptr, flags flags[open_flags]) fd

openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd
openat$full(fd const[AT_FDCWD], file ptr[in, string["/dev/full"]], flags flags[open_flags], mode const[0]) fd
openat$irnet(fd const[AT_FDCWD], file ptr[in, string["/dev/irnet"]], flags flags[open_flags], mode const[0]) fd
openat$hwrng(fd const[AT_FDCWD], file ptr[in, string["/dev/hwrng"]], flags flags[open_flags], mode const[0]) fd
openat$hpet(fd const[AT_FDCWD], file ptr[in, string["/dev/hpet"]], flags flags[open_flags], mode const[0]) fd
openat$autofs(fd const[AT_FDCWD], file ptr[in, string["/dev/autofs"]], flags flags[open_flags], mode const[0]) fd_autofs
openat$keychord(fd const[AT_FDCWD], file ptr[in, string["/dev/keychord"]], flags flags[open_flags], mode const[0]) fd
openat$zygote(fd const[AT_FDCWD], file ptr[in, string["/dev/socket/zygote"]], flags flags[open_flags], mode const[0]) fd
openat$pktcdvd(fd const[AT_FDCWD], file ptr[in, string["/dev/pktcdvd/control"]], flags flags[open_flags], mode const[0]) fd
openat$lightnvm(fd const[AT_FDCWD], file ptr[in, string["/dev/lightnvm/control"]], flags flags[open_flags], mode const[0]) fd
openat$xenevtchn(fd const[AT_FDCWD], file ptr[in, string["/dev/xen/evtchn"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_control(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-control"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_monitor(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-monitor"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_plock(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm_plock"]], flags flags[open_flags], mode const[0]) fd
openat$btrfs_control(fd const[AT_FDCWD], file ptr[in, string["/dev/btrfs-control"]], flags flags[open_flags], mode const[0]) fd
openat$ubi_ctrl(fd const[AT_FDCWD], file ptr[in, string["/dev/ubi_ctrl"]], flags flags[open_flags], mode const[0]) fd
openat$cachefiles(fd const[AT_FDCWD], file ptr[in, string["/dev/cachefiles"]], flags flags[open_flags], mode const[0]) fd
openat$ndctl0(fd const[AT_FDCWD], file ptr[in, string["/dev/ndctl0"]], flags flags[open_flags], mode const[0]) fd
openat$nmem0(fd const[AT_FDCWD], file ptr[in, string["/dev/nmem0"]], flags flags[open_flags], mode const[0]) fd
openat$nvram(fd const[AT_FDCWD], file ptr[in, string["/dev/nvram"]], flags flags[open_flags], mode const[0]) fd
openat$ocfs2_control(fd const[AT_FDCWD], file ptr[in, string["/dev/ocfs2_control"]], flags flags[open_flags], mode const[0]) fd
openat$nvme_fabrics(fd const[AT_FDCWD], file ptr[in, string["/dev/nvme-fabrics"]], flags flags[open_flags], mode const[0]) fd

pipefd {
	rfd	fd
	wfd	fd
}

type iovec[DIR, T] {
	addr	ptr[DIR, T]
	len	len[addr, intptr]
}
type iovec_in iovec[in, array[int8]]
type iovec_out iovec[out, array[int8]]
type iovec_inout iovec[inout, array[int8]]

stat {
	st_dev		intptr
	st_ino		intptr
	st_mode		int32
	st_nlink	int32
	st_uid		uid
	st_gid		gid
	st_rdev		intptr
	__pad1		const[0, intptr]
	st_size		intptr
	st_blksize	int32
	__pad2		const[0, int32]
	st_blocks	intptr
	st_atime	intptr
	st_atime_nsec	intptr
	st_mtime	intptr
	st_mtime_nsec	intptr
	st_ctime	intptr
	st_ctime_nsec	intptr
	__unused4	const[0, int32]
	__unused5	const[0, int32]
}

statx {
	mask		int32
	blksize		int32
	attributes	int64
	nlink		int32
	uid		uid
	gid		gid
	mode		int16
	__spare0	int16
	ino		int64
	size		int64
	blocks		int64
	__spare1	int64
	atime		statx_timestamp
	btime		statx_timestamp
	ctime		statx_timestamp
	mtime		statx_timestamp
	rdev_major	int32
	rdev_minor	int32
	dev_major	int32
	dev_minor	int32
	__spare2	array[int64, 14]
}

define STAT64_SIZE	sizeof(struct stat64)

type stat64 array[int8, STAT64_SIZE]

pollfd {
	fd	fd
	events	flags[pollfd_events, int16]
	revents	const[0, int16]
}

sigset_t {
	mask	array[intptr, _NSIG_WORDS]
}

sigset_size {
	ss	ptr[inout, sigset_t]
	len	len[ss, intptr]
}

resource time_sec[intptr]
resource time_nsec[intptr]
resource time_usec[intptr]

# prog knowns about this struct type
timespec {
	sec	time_sec
	nsec	time_nsec
}

# prog knowns about this struct type
timeval {
	sec	time_sec
	usec	time_usec
}

statx_timestamp {
	sec		int64
	nsec		int32
	__reserved	int32
}

itimerspec {
	interv	timespec
	value	timespec
}

itimerval {
	interv	timeval
	value	timeval
}

utimbuf {
	actime	intptr
	modtime	intptr
}

sigevent {
	val	const[0, intptr]
	signo	signalno
	notify	flags[sigev_notify, int32]
	u	sigevent_u
} [size[SIGEVENT_SIZE]]

sigevent_u [
	tid	pid
	thr	sigevent_thread
]

define SIGEVENT_SIZE	sizeof(struct sigevent)

sigevent_thread {
# NEED: this is function pointer and pthread_attr_t (?)
	func	buffer[in]
	attr	buffer[in]
}

cap_header {
	var	flags[cap_version, int32]
	pid	pid
}

cap_data {
	eff0	int32
	perm0	int32
	inher0	int32
	eff1	int32
	perm1	int32
	inher1	int32
}

epoll_event {
	ev	flags[epoll_ev, int32]
	data	const[0, int64]
# TODO: this packed only on amd64
} [packed]

# TODO: fd_set needs to be a separate type
fd_set {
	mask0	int64
	mask1	int64
	mask2	int64
	mask3	int64
	mask4	int64
	mask5	int64
	mask6	int64
	mask7	int64
}

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}

sock_filter {
	code	int16
	jt	int8
	jf	int8
	k	int32
}

file_handle [
	raw				file_handle_raw
	shmem				file_handle_t[1, fid_shmem]
	fuse				file_handle_t[0x81, fid_fuse]
	fuse_with_parent		file_handle_t[0x82, fid_fuse_with_parent]
	nfs				file_handle_t[36, fid_nfs]
	FILEID_INO32_GEN		file_handle_t[FILEID_INO32_GEN, fid_FILEID_INO32_GEN]
	FILEID_INO32_GEN_PARENT		file_handle_t[FILEID_INO32_GEN_PARENT, fid_FILEID_INO32_GEN_PARENT]
	FILEID_UDF_WITHOUT_PARENT	file_handle_t[FILEID_UDF_WITHOUT_PARENT, fid_FILEID_UDF_WITHOUT_PARENT]
	FILEID_UDF_WITH_PARENT		file_handle_t[FILEID_UDF_WITH_PARENT, fid_FILEID_UDF_WITH_PARENT]
	FILEID_BTRFS_WITH_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITH_PARENT_ROOT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITHOUT_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	ceph_nfs_snapfh			file_handle_t[FILEID_BTRFS_WITH_PARENT, ceph_nfs_snapfh]
	ceph_nfs_fh			file_handle_t[FILEID_INO32_GEN, ceph_nfs_fh]
	ceph_nfs_confh			file_handle_t[FILEID_INO32_GEN_PARENT, ceph_nfs_confh]
	GFS2_SMALL_FH_SIZE		file_handle_t[GFS2_SMALL_FH_SIZE, fid_GFS2_SMALL_FH_SIZE]
	GFS2_LARGE_FH_SIZE		file_handle_t[GFS2_LARGE_FH_SIZE, fid_GFS2_LARGE_FH_SIZE]
	OVL_FILEID_V0			file_handle_t[OVL_FILEID_V0, ovl_fb]
	OVL_FILEID_V1			file_handle_t[OVL_FILEID_V1, ovl_fh]
	FILEID_NILFS_WITHOUT_PARENT	file_handle_t[FILEID_NILFS_WITHOUT_PARENT, nilfs_fid]
	FILEID_NILFS_WITH_PARENT	file_handle_t[FILEID_NILFS_WITH_PARENT, nilfs_fid]
	reiserfs_2			file_handle_t[2, fid_reiserfs_2]
	reiserfs_3			file_handle_t[3, fid_reiserfs_3]
	reiserfs_4			file_handle_t[4, fid_reiserfs_4]
	reiserfs_5			file_handle_t[5, fid_reiserfs_5]
	reiserfs_6			file_handle_t[6, fid_reiserfs_6]
	xfs				file_handle_t[0x81, xfs_fid64]
	xfs_parent			file_handle_t[0x82, xfs_fid64]
	orangefs			file_handle_t[1, fid_orangefs]
	orangefs_parent			file_handle_t[2, fid_orangefs_parent]
	isofs				file_handle_t[1, isofs_fid]
	isofs_parent			file_handle_t[2, isofs_fid]
	ocfs2				file_handle_t[1, fid_ocfs2]
	ocfs2_parent			file_handle_t[2, fid_ocfs2_parent]
] [varlen]

file_handle_raw {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	flags[fid_type, int32]
	f_handle	align32[array[int8]]
}

type file_handle_t[TYPE, FID] {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	const[TYPE, int32]
	f_handle	FID
}

fid_shmem {
	gen	int32
	ino	int64
} [packed]

fid_fuse {
	nodeid_hi	int32
	nodeid_lo	int32
	generation	int32
}

fid_fuse_with_parent {
	base		fid_fuse
	parent_fid	fid_fuse
} [packed]

fid_FILEID_INO32_GEN {
	ino	int32
	gen	int32
}

fid_FILEID_INO32_GEN_PARENT {
	base		fid_FILEID_INO32_GEN
	parent_ino	int32
	parent_gen	int32
}

fid_FILEID_UDF_WITHOUT_PARENT {
	block		int32
	partref		int16
	parent_partref	int16
	generation	int32
}

fid_FILEID_UDF_WITH_PARENT {
	base			fid_FILEID_UDF_WITHOUT_PARENT
	parent_block		int32
	parent_generation	int32
}

btrfs_fid {
	objectid		int64
	root_objectid		int64
	gen			int32
	parent_objectid		int64
	parent_gen		int32
	parent_root_objectid	int64
} [packed]

ceph_nfs_snapfh {
	ino		int64
	snapid		int64
	parent_ino	int64
	hash		int32
} [packed]

ceph_nfs_fh {
	ino	int64
}

ceph_nfs_confh {
	ino		int64
	parent_ino	int64
}

fid_GFS2_SMALL_FH_SIZE {
	no_formal_ino_hi	int32be
	no_formal_ino_lo	int32be
	no_addr_hi		int32be
	no_addr_lo		int32be
}

fid_GFS2_LARGE_FH_SIZE {
	base		fid_GFS2_SMALL_FH_SIZE
	parent_fid	fid_GFS2_SMALL_FH_SIZE
}

define GFS2_SMALL_FH_SIZE	4
define GFS2_LARGE_FH_SIZE	8

fid_nfs {
	fileid_hi	int32
	fileid_lo	int32
	type		int32
# The total size is encoded in file_handle.handle_type, so we make this const size.
	size		const[NFS_MAXFHSIZE, int16]
	data		array[int8, NFS_MAXFHSIZE]
} [align[4]]

fid_reiserfs_2 {
	objectid	int32
	dir_id		int32
}

fid_reiserfs_3 {
	objectid	int32
	dir_id		int32
	generation	int32
}

fid_reiserfs_4 {
	objectid	int32
	dir_id		int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_5 {
	objectid	int32
	dir_id		int32
	generation	int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_6 {
	objectid		int32
	dir_id			int32
	generation		int32
	parent_objectid		int32
	parent_dir_id		int32
	parent_generation	int32
}

xfs_fid64 {
	ino		int64
	gen		int32
	parent_ino	int64
	parent_gen	int32
} [align[4]]

fid_orangefs {
	khandle	array[int8, 16]
	fs_id	int32
}

fid_orangefs_parent {
	base		fid_orangefs
	parent_fid	fid_orangefs
}

nilfs_fid {
	cno		int64
	ino		int64
	gen		int32
	parent_gen	int32
	parent_ino	int64
} [packed]

isofs_fid {
	block			int32
	offset			int16
	parent_offset		int16
	generation		int32
	parent_block		int32
	parent_generation	int32
}

fid_ocfs2 {
	blkno_hi	int32
	blkno_lo	int32
	generation	int32
}

fid_ocfs2_parent {
	base		fid_ocfs2
	parent_fid	fid_ocfs2
}

fid_type = FILEID_ROOT, FILEID_INO32_GEN, FILEID_INO32_GEN_PARENT, FILEID_BTRFS_WITHOUT_PARENT, FILEID_BTRFS_WITH_PARENT, FILEID_BTRFS_WITH_PARENT_ROOT, FILEID_UDF_WITHOUT_PARENT, FILEID_UDF_WITH_PARENT, FILEID_NILFS_WITHOUT_PARENT, FILEID_NILFS_WITH_PARENT, FILEID_FAT_WITHOUT_PARENT, FILEID_FAT_WITH_PARENT, FILEID_LUSTRE, FILEID_KERNFS

mq_attr {
	mq_flags	intptr
	mq_maxmsg	intptr
	mq_msgsize	intptr
	mq_curmsgs	intptr
	__reserved	array[const[0, intptr], 4]
}

kexec_segment {
	buf	buffer[in]
	sz	len[buf, intptr]
# TODO: this is address in kernel
	mem	intptr
	memsz	intptr
}

rusage {
	utime	timeval
	stime	timeval
	maxrss	intptr
	ixrss	intptr
	idrss	intptr
	isrss	intptr
	minflt	intptr
	majflt	intptr
	nswap	intptr
	inblock	intptr
	oublock	intptr
	msgsnd	intptr
	msgrcv	intptr
	signals	intptr
	nvcsw	intptr
	nivcsw	intptr
}

rlimit {
	soft	intptr
	hard	intptr
}

sigaction {
	sa_handler	ptr[in, text[target]]
	sa_flags	flags[sigaction_flags, intptr]
	sa_restorer	ptr[in, text[target]]
	sa_mask		sigset_t
}

sigaltstack {
	ss_sp		ptr[out, array[int8]]
	ss_flags	flags[sigaltstack_flags, int32]
	ss_size		bytesize[ss_sp, intptr]
}

sigaltstack_flags = SS_ONSTACK, SS_DISABLE, SS_AUTODISARM

tms {
	utime	intptr
	stime	intptr
	cutime	intptr
	cstime	intptr
}

siginfo {
	signo	signalno
	errno	int32
	code	int32
} [size[SIGINFO_SIZE]]

define SIGINFO_SIZE	sizeof(struct siginfo)

timex {
	stuff0	intptr
	stuff1	intptr
	stuff2	intptr
	stuff3	intptr
	stuff4	intptr
	stuff5	intptr
	stuff6	intptr
	stuff7	intptr
	stuff8	intptr
	stuff9	intptr
	stuff10	intptr
	stuff11	intptr
	stuff12	intptr
	stuff13	intptr
	stuff14	intptr
	stuff15	intptr
	stuff16	intptr
	stuff17	intptr
	stuff18	intptr
	stuff19	intptr
	stuff20	intptr
	stuff21	intptr
	stuff22	intptr
	stuff23	intptr
	stuff24	intptr
	stuff25	intptr
}

ustat {
	f_tfree		int32
	f_tinode	intptr
	f_fname		array[int8, 6]
	f_fpack		array[int8, 6]
}

user_desc {
	entry_number	int32
# Base should be vma and limit should be len[base]
# But these fields are int32, so we can't use vma.
	base_addr	flags[user_desc_bases, int32]
	limit		flags[user_desc_limits, int32]
	seg_32bit	int32:1
	contents	int32:2
	read_exec_only	int32:1
	limit_in_pages	int32:1
	seg_not_present	int32:1
	useable		int32:1
	lm		int32:1
}

user_desc_bases = 0, 4096, 1048576, 536870912, 536872960, 536875008, -1
user_desc_limits = 0, 1024, 4096, 8192, 16384, -1

sched_attr {
	size		bytesize[parent, int32]
	sched_policy	flags[sched_policy, int32]
	sched_flags	flags[sched_attr_flags, int64]
	sched_nice	int32
	sched_priority	int32
	sched_runtime	int64
	sched_deadline	int64
	sched_period	int64
	sched_util_min	int32
	sched_util_max	int32
}

sched_policy = SCHED_NORMAL, SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_IDLE, SCHED_DEADLINE
sched_attr_flags = SCHED_FLAG_RESET_ON_FORK, SCHED_FLAG_RECLAIM, SCHED_FLAG_DL_OVERRUN, SCHED_FLAG_KEEP_POLICY, SCHED_FLAG_KEEP_PARAMS, SCHED_FLAG_UTIL_CLAMP_MIN, SCHED_FLAG_UTIL_CLAMP_MAX, SCHED_FLAG_SUGOV

flock {
	type	flags[flock_type, int16]
	whence	flags[seek_whence, int16]
	start	intptr
	len	intptr
	pid	pid
}

f_owner_ex {
	type	flags[f_owner_type, int32]
	pid	pid
}

ucred {
	pid	pid
	uid	uid
	gid	gid
}

kcmp_epoll_slot {
	efd	fd_epoll
	tfd	fd
	toff	int32
}

open_how {
	flags	flags[open_flags, int64]
	mode	flags[open_mode, int64]
	resolve	flags[resolve_flags, int64]
}

# Not providing O_WRONLY means O_RDONLY.
open_flags = O_WRONLY, O_RDWR, O_APPEND, FASYNC, O_CLOEXEC, O_CREAT, O_DIRECT, O_DIRECTORY, O_EXCL, O_LARGEFILE, O_NOATIME, O_NOCTTY, O_NOFOLLOW, O_NONBLOCK, O_PATH, O_SYNC, O_TRUNC, __O_TMPFILE
open_mode = S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IWGRP, S_IXGRP, S_IROTH, S_IWOTH, S_IXOTH
resolve_flags = RESOLVE_CACHED, RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV
madvise_flags = MADV_NORMAL, MADV_RANDOM, MADV_SEQUENTIAL, MADV_WILLNEED, MADV_DONTNEED, MADV_REMOVE, MADV_DONTFORK, MADV_DOFORK, MADV_HWPOISON, MADV_SOFT_OFFLINE, MADV_MERGEABLE, MADV_UNMERGEABLE, MADV_HUGEPAGE, MADV_NOHUGEPAGE, MADV_DONTDUMP, MADV_DODUMP, MADV_WIPEONFORK, MADV_KEEPONFORK, MADV_COLD, MADV_PAGEOUT, MADV_POPULATE_READ, MADV_POPULATE_WRITE, MADV_COLLAPSE
fadvise_flags = POSIX_FADV_NORMAL, POSIX_FADV_SEQUENTIAL, POSIX_FADV_RANDOM, POSIX_FADV_NOREUSE, POSIX_FADV_WILLNEED, POSIX_FADV_DONTNEED
move_pages_flags = MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
msync_flags = MS_ASYNC, MS_SYNC, MS_INVALIDATE
mmap_prot = PROT_EXEC, PROT_READ, PROT_WRITE, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP
mmap_flags = MAP_SHARED, MAP_PRIVATE, MAP_32BIT, MAP_ANONYMOUS, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_FILE, MAP_FIXED, MAP_GROWSDOWN, MAP_HUGETLB, MAP_LOCKED, MAP_NONBLOCK, MAP_NORESERVE, MAP_POPULATE, MAP_STACK, MAP_UNINITIALIZED, MAP_SHARED_VALIDATE, MAP_SYNC, MAP_FIXED_NOREPLACE
mremap_flags = MREMAP_MAYMOVE, MREMAP_FIXED, MREMAP_DONTUNMAP
mbind_mode = MPOL_DEFAULT, MPOL_BIND, MPOL_INTERLEAVE, MPOL_PREFERRED, MPOL_F_STATIC_NODES, MPOL_F_RELATIVE_NODES
mbind_flags = MPOL_MF_STRICT, MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
pipe_flags = O_NONBLOCK, O_CLOEXEC, O_DIRECT, O_NOTIFICATION_PIPE
mlock_flags = MLOCK_ONFAULT
mlockall_flags = MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT
dup_flags = O_CLOEXEC
splice_flags = SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT
seek_whence = SEEK_SET, SEEK_CUR, SEEK_END, SEEK_DATA, SEEK_HOLE
signalfd_flags = SFD_NONBLOCK, SFD_CLOEXEC
eventfd_flags = EFD_CLOEXEC, EFD_NONBLOCK, EFD_SEMAPHORE
timerfd_create_flags = TFD_NONBLOCK, TFD_CLOEXEC
timerfd_settime_flags = TFD_TIMER_ABSTIME, TFD_TIMER_CANCEL_ON_SET
clock_type = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID, CLOCK_REALTIME_ALARM, CLOCK_BOOTTIME_ALARM
sigev_notify = SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD, SIGEV_THREAD_ID
cap_version = _LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_VERSION_3
epoll_flags = EPOLL_CLOEXEC
epoll_ev = POLLIN, POLLOUT, POLLRDHUP, POLLPRI, POLLERR, POLLHUP, EPOLLET, EPOLLONESHOT, EPOLLEXCLUSIVE, EPOLLWAKEUP
pollfd_events = POLLIN, POLLPRI, POLLOUT, POLLERR, POLLHUP, POLLNVAL, POLLRDNORM, POLLRDBAND, POLLWRNORM, POLLWRBAND, POLLMSG, POLLREMOVE, POLLRDHUP, POLLFREE, POLL_BUSY_LOOP
mknod_mode = S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_ISUID, S_ISGID, S_ISVTX, open_mode
at_flags = AT_EMPTY_PATH, AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH
fallocate_mode = FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, FALLOC_FL_COLLAPSE_RANGE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_INSERT_RANGE, FALLOC_FL_UNSHARE_RANGE, FALLOC_FL_NO_HIDE_STALE
linkat_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW
unlinkat_flags = AT_REMOVEDIR
renameat2_flags = RENAME_EXCHANGE, RENAME_NOREPLACE, RENAME_WHITEOUT
flock_op = LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB
statx_flags = AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH, AT_STATX_SYNC_TYPE, AT_STATX_SYNC_AS_STAT, AT_STATX_FORCE_SYNC, AT_STATX_DONT_SYNC
statx_mask = STATX_TYPE, STATX_MODE, STATX_NLINK, STATX_UID, STATX_GID, STATX_ATIME, STATX_MTIME, STATX_CTIME, STATX_INO, STATX_SIZE, STATX_BLOCKS, STATX_BASIC_STATS, STATX_BTIME
name_to_handle_at_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW, AT_HANDLE_FID
mq_open_flags = O_WRONLY, O_RDWR, O_NONBLOCK, O_CREAT, O_EXCL, O_CREAT
finit_module_flags = MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC
delete_module_flags = O_NONBLOCK, O_TRUNC
kexec_load_flags = KEXEC_ON_CRASH, KEXEC_PRESERVE_CONTEXT, KEXEC_ARCH_386, KEXEC_ARCH_X86_64, KEXEC_ARCH_PPC, KEXEC_ARCH_PPC64, KEXEC_ARCH_IA_64, KEXEC_ARCH_ARM, KEXEC_ARCH_S390, KEXEC_ARCH_SH, KEXEC_ARCH_MIPS, KEXEC_ARCH_MIPS_LE, KEXEC_ARCH_DEFAULT
faccessat_flags = AT_EACCESS, AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH
sync_file_flags = SYNC_FILE_RANGE_WAIT_BEFORE, SYNC_FILE_RANGE_WRITE, SYNC_FILE_RANGE_WAIT_AFTER
kcmp_flags = KCMP_FILE, KCMP_FILES, KCMP_FS, KCMP_IO, KCMP_SIGHAND, KCMP_SYSVSEM, KCMP_VM
rusage_who = RUSAGE_SELF, RUSAGE_CHILDREN, RUSAGE_THREAD
rlimit_type = RLIMIT_AS, RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_LOCKS, RLIMIT_MEMLOCK, RLIMIT_MSGQUEUE, RLIMIT_NICE, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_RTPRIO, RLIMIT_RTTIME, RLIMIT_SIGPENDING, RLIMIT_STACK
# The ones that disable console output are intentionally omitted.
syslog_cmd = SYSLOG_ACTION_CLOSE, SYSLOG_ACTION_OPEN, SYSLOG_ACTION_READ, SYSLOG_ACTION_READ_ALL, SYSLOG_ACTION_READ_CLEAR, SYSLOG_ACTION_SIZE_UNREAD, SYSLOG_ACTION_SIZE_BUFFER
ioprio_which_pid = IOPRIO_WHO_PROCESS, IOPRIO_WHO_PGRP
ioprio_which_uid = IOPRIO_WHO_USER
personality_flags = PER_LINUX, PER_SVR4, PER_SVR3, PER_OSR5, PER_WYSEV386, PER_ISCR4, PER_BSD, PER_XENIX, PER_LINUX32, PER_IRIX32, PER_IRIXN32, PER_IRIX64, PER_RISCOS, PER_SOLARIS, PER_UW7, PER_OSF4, PER_HPUX, ADDR_NO_RANDOMIZE, MMAP_PAGE_ZERO, ADDR_COMPAT_LAYOUT, READ_IMPLIES_EXEC, ADDR_LIMIT_32BIT, SHORT_INODE, WHOLE_SECONDS, STICKY_TIMEOUTS, ADDR_LIMIT_3GB
clock_id = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID
sigprocmask_how = SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK
getitimer_which = ITIMER_REAL, ITIMER_VIRTUAL, ITIMER_PROF
wait_options = WNOHANG, WUNTRACED, WCONTINUED, WEXITED, WSTOPPED, WCONTINUED, WNOHANG, WNOWAIT, __WCLONE, __WALL, __WNOTHREAD
waitid_which = P_PID, P_PGID, P_ALL
sigaction_flags = SA_NOCLDSTOP, SA_NOCLDWAIT, SA_NODEFER, SA_ONSTACK, SA_RESETHAND, SA_RESTART, SA_SIGINFO
timer_flags = TIMER_ABSTIME
utimensat_flags = AT_SYMLINK_NOFOLLOW
priority_which = PRIO_PROCESS, PRIO_PGRP, PRIO_USER
mempolicy_flags = MPOL_F_MEMS_ALLOWED, MPOL_F_ADDR, MPOL_F_NODE
ptrace_req = PTRACE_LISTEN, PTRACE_KILL, PTRACE_INTERRUPT, PTRACE_ATTACH, PTRACE_DETACH
ptrace_req_peek = PTRACE_PEEKTEXT, PTRACE_PEEKDATA
ptrace_req_poke = PTRACE_POKETEXT, PTRACE_POKEDATA
ptrace_req_getregs = PTRACE_GETREGS, PTRACE_GETFPREGS
ptrace_req_setregs = PTRACE_SETREGS, PTRACE_SETFPREGS
ptrace_req_setopts = PTRACE_SETOPTIONS, PTRACE_SEIZE
ptrace_req_cont = PTRACE_CONT, PTRACE_SYSCALL, PTRACE_SINGLESTEP, PTRACE_SYSEMU, PTRACE_SYSEMU_SINGLESTEP
pthread_regset = NT_PRSTATUS, NT_PRFPREG, NT_PRPSINFO, NT_TASKSTRUCT, NT_AUXV, NT_386_TLS, NT_386_IOPERM, NT_X86_XSTATE
ptrace_options = PTRACE_O_EXITKILL, PTRACE_O_TRACECLONE, PTRACE_O_TRACEEXEC, PTRACE_O_TRACEEXIT, PTRACE_O_TRACEFORK, PTRACE_O_TRACESYSGOOD, PTRACE_O_TRACEVFORK, PTRACE_O_TRACEVFORKDONE
fcntl_dupfd = F_DUPFD, F_DUPFD_CLOEXEC
fcntl_getflags = F_GETFD, F_GETFL, F_GETSIG, F_GETLEASE, F_GETPIPE_SZ, F_GET_SEALS
fcntl_lock = F_SETLK, F_SETLKW, F_GETLK, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW
fcntl_flags = FD_CLOEXEC
fcntl_status = O_APPEND, FASYNC, O_DIRECT, O_NOATIME, O_NONBLOCK
flock_type = F_RDLCK, F_WRLCK, F_UNLCK
f_owner_type = F_OWNER_TID, F_OWNER_PID, F_OWNER_PGRP
fcntl_notify = DN_MULTISHOT, DN_ACCESS, DN_MODIFY, DN_CREATE, DN_DELETE, DN_RENAME, DN_ATTRIB
seal_types = F_SEAL_SEAL, F_SEAL_SHRINK, F_SEAL_GROW, F_SEAL_WRITE
ioctl_int_in = FIONBIO, FIOASYNC
ioctl_int_out = FIOQSIZE, FIGETBSZ
fcntl_rw_hint = RWF_WRITE_LIFE_NOT_SET, RWH_WRITE_LIFE_NONE, RWH_WRITE_LIFE_SHORT, RWH_WRITE_LIFE_MEDIUM, RWH_WRITE_LIFE_LONG, RWH_WRITE_LIFE_EXTREME
fiemap_flags = FIEMAP_FLAG_SYNC, FIEMAP_FLAG_XATTR, FIEMAP_FLAG_CACHE
fiemap_extent_flags = FIEMAP_EXTENT_LAST, FIEMAP_EXTENT_UNKNOWN, FIEMAP_EXTENT_DELALLOC, FIEMAP_EXTENT_ENCODED, FIEMAP_EXTENT_DATA_ENCRYPTED, FIEMAP_EXTENT_NOT_ALIGNED, FIEMAP_EXTENT_DATA_INLINE, FIEMAP_EXTENT_DATA_TAIL, FIEMAP_EXTENT_UNWRITTEN, FIEMAP_EXTENT_MERGED, FIEMAP_EXTENT_SHARED
getrandom_flags = GRND_NONBLOCK, GRND_RANDOM
clone_flags = CLONE_VM, CLONE_FS, CLONE_FILES, CLONE_SIGHAND, CLONE_PTRACE, CLONE_VFORK, CLONE_PARENT, CLONE_THREAD, CLONE_NEWNS, CLONE_SYSVSEM, CLONE_SETTLS, CLONE_PARENT_SETTID, CLONE_CHILD_CLEARTID, CLONE_UNTRACED, CLONE_CHILD_SETTID, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_IO, CLONE_PIDFD, CLONE_NEWTIME
clone3_flags = CLONE_CLEAR_SIGHAND, CLONE_INTO_CGROUP, clone_flags
ptrace_peeksiginfo_flags = PTRACE_PEEKSIGINFO_SHARED
close_range_flags = CLOSE_RANGE_UNSHARE

# Consts for target.SpecialFileLenghts.
_ = SMB_PATH_MAX, XT_CGROUP_PATH_MAX, XENSTORE_REL_PATH_MAX

# misc
_ = KCOV_INIT_TRACE, KCOV_ENABLE, KCOV_DISABLE, KCOV_TRACE_PC, KCOV_TRACE_CMP, PTRACE_TRACEME, SYSLOG_ACTION_CONSOLE_ON, SYSLOG_ACTION_CONSOLE_OFF, SYSLOG_ACTION_CONSOLE_LEVEL, SYSLOG_ACTION_CLEAR, __NR_mmap2

# Hardcode KCOV_REMOTE_ENABLE value for amd64 until new kcov patches reach mainline.
define KCOV_REMOTE_ENABLE	1075340134

# Not yet implemented syscalls:
# umask
# vhangup
# _sysctl
# nfsservctl
# getcpu

# Probably no sense in calling these.
# Also affect system-wide state, so not reproducible anyway.
# sched_get_priority_max
# sched_get_priority_min
]

gemini-3-pro-preview

							input: 72826
							output: 18
							thoughts: 46
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience:

**Navigating the Linux System Files**

Right, so I was looking for the definition or perhaps related code for `mount`. My initial thought was that it resided somewhere in `sys/linux/sys.txt`, but upon a bit more reflection, that didn't quite feel right. My instincts are telling me to look in the filesystem-related files, and so I am now checking `sys/linux/filesystem.txt`. It would be logical for a command so fundamental to system operation to be described there. I'm expecting to find either the core implementation, or references to relevant kernel structures, or perhaps even just an entry point that will lead me down the correct rabbit hole. Let's see what's in there.

map[File:filesystem.txt]

map[Output:# Copyright 2018 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <uapi/linux/mount.h>
include <linux/fs.h>
include <linux/fcntl.h>

mount(src ptr[in, blockdev_filename], dst ptr[in, filename], type ptr[in, string[filesystem]], flags flags[mount_flags], data ptr[in, string, opt])
umount2(path ptr[in, filename], flags flags[umount_flags])

mount$bpf(src const[0], dst ptr[in, filename], type ptr[in, string["bpf"]], flags flags[mount_flags], opts ptr[in, fs_options[bpf_options]])
mount$overlay(src const[0], dst ptr[in, filename], type ptr[in, string["overlay"]], flags flags[mount_flags], opts ptr[in, fs_options[overlay_options]])
mount$binder(src const[0], dst ptr[in, filename], type ptr[in, string["binder"]], flags flags[mount_flags], opts ptr[in, fs_options[binder_options]])
mount$tmpfs(src const[0], dst ptr[in, filename], type ptr[in, string["tmpfs"]], flags flags[mount_flags], opts ptr[in, fs_options[tmpfs_options]])
mount$cgroup(src const[0], dst ptr[in, filename], type ptr[in, string["cgroup"]], flags flags[mount_flags], opts ptr[in, fs_options[cgroup_options]])
mount$cgroup2(src const[0], dst ptr[in, filename], type ptr[in, string["cgroup2"]], flags flags[mount_flags], opts ptr[in, fs_options[cgroup2_options]])
mount$afs(src ptr[in, afs_source], dst ptr[in, filename], type ptr[in, string["afs"]], flags flags[mount_flags], opts ptr[in, fs_options[afs_options]])

# A bind mount ignores the filesystem type argument, but
# pkg/host/syscalls_linux.go:isSupportedFilesystem() requires one in
# /proc/filesystems.  Use a common and valid filesystem string ("pipefs") to
# pass the check.
mount$bind(src ptr[in, filename], dst ptr[in, filename], type ptr[in, string["pipefs"]], flags flags[mount_flags], data const[0])

# esdfs is ChromeOS-specific:
# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/d2c1fb9fcdb53%5E%21/
mount$esdfs(src ptr[in, filename], dst ptr[in, filename], type ptr[in, string["esdfs"]], flags flags[mount_flags], opts ptr[in, fs_options[esdfs_options]])

# TODO: pvfs2 requires some device/source, but it looks unused:
# https://elixir.bootlin.com/linux/v6.1-rc6/source/fs/orangefs/super.c#L488
# Instead it sends requests to some pvfs2-req character device,
# and somebody is supposed to answer these requests with ioctls.
# But the deivce is not even created in /dev, somebody is supposed to mknod it.
# And it's major number is unknown (printed to console in debug mode only):
# https://elixir.bootlin.com/linux/v6.1-rc6/source/fs/orangefs/devorangefs-req.c#L803
# It does not look usable.
mount$pvfs2(src ptr[in, string["unused"]], dst ptr[in, filename], type ptr[in, string["pvfs2"]], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]])

# TODO: nfs source is "hostname:export_path", but we also needs to setup port,
# protocol and other options, and most importantly we need the server to reply to RPCs.
# There is something called nfsd (fs/nfsd) which may help and which we need to test as well.
mount$nfs(src ptr[in, string], dst ptr[in, filename], type ptr[in, string["nfs"]], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]])
mount$nfs4(src ptr[in, string], dst ptr[in, filename], type ptr[in, string["nfs4"]], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]])

resource fd_fscontext[fd]

fsopen(type ptr[in, string[filesystem]], flags flags[fsopen_flags]) fd_fscontext
fspick(dfd fd_dir[opt], path ptr[in, filename], flags flags[fspick_flags]) fd_fscontext
fsconfig$FSCONFIG_SET_FLAG(fd fd_fscontext, cmd const[FSCONFIG_SET_FLAG], key ptr[in, string[fsconfig_flag_params]], value const[0], aux const[0])
fsconfig$FSCONFIG_SET_STRING(fd fd_fscontext, cmd const[FSCONFIG_SET_STRING], key ptr[in, string], value ptr[in, string], aux const[0])
fsconfig$FSCONFIG_SET_BINARY(fd fd_fscontext, cmd const[FSCONFIG_SET_BINARY], key ptr[in, string], value ptr[in, array[int8]], aux bytesize[value])
fsconfig$FSCONFIG_SET_PATH(fd fd_fscontext, cmd const[FSCONFIG_SET_PATH], key ptr[in, string], value ptr[in, filename], aux fd_dir[opt])
fsconfig$FSCONFIG_SET_PATH_EMPTY(fd fd_fscontext, cmd const[FSCONFIG_SET_PATH_EMPTY], key ptr[in, string], value ptr[in, filename], aux fd_dir[opt])
fsconfig$FSCONFIG_SET_FD(fd fd_fscontext, cmd const[FSCONFIG_SET_FD], key ptr[in, string], value const[0], aux fd)
fsconfig$FSCONFIG_CMD_CREATE(fd fd_fscontext, cmd const[FSCONFIG_CMD_CREATE], key const[0], value const[0], aux const[0])
fsconfig$FSCONFIG_CMD_RECONFIGURE(fd fd_fscontext, cmd const[FSCONFIG_CMD_RECONFIGURE], key const[0], value const[0], aux const[0])
fsmount(fs_fd fd_fscontext, flags flags[fsmount_flags], attr_flags flags[fsmount_attr_flags]) fd
move_mount(from_dfd fd_dir[opt], from_pathname ptr[in, filename], to_dfd fd_dir[opt], to_pathname ptr[in, filename], flags flags[move_mount_flags])
open_tree(dfd fd_dir[opt], filename ptr[in, filename], flags flags[open_tree_flags]) fd
mount_setattr(dfd fd_dir[opt], filename ptr[in, filename], flags flags[mount_setattr_flags], args ptr[in, mount_attr], size bytesize[args])

open_tree_flags = AT_EMPTY_PATH, AT_NO_AUTOMOUNT, AT_RECURSIVE, AT_SYMLINK_NOFOLLOW, OPEN_TREE_CLONE, OPEN_TREE_CLOEXEC

mount_setattr_flags = AT_EMPTY_PATH, AT_NO_AUTOMOUNT, AT_RECURSIVE, AT_SYMLINK_NOFOLLOW

mount_attr {
	attr_set	flags[mount_attr_flags, int64]
	attr_clr	flags[mount_attr_flags, int64]
	propagation	flags[mount_attr_propagation_flags, int64]
	userns_fd	align64[fd_userns]
}

mount_attr_flags = MOUNT_ATTR_IDMAP, fsmount_attr_flags
mount_attr_propagation_flags = MS_UNBINDABLE, MS_PRIVATE, MS_SLAVE, MS_SHARED
fsmount_flags = FSMOUNT_CLOEXEC
fsopen_flags = FSOPEN_CLOEXEC
fspick_flags = FSPICK_CLOEXEC
fsmount_attr_flags = MOUNT_ATTR_RDONLY, MOUNT_ATTR_NOSUID, MOUNT_ATTR_NODEV, MOUNT_ATTR_NOEXEC, MOUNT_ATTR__ATIME, MOUNT_ATTR_NODIRATIME
move_mount_flags = MOVE_MOUNT_F_SYMLINKS, MOVE_MOUNT_F_AUTOMOUNTS, MOVE_MOUNT_F_EMPTY_PATH, MOVE_MOUNT_T_SYMLINKS, MOVE_MOUNT_T_AUTOMOUNTS, MOVE_MOUNT_T_EMPTY_PATH, MOVE_MOUNT_SET_GROUP, MOVE_MOUNT_BENEATH
fsconfig_flag_params = "dirsync", "lazytime", "mand", "posixacl", "ro", "sync", "async", "nolazytime", "nomand", "rw", "silent"

filesystem = "sysfs", "rootfs", "ramfs", "tmpfs", "devtmpfs", "debugfs", "securityfs", "sockfs", "pipefs", "anon_inodefs", "devpts", "hugetlbfs", "vfat", "ecryptfs", "fuseblk", "fuse", "rpc_pipefs", "nfs", "nfs4", "nfsd", "binfmt_misc", "autofs", "xfs", "jfs", "msdos", "ntfs", "ntfs3", "minix", "hfs", "hfsplus", "qnx4", "ufs", "btrfs", "configfs", "ncpfs", "qnx6", "exofs", "befs", "vxfs", "gfs2", "gfs2meta", "fusectl", "bfs", "nsfs", "efs", "cifs", "efivarfs", "affs", "tracefs", "bdev", "ocfs2", "ocfs2_dlmfs", "hpfs", "proc", "afs", "reiserfs", "jffs2", "romfs", "aio", "sysv", "v7", "udf", "ceph", "pstore", "adfs", "9p", "hostfs", "squashfs", "cramfs", "iso9660", "coda", "nilfs2", "logfs", "overlay", "f2fs", "omfs", "ubifs", "openpromfs", "bpf", "cgroup", "cgroup2", "cpuset", "mqueue", "aufs", "selinuxfs", "dax", "erofs", "virtiofs", "exfat", "binder", "zonefs", "pvfs2", "incremental-fs", "esdfs", "smb3", "gadgetfs", ext4_types

blockdev_filename [
	filename	filename
	nbd		nbd_filename
	loop		loop_filename
	nullb		string["/dev/nullb0"]
	rnullb		string["/dev/rnullb0"]
	md0		string["/dev/md0"]
	sg0		string["/dev/sg0"]
	sr0		string["/dev/sr0"]
] [varlen]

nbd_filename {
	prefix	stringnoz["/dev/nbd"]
# NEED: this does not support formatting numbers larger than 9.
	id	proc['0', 1, int8]
	z	const[0, int8]
} [packed]

loop_filename {
	prefix	stringnoz["/dev/loop"]
# NEED: this does not support formatting numbers larger than 9.
	id	proc['0', 1, int8]
	z	const[0, int8]
} [packed]

syz_read_part_table(size len[img], img ptr[in, compressed_image]) (timeout[200], no_generate, no_minimize)

define SYZ_MOUNT_IMAGE_TIMEOUT	4000

syz_mount_image$vfat(fs ptr[in, string["vfat"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[vfat_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.vfat -n"])
syz_mount_image$msdos(fs ptr[in, string["msdos"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[msdos_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.msdos -n"])
syz_mount_image$bfs(fs ptr[in, string["bfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$xfs(fs ptr[in, string["xfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[xfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["xfs_repair -n"])
syz_mount_image$minix(fs ptr[in, string["minix"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.minix"])
syz_mount_image$reiserfs(fs ptr[in, string["reiserfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[reiserfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.reiserfs -n"])
syz_mount_image$hfs(fs ptr[in, string["hfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[hfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$hfsplus(fs ptr[in, string["hfsplus"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[hfsplus_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$iso9660(fs ptr[in, string["iso9660"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[iso9660_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$gfs2(fs ptr[in, string["gfs2"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[gfs2_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.gfs2 -n"])
syz_mount_image$jfs(fs ptr[in, string["jfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[jfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.jfs -n"])
syz_mount_image$btrfs(fs ptr[in, string["btrfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[btrfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["btrfsck --readonly"])
syz_mount_image$ntfs(fs ptr[in, string["ntfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[ntfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$ntfs3(fs ptr[in, string["ntfs3"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[ntfs3_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$ext4(fs ptr[in, string[ext4_types]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[ext4_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.ext4 -n"])
syz_mount_image$f2fs(fs ptr[in, string["f2fs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[f2fs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.f2fs"])
syz_mount_image$ocfs2(fs ptr[in, string["ocfs2"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[ocfs2_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.ocfs2 -n"])
syz_mount_image$erofs(fs ptr[in, string["erofs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[erofs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.erofs"])
syz_mount_image$exfat(fs ptr[in, string["exfat"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[exfat_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.exfat -n"])
syz_mount_image$cramfs(fs ptr[in, string["cramfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize, fsck["fsck.cramfs"])
syz_mount_image$romfs(fs ptr[in, string["romfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$efs(fs ptr[in, string["efs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$jffs2(fs ptr[in, string["jffs2"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[jffs2_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$nilfs2(fs ptr[in, string["nilfs2"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[nilfs2_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$squashfs(fs ptr[in, string["squashfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[squashfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$udf(fs ptr[in, string["udf"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[udf_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$bcachefs(fs ptr[in, string["bcachefs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[bcachefs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)

# TODO: zonefs needs a zoned block device:
# https://elixir.bootlin.com/linux/v6.1-rc6/source/fs/zonefs/super.c#L1768
# So currnetly the mount always fails.
# These docs say such devices can be emulated with nullb, but need special setup:
# https://zonedstorage.io/docs/getting-started/zbd-emulation
# https://btrfs.wiki.kernel.org/index.php/Zoned
syz_mount_image$zonefs(fs ptr[in, string["zonefs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[zonefs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)

# TODO: ubifs needs a special ubi device:
# https://elixir.bootlin.com/linux/v6.1-rc6/source/fs/ubifs/super.c#L2063
# So currnetly the mount always fails.
syz_mount_image$ubifs(fs ptr[in, string["ubifs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[ubifs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)

# TODO: add mount options for the following file systems.
syz_mount_image$adfs(fs ptr[in, string["adfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[adfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$affs(fs ptr[in, string["affs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[affs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$befs(fs ptr[in, string["befs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$vxfs(fs ptr[in, string["vxfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[vxfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$omfs(fs ptr[in, string["omfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[omfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$hpfs(fs ptr[in, string["hpfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[hpfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$qnx4(fs ptr[in, string["qnx4"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$qnx6(fs ptr[in, string["qnx6"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[qnx6_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$sysv(fs ptr[in, string["sysv"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$ufs(fs ptr[in, string["ufs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[ufs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$gfs2meta(fs ptr[in, string["gfs2meta"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)
syz_mount_image$v7(fs ptr[in, string["v7"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[stringnoz]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)

# Note: tmpfs does not need an image, but we use this in tests.
syz_mount_image$tmpfs(fs ptr[in, string["tmpfs"]], dir ptr[in, filename], flags flags[mount_flags], opts ptr[in, fs_options[tmpfs_options]], chdir bool8, size len[img], img ptr[in, compressed_image]) fd_dir (timeout[SYZ_MOUNT_IMAGE_TIMEOUT], no_generate, no_minimize)

type fs_options[ELEMS] {
	elems	array[fs_opt_elem[ELEMS]]
	common	array[fs_opt_elem[fs_options_common]]
	null	const[0, int8]
} [packed]

type fs_opt_elem[ELEMS] {
	elem	ELEMS
	comma	const[',', int8]
} [packed]

type fs_opt[NAME, TYPE] {
	name	stringnoz[NAME]
	eq	const['=', int8]
	val	TYPE
} [packed]

type fs_opt_nodelim[NAME, TYPE] {
	name	stringnoz[NAME]
	val	TYPE
} [packed]

type fs_opt_str[NAME] fs_opt[NAME, stringnoz]
type fs_opt_dec[NAME, VAL] fs_opt[NAME, fmt[dec, VAL]]
type fs_opt_hex[NAME, VAL] fs_opt[NAME, fmt[hex, VAL]]
type fs_opt_oct[NAME, VAL] fs_opt[NAME, fmt[oct, VAL]]
type fs_opt_dec_suffix[NAME] fs_opt[NAME, array[flags[fs_opt_digits_suffix, int8]]]
type fs_opt_filename[NAME] fs_opt[NAME, stringnoz[filename]]
type fs_opt_codepage[NAME] fs_opt[NAME, stringnoz[codepages_names]]
type fs_opt_cp_num[NAME] fs_opt[NAME, stringnoz[codepage_nums]]

fs_opt_digits_suffix = '-', 'x', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'k', 'm', 'g', 't', 'p', 'e', '%'

fs_options_common [
	flag			stringnoz[fsconfig_flag_params]

# SELinux options:
	context			fs_opt["context", stringnoz[selinux_user_context]]
	fscontext		fs_opt["fscontext", stringnoz[selinux_user_context]]
	rootcontext		fs_opt["rootcontext", stringnoz[selinux_user_context]]
	defcontext		fs_opt["defcontext", stringnoz[selinux_user_context]]
	seclabel		stringnoz["seclabel"]

# Smack options:
	smackfsdef		fs_opt_str["smackfsdef"]
	smackfsfloor		fs_opt_str["smackfsfloor"]
	smackfshat		fs_opt_str["smackfshat"]
	smackfsroot		fs_opt_str["smackfsroot"]
	smackfstransmute	fs_opt_str["smackfstransmute"]

# IMA options:
	measure			stringnoz["measure"]
	dont_measure		stringnoz["dont_measure"]
	appraise		stringnoz["appraise"]
	dont_appraise		stringnoz["dont_appraise"]
	audit			stringnoz["audit"]
	hash			stringnoz["hash"]
	dont_hash		stringnoz["dont_hash"]
	permit_directio		stringnoz["permit_directio"]
	obj_user		fs_opt_str["obj_user"]
	obj_role		fs_opt_str["obj_role"]
	obj_type		fs_opt_str["obj_type"]
	subj_user		fs_opt_str["subj_user"]
	subj_role		fs_opt_str["subj_role"]
	subj_type		fs_opt_str["subj_type"]
	func			fs_opt["func", stringnoz[ima_funcs]]
	mask			fs_opt["mask", stringnoz[ima_masks]]
	fsmagic			fs_opt_hex["fsmagic", intptr]
	fsname			fs_opt_str["fsname"]
	fsuuid			fs_opt["fsuuid", uuid_str]
	uid_eq			fs_opt_dec["uid", uid]
	euid_eq			fs_opt_dec["euid", uid]
	fowner_eq		fs_opt_dec["fowner", uid]
	uid_gt			fs_opt_nodelim["uid>", fmt[dec, uid]]
	euid_gt			fs_opt_nodelim["euid>", fmt[dec, uid]]
	fowner_gt		fs_opt_nodelim["fowner>", fmt[dec, uid]]
	uid_lt			fs_opt_nodelim["uid<", fmt[dec, uid]]
	euid_lt			fs_opt_nodelim["euid<", fmt[dec, uid]]
	fowner_lt		fs_opt_nodelim["fowner<", fmt[dec, uid]]
	appraise_type		stringnoz["appraise_type=imasig"]
	pcr			fs_opt_dec["pcr", int64[0:64]]
] [varlen]

uuid_str {
	p0	array[flags[hex_chars, int8], 8]
	d0	const['-', int8]
	p1	array[flags[hex_chars, int8], 4]
	d1	const['-', int8]
	p2	array[flags[hex_chars, int8], 4]
	d2	const['-', int8]
	p3	array[flags[hex_chars, int8], 4]
	d3	const['-', int8]
	p4	array[flags[hex_chars, int8], 8]
}

hex_chars = '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'

ima_funcs = "FILE_CHECK", "PATH_CHECK", "MODULE_CHECK", "FIRMWARE_CHECK", "FILE_MMAP", "MMAP_CHECK", "BPRM_CHECK", "CREDS_CHECK", "KEXEC_KERNEL_CHECK", "KEXEC_INITRAMFS_CHECK", "POLICY_CHECK"
ima_masks = "MAY_EXEC", "MAY_WRITE", "MAY_READ", "MAY_APPEND", "^MAY_EXEC", "^MAY_WRITE", "^MAY_READ", "^MAY_APPEND"

msdos_options [
	fat	fat_options
	nodots	stringnoz["nodots"]
	dots	stringnoz["dots"]
] [varlen]

vfat_options [
	fat		fat_options
	iocharset	fs_opt_codepage["iocharset"]
	rodir		stringnoz["rodir"]
	utf8no		stringnoz["utf8=0"]
	utf8		stringnoz["utf8=1"]
	uni_xlateno	stringnoz["uni_xlate=0"]
	uni_xlate	stringnoz["uni_xlate=1"]
	numtail		stringnoz["nonumtail=0"]
	nonumtail	stringnoz["nnonumtail=1"]
	shortname_lower	stringnoz["shortname=lower"]
	shortname_win95	stringnoz["shortname=win95"]
	shortname_winnt	stringnoz["shortname=winnt"]
	shortname_mixed	stringnoz["shortname=mixed"]
] [varlen]

fat_options [
	check_relaxed	stringnoz["check=relaxed"]
	check_strict	stringnoz["check=strict"]
	check_normal	stringnoz["check=normal"]
	usefree		stringnoz["usefree"]
	nocase		stringnoz["nocase"]
	quiet		stringnoz["quiet"]
	showexec	stringnoz["showexec"]
	debug		stringnoz["debug"]
	sys_immutable	stringnoz["sys_immutable"]
	flush		stringnoz["flush"]
	tz_utc		stringnoz["tz=UTC"]
	errors_continue	stringnoz["errors=continue"]
	errors_remount	stringnoz["errors=remount-ro"]
	discard		stringnoz["discard"]
	nfs		stringnoz["nfs"]
	nfs_nostale_ro	stringnoz["nfs=nostale_ro"]
	nfs_stale_rw	stringnoz["nfs=stale_rw"]
	dos1xfloppy	stringnoz["dos1xfloppy"]
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	umask		fs_opt_oct["umask", int32]
	dmask		fs_opt_oct["dmask", int32]
	fmask		fs_opt_oct["fmask", int32]
	allow_utime	fs_opt_oct["allow_utime", int32]
	time_offset	fs_opt_hex["time_offset", int32[-1440:1440]]
	codepage	fs_opt_cp_num["codepage"]
] [varlen]

xfs_options [
	wsync		stringnoz["wsync"]
	noalign		stringnoz["noalign"]
	swalloc		stringnoz["swalloc"]
	nouuid		stringnoz["nouuid"]
	mtpt		stringnoz["mtpt"]
	grpid		stringnoz["grpid"]
	nogrpid		stringnoz["nogrpid"]
	bsdgroups	stringnoz["bsdgroups"]
	sysvgroups	stringnoz["sysvgroups"]
	norecovery	stringnoz["norecovery"]
	inode64		stringnoz["inode64"]
	inode32		stringnoz["inode32"]
	ikeep		stringnoz["ikeep"]
	noikeep		stringnoz["noikeep"]
	largeio		stringnoz["largeio"]
	nolargeio	stringnoz["nolargeio"]
	attr2		stringnoz["attr2"]
	noattr2		stringnoz["noattr2"]
	filestreams	stringnoz["filestreams"]
	quota		stringnoz["quota"]
	noquota		stringnoz["noquota"]
	lazytime	stringnoz["lazytime"]
	nolazytime	stringnoz["nolazytime"]
	usrquota	stringnoz["usrquota"]
	grpquota	stringnoz["grpquota"]
	prjquota	stringnoz["prjquota"]
	uquota		stringnoz["uquota"]
	gquota		stringnoz["gquota"]
	pquota		stringnoz["pquota"]
	uqnoenforce	stringnoz["uqnoenforce"]
	gqnoenforce	stringnoz["gqnoenforce"]
	pqnoenforce	stringnoz["pqnoenforce"]
	qnoenforce	stringnoz["qnoenforce"]
	discard		stringnoz["discard"]
	nodiscard	stringnoz["nodiscard"]
	dax		stringnoz["dax"]
	dax_inode	stringnoz["dax=inode"]
	dax_always	stringnoz["dax=always"]
	dax_never	stringnoz["dax=never"]
	barrier		stringnoz["barrier"]
	nobarrier	stringnoz["nobarrier"]
	logbufs		fs_opt_dec["logbufs", int32[-1:8]]
	biosize		fs_opt_dec["biosize", int32]
	sunit		fs_opt_hex["sunit", int32]
	swidth		fs_opt_hex["swidth", int32]
	logbsize	fs_opt_dec_suffix["logbsize"]
	allocsize	fs_opt_dec_suffix["allocsize"]
	logdev		fs_opt_filename["logdev"]
	rtdev		fs_opt_filename["rtdev"]
] [varlen]

reiserfs_options [
	tails_on		stringnoz["tails=on"]
	tails_off		stringnoz["tails=off"]
	tails_small		stringnoz["tails=small"]
	notail			stringnoz["notail"]
	conv			stringnoz["conv"]
	noattrs			stringnoz["noattrs"]
	expose_privroot		stringnoz["expose_privroot"]
	user_xattr		stringnoz["user_xattr"]
	nouser_xattr		stringnoz["nouser_xattr"]
	acl			stringnoz["acl"]
	noacl			stringnoz["noacl"]
	replayonly		stringnoz["replayonly"]
	nolargeio		stringnoz["nolargeio"]
	usrquota		stringnoz["usrquota"]
	grpquota		stringnoz["grpquota"]
	noquota			stringnoz["noquota"]
	usrjquota		stringnoz["usrjquota"]
	usrjquota_file		stringnoz["usrjquota=syz"]
	grpjquota		stringnoz["grpjquota"]
	commit			fs_opt_hex["commit", int32]
	resize			fs_opt_hex["resize", int32]
	resize_auto		stringnoz["resize=auto"]
	jdev			fs_opt_filename["jdev"]
	jqfmt_vfsold		stringnoz["jqfmt=vfsold"]
	jqfmt_vfsv0		stringnoz["jqfmt=vfsv0"]
	hash_tea		stringnoz["hash=tea"]
	hash_rupasov		stringnoz["hash=rupasov"]
	hash_r5			stringnoz["hash=r5"]
	balloc_noborder		stringnoz["block-allocator=noborder"]
	balloc_border		stringnoz["block-allocator=border"]
	balloc_no_unhash_reloc	stringnoz["block-allocator=no_unhashed_relocation"]
	balloc_hashed_reloc	stringnoz["block-allocator=hashed_relocation"]
	balloc_test4		stringnoz["block-allocator=test4"]
	balloc_notest4		stringnoz["block-allocator=notest4"]
	barrier_none		stringnoz["barrier=none"]
	barrier_flush		stringnoz["barrier=flush"]
	data_ordered		stringnoz["data=ordered"]
	data_journal		stringnoz["data=journal"]
	data_writeback		stringnoz["data=writeback"]
	errors_continue		stringnoz["errors=continue"]
	errors_ro_remount	stringnoz["errors=ro-remount"]
] [varlen]

hfs_options [
	quiet		stringnoz["quiet"]
	umask		fs_opt_oct["umask", int32]
	file_umask	fs_opt_oct["file_umask", int32]
	dir_umask	fs_opt_oct["dir_umask", int32]
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	part		fs_opt_hex["part", int32]
	session		fs_opt_hex["session", int32]
	type		fs_opt["type", array[int8, 4]]
	creator		fs_opt["creator", array[int8, 4]]
	codepage	fs_opt_codepage["codepage"]
	iocharset	fs_opt_codepage["iocharset"]
] [varlen]

hfsplus_options [
	decompose	stringnoz["decompose"]
	nodecompose	stringnoz["nodecompose"]
	barrier		stringnoz["barrier"]
	nobarrier	stringnoz["nobarrier"]
	force		stringnoz["force"]
	umask		fs_opt_oct["umask", int32]
	type		fs_opt["type", array[int8, 4]]
	creator		fs_opt["creator", array[int8, 4]]
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	part		fs_opt_hex["part", int32]
	session		fs_opt_hex["session", int32]
	nls		fs_opt_codepage["nls"]
] [varlen]

iso9660_options [
	norock		stringnoz["norock"]
	nojoliet	stringnoz["nojoliet"]
	unhide		stringnoz["unhide"]
	hide		stringnoz["hide"]
	showassoc	stringnoz["showassoc"]
	cruft		stringnoz["cruft"]
	utf8		stringnoz["utf8"]
	map_acorn	stringnoz["map=acorn"]
	map_normal	stringnoz["map=normal"]
	map_off		stringnoz["map=off"]
	check_relaxed	stringnoz["check=relaxed"]
	check_strict	stringnoz["check=strict"]
	overriderock	stringnoz["overriderockperm"]
	nocompress	stringnoz["nocompress"]
	session		fs_opt_hex["session", int32[0:98]]
	sbsector	fs_opt_hex["sbsector", int32]
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	mode		fs_opt_hex["mode", int32]
	dmode		fs_opt_hex["dmode", int32]
	block		fs_opt_hex["block", flags[iso9660_blocks]]
	iocharset	fs_opt_codepage["iocharset"]
] [varlen]

iso9660_blocks = 512, 1024, 2048

# Note that the "debug" option has been omitted since it's equivalent to "errors=panic".
gfs2_options [
	spectator		stringnoz["spectator"]
	norecovery		stringnoz["norecovery"]
	ignore_local_fs		stringnoz["ignore_local_fs"]
	localflocks		stringnoz["localflocks"]
	localcaching		stringnoz["localcaching"]
	nodebug			stringnoz["nodebug"]
	upgrade			stringnoz["upgrade"]
	acl			stringnoz["acl"]
	noacl			stringnoz["noacl"]
	quota_off		stringnoz["quota=off"]
	quota_account		stringnoz["quota=account"]
	quota_on		stringnoz["quota=on"]
	quota_quiet		stringnoz["quota=quiet"]
	quota			stringnoz["quota"]
	noquota			stringnoz["noquota"]
	suiddir			stringnoz["suiddir"]
	nosuiddir		stringnoz["nosuiddir"]
	data_writeback		stringnoz["data=writeback"]
	data_ordered		stringnoz["data=ordered"]
	meta			stringnoz["meta"]
	discard			stringnoz["discard"]
	nodiscard		stringnoz["nodiscard"]
	errors_withdraw		stringnoz["errors=withdraw"]
	barrier			stringnoz["barrier"]
	nobarrier		stringnoz["nobarrier"]
	rgrplvb			stringnoz["rgrplvb"]
	norgrplvb		stringnoz["norgrplvb"]
	loccookie		stringnoz["loccookie"]
	noloccookie		stringnoz["noloccookie"]
	commit			fs_opt_hex["commit", int32]
	statfs_quantum		fs_opt_hex["statfs_quantum", int32]
	statfs_percent		fs_opt_hex["statfs_percent", int32]
	quota_quantum		fs_opt_hex["quota_quantum", int32]
	lockproto_dlm		stringnoz["lockproto=dlm"]
	lockproto_nolock	stringnoz["lockproto=lock_nolock"]
	locktable		fs_opt_str["locktable"]
	hostdata		fs_opt_str["hostdata"]
] [varlen]

jfs_options [
	integrity	stringnoz["integrity"]
	nointegrity	stringnoz["nointegrity"]
	resize		stringnoz["resize"]
	noquota		stringnoz["noquota"]
	quota		stringnoz["quota"]
	usrquota	stringnoz["usrquota"]
	grpquota	stringnoz["grpquota"]
	discard		stringnoz["discard"]
	nodiscard	stringnoz["nodiscard"]
	iocharset	fs_opt_codepage["iocharset"]
	errors_continue	stringnoz["errors=continue"]
	errors_remount	stringnoz["errors=remount-ro"]
	resize_size	fs_opt_hex["resize", int32]
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	umask		fs_opt_hex["umask", int32]
	discard_size	fs_opt_hex["discard", int32]
] [varlen]

btrfs_options [
	degraded		stringnoz["degraded"]
	nodatasum		stringnoz["nodatasum"]
	datasum			stringnoz["datasum"]
	nodatacow		stringnoz["nodatacow"]
	datacow			stringnoz["datacow"]
	nobarrier		stringnoz["nobarrier"]
	barrier			stringnoz["barrier"]
	compress		stringnoz["compress"]
	compress_force		stringnoz["compress-force"]
	ssd			stringnoz["ssd"]
	ssd_spread		stringnoz["ssd_spread"]
	nossd_spread		stringnoz["nossd_spread"]
	nossd			stringnoz["nossd"]
	acl			stringnoz["acl"]
	noacl			stringnoz["noacl"]
	notreelog		stringnoz["notreelog"]
	treelog			stringnoz["treelog"]
	flushoncommit		stringnoz["flushoncommit"]
	noflushoncommit		stringnoz["noflushoncommit"]
	discard			stringnoz["discard"]
	nodiscard		stringnoz["nodiscard"]
	discard_sync		stringnoz["discard=sync"]
	discard_async		stringnoz["discard=async"]
	fatal_errors_bug	stringnoz["fatal_errors=bug"]
	space_cache		stringnoz["space_cache"]
	clear_cache		stringnoz["clear_cache"]
	user_subvol_rm		stringnoz["user_subvol_rm_allowed"]
	enospc_debug		stringnoz["enospc_debug"]
	noenospc_debug		stringnoz["noenospc_debug"]
	autodefrag		stringnoz["autodefrag"]
	noautodefrag		stringnoz["noautodefrag"]
	inode_cache		stringnoz["inode_cache"]
	noinode_cache		stringnoz["noinode_cache"]
	nospace_cache		stringnoz["nospace_cache"]
	usebackuproot		stringnoz["usebackuproot"]
	skip_balance		stringnoz["skip_balance"]
	check_int		stringnoz["check_int"]
	check_int_data		stringnoz["check_int_data"]
	rescan_uuid_tree	stringnoz["rescan_uuid_tree"]
	fragment_data		stringnoz["fragment=data"]
	fragment_metadata	stringnoz["fragment=metadata"]
	fragment_all		stringnoz["fragment=all"]
	ref_verify		stringnoz["ref_verify"]
	metadata_ratio		fs_opt_hex["metadata_ratio", int32]
	check_int_print_mask	fs_opt_hex["check_int_print_mask", int32]
	commit			fs_opt_hex["commit", int32]
	thread_pool		fs_opt_hex["thread_pool", int32]
	device			fs_opt_filename["device"]
	subvolid		fs_opt_hex["subvolid", int64]
	subvol			fs_opt_str["subvol"]
	max_inline		fs_opt_dec_suffix["max_inline"]
	compress_algo		fs_opt["compress", stringnoz[btrfs_compress_algos]]
	compress_force_algo	fs_opt["compress-force", stringnoz[btrfs_compress_algos]]
	space_cache_v1		stringnoz["space_cache=v1"]
	space_cache_v2		stringnoz["space_cache=v2"]
	rescue			fs_opt["rescue", stringnoz[btrfs_rescue_opts]]
] [varlen]

btrfs_compress_algos = "zlib", "lzo", "zstd", "no"
btrfs_rescue_opts = "usebackuproot", "nologreplay", "ignorebadroots", "ibadroots", "ignoredatacsums", "ignoremetacsums", "ignoresuperflags", "idatacsums", "imetacsums", "isuperflags", "all"

ntfs_options [
	uid			fs_opt_hex["uid", uid]
	gid			fs_opt_hex["gid", gid]
	umask			fs_opt_oct["umask", int32]
	fmask			fs_opt_oct["fmask", int32]
	dmask			fs_opt_oct["dmask", int32]
	mft_zone_multiplier	fs_opt_hex["mft_zone_multiplier", int32[-1:4]]
	show_sys_files_no	stringnoz["show_sys_files=no"]
	show_sys_files_yes	stringnoz["show_sys_files=yes"]
	case_sensitive_no	stringnoz["case_sensitive=no"]
	case_sensitive_yes	stringnoz["case_sensitive=yes"]
	disable_sparse_no	stringnoz["disable_sparse=no"]
	disable_sparse_yes	stringnoz["disable_sparse=yes"]
	errors_remount		stringnoz["errors=remount-ro"]
	errors_continue		stringnoz["errors=continue"]
	errors_recover		stringnoz["errors=recover"]
	nls			fs_opt_codepage["nls"]
	utf8			stringnoz["utf8"]
] [varlen]

ntfs3_options [
	uid			fs_opt_hex["uid", uid]
	gid			fs_opt_hex["gid", gid]
	umask			fs_opt_oct["umask", int32]
	fmask			fs_opt_oct["fmask", int32]
	dmask			fs_opt_oct["dmask", int32]
	noacsrules		stringnoz["noacsrules"]
	hidden			stringnoz["hidden"]
	nohidden		stringnoz["nohidden"]
	sys_immutable		stringnoz["sys_immutable"]
	nosys_immutable		stringnoz["nosys_immutable"]
	discard			stringnoz["discard"]
	nodiscard		stringnoz["discard"]
	force			stringnoz["force"]
	noforce			stringnoz["noforce"]
	sparse			stringnoz["sparse"]
	nosparse		stringnoz["nosparse"]
	hide_dot_files		stringnoz["hide_dot_files"]
	nohide_dot_files	stringnoz["nohide_dot_files"]
	windows_names		stringnoz["windows_names"]
	nowindows_names		stringnoz["windows_names"]
	showmeta		stringnoz["showmeta"]
	noshowmeta		stringnoz["noshowmeta"]
	prealloc		stringnoz["prealloc"]
	noprealloc		stringnoz["noprealloc"]
	acl			stringnoz["acl"]
	noacl			stringnoz["noacl"]
	iocharset		fs_opt_codepage["iocharset"]
	case			stringnoz["case"]
	nocase			stringnoz["nocase"]
] [varlen]

ext4_options [
	bsddf				stringnoz["bsddf"]
	minixdf				stringnoz["minixdf"]
	grpid				stringnoz["grpid"]
	bsdgroups			stringnoz["bsdgroups"]
	nogrpid				stringnoz["nogrpid"]
	sysvgroups			stringnoz["sysvgroups"]
	errors_continue			stringnoz["errors=continue"]
	errors_remount			stringnoz["errors=remount-ro"]
	nouid32				stringnoz["nouid32"]
	debug				stringnoz["debug"]
	oldalloc			stringnoz["oldalloc"]
	orlov				stringnoz["orlov"]
	user_xattr			stringnoz["user_xattr"]
	nouser_xattr			stringnoz["nouser_xattr"]
	acl				stringnoz["acl"]
	noacl				stringnoz["noacl"]
	norecovery			stringnoz["norecovery"]
	noload				stringnoz["noload"]
	nobh				stringnoz["nobh"]
	bh				stringnoz["bh"]
	journal_checksum		stringnoz["journal_checksum"]
	nojournal_checksum		stringnoz["nojournal_checksum"]
	journal_async_commit		stringnoz["journal_async_commit"]
	abort				stringnoz["abort"]
	data_journal			stringnoz["data=journal"]
	data_ordered			stringnoz["data=ordered"]
	data_writeback			stringnoz["data=writeback"]
	data_err_abort			stringnoz["data_err=abort"]
	data_err_ignore			stringnoz["data_err=ignore"]
	usrjquota			stringnoz["usrjquota="]
	grpjquota			stringnoz["grpjquota="]
	jqfmt_vfsold			stringnoz["jqfmt=vfsold"]
	jqfmt_vfsv0			stringnoz["jqfmt=vfsv0"]
	jqfmt_vfsv1			stringnoz["jqfmt=vfsv1"]
	grpquota			stringnoz["grpquota"]
	noquota				stringnoz["noquota"]
	quota				stringnoz["quota"]
	usrquota			stringnoz["usrquota"]
	prjquota			stringnoz["prjquota"]
	barrier				stringnoz["barrier"]
	nobarrier			stringnoz["nobarrier"]
	i_version			stringnoz["i_version"]
	dax				stringnoz["dax"]
	dax_always			stringnoz["dax=always"]
	dax_inode			stringnoz["dax=inode"]
	dax_never			stringnoz["dax=never"]
	delalloc			stringnoz["delalloc"]
	lazytime			stringnoz["lazytime"]
	nolazytime			stringnoz["nolazytime"]
	nodelalloc			stringnoz["nodelalloc"]
	mblk_io_submit			stringnoz["mblk_io_submit"]
	nomblk_io_submit		stringnoz["nomblk_io_submit"]
	block_validity			stringnoz["block_validity"]
	noblock_validity		stringnoz["noblock_validity"]
	auto_da_alloc			stringnoz["auto_da_alloc"]
	noauto_da_alloc			stringnoz["noauto_da_alloc"]
	dioread_nolock			stringnoz["dioread_nolock"]
	nodioread_nolock		stringnoz["nodioread_nolock"]
	dioread_lock			stringnoz["dioread_lock"]
	discard				stringnoz["discard"]
	nodiscard			stringnoz["nodiscard"]
	init_itable			stringnoz["init_itable"]
	noinit_itable			stringnoz["noinit_itable"]
	test_dummy_encryption		stringnoz["test_dummy_encryption"]
	test_dummy_encryption_v1	stringnoz["test_dummy_encryption=v1"]
	nombcache			stringnoz["nombcache"]
	inlinecrypt			stringnoz["inlinecrypt"]
	mb_optimize_scan		fs_opt_hex["mb_optimize_scan", int32[0:1]]
	resgid				fs_opt_hex["resgid", gid]
	resuid				fs_opt_hex["resuid", uid]
	sb				fs_opt_hex["sb", int32]
	commit				fs_opt_hex["commit", int32]
	min_batch_time			fs_opt_hex["min_batch_time", int32]
	max_batch_time			fs_opt_hex["max_batch_time", int32]
	journal_dev			fs_opt_hex["journal_dev", int32]
	barrier_val			fs_opt_hex["barrier", int32]
	stripe				fs_opt_hex["stripe", int32]
	debug_want_extra_isize		fs_opt_hex["debug_want_extra_isize", int32]
	inode_readahead_blks		fs_opt_hex["inode_readahead_blks", flags[ext4_inode_readahead_blks]]
	journal_ioprio			fs_opt_hex["journal_ioprio", int32[0:7]]
	auto_da_alloc_val		fs_opt_hex["auto_da_alloc", int32]
	init_itable_val			fs_opt_hex["init_itable", int32]
	max_dir_size_kb			fs_opt_hex["max_dir_size_kb", int32]
	journal_path			fs_opt_filename["journal_path"]
	grpjquota_path			fs_opt_filename["grpjquota"]
	usrjquota_path			fs_opt_filename["usrjquota"]
] [varlen]

ext4_types = "ext4", "ext3", "ext2"
ext4_inode_readahead_blks = 0, 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 0x1000, 0x2000, 0x4000, 0x8000, 0x10000, 0x20000, 0x40000, 0x80000, 0x100000, 0x200000, 0x400000, 0x800000, 0x1000000, 0x2000000, 0x4000000, 0x8000000

f2fs_options [
	background_gc_sync		stringnoz["background_gc=sync"]
	background_gc_off		stringnoz["background_gc=off"]
	background_gc_on		stringnoz["background_gc=on"]
	disable_roll_forward		stringnoz["disable_roll_forward"]
	norecovery			stringnoz["norecovery"]
	discard				stringnoz["discard"]
	nodiscard			stringnoz["nodiscard"]
	noheap				stringnoz["no_heap"]
	heap				stringnoz["heap"]
	user_xattr			stringnoz["user_xattr"]
	nouser_xattr			stringnoz["nouser_xattr"]
	acl				stringnoz["acl"]
	noacl				stringnoz["noacl"]
	six_active_logs			stringnoz["active_logs=6"]
	four_active_logs		stringnoz["active_logs=4"]
	two_active_logs			stringnoz["active_logs=2"]
	disable_ext_identify		stringnoz["disable_ext_identify"]
	inline_xattr			stringnoz["inline_xattr"]
	noinline_xattr			stringnoz["noinline_xattr"]
	inline_xattr_size		fs_opt_hex["inline_xattr_size", int32]
	inline_data			stringnoz["inline_data"]
	noinline_data			stringnoz["noinline_data"]
	inline_dentry			stringnoz["inline_dentry"]
	noinline_dentry			stringnoz["noinline_dentry"]
	flush_merge			stringnoz["flush_merge"]
	noflush_merge			stringnoz["noflush_merge"]
	barrier				stringnoz["barrier"]
	nobarrier			stringnoz["nobarrier"]
	fastboot			stringnoz["fastboot"]
	extent_cache			stringnoz["extent_cache"]
	noextent_cache			stringnoz["noextent_cache"]
	data_flush			stringnoz["data_flush"]
	reserve_root			fs_opt_dec["reserver_root", int32]
	adaptive_mode			stringnoz["mode=adaptive"]
	lfs_mode			stringnoz["mode=lfs"]
	segment_mode			stringnoz["mode=fragment:segment"]
	block_mode			stringnoz["mode=fragment:block"]
	io_bits				fs_opt_dec["io_bits", int32[0:256]]
	fault_injection			fs_opt_dec["fault_injection", int32]
	fault_type			fs_opt_dec["fault_type", int32]
	resgid				fs_opt_hex["resgid", gid]
	resuid				fs_opt_hex["resuid", uid]
	lazytime			stringnoz["lazytime"]
	nolazytime			stringnoz["nolazytime"]
	quota				stringnoz["quota"]
	noquota				stringnoz["noquota"]
	usrquota			fs_opt_str["usrquota"]
	grpquota			fs_opt_str["grpquota"]
	prjquota			fs_opt_str["prjquota"]
	usrjquota			fs_opt_str["usrjquota"]
	grpjquota			fs_opt_str["grpjquota"]
	prjjquota			fs_opt_str["prjjquota"]
	jqfmt_vfsold			stringnoz["jqfmt=vfsold"]
	jqfmt_vfsv0			stringnoz["jqfmt=vfsv0"]
	jqfmt_vfsv1			stringnoz["jqfmt=vfsv1"]
	whint_mode_user			stringnoz["whint_mode=user-based"]
	whint_mode_off			stringnoz["whint_mode=off"]
	whint_mode_fs			stringnoz["whint_mode=fs-based"]
	alloc_mode_def			stringnoz["alloc_mode=default"]
	alloc_mode_reuse		stringnoz["alloc_mode=reuse"]
	fsync_mode_posix		stringnoz["fsync_mode=posix"]
	fsync_mode_strict		stringnoz["fsync_mode=strict"]
	test_dummy_encryption		stringnoz["test_dummy_encryption"]
	test_dummy_encryption_v1	stringnoz["test_dummy_encryption=v1"]
	errors_continue			stringnoz["errors=continue"]
	errors_remount			stringnoz["errors=remount-ro"]
	inlinecrypt			stringnoz["inlinecrypt"]
	checkpoint_diasble		stringnoz["checkpoint=disable"]
	checkpoint_enable		stringnoz["checkpoint=enable"]
	checkpoint_merge		stringnoz["checkpoint=merge"]
	nocheckpoint_merge		stringnoz["nocheckpoint_merge"]
	compress_chksum			stringnoz["compress_chksum"]
	compress_cache			stringnoz["compress_cache"]
	atgc				stringnoz["atgc"]
	gc_merge			stringnoz["gc_merge"]
	nogc_merge			stringnoz["nogc_merge"]
	discard_unit_block		stringnoz["discard_unit=block"]
	discard_unit_segment		stringnoz["discard_unit=segment"]
	discard_unit_section		stringnoz["discard_unit=section"]
	memory_normal			stringnoz["memory=normal"]
	memory_low			stringnoz["memory=low"]
	age_extent_cache		stringnoz["age_extent_cache"]
] [varlen]

ocfs2_options [
	barrier			fs_opt_dec["barrier", int32]
	err_ro			stringnoz["errors=remount-ro"]
	intr			stringnoz["intr"]
	nointr			stringnoz["nointr"]
	heartbeat_none		stringnoz["heartbeat=none"]
	heartbeat_local		stringnoz["heartbeat=local"]
	heartbeat_global	stringnoz["heartbeat=global"]
	data_ordered		stringnoz["data=ordered"]
	data_writeback		stringnoz["data=writeback"]
	atime_quantum		fs_opt_dec["atime_quantum", int32]
	preferred_slot		fs_opt_dec["preferred_slot", int32]
	commit			fs_opt_dec["commit", int32]
	localalloc		fs_opt_dec["localalloc", int32]
	localflocks		stringnoz["localflocks"]
	cluster_stack		stringnoz["cluster_stack=o2cb"]
	user_xattr		stringnoz["user_xattr"]
	nouser_xattr		stringnoz["nouser_xattr"]
	inode64			stringnoz["inode64"]
	acl			stringnoz["acl"]
	noacl			stringnoz["noacl"]
	usrquota		stringnoz["usrquota"]
	grpquota		stringnoz["grpquota"]
	coherency_buffered	stringnoz["coherency=buffered"]
	coherency_full		stringnoz["coherency=full"]
	resv_level		fs_opt_dec["resv_level", int32[0:9]]
	dir_resv_level		fs_opt_dec["dir_resv_level", int32[0:9]]
	journal_async_commit	stringnoz["journal_async_commit"]
	err_cont		stringnoz["errors=continue"]
] [varlen]

bpf_options [
	uid	fs_opt_hex["uid", uid]
	gid	fs_opt_hex["gid", gid]
	mode	fs_opt_oct["mode", int32]
] [varlen]

overlay_options [
	lowerdir		fs_opt_filename["lowerdir"]
	upperdir		fs_opt_filename["upperdir"]
	workdir			fs_opt_filename["workdir"]
	redirect_dir_on		stringnoz["redirect_dir=on"]
	redirect_dir_off	stringnoz["redirect_dir=off"]
	redirect_dir_follow	stringnoz["redirect_dir=follow"]
	redirect_dir_nofollow	stringnoz["redirect_dir=nofollow"]
	default_permissions	stringnoz["default_permissions"]
	index_on		stringnoz["index=on"]
	index_off		stringnoz["index=off"]
	uuid_on			stringnoz["uuid=on"]
	uuid_off		stringnoz["uuid=off"]
	uuid_auto		stringnoz["uuid=auto"]
	uuid_null		stringnoz["uuid=null"]
	nfs_export_on		stringnoz["nfs_export=on"]
	nfs_export_off		stringnoz["nfs_export=off"]
	userxattr		stringnoz["userxattr"]
	xino_on			stringnoz["xino=on"]
	xino_off		stringnoz["xino=off"]
	xino_auto		stringnoz["xino=auto"]
	metacopy_on		stringnoz["metacopy=on"]
	metacopy_off		stringnoz["metacopy=off"]
	verity_on		stringnoz["verity=on"]
	verity_off		stringnoz["verity=off"]
	verity_require		stringnoz["verity=require"]
	volatile		stringnoz["volatile"]
] [varlen]

binder_options [
	max	fs_opt_dec["max", int32[0:4]]
	stats	stringnoz["stats=global"]
] [varlen]

erofs_options [
	user_xattr			stringnoz["user_xattr"]
	nouser_xattr			stringnoz["nouser_xattr"]
	acl				stringnoz["acl"]
	noacl				stringnoz["noacl"]
	fault_injection			fs_opt_hex["fault_injection", int32]
	cache_strategy_disabled		stringnoz["cache_strategy=disabled"]
	cache_strategy_readahead	stringnoz["cache_strategy=readahead"]
	cache_strategy_readaround	stringnoz["cache_strategy=readaround"]
	dax				stringnoz["dax"]
	dax_always			stringnoz["dax=always"]
	dax_never			stringnoz["dax=never"]
] [varlen]

exfat_options [
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	umask		fs_opt_oct["umask", int32]
	dmask		fs_opt_oct["dmask", int32]
	fmask		fs_opt_oct["fmask", int32]
	allow_utime	fs_opt_oct["allow_utime", int32]
	codepage	fs_opt_codepage["codepage"]
	iocharset	fs_opt_codepage["iocharset"]
	namecase	stringnoz["namecase=1"]
	errors_remount	stringnoz["errors=remount-ro"]
	errors_continue	stringnoz["errors=continue"]
	utf8		stringnoz["utf8"]
	discard		stringnoz["discard"]
	keep_last_dots	stringnoz["keep_last_dots"]
	sys_tz		stringnoz["sys_tz"]
	time_offset	fs_opt_hex["time_offset", int32]
	zero_size_dir	stringnoz["zero_size_dir"]
] [varlen]

# TODO: afs should be configured via /proc/fs/afs/{cells,servers} (see fs/afs/proc.c).
# Without that mounting of afs will fail.
afs_source [
	none	string["none"]
	cell	afs_cell_source
] [varlen]

afs_cell_source {
	prefix	flags[afs_cell_prefix, int8]
	cell	stringnoz[afs_cells]
	volname	stringnoz[afs_volnames]
	suffix	stringnoz[afs_suffixes]
	z	const[0, int8]
} [packed]

afs_cell_prefix = '%', '#'
afs_cells = "", "syz0:", "syz1:"
afs_volnames = "syz0", "syz1"
afs_suffixes = "", ".readonly", ".backup"

afs_options [
	autocell	stringnoz["autocell"]
	dyn		stringnoz["dyn"]
	flock_local	stringnoz["flock=local"]
	flock_openafs	stringnoz["flock=openafs"]
	flock_strict	stringnoz["flock=strict"]
	flock_write	stringnoz["flock=write"]
] [varlen]

tmpfs_options [
	uid				fs_opt_hex["uid", uid]
	gid				fs_opt_hex["gid", gid]
	mode				fs_opt_oct["mode", int32]
	nr_blocks			fs_opt_dec_suffix["nr_blocks"]
	nr_inodes			fs_opt_dec_suffix["nr_inodes"]
	size				fs_opt_dec_suffix["size"]
	huge_never			stringnoz["huge=never"]
	huge_always			stringnoz["huge=always"]
	huge_within_size		stringnoz["huge=within_size"]
	huge_advise			stringnoz["huge=advise"]
	mpol				fs_opt["mpol", tmpfs_mpol]
	inode32				stringnoz["inode32"]
	inode64				stringnoz["indo64"]
	noswap				stringnoz["noswap"]
	quota				stringnoz["quota"]
	usrquota			stringnoz["usrquota"]
	grpquota			stringnoz["grpquota"]
	usrquota_block_hardlimit	fs_opt_dec_suffix["usrquota_block_hardlimit"]
	usrquota_inode_hardlimit	fs_opt_dec_suffix["usrquota_inode_hardlimit"]
	grpquota_block_hardlimit	fs_opt_dec_suffix["grpquota_block_hardlimit"]
	grpquota_inode_hardlimit	fs_opt_dec_suffix["grpquota_inode_hardlimit"]
] [varlen]

tmpfs_mpol {
	policy	stringnoz[tmpfs_mpol_policy]
	flags	stringnoz[tmpfs_mpol_flags]
	nodes	optional[tmpfs_mpol_nodes]
} [packed]

tmpfs_mpol_nodes {
	colon	const[':', int8]
	nodes	array[flags[tmpfs_mpol_node_chars, int8]]
}

tmpfs_mpol_policy = "default", "prefer", "bind", "interleave", "local"
tmpfs_mpol_flags = "", "=static", "=relative"
tmpfs_mpol_node_chars = '-', ':', '/', ',', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9'

zonefs_options [
	errors_remount_ro	stringnoz["errors=remount-ro"]
	errors_zone_ro		stringnoz["errors=zone-ro"]
	errors_zone_offline	stringnoz["errors=zone-offline"]
	errors_repair		stringnoz["errors=repair"]
	explicit_open		stringnoz["explicit-open"]
] [varlen]

jffs2_options [
	compr_none	stringnoz["compr=none"]
	compr_lzo	stringnoz["compr=lzo"]
	compr_zlib	stringnoz["compr=zlib"]
	rp_size		fs_opt_dec["rp_size", int32]
] [varlen]

nilfs2_options [
	barrier			stringnoz["barrier"]
	nobarrier		stringnoz["nobarrier"]
	norecovery		stringnoz["norecovery"]
	discard			stringnoz["discard"]
	nodiscard		stringnoz["nodiscard"]
	snapshot		fs_opt_hex["cp", int32[0:3]]
	order_relaxed		stringnoz["order=relaxed"]
	order_strict		stringnoz["order=strict"]
	errors_continue		stringnoz["errors=continue"]
	errors_remount_ro	stringnoz["errors=remount-ro"]
] [varlen]

squashfs_options [
	errors		stringnoz["errors=continue"]
	threads_str	fs_opt["threads", stringnoz[squashfs_thread]]
	threads_num	fs_opt_dec["threads", int32]
] [varlen]

squashfs_thread = "single", "multi", "percpu"

ubifs_options [
	fast_unmount	stringnoz["fast_unmount"]
	norm_unmount	stringnoz["norm_unmount"]
	bulk_read	stringnoz["bulk_read"]
	no_bulk_read	stringnoz["no_bulk_read"]
	chk_data_crc	stringnoz["chk_data_crc"]
	no_chk_data_crc	stringnoz["no_chk_data_crc"]
	compr_none	stringnoz["compr=none"]
	compr_lzo	stringnoz["compr=lzo"]
	compr_zlib	stringnoz["compr=zlib"]
	compr_zstd	stringnoz["compr=zstd"]
	auth_key	fs_opt_str["auth_key"]
	auth_hash_name	fs_opt["auth_hash_name", stringnoz[ubifs_auth_hash_name]]
] [varlen]

adfs_options [
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	ownmask		fs_opt_oct["ownmask", int32]
	othmask		fs_opt_oct["othmask", int32]
	ftsuffix	fs_opt_dec["ftsuffix", int32]
] [varlen]

affs_options [
	bs		fs_opt_hex["bs", flags[affs_bs]]
	mode		fs_opt_oct["mode", int32]
	mufs		stringnoz["mufs"]
	notruncate	stringnoz["nofilenametruncate"]
	protect		stringnoz["protect"]
	reserved	fs_opt_dec["reserved", int32]
	root		fs_opt_dec["root", int32]
	setuid		fs_opt_hex["setuid", uid]
	setgid		fs_opt_hex["setgid", gid]
	verbose		stringnoz["verbose"]
] [varlen]

affs_bs = 512, 1024, 2048, 4096

vxfs_options [
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	iocharset	fs_opt_codepage["iocharset"]
	debug		stringnoz["debug"]
] [varlen]

omfs_options [
	uid	fs_opt_hex["uid", uid]
	gid	fs_opt_hex["gid", gid]
	umask	fs_opt_oct["umask", int32]
	dmask	fs_opt_oct["dmask", int32]
	fmask	fs_opt_oct["fmask", int32]
] [varlen]

hpfs_options [
	help		stringnoz["help"]
	uid		fs_opt_hex["uid", uid]
	gid		fs_opt_hex["gid", gid]
	umask		fs_opt_oct["umask", int32]
	case_lower	stringnoz["case=lower"]
	case_asis	stringnoz["case=asis"]
	check_none	stringnoz["check=none"]
	check_normal	stringnoz["check=normal"]
	check_strict	stringnoz["check=strict"]
	err_cont	stringnoz["errors=continue"]
	err_ro		stringnoz["errors=remount-ro"]
	eas_no		stringnoz["eas=no"]
	eas_ro		stringnoz["ear=ro"]
	eas_rw		stringnoz["eas=rw"]
	chkdsk_no	stringnoz["chkdsk=no"]
	chkdsk_errors	stringnoz["chkdsk=errors"]
	chkdsk_always	stringnoz["chkdsk=always"]
	timeshift	fs_opt_dec["timeshift", int32]
] [varlen]

qnx6_options [
	mmi_fs	stringnoz["mmi_fs"]
] [varlen]

# We could use more hash names, but the problem is that alg_hash_name is 0-terminated.
ubifs_auth_hash_name = "crc32", "ghash", "md5", "sha1"

udf_options [
	novrs		stringnoz["novrs"]
	nostrict	stringnoz["nostrict"]
	unhide		stringnoz["unhide"]
	undelete	stringnoz["undelete"]
	noadinicb	stringnoz["noadinicb"]
	adinicb		stringnoz["adinicb"]
	shortad		stringnoz["shortad"]
	longad		stringnoz["longad"]
	utf8		stringnoz["utf8"]
	iocharset	fs_opt_codepage["iocharset"]
	uid_forget	stringnoz["uid=forget"]
	uid_ignore	stringnoz["uid=ignore"]
	gid_forget	stringnoz["gid=forget"]
	gid_ignore	stringnoz["gid=ignore"]
	gid		fs_opt_dec["gid", gid]
	uid		fs_opt_dec["uid", uid]
	umask		fs_opt_oct["umask", int32]
	mode		fs_opt_oct["mode", int32]
	dmode		fs_opt_oct["dmode", int32]
	bs		fs_opt_dec["bs", int32]
	session		fs_opt_dec["session", int32]
	lastblock	fs_opt_dec["lastblock", int32]
	anchor		fs_opt_dec["anchor", int32]
	volume		fs_opt_dec["volume", int32]
	partition	fs_opt_dec["partition", int32]
	fileset		fs_opt_dec["fileset", int32]
	rootdir		fs_opt_dec["rootdir", int32]
] [varlen]

esdfs_options [
	lower		fs_opt_str["lower"]
	upper		fs_opt_str["upper"]
	derive		fs_opt["derive", stringnoz[esdfs_derive]]
	confine		stringnoz["confine"]
	noconfine	stringnoz["noconfine"]
	derive_gid	stringnoz["derive_gid"]
	default_normal	stringnoz["default_normal"]
	dl_loc		fs_opt_str["dl_loc"]
	dl_uid		fs_opt_oct["dl_uid", uid]
	dl_gid		fs_opt_oct["dl_gid", gid]
	ns_fd		fs_opt_oct["ns_fd", fd_namespace]
	fsuid		fs_opt_oct["fsuid", uid]
	fsgid		fs_opt_oct["fsgid", gid]
	gid		fs_opt_oct["gid", gid]
	mask		fs_opt_oct["mask", int32]
	userid		fs_opt_oct["userid", uid]
	multiuser	stringnoz["multiuser"]
] [varlen]

esdfs_derive = "none", "legacy", "unified", "multi", "public"

bcachefs_options [
	metadata_checksum		fs_opt["metadata_checksum", stringnoz[bcachefs_checksum]]
	data_checksum			fs_opt["data_checksum", stringnoz[bcachefs_checksum]]
	compression			fs_opt["compression", stringnoz[bcachefs_compression]]
	background_compression		fs_opt["background_compression", stringnoz[bcachefs_compression]]
	str_hash			fs_opt["str_hash", stringnoz[bcachefs_str_hash]]
	nocow				stringnoz["nocow"]
	errors_continue			stringnoz["errors=continue"]
	errors_fix_safe			stringnoz["errors=fix_safe"]
	errors_ro			stringnoz["error=ro"]
	metadata_replicas		fs_opt_hex["metadata_replicas", int32[1:4]]
	data_replicas			fs_opt_hex["data_replicas", int32[1:4]]
	metadata_replicas_required	fs_opt_hex["metadata_replicas_required", int32[1:4]]
	data_replicas_required		fs_opt_hex["data_replicas_required", int32[1:4]]
	erasure_code			stringnoz["erasure_code"]
	inodes_32bit			stringnoz["inodes_32bit"]
	shared_inode_numbers		stringnoz["shard_inode_numbers"]
	inodes_use_key_cache		stringnoz["inodes_use_key_cache"]
	btree_node_mem_ptr_optimization	stringnoz["btree_node_mem_ptr_optimization"]
	gc_reserve_percent		fs_opt_hex["gc_reserve_percent", int32[5:21]]
	gc_reserve_bytes		fs_opt_hex["gc_reserve_bytes", int32]
	root_reserve_percent		fs_opt_hex["root_reserve_percent", int32[0:100]]
	wide_macs			stringnoz["wide_macs"]
	inline_data			stringnoz["inline_data"]
	acl				stringnoz["acl"]
	usrquota			stringnoz["usrquota"]
	grpquota			stringnoz["grpquota"]
	prjquota			stringnoz["prjquota"]
	degraded			stringnoz["degraded"]
	very_degraded			stringnoz["very_degraded"]
	no_splitbrain_check		stringnoz["no_splitbrain_check"]
	discard				stringnoz["discard"]
	verbose				stringnoz["verbose"]
	journal_flush_delay		fs_opt_hex["journal_flush_delay", int32]
	journal_flush_disabled		stringnoz["journal_flush_disabled"]
	journal_reclaim_delay		fs_opt_hex["journal_reclaim_delay", int32]
	move_bytes_in_flight		fs_opt_hex["move_bytes_in_flight", int32]
	move_ios_in_flight		fs_opt_hex["move_ios_in_flight", int32[1:1024]]
	fsck				stringnoz["fsck"]
	fsck_memory_usage_percent	fs_opt_hex["fsck_memory_usage_percent", int32[20:70]]
	fix_errors			fs_opt["fix_errors", stringnoz[bcachefs_fix_errors]]
	ratelimit_errors		stringnoz["ratelimit_errors"]
	nochanges			stringnoz["nochanges"]
	norecovery			stringnoz["norecovery"]
	recovery_pass_last		fs_opt["recovery_pass_last", stringnoz[bcachefs_recovery_pass_last]]
	journal_transaction_names	stringnoz["journal_transaction_names"]
	allocator_stuck_timeout		fs_opt_hex["allocator_stuck_timeout", int16]
	noexcl				stringnoz["noexcl"]
	direct_io			stringnoz["direct_io"]
	sb				fs_opt_hex["sb", int32]
	read_only			stringnoz["read_only"]
	reconstruct_alloc		stringnoz["reconstruct_alloc"]
	version_upgrade			fs_opt["version_upgrade", stringnoz[bcachefs_version_upgrade]]
	nocow_enabled			stringnoz["nocow_enabled"]
	no_data_io			stringnoz["no_data_io"]
	btree_node_prefetch		stringnoz["btree_node_prefetch"]
] [varlen]

bcachefs_checksum = "none", "crc32c", "crc64", "xxhash"
bcachefs_compression = "none", "lz4", "gzip", "zstd"
bcachefs_str_hash = "crc32c", "crc64", "siphash"
bcachefs_fix_errors = "exit", "yes", "no", "ask"
bcachefs_version_upgrade = "compatible", "incompatible", "none"
bcachefs_recovery_pass_last = "scan_for_btree_nodes", "check_topology", "accounting_read", "alloc_read", "stripes_read", "initialize_subvolumes", "snapshots_read", "check_allocations", "trans_mark_dev_sbs", "fs_journal_alloc", "set_may_go_rw", "journal_replay", "check_alloc_info", "check_lrus", "check_btree_backpointers", "check_backpointers_to_extents", "check_extents_to_backpointers", "check_alloc_to_lru_refs", "fs_freespace_init", "bucket_gens_init", "reconstruct_snapshots", "check_snapshot_trees", "check_snapshots", "check_subvols", "check_subvol_children", "delete_dead_snapshots", "fs_upgrade_for_subvolumes", "check_inodes", "check_extents", "check_indirect_extents", "check_dirents", "check_xattrs", "check_root", "check_subvolume_structure", "check_directory_structure", "check_nlinks", "resume_logged_ops", "delete_dead_inodes", "fix_reflink_p", "set_fs_needs_rebalance"

cgroup_options [
	all		stringnoz["all"]
	clone_children	stringnoz["clone_children"]
	cpuset_v2_mode	stringnoz["cpuset_v2_mode"]
	name		fs_opt_str["name"]
	none		stringnoz["none"]
	noprefix	stringnoz["noprefix"]
	release_agent	fs_opt_filename["release_agent"]
	xattr		stringnoz["xattr"]
	favordynmods	stringnoz["favordynmods"]
	nofavordynmods	stringnoz["nofavordynmods"]
	subsystem	stringnoz[cgroup_subsystems]
] [varlen]

cgroup2_options [
	nsdelegate			stringnoz["nsdelegate"]
	favordynmods			stringnoz["favordynmods"]
	memory_localevents		stringnoz["memory_localevents"]
	memory_recursiveprot		stringnoz["memory_recursiveprot"]
	memory_hugetlb_accounting	stringnoz["memory_hugetlb_accounting"]
	pids_localevents		stringnoz["pids_localevents"]
	subsystem			stringnoz[cgroup_subsystems]
] [varlen]

ufs_options [
	type	fs_opt["type", stringnoz[ufs_type]]
	onerror	fs_opt["onerror", stringnoz[ufs_onerror]]
] [varlen]

ufs_type = "old", "sunx86", "sun", "sunos", "44bsd", "ufs2", "5xbsd", "hp", "nextstep-cd", "nextstep", "openstep"
ufs_onerror = "lock", "umount", "repair"

codepage_nums = "1250", "1251", "1255", "437", "737", "775", "850", "852", "855", "857", "860", "861", "862", "863", "864", "865", "866", "869", "874", "932", "936", "949", "950"
codepages_names = "macceltic", "maccenteuro", "maccroatian", "maccyrillic", "macgaelic", "macgreek", "maciceland", "macinuit", "macroman", "macromanian", "macturkish", "ascii", "default", "cp1250", "cp1251", "cp1255", "cp437", "cp737", "cp775", "cp850", "cp852", "cp855", "cp857", "cp860", "cp861", "cp862", "cp863", "cp864", "cp865", "cp866", "cp869", "cp874", "cp932", "cp936", "cp949", "cp950", "euc-jp", "iso8859-13", "iso8859-14", "iso8859-15", "iso8859-1", "iso8859-2", "iso8859-3", "iso8859-4", "iso8859-5", "iso8859-6", "iso8859-7", "iso8859-9", "koi8-r", "koi8-ru", "koi8-u", "utf8", "none"
mount_flags = MS_BIND, MS_DIRSYNC, MS_MANDLOCK, MS_MOVE, MS_NOATIME, MS_NODEV, MS_NODIRATIME, MS_NOEXEC, MS_NOSUID, MS_RDONLY, MS_RELATIME, MS_REMOUNT, MS_SILENT, MS_STRICTATIME, MS_SYNCHRONOUS, MS_REC, MS_POSIXACL, MS_UNBINDABLE, MS_PRIVATE, MS_SLAVE, MS_SHARED, MS_I_VERSION, MS_LAZYTIME
umount_flags = MNT_FORCE, MNT_DETACH, MNT_EXPIRE, UMOUNT_NOFOLLOW

file_getattr(dfd fd_dir[opt], filename ptr[in, filename], ufattr ptr[out, file_attr], usize len[ufattr], flags flags[at_flags])
file_setattr(dfd fd_dir[opt], filename ptr[in, filename], ufattr ptr[in, file_attr], usize len[ufattr], flags flags[at_flags])

file_attr {
	fa_xflags	flags[file_attr_flags, int64]
	fa_extsize	int32
	fa_nextents	int32
	fa_projid	int32
	fa_cowextsize	int32
}

file_attr_flags = FS_XFLAG_REALTIME, FS_XFLAG_PREALLOC, FS_XFLAG_IMMUTABLE, FS_XFLAG_APPEND, FS_XFLAG_SYNC, FS_XFLAG_NOATIME, FS_XFLAG_NODUMP, FS_XFLAG_RTINHERIT, FS_XFLAG_PROJINHERIT, FS_XFLAG_NOSYMLINKS, FS_XFLAG_EXTSIZE, FS_XFLAG_EXTSZINHERIT, FS_XFLAG_NODEFRAG, FS_XFLAG_FILESTREAM, FS_XFLAG_DAX, FS_XFLAG_COWEXTSIZE, FS_XFLAG_HASATTR
]

gemini-3-pro-preview

							input: 96782
							output: 37
							thoughts: 2118
						

**Reproducing a Data Race with Concurrent Renames**

Okay, so I've been digging into this, and it looks like the key is the interaction between `d_make_discardable` and `dentry_unlist`. We're targeting a data race here, specifically in a scenario involving concurrent renames. Let's see... the `mount` function is defined in `filesystem.txt`, but that's not our focus now, we're after this race.

The bug hinges on two threads: one renaming "file1" to "file2" (where "file2" already exists), and another renaming "file3" to "file4" (where "file4" already exists). I've got the `rename` function definition from `sys.txt` to confirm the parameters. My initial thought is to craft a syzkaller program to trigger this condition. I'm thinking of creating a few files and then calling `rename` on them concurrently.

I'll need to make sure the target files of the renames exist. The program I'm writing needs to create and rename simultaneously. Okay, so when `rename` is called, it unlinks the target file, and then I know that `d_make_discardable` gets called on the target file. Since this is our target, "file2" and "file4" must exist. Now, it looks like `shmem_rename2` will call `shmem_unlink` on the target. If we can get `d_make_discardable(b)` and `dentry_unlist(c)` to occur simultaneously, we might have something.

`d_make_discardable(b)` happens when `b` is unlinked, and `dentry_unlist(c)` occurs when `c` is killed. After `rename` finishes, it calls `dput` on both the old and new dentries. If `rename` was the only thing holding a reference to `c`, `dput(c)` will kill it. So the important thing is that `c` be killed. `rename` holds a reference to both the old and new dentries. So, in our case, if `file3` or `file4` (which we're calling `c`) are the only reference, calling `dput(c)` at the end of `rename` will be the event we need to trigger the race.

So, in the scenario, when `rename` is finished, it calls `dput(c)`. If `c` is killed, `__dentry_kill(c)` is called. But `c` needs to be a sibling of `b` (e.g., `file2`), and `c->d_sib.next` needs to point to `b`. If we create files in a certain order, and then rename them, we can increase the chance of this condition. I think we can either create a bunch of files and rename them all concurrently, or use a loop. I think I will focus on using the `async` feature to do multiple renames in parallel.

So, I'm going to refine the reproducer, starting with more files in the same directory. I'm going to set up a program to create files, rename them, and run this with syzkaller.

Ah, wait, if we use `async`, we need to ensure the files are actually created *before* the `rename` calls are made. Since syzkaller executes calls sequentially unless `async` is specified, the `creat` calls should be executed in order, and then the renames will happen concurrently.

Now, a crucial point! We need to make sure we close the files immediately after creating them. The `creat` function returns an `fd`. If the file remains open, the dentry will still have a reference. Thus, when `dput` is called at the end of `rename`, it *won't* kill the dentry, because the open file will be holding a reference! If the file is open, the reference count `d_lockref.count` is greater than zero, and the `dput` will just decrement the counter and return without calling `__dentry_kill`. The only reference to the dentry must come from the directory.

Okay, I'm refining the syzkaller program to include `close` calls after each `creat`. This should fix the scenario.

Now, if we unlink the target with `rename`, the target's `d_inode` might be dropped, and then we want to see if `dput` kills it. `rename` calls `dput` on the new dentry as well, so if the new dentry was unlinked, its `d_inode` might also get dropped. So does `dput(new_dentry)` kill

map[ContextFile:fs/dcache.c IncludeLines:true Name:dput]

map[SourceCode: 909:	/*
 910:	 * dput - release a dentry
 911:	 * @dentry: dentry to release 
 912:	 *
 913:	 * Release a dentry. This will drop the usage count and if appropriate
 914:	 * call the dentry unlink method as well as removing it from the queues and
 915:	 * releasing its resources. If the parent dentries were scheduled for release
 916:	 * they too may now get deleted.
 917:	 */
 918:	void dput(struct dentry *dentry)
 919:	{
 920:		if (!dentry)
 921:			return;
 922:		might_sleep();
 923:		rcu_read_lock();
 924:		if (likely(fast_dput(dentry))) {
 925:			rcu_read_unlock();
 926:			return;
 927:		}
 928:		finish_dput(dentry);
 929:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 100274
							output: 39
							thoughts: 10
						

Okay, here's the summary, assuming I'm the one having these thoughts and I am an expert in my field.

**Checking `finish_dput`**

Right, let's see. First things first, I need to verify that `finish_dput` is behaving as expected. Before I even think about deploying anything else, I need to make sure this critical utility is functioning correctly. I'll need to go through the checklist, make sure all tests are passing, and review the logging for any anomalies. I should also check the error handling; if it's gracefully handling edge cases or if it is throwing cryptic errors. I'll focus on potential race conditions and ensure that the process cleans up any temporary files or resources properly. This is foundational; without it, I can't be confident in the broader system. I'll also want to look at recent changes to that function, to make sure there are no obvious regressions, that might have broken it. So, let me get started on that.

map[ContextFile:fs/dcache.c IncludeLines:true Name:finish_dput]

map[SourceCode: 873:	static void finish_dput(struct dentry *dentry)
 874:		__releases(dentry->d_lock)
 875:		__releases(RCU)
 876:	{
 877:		while (lock_for_kill(dentry)) {
 878:			rcu_read_unlock();
 879:			dentry = __dentry_kill(dentry);
 880:			if (!dentry)
 881:				return;
 882:			if (retain_dentry(dentry, true)) {
 883:				spin_unlock(&dentry->d_lock);
 884:				return;
 885:			}
 886:			rcu_read_lock();
 887:		}
 888:		rcu_read_unlock();
 889:		spin_unlock(&dentry->d_lock);
 890:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 100814
							output: 39
							thoughts: 10
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to an expert:

**Checking `fast_dput` Functionality**

Alright, I'm thinking about how `fast_dput` is behaving. I need to quickly assess it. I want to make sure the function is running as expected, handling data transfer efficiently, and isn't introducing any unexpected bottlenecks. I should probably run some tests against it, maybe with varied dataset sizes, to make sure there are no unintended problems.

map[ContextFile:fs/dcache.c IncludeLines:true Name:fast_dput]

map[SourceCode: 803:	/*
 804:	 * Try to do a lockless dput(), and return whether that was successful.
 805:	 *
 806:	 * If unsuccessful, we return false, having already taken the dentry lock.
 807:	 * In that case refcount is guaranteed to be zero and we have already
 808:	 * decided that it's not worth keeping around.
 809:	 *
 810:	 * The caller needs to hold the RCU read lock, so that the dentry is
 811:	 * guaranteed to stay around even if the refcount goes down to zero!
 812:	 */
 813:	static inline bool fast_dput(struct dentry *dentry)
 814:	{
 815:		int ret;
 816:	
 817:		/*
 818:		 * try to decrement the lockref optimistically.
 819:		 */
 820:		ret = lockref_put_return(&dentry->d_lockref);
 821:	
 822:		/*
 823:		 * If the lockref_put_return() failed due to the lock being held
 824:		 * by somebody else, the fast path has failed. We will need to
 825:		 * get the lock, and then check the count again.
 826:		 */
 827:		if (unlikely(ret < 0)) {
 828:			spin_lock(&dentry->d_lock);
 829:			if (WARN_ON_ONCE(dentry->d_lockref.count <= 0)) {
 830:				spin_unlock(&dentry->d_lock);
 831:				return true;
 832:			}
 833:			dentry->d_lockref.count--;
 834:			goto locked;
 835:		}
 836:	
 837:		/*
 838:		 * If we weren't the last ref, we're done.
 839:		 */
 840:		if (ret)
 841:			return true;
 842:	
 843:		/*
 844:		 * Can we decide that decrement of refcount is all we needed without
 845:		 * taking the lock?  There's a very common case when it's all we need -
 846:		 * dentry looks like it ought to be retained and there's nothing else
 847:		 * to do.
 848:		 */
 849:		if (retain_dentry(dentry, false))
 850:			return true;
 851:	
 852:		/*
 853:		 * Either not worth retaining or we can't tell without the lock.
 854:		 * Get the lock, then.  We've already decremented the refcount to 0,
 855:		 * but we'll need to re-check the situation after getting the lock.
 856:		 */
 857:		spin_lock(&dentry->d_lock);
 858:	
 859:		/*
 860:		 * Did somebody else grab a reference to it in the meantime, and
 861:		 * we're no longer the last user after all? Alternatively, somebody
 862:		 * else could have killed it and marked it dead. Either way, we
 863:		 * don't need to do anything else.
 864:		 */
 865:	locked:
 866:		if (dentry->d_lockref.count || retain_dentry(dentry, true)) {
 867:			spin_unlock(&dentry->d_lock);
 868:			return true;
 869:		}
 870:		return false;
 871:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 102013
							output: 39
							thoughts: 1264
						

**Analyzing the `rename` Race Condition**

Okay, let's break this down. My initial thought was, wait a minute, `d_make_discardable` calls `finish_dput(dentry)` and I'm seeing it in the path from a `rename` operation. Let's trace it back. Okay, so `d_make_discardable` is called from `simple_unlink`, which is called from `shmem_unlink`, and that's called from `shmem_rename2`, which comes from `vfs_rename`, and finally `filename_renameat2`. But `filename_renameat2` calls `end_renaming` and *that* calls `dput` on both the old and new dentries!

Now, let's revisit `d_make_discardable`. Ah, it drops a reference count. Specifically, `dentry->d_lockref.count--` *before* calling `finish_dput`. So, it's possible that `d_make_discardable` itself can kill the dentry if the reference count goes to zero! But, `vfs_rename` holds a reference to `new_dentry` (the target), which ensures that the count can't reach zero yet. Okay, I'm with it. Then, I remember that tmpfs dentries have `DCACHE_PERSISTENT` and an extra reference count. So, when `simple_unlink` is called, it drops that extra reference count.

If the only other reference is from `vfs_rename`, then `dentry->d_lockref.count` becomes 1. Then `finish_dput` sees the count is 1, and `retain_dentry` returns true, so it doesn't kill it. Then, `vfs_rename` finishes, and `end_renaming` calls `dput(new_dentry)`. *That* `dput` drops the last reference (count becomes 0), and calls `__dentry_kill`. So, `__dentry_kill` is called from `dput` within `end_renaming`.

Yes, this matches the stack trace in the bug report! We're seeing a read in `dentry_unlist` and that's part of `__dentry_kill`, and the write in `d_make_discardable` during the `rename` process.

Okay, now let's go over the stack trace. The read is coming from: `dentry_unlist fs/dcache.c:640 [inline]`, which is called by `__dentry_kill+0x25c/0x460 fs/dcache.c:684`, called by `finish_dput+0x2b/0x200 fs/dcache.c:879`, called by `dput+0x52/0x60 fs/dcache.c:928`, called by `end_renaming fs/namei.c:4096 [inline]`, called by `filename_renameat2+0x493/0x6e0 fs/namei.c:6146`.

The write is coming from: `d_make_discardable+0x4f/0xa0 fs/dcache.c:936` called by `simple_unlink+0x68/0x80 fs/libfs.c:809`, called by `shmem_unlink+0x12d/0x140 mm/shmem.c:4005`, called by `shmem_rename2+0x18e/0x310 mm/shmem.c:4086`, called by `vfs_rename+0x97f/0xad0 fs/namei.c:6026`, called by `filename_renameat2+0x3b6/0x6e0 fs/namei.c:6144`.

So, it's two tasks doing concurrent `rename` operations. Task 1 is renaming "file1" to "file2" where "file2" exists. Task 2 is renaming "file3" to "file4" where "file4" exists. Task 1 is in `shmem_rename2` -> `d_make_discardable(file2)` and this is modifying `file2->d_flags`. Task 2 is in `end_renaming` -> `dput(file4)` -> `__dentry_kill(file4)` -> `dentry_unlist(file4)`. And `dentry_

map[ContextFile:fs/dcache.c IncludeLines:true Name:__d_alloc]

map[SourceCode:1734:	static struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
1735:	{
1736:		struct dentry *dentry;
1737:		char *dname;
1738:		int err;
1739:	
1740:		dentry = kmem_cache_alloc_lru(dentry_cache, &sb->s_dentry_lru,
1741:					      GFP_KERNEL);
1742:		if (!dentry)
1743:			return NULL;
1744:	
1745:		/*
1746:		 * We guarantee that the inline name is always NUL-terminated.
1747:		 * This way the memcpy() done by the name switching in rename
1748:		 * will still always have a NUL at the end, even if we might
1749:		 * be overwriting an internal NUL character
1750:		 */
1751:		dentry->d_shortname.string[DNAME_INLINE_LEN-1] = 0;
1752:		if (unlikely(!name)) {
1753:			name = &slash_name;
1754:			dname = dentry->d_shortname.string;
1755:		} else if (name->len > DNAME_INLINE_LEN-1) {
1756:			size_t size = offsetof(struct external_name, name[1]);
1757:			struct external_name *p = kmalloc(size + name->len,
1758:							  GFP_KERNEL_ACCOUNT |
1759:							  __GFP_RECLAIMABLE);
1760:			if (!p) {
1761:				kmem_cache_free(dentry_cache, dentry); 
1762:				return NULL;
1763:			}
1764:			atomic_set(&p->count, 1);
1765:			dname = p->name;
1766:		} else  {
1767:			dname = dentry->d_shortname.string;
1768:		}	
1769:	
1770:		dentry->__d_name.len = name->len;
1771:		dentry->__d_name.hash = name->hash;
1772:		memcpy(dname, name->name, name->len);
1773:		dname[name->len] = 0;
1774:	
1775:		/* Make sure we always see the terminating NUL character */
1776:		smp_store_release(&dentry->__d_name.name, dname); /* ^^^ */
1777:	
1778:		dentry->d_flags = 0;
1779:		lockref_init(&dentry->d_lockref);
1780:		seqcount_spinlock_init(&dentry->d_seq, &dentry->d_lock);
1781:		dentry->d_inode = NULL;
1782:		dentry->d_parent = dentry;
1783:		dentry->d_sb = sb;
1784:		dentry->d_op = sb->__s_d_op;
1785:		dentry->d_flags = sb->s_d_flags;
1786:		dentry->d_fsdata = NULL;
1787:		INIT_HLIST_BL_NODE(&dentry->d_hash);
1788:		INIT_LIST_HEAD(&dentry->d_lru);
1789:		INIT_HLIST_HEAD(&dentry->d_children);
1790:		INIT_HLIST_NODE(&dentry->d_u.d_alias);
1791:		INIT_HLIST_NODE(&dentry->d_sib);
1792:	
1793:		if (dentry->d_op && dentry->d_op->d_init) {
1794:			err = dentry->d_op->d_init(dentry);
1795:			if (err) {
1796:				if (dname_external(dentry))
1797:					kfree(external_name(dentry));
1798:				kmem_cache_free(dentry_cache, dentry);
1799:				return NULL;
1800:			}
1801:		}
1802:	
1803:		this_cpu_inc(nr_dentry);
1804:	
1805:		return dentry;
1806:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 105570
							output: 38
							thoughts: 9
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `d_alloc`**

Alright, time to get to it. Let's dig in and see what's happening with `d_alloc`. I need to understand its behavior and how it's interacting with the rest of the system. I'm thinking about its role in memory management. My goal is to get a handle on its internal mechanisms, performance characteristics, and potential bottlenecks. Specifically, I need to know: what's going on *inside* that function.

map[ContextFile:fs/dcache.c IncludeLines:true Name:d_alloc]

map[SourceCode:1808:	/**
1809:	 * d_alloc - allocate a dcache entry
1810:	 * @parent: parent of entry to allocate
1811:	 * @name: qstr of the name
1812:	 *
1813:	 * Allocates a dentry. It returns %NULL if there is insufficient memory
1814:	 * available. On a success the dentry is returned. The name passed in is
1815:	 * copied and the copy passed in may be reused after this call.
1816:	 */
1817:	struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
1818:	{
1819:		struct dentry *dentry = __d_alloc(parent->d_sb, name);
1820:		if (!dentry)
1821:			return NULL;
1822:		spin_lock(&parent->d_lock);
1823:		/*
1824:		 * don't need child lock because it is not subject
1825:		 * to concurrency here
1826:		 */
1827:		dentry->d_parent = dget_dlock(parent);
1828:		hlist_add_head(&dentry->d_sib, &parent->d_children);
1829:		spin_unlock(&parent->d_lock);
1830:	
1831:		return dentry;
1832:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 106157
							output: 39
							thoughts: 3079
						

**Race Condition Analysis and Syzkaller Program Development**

Okay, so the `hlist_add_head` function adds to the head of the list, right? If we create files in a specific order, let's say `file1`, `file2`, `file3`, and `file4`, the list will look like this: `file4 -> file3 -> file2 -> file1`. This means `file4->d_sib.next` points to `file3`. But, what if we create the files in a different order? If we create `file2` and then `file4`, then `file4` ends up at the head, with `file4->d_sib.next` now pointing to `file2`.  Then, if we kill `file4` later, `dentry_unlist(file4)` is going to read `file2->d_flags`. Concurrently, if we unlink `file2`, `d_make_discardable(file2)` will modify its `d_flags`. Bingo!

Alright, let's craft a syzkaller program to trigger this. I'll create `file2`, then `file4`, and then rename `file1` to `file2` and rename `file3` to `file4` concurrently. However, wait, if we create `file2` then `file4`, the list would be `file4 -> file2`. Then if we create `file1` and `file3`, the list is `file3 -> file1 -> file4 -> file2`. So, we rename `file1` to `file2` and `file3` to `file4`, and in the end, `file4->d_sib.next` will still be `file2`, since the list order will always be the same after the `rename` calls. The target of rename will be unlinked, and at the end of the `rename` call, the target dentry will be killed.

The plan is this: The race is between `d_make_discardable(file2)` (in thread 1) and `__dentry_kill(file4)` (in thread 2). The concurrency between those threads is exactly what we need.

To increase the probability, let's create and rename more files concurrently. I'm going to create `file2`, `file4`, `file6`, and `file8` first, then the files that we are renaming (`file1`, `file3`, `file5`, and `file7`) and rename them concurrently. And since the bug report mentions `shmem_rename2`, it implies that the target filesystem is `shmem` (tmpfs). Syzkaller usually runs in a `tmpfs` directory, so, in order to be absolutely sure, it will not be necessary to explicitly mount `tmpfs`.

Double-checking the `creat` and `rename` syntax, the syzkaller program looks good:

```syzkaller
r0 = creat(&(0x7f0000000000)='./file2\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./file4\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./file6\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./file8\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./file1\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./file3\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./file5\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./file7\x00', 0x1ff)
close(r7)
rename(&(0x7f0000000100)='./file1\x00', &(0x7f0000000000)='./file2\x00') (async)
rename(&(0x7f0

map[ContextFile:mm/shmem.c IncludeLines:true Name:shmem_unlink]

map[SourceCode:3994:	static int shmem_unlink(struct inode *dir, struct dentry *dentry)
3995:	{
3996:		struct inode *inode = d_inode(dentry);
3997:	
3998:		if (inode->i_nlink > 1 && !S_ISDIR(inode->i_mode))
3999:			shmem_free_inode(inode->i_sb, 0);
4000:	
4001:		simple_offset_remove(shmem_get_offset_ctx(dir), dentry);
4002:	
4003:		dir->i_size -= BOGO_DIRENT_SIZE;
4004:		inode_inc_iversion(dir);
4005:		simple_unlink(dir, dentry);
4006:	
4007:		/*
4008:		 * For now, VFS can't deal with case-insensitive negative dentries, so
4009:		 * we invalidate them
4010:		 */
4011:		if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
4012:			d_invalidate(dentry);
4013:	
4014:		return 0;
4015:	}
 SourceFile:mm/shmem.c]

gemini-3-pro-preview

							input: 110664
							output: 39
							thoughts: 40
						

Okay, here's my interpretation of those thoughts, presented as a personal thought process, as requested:

**Deconstructing the Unlink Flow**

Alright, let's see... so we're dealing with `vfs_unlink` here. I need to understand this unlink process. Ah, right, `vfs_unlink`… that calls `shmem_unlink`. Now, the important question is: does `vfs_unlink` also call `dput`? That's the critical point I'm trying to get at. It's about how the filesystem structures are cleaned up and resources released. To make sure I understand the complete picture, I should probably check the source code for `do_unlinkat`. That should provide the higher-level context, and help me unravel the call chain from the user-space `unlink` system call all the way down to the shmem-specific stuff, to be sure I am understanding everything correctly.

requested entity does not exist

map[ContextFile:fs/namei.c IncludeLines:true Name:do_unlinkat]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 110964
							output: 18
							thoughts: 24
						

Here's a summary of my thought process:

**Diving into the `do_unlinkat` Implementation**

Okay, time to get my hands dirty. I need to understand the implementation of `do_unlinkat`, and since I know it lives in the core filesystem code, I'll start by checking `fs/namei.c`. `grepper` should quickly help me pinpoint the function's definition and, more importantly, how it interacts with the rest of the file system infrastructure. I'm especially interested in any potential race conditions or locking strategies used here. I want to see how this function handles the actual unlinking process, any error checking, and if there are any interesting optimizations used. From there, I can move on to understand how `do_unlinkat` gets called from user space.

map[Expression:do_unlinkat]

map[Output:Documentation/filesystems/porting.rst=1348=fs/namei.c primitives that consume filesystem references (do_renameat2(),
Documentation/filesystems/porting.rst:1349:do_linkat(), do_symlinkat(), do_mkdirat(), do_mknodat(), do_unlinkat()
Documentation/filesystems/porting.rst-1350-and do_rmdir()) are gone; they are replaced with non-consuming analogues
]

gemini-3-pro-preview

							input: 111298
							output: 42
							thoughts: 34
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Navigating the Unlink Code Path**

Alright, so the core `vfs_unlink` or `do_unlinkat` function, which is usually the entry point for removing files, seems to have been removed or redirected. Interesting. My immediate next step is to examine the likely replacement, which is likely `__do_sys_unlinkat`. That's where I'd expect the actual system call implementation, handling the various aspects of removing a file or directory entry, to reside. I'll need to confirm if it has the same calling conventions, context management, and error handling as its predecessor. Time to dive into the source code and start tracing the path of execution.

map[ContextFile:fs/namei.c IncludeLines:true Name:__do_sys_unlinkat]

map[SourceCode:5561:	SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
5562:	{
5563:		if ((flag & ~AT_REMOVEDIR) != 0)
5564:			return -EINVAL;
5565:	
5566:		CLASS(filename, name)(pathname);
5567:		if (flag & AT_REMOVEDIR)
5568:			return filename_rmdir(dfd, name);
5569:		return filename_unlinkat(dfd, name);
5570:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 111729
							output: 39
							thoughts: 10
						

Okay, here's my interpretation of that thought process, assuming I'm deep in my code and thinking about a file system operation:

**Diving into `filename_unlinkat`**

Right, let's take a look at `filename_unlinkat`. I need to understand exactly what's happening under the hood with this function. It's a crucial piece of the file system puzzle, handling the removal of files and directories with relative or absolute paths. I need to make sure I understand it thoroughly before I consider using it or troubleshooting an existing implementation. I'm focusing on the implementation details now, and I'll see how it fits into the broader context later. I'll need to double check any edge cases too, such as dealing with symlinks, permissions, and concurrent access.

map[ContextFile:fs/namei.c IncludeLines:true Name:filename_unlinkat]

map[SourceCode:5492:	/*
5493:	 * Make sure that the actual truncation of the file will occur outside its
5494:	 * directory's i_rwsem.  Truncate can take a long time if there is a lot of
5495:	 * writeout happening, and we don't want to prevent access to the directory
5496:	 * while waiting on the I/O.
5497:	 */
5498:	int filename_unlinkat(int dfd, struct filename *name)
5499:	{
5500:		int error;
5501:		struct dentry *dentry;
5502:		struct path path;
5503:		struct qstr last;
5504:		int type;
5505:		struct inode *inode;
5506:		struct delegated_inode delegated_inode = { };
5507:		unsigned int lookup_flags = 0;
5508:	retry:
5509:		error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
5510:		if (error)
5511:			return error;
5512:	
5513:		error = -EISDIR;
5514:		if (type != LAST_NORM)
5515:			goto exit_path_put;
5516:	
5517:		error = mnt_want_write(path.mnt);
5518:		if (error)
5519:			goto exit_path_put;
5520:	retry_deleg:
5521:		dentry = start_dirop(path.dentry, &last, lookup_flags);
5522:		error = PTR_ERR(dentry);
5523:		if (IS_ERR(dentry))
5524:			goto exit_drop_write;
5525:	
5526:		/* Why not before? Because we want correct error value */
5527:		if (unlikely(last.name[last.len])) {
5528:			if (d_is_dir(dentry))
5529:				error = -EISDIR;
5530:			else
5531:				error = -ENOTDIR;
5532:			end_dirop(dentry);
5533:			goto exit_drop_write;
5534:		}
5535:		inode = dentry->d_inode;
5536:		ihold(inode);
5537:		error = security_path_unlink(&path, dentry);
5538:		if (error)
5539:			goto exit_end_dirop;
5540:		error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode,
5541:				   dentry, &delegated_inode);
5542:	exit_end_dirop:
5543:		end_dirop(dentry);
5544:		iput(inode);	/* truncate the inode here */
5545:		if (is_delegated(&delegated_inode)) {
5546:			error = break_deleg_wait(&delegated_inode);
5547:			if (!error)
5548:				goto retry_deleg;
5549:		}
5550:	exit_drop_write:
5551:		mnt_drop_write(path.mnt);
5552:	exit_path_put:
5553:		path_put(&path);
5554:		if (retry_estale(error, lookup_flags)) {
5555:			lookup_flags |= LOOKUP_REVAL;
5556:			goto retry;
5557:		}
5558:		return error;
5559:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 112969
							output: 39
							thoughts: 28
						

Here's my thought process, summarized as if I were considering the code:

**Analyzing `end_dirop` and its implications**

Okay, so I'm focusing on how `end_dirop` functions, and my main concern is that it directly calls `dput(dentry)`. This is significant because `dput` is, of course, the key function responsible for decrementing the reference count of a dentry and potentially freeing it. So, essentially, `end_dirop` is the crucial point where a directory operation is finalized, and this dentry, or a part of it, could be potentially discarded.

I need to confirm this understanding, because this has serious implications on concurrency, data structures and other low level concerns. Let me just quickly go back and confirm that `end_dirop` truly is where this happens. Time to dive into the source code and confirm what I already "know".

map[ContextFile:fs/namei.c IncludeLines:true Name:end_dirop]

map[SourceCode:2937:	/**
2938:	 * end_dirop - signal completion of a dirop
2939:	 * @de: the dentry which was returned by start_dirop or similar.
2940:	 *
2941:	 * If the de is an error, nothing happens. Otherwise any lock taken to
2942:	 * protect the dentry is dropped and the dentry itself is release (dput()).
2943:	 */
2944:	void end_dirop(struct dentry *de)
2945:	{
2946:		if (!IS_ERR(de)) {
2947:			inode_unlock(de->d_parent->d_inode);
2948:			dput(de);
2949:		}
2950:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 113467
							output: 39
							thoughts: 428
						

**Unraveling the `unlink` Race Condition**

Okay, so I've been digging into this potential race condition and it looks like `unlink` might be a player here, just like `rename`. Initially, `rename` seemed preferable because it unlinks the target, giving us more direct control. However, after thinking about it, `unlink` offers a simpler approach. Let's trace how `unlink("file4")` works to see if this is possible.

`filename_unlinkat` kicks things off, calling `start_dirop`, which, in turn, looks up the dentry for "file4" and returns it. Then, `vfs_unlink` gets involved, leading to `shmem_unlink(file4)`, which then calls `simple_unlink(file4)`. This eventually calls `d_make_discardable(file4)`. Then, `filename_unlinkat` calls `end_dirop(file4)` which, calls `dput(file4)`. Crucially, if there are no other references to the dentry, `dput(file4)` will kill it by calling `__dentry_kill(file4)`.

Hang on, this is functionally the same as the rename path! But if `unlink` calls `d_make_discardable(file4)` and then *immediately* calls `__dentry_kill(file4)` sequentially in the *same* thread, there's no race. The race needs `d_make_discardable(file2)` in one thread, and `__dentry_kill(file4)` in a *separate* thread.

So if thread 1 does `unlink("file2")` and thread 2 does `unlink("file4")`, we might have a winner!

But wait, hold on. `unlink` grabs `i_rwsem` on the parent directory. Going back to `start_dirop`, it calls `inode_lock(dir)`. Uh oh! `start_dirop` takes `inode_lock(dir)`! If both thread 1 and thread 2 are unlinking files *within the same directory*, they'll be serialized by the `inode_lock(dir)` on the parent!

Time to carefully check `start_dirop` and see what it's really doing...

map[ContextFile:fs/namei.c IncludeLines:true Name:start_dirop]

map[SourceCode:2931:	struct dentry *start_dirop(struct dentry *parent, struct qstr *name,
2932:				   unsigned int lookup_flags)
2933:	{
2934:		return __start_dirop(parent, name, lookup_flags, TASK_NORMAL);
2935:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 114543
							output: 40
							thoughts: 11
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to an expert:

**Internal Code Check - `__start_dirop`**

Right, let's just make sure we're on the same page. The immediate priority is to examine `__start_dirop`. I want to quickly refresh my understanding of how this particular function is structured, what its inputs and outputs are, and, most importantly, where it sits within the broader architecture. Is this the entry point for directory operations? Does it interact with caching layers? How does it handle potential race conditions or locking? I'm expecting this to either be the *very* first step, or perhaps a wrapper for an initial setup that then calls the core functionality. I'm hoping it’s well-documented, because it's the kind of thing that has to be *absolutely* bulletproof.

map[ContextFile:fs/namei.c IncludeLines:true Name:__start_dirop]

map[SourceCode:2896:	/**
2897:	 * __start_dirop - begin a create or remove dirop, performing locking and lookup
2898:	 * @parent:       the dentry of the parent in which the operation will occur
2899:	 * @name:         a qstr holding the name within that parent
2900:	 * @lookup_flags: intent and other lookup flags.
2901:	 * @state:        task state bitmask
2902:	 *
2903:	 * The lookup is performed and necessary locks are taken so that, on success,
2904:	 * the returned dentry can be operated on safely.
2905:	 * The qstr must already have the hash value calculated.
2906:	 *
2907:	 * Returns: a locked dentry, or an error.
2908:	 *
2909:	 */
2910:	static struct dentry *__start_dirop(struct dentry *parent, struct qstr *name,
2911:					    unsigned int lookup_flags,
2912:					    unsigned int state)
2913:	{
2914:		struct dentry *dentry;
2915:		struct inode *dir = d_inode(parent);
2916:	
2917:		if (state == TASK_KILLABLE) {
2918:			int ret = down_write_killable_nested(&dir->i_rwsem,
2919:							     I_MUTEX_PARENT);
2920:			if (ret)
2921:				return ERR_PTR(ret);
2922:		} else {
2923:			inode_lock_nested(dir, I_MUTEX_PARENT);
2924:		}
2925:		dentry = lookup_one_qstr_excl(name, parent, lookup_flags);
2926:		if (IS_ERR(dentry))
2927:			inode_unlock(dir);
2928:		return dentry;
2929:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 115339
							output: 39
							thoughts: 96
						

**Analyzing Potential Race Conditions in File System Operations**

Okay, so I'm digging into this file system code, and my initial thought is, "Yes, `__start_dirop` does indeed grab `inode_lock_nested(dir)`." That's good, that means concurrent `unlink` operations within the same directory should be properly serialized. But wait, if `unlink` is serialized due to the directory inode lock, how is there a race between `d_make_discardable(file2)` and `__dentry_kill(file4)`? That doesn't make intuitive sense given the lock. I need to understand that. Then, aha! I need to consider `vfs_rename` too, since that also holds `inode_lock(dir)`. It's possible the interaction between `rename` and `unlink` is where the unexpected behavior is coming from. So, I need to check the `vfs_rename` implementation closely. Time to dive into that code and see how it handles those locks.

map[ContextFile:fs/namei.c IncludeLines:true Name:vfs_rename]

map[SourceCode:5850:	/**
5851:	 * vfs_rename - rename a filesystem object
5852:	 * @rd:		pointer to &struct renamedata info
5853:	 *
5854:	 * The caller must hold multiple mutexes--see lock_rename()).
5855:	 *
5856:	 * If vfs_rename discovers a delegation in need of breaking at either
5857:	 * the source or destination, it will return -EWOULDBLOCK and return a
5858:	 * reference to the inode in delegated_inode.  The caller should then
5859:	 * break the delegation and retry.  Because breaking a delegation may
5860:	 * take a long time, the caller should drop all locks before doing
5861:	 * so.
5862:	 *
5863:	 * Alternatively, a caller may pass NULL for delegated_inode.  This may
5864:	 * be appropriate for callers that expect the underlying filesystem not
5865:	 * to be NFS exported.
5866:	 *
5867:	 * The worst of all namespace operations - renaming directory. "Perverted"
5868:	 * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
5869:	 * Problems:
5870:	 *
5871:	 *	a) we can get into loop creation.
5872:	 *	b) race potential - two innocent renames can create a loop together.
5873:	 *	   That's where 4.4BSD screws up. Current fix: serialization on
5874:	 *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
5875:	 *	   story.
5876:	 *	c) we may have to lock up to _four_ objects - parents and victim (if it exists),
5877:	 *	   and source (if it's a non-directory or a subdirectory that moves to
5878:	 *	   different parent).
5879:	 *	   And that - after we got ->i_rwsem on parents (until then we don't know
5880:	 *	   whether the target exists).  Solution: try to be smart with locking
5881:	 *	   order for inodes.  We rely on the fact that tree topology may change
5882:	 *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
5883:	 *	   move will be locked.  Thus we can rank directories by the tree
5884:	 *	   (ancestors first) and rank all non-directories after them.
5885:	 *	   That works since everybody except rename does "lock parent, lookup,
5886:	 *	   lock child" and rename is under ->s_vfs_rename_mutex.
5887:	 *	   HOWEVER, it relies on the assumption that any object with ->lookup()
5888:	 *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
5889:	 *	   we'd better make sure that there's no link(2) for them.
5890:	 *	d) conversion from fhandle to dentry may come in the wrong moment - when
5891:	 *	   we are removing the target. Solution: we will have to grab ->i_rwsem
5892:	 *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
5893:	 *	   ->i_rwsem on parents, which works but leads to some truly excessive
5894:	 *	   locking].
5895:	 */
5896:	int vfs_rename(struct renamedata *rd)
5897:	{
5898:		int error;
5899:		struct inode *old_dir = d_inode(rd->old_parent);
5900:		struct inode *new_dir = d_inode(rd->new_parent);
5901:		struct dentry *old_dentry = rd->old_dentry;
5902:		struct dentry *new_dentry = rd->new_dentry;
5903:		struct delegated_inode *delegated_inode = rd->delegated_inode;
5904:		unsigned int flags = rd->flags;
5905:		bool is_dir = d_is_dir(old_dentry);
5906:		struct inode *source = old_dentry->d_inode;
5907:		struct inode *target = new_dentry->d_inode;
5908:		bool new_is_dir = false;
5909:		unsigned max_links = new_dir->i_sb->s_max_links;
5910:		struct name_snapshot old_name;
5911:		bool lock_old_subdir, lock_new_subdir;
5912:	
5913:		if (source == target)
5914:			return 0;
5915:	
5916:		error = may_delete_dentry(rd->mnt_idmap, old_dir, old_dentry, is_dir);
5917:		if (error)
5918:			return error;
5919:	
5920:		if (!target) {
5921:			error = may_create_dentry(rd->mnt_idmap, new_dir, new_dentry);
5922:		} else {
5923:			new_is_dir = d_is_dir(new_dentry);
5924:	
5925:			if (!(flags & RENAME_EXCHANGE))
5926:				error = may_delete_dentry(rd->mnt_idmap, new_dir,
5927:							  new_dentry, is_dir);
5928:			else
5929:				error = may_delete_dentry(rd->mnt_idmap, new_dir,
5930:							  new_dentry, new_is_dir);
5931:		}
5932:		if (error)
5933:			return error;
5934:	
5935:		if (!old_dir->i_op->rename)
5936:			return -EPERM;
5937:	
5938:		/*
5939:		 * If we are going to change the parent - check write permissions,
5940:		 * we'll need to flip '..'.
5941:		 */
5942:		if (new_dir != old_dir) {
5943:			if (is_dir) {
5944:				error = inode_permission(rd->mnt_idmap, source,
5945:							 MAY_WRITE);
5946:				if (error)
5947:					return error;
5948:			}
5949:			if ((flags & RENAME_EXCHANGE) && new_is_dir) {
5950:				error = inode_permission(rd->mnt_idmap, target,
5951:							 MAY_WRITE);
5952:				if (error)
5953:					return error;
5954:			}
5955:		}
5956:	
5957:		error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry,
5958:					      flags);
5959:		if (error)
5960:			return error;
5961:	
5962:		take_dentry_name_snapshot(&old_name, old_dentry);
5963:		dget(new_dentry);
5964:		/*
5965:		 * Lock children.
5966:		 * The source subdirectory needs to be locked on cross-directory
5967:		 * rename or cross-directory exchange since its parent changes.
5968:		 * The target subdirectory needs to be locked on cross-directory
5969:		 * exchange due to parent change and on any rename due to becoming
5970:		 * a victim.
5971:		 * Non-directories need locking in all cases (for NFS reasons);
5972:		 * they get locked after any subdirectories (in inode address order).
5973:		 *
5974:		 * NOTE: WE ONLY LOCK UNRELATED DIRECTORIES IN CROSS-DIRECTORY CASE.
5975:		 * NEVER, EVER DO THAT WITHOUT ->s_vfs_rename_mutex.
5976:		 */
5977:		lock_old_subdir = new_dir != old_dir;
5978:		lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE);
5979:		if (is_dir) {
5980:			if (lock_old_subdir)
5981:				inode_lock_nested(source, I_MUTEX_CHILD);
5982:			if (target && (!new_is_dir || lock_new_subdir))
5983:				inode_lock(target);
5984:		} else if (new_is_dir) {
5985:			if (lock_new_subdir)
5986:				inode_lock_nested(target, I_MUTEX_CHILD);
5987:			inode_lock(source);
5988:		} else {
5989:			lock_two_nondirectories(source, target);
5990:		}
5991:	
5992:		error = -EPERM;
5993:		if (IS_SWAPFILE(source) || (target && IS_SWAPFILE(target)))
5994:			goto out;
5995:	
5996:		error = -EBUSY;
5997:		if (is_local_mountpoint(old_dentry) || is_local_mountpoint(new_dentry))
5998:			goto out;
5999:	
6000:		if (max_links && new_dir != old_dir) {
6001:			error = -EMLINK;
6002:			if (is_dir && !new_is_dir && new_dir->i_nlink >= max_links)
6003:				goto out;
6004:			if ((flags & RENAME_EXCHANGE) && !is_dir && new_is_dir &&
6005:			    old_dir->i_nlink >= max_links)
6006:				goto out;
6007:		}
6008:		error = try_break_deleg(old_dir, delegated_inode);
6009:		if (error)
6010:			goto out;
6011:		if (new_dir != old_dir) {
6012:			error = try_break_deleg(new_dir, delegated_inode);
6013:			if (error)
6014:				goto out;
6015:		}
6016:		if (!is_dir) {
6017:			error = try_break_deleg(source, delegated_inode);
6018:			if (error)
6019:				goto out;
6020:		}
6021:		if (target && !new_is_dir) {
6022:			error = try_break_deleg(target, delegated_inode);
6023:			if (error)
6024:				goto out;
6025:		}
6026:		error = old_dir->i_op->rename(rd->mnt_idmap, old_dir, old_dentry,
6027:					      new_dir, new_dentry, flags);
6028:		if (error)
6029:			goto out;
6030:	
6031:		if (!(flags & RENAME_EXCHANGE) && target) {
6032:			if (is_dir) {
6033:				shrink_dcache_parent(new_dentry);
6034:				target->i_flags |= S_DEAD;
6035:			}
6036:			dont_mount(new_dentry);
6037:			detach_mounts(new_dentry);
6038:		}
6039:		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
6040:			if (!(flags & RENAME_EXCHANGE))
6041:				d_move(old_dentry, new_dentry);
6042:			else
6043:				d_exchange(old_dentry, new_dentry);
6044:		}
6045:	out:
6046:		if (!is_dir || lock_old_subdir)
6047:			inode_unlock(source);
6048:		if (target && (!new_is_dir || lock_new_subdir))
6049:			inode_unlock(target);
6050:		dput(new_dentry);
6051:		if (!error) {
6052:			fsnotify_move(old_dir, new_dir, &old_name.name, is_dir,
6053:				      !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
6054:			if (flags & RENAME_EXCHANGE) {
6055:				fsnotify_move(new_dir, old_dir, &old_dentry->d_name,
6056:					      new_is_dir, NULL, new_dentry);
6057:			}
6058:		}
6059:		release_dentry_name_snapshot(&old_name);
6060:	
6061:		return error;
6062:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 119307
							output: 40
							thoughts: 192
						

**Unraveling the Rename Conundrum**

Okay, so `vfs_rename` is definitely the function called by `do_renameat2`. Right, that makes sense. And `do_renameat2` then calls `lock_rename` on the new and old directories, which is critical. Now I remember – `lock_rename` grabs the `inode_lock` on the *parent* directories. Aha! So renames within the same directory are effectively serialized. That's good, that's what I'd expect.

But wait, if renames in the same directory are serialized, how can there be a race between `d_make_discardable(file2)` and `__dentry_kill(file4)`? That doesn't add up! I must be missing something.

Ah, I see it! Looking at `vfs_rename`, it calls `dput(new_dentry)` at the very end, line 6050, as part of its cleanup. But `do_renameat2`, or maybe `filename_renameat2` which it calls, also calls `dput` on *both* the `old_dentry` and the `new_dentry` after it unlocks the parent directories. So the `dput` calls for the old and new dentries happen outside of the critical section and the locks. Interesting. This is where I need to dig in a bit further to `filename_renameat2` to understand the full picture.

map[ContextFile:fs/namei.c IncludeLines:true Name:filename_renameat2]

map[SourceCode:6065:	int filename_renameat2(int olddfd, struct filename *from,
6066:			       int newdfd, struct filename *to, unsigned int flags)
6067:	{
6068:		struct renamedata rd;
6069:		struct path old_path, new_path;
6070:		struct qstr old_last, new_last;
6071:		int old_type, new_type;
6072:		struct delegated_inode delegated_inode = { };
6073:		unsigned int lookup_flags = 0;
6074:		bool should_retry = false;
6075:		int error;
6076:	
6077:		if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
6078:			return -EINVAL;
6079:	
6080:		if ((flags & (RENAME_NOREPLACE | RENAME_WHITEOUT)) &&
6081:		    (flags & RENAME_EXCHANGE))
6082:			return -EINVAL;
6083:	
6084:	retry:
6085:		error = filename_parentat(olddfd, from, lookup_flags, &old_path,
6086:					  &old_last, &old_type);
6087:		if (error)
6088:			return error;
6089:	
6090:		error = filename_parentat(newdfd, to, lookup_flags, &new_path, &new_last,
6091:					  &new_type);
6092:		if (error)
6093:			goto exit1;
6094:	
6095:		error = -EXDEV;
6096:		if (old_path.mnt != new_path.mnt)
6097:			goto exit2;
6098:	
6099:		error = -EBUSY;
6100:		if (old_type != LAST_NORM)
6101:			goto exit2;
6102:	
6103:		if (flags & RENAME_NOREPLACE)
6104:			error = -EEXIST;
6105:		if (new_type != LAST_NORM)
6106:			goto exit2;
6107:	
6108:		error = mnt_want_write(old_path.mnt);
6109:		if (error)
6110:			goto exit2;
6111:	
6112:	retry_deleg:
6113:		rd.old_parent	   = old_path.dentry;
6114:		rd.mnt_idmap	   = mnt_idmap(old_path.mnt);
6115:		rd.new_parent	   = new_path.dentry;
6116:		rd.delegated_inode = &delegated_inode;
6117:		rd.flags	   = flags;
6118:	
6119:		error = __start_renaming(&rd, lookup_flags, &old_last, &new_last);
6120:		if (error)
6121:			goto exit_lock_rename;
6122:	
6123:		if (flags & RENAME_EXCHANGE) {
6124:			if (!d_is_dir(rd.new_dentry)) {
6125:				error = -ENOTDIR;
6126:				if (new_last.name[new_last.len])
6127:					goto exit_unlock;
6128:			}
6129:		}
6130:		/* unless the source is a directory trailing slashes give -ENOTDIR */
6131:		if (!d_is_dir(rd.old_dentry)) {
6132:			error = -ENOTDIR;
6133:			if (old_last.name[old_last.len])
6134:				goto exit_unlock;
6135:			if (!(flags & RENAME_EXCHANGE) && new_last.name[new_last.len])
6136:				goto exit_unlock;
6137:		}
6138:	
6139:		error = security_path_rename(&old_path, rd.old_dentry,
6140:					     &new_path, rd.new_dentry, flags);
6141:		if (error)
6142:			goto exit_unlock;
6143:	
6144:		error = vfs_rename(&rd);
6145:	exit_unlock:
6146:		end_renaming(&rd);
6147:	exit_lock_rename:
6148:		if (is_delegated(&delegated_inode)) {
6149:			error = break_deleg_wait(&delegated_inode);
6150:			if (!error)
6151:				goto retry_deleg;
6152:		}
6153:		mnt_drop_write(old_path.mnt);
6154:	exit2:
6155:		if (retry_estale(error, lookup_flags))
6156:			should_retry = true;
6157:		path_put(&new_path);
6158:	exit1:
6159:		path_put(&old_path);
6160:		if (should_retry) {
6161:			should_retry = false;
6162:			lookup_flags |= LOOKUP_REVAL;
6163:			goto retry;
6164:		}
6165:		return error;
6166:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 121384
							output: 39
							thoughts: 10
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Analyzing the Renaming Process**

Right, let's take a quick look at `end_renaming`. I'm immediately going to think about its role within the broader renaming strategy we're employing. Is it a finalization step? A clean-up? Perhaps a post-processing function that ensures consistency across the renamed data? I'll need to consider its input parameters – are they indicative of success or failure of the renaming procedure overall? Any logging or error handling within the function is crucial; this will be telling. Knowing the context of this function is going to be helpful. Is the "renaming" operation a single file, database table, or a more complex distributed system that may require rollbacks? Are we potentially dealing with concurrent access issues that `end_renaming` is designed to resolve? Understanding these factors will drive my exploration. Ultimately, my analysis will determine whether the function is appropriately robust and efficient.

map[ContextFile:fs/namei.c IncludeLines:true Name:end_renaming]

map[SourceCode:4092:	void end_renaming(struct renamedata *rd)
4093:	{
4094:		unlock_rename(rd->old_parent, rd->new_parent);
4095:		dput(rd->old_dentry);
4096:		dput(rd->new_dentry);
4097:		dput(rd->old_parent);
4098:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 121787
							output: 1107
							thoughts: 6493
						

**Race Condition Analysis and Reproducer Construction**

Okay, here's the breakdown of my thinking: First, I saw that `end_renaming` calls `unlock_rename` *before* `dput`, meaning the `dput` happens outside the parent directory's lock. This is critical. `dput` then calls `__dentry_kill`, which takes the parent's `d_lock` *and* calls `dentry_unlist`.  Meanwhile, `d_make_discardable` (called from deep within the rename process) is happening *inside* the parent directory's lock.  

So, a race is possible! One thread could be in `vfs_rename`, modifying a dentry's flags within the parent's lock. Another thread could *finish* its rename, release the lock, and then call `dput`. The `dput` then calls `__dentry_kill`, which tries to read the *same* flags, but *outside* the now-released lock.  Specifically, `dentry_unlist` reads `file4->d_sib.next->d_flags` (which is `file2->d_flags`), and `file2`'s flags can be modified concurrently!

The key is that `dentry_unlist` is reading the flags of the *next* dentry in the list. So, if we control the creation order of the files, we can ensure a data race occurs.

Initially, I looked at using `rename` and realized that multiple concurrent renames could trigger this sequence. I sketched out a basic scenario with two `rename` calls, but realized there was no guarantee the parent directory would be locked.

I started by crafting a syzkaller reproducer for this scenario. Initially, I used two `rename` calls, where one thread renames "file3" to "file4," and the second renames "file1" to "file2". The key insight was that `file4`'s `dentry_unlist` would then be looking at `file2`'s flags.

I then tested this with multiple pairs, thinking that it would increase the race probability.

Then, I looked at `unlink` since that would be much simpler: `unlink` also calls `dput` *outside* the lock.  I traced `unlink` and verified that the relevant calls happen in the same out-of-lock sequence. However, even with an `unlink` reproducer, the bug report was focused on `rename` (specifically in `shmem_rename2` and `vfs_rename`). So, I decided to focus on a `rename` reproducer.

The critical insight here is the relative positioning of the files in the directory's dentry list. We need to create the files such that the *target* of a rename is immediately adjacent in the list to another *target*. This is the core of the exploit.

So, I devised the syzkaller program where we create `src1`, `src2`, `src3`, `src4`, `tgt1`, `tgt2`, `tgt3`, `tgt4` and rename each source to each target. This would guarantee `tgt4 -> tgt3 -> tgt2 -> tgt1` on the list. `tgt4` can be unlinked (by another thread), and then when `dentry_unlist(tgt4)` tries to read `tgt3->d_flags` *while* `d_make_discardable(tgt3)` is running, we have the race. Then I increased the number of renames to improve the probability of the race occurring.

Finally, I verified that the `creat` syscall and file descriptor handling are correct in the syzkaller snippet. With this setup, the threads will work concurrently, and the test should reproduce the data race.

map[ReproSyz:r0 = creat(&(0x7f0000000000)='./s1\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./s2\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./s3\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./s4\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./s5\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./s6\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./s7\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./s8\x00', 0x1ff)
close(r7)
r8 = creat(&(0x7f0000000200)='./t1\x00', 0x1ff)
close(r8)
r9 = creat(&(0x7f0000000240)='./t2\x00', 0x1ff)
close(r9)
r10 = creat(&(0x7f0000000280)='./t3\x00', 0x1ff)
close(r10)
r11 = creat(&(0x7f00000002c0)='./t4\x00', 0x1ff)
close(r11)
r12 = creat(&(0x7f0000000300)='./t5\x00', 0x1ff)
close(r12)
r13 = creat(&(0x7f0000000340)='./t6\x00', 0x1ff)
close(r13)
r14 = creat(&(0x7f0000000380)='./t7\x00', 0x1ff)
close(r14)
r15 = creat(&(0x7f00000003c0)='./t8\x00', 0x1ff)
close(r15)
rename(&(0x7f0000000000)='./s1\x00', &(0x7f0000000200)='./t1\x00') (async)
rename(&(0x7f0000000040)='./s2\x00', &(0x7f0000000240)='./t2\x00') (async)
rename(&(0x7f0000000080)='./s3\x00', &(0x7f0000000280)='./t3\x00') (async)
rename(&(0x7f00000000c0)='./s4\x00', &(0x7f00000002c0)='./t4\x00') (async)
rename(&(0x7f0000000100)='./s5\x00', &(0x7f0000000300)='./t5\x00') (async)
rename(&(0x7f0000000140)='./s6\x00', &(0x7f0000000340)='./t6\x00') (async)
rename(&(0x7f0000000180)='./s7\x00', &(0x7f0000000380)='./t7\x00') (async)
rename(&(0x7f00000001c0)='./s8\x00', &(0x7f00000003c0)='./t8\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 130225
							output: 1135
							thoughts: 1239
						

**Debugging the Bug Hunt**

Okay, so the initial attempt didn't trigger the bug I'm after. Hmm, it's likely the timing is off or perhaps the window of opportunity is too narrow. A common approach in these situations is to increase the volume of activity, which should make the edge-case in question more likely to occur. I'll increase the number of files and renames to see if that works.

But hold on, instead of `rename`, why don't I try using `unlink`? It's often simpler to reason about. And actually, since I'm trying to create and delete the files, `unlink` is conceptually cleaner. I can probably execute many more of those than renames. I think `unlink` is much better suited to what I'm doing here. It's a quick sequence. The syzkaller code looks good. Let me give that a shot.

map[ReproSyz:r0 = creat(&(0x7f0000000000)='./f0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./f1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./f2\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./f3\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./f4\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./f5\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./f6\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./f7\x00', 0x1ff)
close(r7)
r8 = creat(&(0x7f0000000200)='./f8\x00', 0x1ff)
close(r8)
r9 = creat(&(0x7f0000000240)='./f9\x00', 0x1ff)
close(r9)
r10 = creat(&(0x7f0000000280)='./fa\x00', 0x1ff)
close(r10)
r11 = creat(&(0x7f00000002c0)='./fb\x00', 0x1ff)
close(r11)
r12 = creat(&(0x7f0000000300)='./fc\x00', 0x1ff)
close(r12)
r13 = creat(&(0x7f0000000340)='./fd\x00', 0x1ff)
close(r13)
r14 = creat(&(0x7f0000000380)='./fe\x00', 0x1ff)
close(r14)
r15 = creat(&(0x7f00000003c0)='./ff\x00', 0x1ff)
close(r15)
unlink(&(0x7f0000000000)='./f0\x00') (async)
unlink(&(0x7f0000000040)='./f1\x00') (async)
unlink(&(0x7f0000000080)='./f2\x00') (async)
unlink(&(0x7f00000000c0)='./f3\x00') (async)
unlink(&(0x7f0000000100)='./f4\x00') (async)
unlink(&(0x7f0000000140)='./f5\x00') (async)
unlink(&(0x7f0000000180)='./f6\x00') (async)
unlink(&(0x7f00000001c0)='./f7\x00') (async)
unlink(&(0x7f0000000200)='./f8\x00') (async)
unlink(&(0x7f0000000240)='./f9\x00') (async)
unlink(&(0x7f0000000280)='./fa\x00') (async)
unlink(&(0x7f00000002c0)='./fb\x00') (async)
unlink(&(0x7f0000000300)='./fc\x00') (async)
unlink(&(0x7f0000000340)='./fd\x00') (async)
unlink(&(0x7f0000000380)='./fe\x00') (async)
unlink(&(0x7f00000003c0)='./ff\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 132817
							output: 38
							thoughts: 1576
						

**Analyzing a Potential Race Condition in Rename Operations**

Okay, still no crash, which is odd. Time to really dig into the timing. I'm focusing on why I'm not seeing the crash in my tests, which I assume is a race condition between `unlink` operations.

My first thought was focusing on `unlink` and two threads unlinking different files. I considered file creation order to understand how files would be placed on the directory's list, specifically with `f1` created after `f0`, leading to `f1` being the head of the directory's sibling list relative to `f0`. The thought process was that if Thread 2 calls `d_make_discardable(f1)`, followed by `dput(f1)` (which then calls `dentry_unlist(f1)`), then a race condition could exist if Thread 1 calls `d_make_discardable(f0)` in the time window after `dentry_unlist` starts in Thread 2. `dentry_unlist(f1)` reads `f0->d_flags` and `d_make_discardable(f0)` is likely to modify them. However, I got the timing wrong. `d_make_discardable(f0)` is called inside a lock, so the timing window is likely too small. `d_make_discardable` is fast but I don't see how the timing window can be that small. `rename` is the same though, so that doesn't increase the window.

The bug report mentions `rename`, and that's when it clicked. In `rename`, `d_make_discardable` and `dput` are called on the target file. It also calls `dput` on the source. The critical detail is that if `rename("src", "tgt")` happens, `tgt` is unlinked and its `d_make_discardable` and `dput` functions are called. `src` however, is not unlinked. If `tgt` is unlinked it drops its directory reference. So the directory's reference is dropped. If no other references exist, the directory reference is dropped. Therefore, I can make `rename` kill `tgt`. This implies a race when Thread 1 does `rename("s1", "t1")` and Thread 2 does `rename("s2", "t2")`. If `t2` is unlinked before `t1`, and `t2`'s `dentry_unlist` reads the `t1->d_flags` before `d_make_discardable(t1)` is called, the race is confirmed.

To solidify this, I checked the sibling list allocation. It adds to the head. This means the list would look like `t2 -> t1` if we create `t1` then `t2`. However, it's more complicated. If we create all files, it's `s2 -> s1 -> t2 -> t1`. This means `t2->d_sib.next` is indeed `t1`, which fits my theory. So I know the order is correct.

Now, let's trace `dentry_unlist` being called on `t2`. I confirmed that `t2` *is* unlinked by `rename`. It calls `shmem_unlink` then `simple_unlink`. Inside this is `d_make_discardable` which drops the extra reference. Then after `rename` finishes and calls `end_renaming`, then calls `dput(t2)`, and the last reference is dropped and `t2` is killed, and then `dentry_unlist` is called. So it should work!

But is there another reference to `t2`? When we `creat` it, we get a file descriptor, and we close the file descriptor. So that's the only references. One is the directory and the other is the reference held by `vfs_rename`. Thus, `t2` should be killed by my logic!

But wait... does `shmem_unlink` drop the directory reference? `simple_unlink` calls `d_make_discardable`, which drops `dentry->d_lockref.count--`. But it *doesn't* call `d_drop(dentry)`? Time to review `simple_unlink` again!

map[ContextFile:fs/libfs.c IncludeLines:true Name:simple_unlink]

map[SourceCode: 806:	int simple_unlink(struct inode *dir, struct dentry *dentry)
 807:	{
 808:		__simple_unlink(dir, dentry);
 809:		d_make_discardable(dentry);
 810:		return 0;
 811:	}
 SourceFile:fs/libfs.c]

gemini-3-pro-preview

							input: 135479
							output: 39
							thoughts: 10
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Digging into the `__simple_unlink` Function**

Right, let's dive into this `__simple_unlink` function. My initial thought is to understand its role. It's likely a streamlined or optimized version of a core unlinking operation, perhaps specifically designed for a specific file system or a particular edge case, or maybe to bypass some error checking for performance. I need to figure out *why* this is the *simple* version, compared to a potentially more comprehensive or "robust" implementation. Is it optimized for speed at the cost of safety? Or is it part of a layered approach where more sophisticated unlink operations are called only when needed? My priority is to understand the trade-offs at play. Does it deal with hard links differently? What about permissions checks or potential race conditions? Is it thread-safe? The design choices here are key. I need to mentally trace the execution path and identify any potential vulnerabilities that might exist in a "simple" unlink. Let's see what it's doing under the hood.

map[ContextFile:fs/libfs.c IncludeLines:true Name:__simple_unlink]

map[SourceCode: 788:	void __simple_unlink(struct inode *dir, struct dentry *dentry)
 789:	{
 790:		struct inode *inode = d_inode(dentry);
 791:	
 792:		inode_set_mtime_to_ts(dir,
 793:				      inode_set_ctime_to_ts(dir, inode_set_ctime_current(inode)));
 794:		drop_nlink(inode);
 795:	}
 SourceFile:fs/libfs.c]

gemini-3-pro-preview

							input: 135930
							output: 575
							thoughts: 1149
						

**Debugging a Potential Race Condition in Dentry Unlinking**

Okay, so I was looking into this `__simple_unlink` function and realized something crucial: it *doesn't* call `d_drop(dentry)` directly.  Instead, `d_make_discardable` is responsible for decrementing the dentry's reference count and scheduling it for destruction using `finish_dput`. The interesting bit is that `finish_dput` only kills the dentry with `__dentry_kill` if the reference count hits zero. Since `vfs_rename` holds a reference, this initial `finish_dput` won't actually unhash or unlist the dentry. But when `vfs_rename` finishes, `end_renaming` calls `dput` and again that calls `finish_dput` which will finally call `__dentry_kill`, unhashing and unlisting it. So, at first glance, the logic *seems* sound.

But then, my mind jumps to a concurrency concern! What if `d_make_discardable` gets called at the *same* time as `dentry_unlist`?  Imagine thread 1 calls `d_make_discardable`, modifiying `dentry->d_flags` in the process. At the same time Thread 2 calls `dentry_unlist`. In `dentry_unlist` reads `dentry->d_sib.next->d_flags` and `dentry->d_sib.next` might be `dentry` from Thread 1! This sounds like a race! I am certain that this race should result in an invalid read.

But why didn't it trigger? My first thought is perhaps the syzkaller program wasn't running enough times to reliably hit the race. So I need to add a loop to the program to increase the probability that the race condition happens. So I came up with an eight file program:

```syzkaller
# loop
r0 = creat(&(0x7f0000000000)='./f0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./f1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./f2\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./f3\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./f4\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./f5\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./f6\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./f7\x00', 0x1ff)
close(r7)
unlink(&(0x7f0000000000)='./f0\x00') (async)
unlink(&(0x7f0000000040)='./f1\x00') (async)
unlink(&(0x7f0000000080)='./f2\x00') (async)
unlink(&(0x7f00000000c0)='./f3\x00') (async)
unlink(&(0x7f0000000100)='./f4\x00') (async)
unlink(&(0x7f0000000140)='./f5\x00') (async)
unlink(&(0x7f0000000180)='./f6\x00') (async)
unlink(&(0x7f00000001c0)='./f7\x00') (async)
```

Then I remembered that syzkaller has `ReproOpts`. I can enable the same looping I wrote in the code by using the `ReproOpts` feature in conjunction with

map[ReproSyz:r0 = creat(&(0x7f0000000000)='./f0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./f1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./f2\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./f3\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./f4\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./f5\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./f6\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./f7\x00', 0x1ff)
close(r7)
unlink(&(0x7f0000000000)='./f0\x00') (async)
unlink(&(0x7f0000000040)='./f1\x00') (async)
unlink(&(0x7f0000000080)='./f2\x00') (async)
unlink(&(0x7f00000000c0)='./f3\x00') (async)
unlink(&(0x7f0000000100)='./f4\x00') (async)
unlink(&(0x7f0000000140)='./f5\x00') (async)
unlink(&(0x7f0000000180)='./f6\x00') (async)
unlink(&(0x7f00000001c0)='./f7\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 138704
							output: 40
							thoughts: 187
						

**Debugging a Persistent Glitch**

Okay, still no crash, which means we're still hunting. The bug report points to something interesting: it seems the issue originates within `shmem_rename2` and involves a file operation. The backtrace is suggestive, we see `shmem_rename2+0x18e/0x310`, `vfs_rename+0x97f/0xad0`, and then deep in name resolution with `filename_renameat2+0x3b6/0x6e0`.

Aha, `shmem_rename2` *calls* `shmem_unlink` on the target. This is where the lightbulb goes off! It makes me wonder if there's a difference between `shmem_rename2` doing it versus `vfs_unlink` directly calling `shmem_unlink`. We need to dissect `shmem_rename2` and understand its interaction with the unlinking process. Let's delve into that function, the nuance is probably hiding there.

map[ContextFile:mm/shmem.c IncludeLines:true Name:shmem_rename2]

map[SourceCode:4042:	/*
4043:	 * The VFS layer already does all the dentry stuff for rename,
4044:	 * we just have to decrement the usage count for the target if
4045:	 * it exists so that the VFS layer correctly free's it when it
4046:	 * gets overwritten.
4047:	 */
4048:	static int shmem_rename2(struct mnt_idmap *idmap,
4049:				 struct inode *old_dir, struct dentry *old_dentry,
4050:				 struct inode *new_dir, struct dentry *new_dentry,
4051:				 unsigned int flags)
4052:	{
4053:		struct inode *inode = d_inode(old_dentry);
4054:		int they_are_dirs = S_ISDIR(inode->i_mode);
4055:		bool had_offset = false;
4056:		int error;
4057:	
4058:		if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4059:			return -EINVAL;
4060:	
4061:		if (flags & RENAME_EXCHANGE)
4062:			return simple_offset_rename_exchange(old_dir, old_dentry,
4063:							     new_dir, new_dentry);
4064:	
4065:		if (!simple_empty(new_dentry))
4066:			return -ENOTEMPTY;
4067:	
4068:		error = simple_offset_add(shmem_get_offset_ctx(new_dir), new_dentry);
4069:		if (error == -EBUSY)
4070:			had_offset = true;
4071:		else if (unlikely(error))
4072:			return error;
4073:	
4074:		if (flags & RENAME_WHITEOUT) {
4075:			error = shmem_whiteout(idmap, old_dir, old_dentry);
4076:			if (error) {
4077:				if (!had_offset)
4078:					simple_offset_remove(shmem_get_offset_ctx(new_dir),
4079:							     new_dentry);
4080:				return error;
4081:			}
4082:		}
4083:	
4084:		simple_offset_rename(old_dir, old_dentry, new_dir, new_dentry);
4085:		if (d_really_is_positive(new_dentry)) {
4086:			(void) shmem_unlink(new_dir, new_dentry);
4087:			if (they_are_dirs) {
4088:				drop_nlink(d_inode(new_dentry));
4089:				drop_nlink(old_dir);
4090:			}
4091:		} else if (they_are_dirs) {
4092:			drop_nlink(old_dir);
4093:			inc_nlink(new_dir);
4094:		}
4095:	
4096:		old_dir->i_size -= BOGO_DIRENT_SIZE;
4097:		new_dir->i_size += BOGO_DIRENT_SIZE;
4098:		simple_rename_timestamp(old_dir, old_dentry, new_dir, new_dentry);
4099:		inode_inc_iversion(old_dir);
4100:		inode_inc_iversion(new_dir);
4101:		return 0;
4102:	}
 SourceFile:mm/shmem.c]

gemini-3-pro-preview

							input: 140168
							output: 1107
							thoughts: 3981
						

**Analyzing a Potential Data Race in `shmem_rename2`**

Okay, so the initial bug report points to a potential data race within `shmem_rename2`, specifically related to `dentry` flags during file renaming. My thought process is now dissecting the code path to pinpoint the exact location. It appears that `shmem_rename2` eventually calls `shmem_unlink`, which in turn calls `simple_unlink`, which then calls `d_make_discardable`. This last function is the key, as it modifies `dentry->d_flags`.

The core question revolves around the interaction of `rename` and `unlink` with the `dentry->d_sib.next` pointer, especially concerning concurrent operations. When files `f0`, `f1`, `f2`, and `f3` are created, they're added to a directory's `d_children` list in reverse order, forming a linked list. If we then *unlink* `f3`, `d_make_discardable(f3)` is called, which changes flags. Then, `dput(f3)` is called and eventually calls `dentry_unlist(f3)`, which iterates over `f3->d_sib.next`, which is `f2`. Therefore `dentry_unlist(f3)` is reading `f2->d_flags`. The potential race arises if, concurrently, *another* process does an `unlink` on `f2`, such as through `d_make_discardable(f2)`, simultaneously *modifying* `f2->d_flags` while the first process is reading them.

I'm thinking, "Why doesn't this trigger reliably? Is the race window too small?" Looking at the code for `d_make_discardable`, it does have a `spin_lock` that protects the write to `dentry->d_flags`, but it does not protect the read by `dentry_unlist` (specifically the `next->d_flags` read). Bingo, the KCSAN bug report says "data-race", and if KCSAN is enabled it *should* detect this if it's there.

I'm starting to consider KCSAN and its capabilities within the test environment. Does the VM used by `reproduce-crash` have KCSAN enabled? I'm assuming it uses the same kernel config. So, if KCSAN *is* enabled, perhaps we just need to increase the number of times we test this.

To address this, I'm thinking of creating a test program. But I realize I can use syzkaller's `repeat: true` option to run the calls repeatedly. I'm now drafting a syzkaller program to create and rename a bunch of files. I set up the initial file and rename, but realize the specific `rename` setup in the original thought process has some flaw. The `rename`s don't trigger the race if the targets are not adjacent in the linked list because the `next` of the target is not a target. I need a *new* file list layout. I need adjacent targets, such as `t4 -> t3 -> t2 -> t1 -> s4 -> s3 -> s2 -> s1`. The goal is for the `rename` target's `d_sib.next` to be another target file, allowing for the concurrent race.

I'm now crafting a syzkaller program to rename files with this new ordering.  But...wait...I've tried a similar setup already, and it *still* didn't trigger. So, I need to go back and check the *precise* setup from that previous attempt. I'm suspecting that `rename` itself might be taking an `inode_lock` on the directory, which *serializes* the rename calls, thus preventing the race.

If the rename calls *are* serialized, I need to analyze the specific order of events to find the race window: Each `rename` takes `inode_lock`, does `d_make_discardable`, and then releases the lock. For a race, I need a second rename call to be in the `dentry_unlist` while the first call is in `d_make_discardable`. So, the renames need to be scheduled correctly. One call must release the `inode_lock` *before* the second enters `d_make_discardable`, *while* the first call enters the `dentry_unlist` on a concurrent CPU.

I'm now thinking about the details of the synchronization. The window of opportunity is between the `inode_unlock` and `dput`, when a concurrent `dput` and call to `dentry_unlist` might hit the race condition. Since `dput(old_dentry)`

map[ReproSyz:r0 = creat(&(0x7f0000000000)='./s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./s2\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./s3\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./s4\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./s5\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./s6\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./s7\x00', 0x1ff)
close(r7)
r8 = creat(&(0x7f0000000200)='./t0\x00', 0x1ff)
close(r8)
r9 = creat(&(0x7f0000000240)='./t1\x00', 0x1ff)
close(r9)
r10 = creat(&(0x7f0000000280)='./t2\x00', 0x1ff)
close(r10)
r11 = creat(&(0x7f00000002c0)='./t3\x00', 0x1ff)
close(r11)
r12 = creat(&(0x7f0000000300)='./t4\x00', 0x1ff)
close(r12)
r13 = creat(&(0x7f0000000340)='./t5\x00', 0x1ff)
close(r13)
r14 = creat(&(0x7f0000000380)='./t6\x00', 0x1ff)
close(r14)
r15 = creat(&(0x7f00000003c0)='./t7\x00', 0x1ff)
close(r15)
rename(&(0x7f0000000000)='./s0\x00', &(0x7f0000000200)='./t0\x00') (async)
rename(&(0x7f0000000040)='./s1\x00', &(0x7f0000000240)='./t1\x00') (async)
rename(&(0x7f0000000080)='./s2\x00', &(0x7f0000000280)='./t2\x00') (async)
rename(&(0x7f00000000c0)='./s3\x00', &(0x7f00000002c0)='./t3\x00') (async)
rename(&(0x7f0000000100)='./s4\x00', &(0x7f0000000300)='./t4\x00') (async)
rename(&(0x7f0000000140)='./s5\x00', &(0x7f0000000340)='./t5\x00') (async)
rename(&(0x7f0000000180)='./s6\x00', &(0x7f0000000380)='./t6\x00') (async)
rename(&(0x7f00000001c0)='./s7\x00', &(0x7f00000003c0)='./t7\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 146306
							output: 39
							thoughts: 1081
						

**Debugging a Persistent Race Condition**

Okay, still no crash. I need to re-examine this bug report carefully. Looking at the call stacks, I see `shmem_rename2`, `vfs_rename`, and `filename_renameat2` involved, specifically around lines `mm/shmem.c:4086`, `fs/namei.c:6026`, and `fs/namei.c:6144` respectively.  The stack also highlights `end_renaming` (inlined from `fs/namei.c:4096`) and the subsequent call to `filename_renameat2`.

The bug report shows a write by one task and a read by another to the *same* address: `0xffff888107b73cc0` of 4 bytes.  The tasks, 3303 and 3718, are on different CPUs (0 and 1).

The crucial question is: are these `rename` operations happening in *different* directories? If so, they wouldn't contend for the `inode_lock(dir)`!  However, if they were in *different* directories, they are not siblings. And the key is in `dentry_unlist`, which iterates over `dentry->d_sib.next`. `d_sib` handles siblings, i.e., entries *within the same directory*. This means the `rename` calls *must* be in the same directory! And if they are in the same directory, they *must* share `inode_lock(dir)`.  Therefore, they cannot be in `vfs_rename` at the same time!  

So, one task *must* have released the `inode_lock(dir)` and the other *must* have acquired it.  That's exactly what I initially analyzed. Task 2 releases the lock, calls `dput(t2)`. Task 1 acquires the lock and calls `d_make_discardable(t1)`. That's the *only* way the race on `t1->d_flags` can happen.

So why isn't it triggering reliably?  I have to check this in detail. What if `t2->d_sib.next` doesn't actually point to `t1`?  I need to revisit `d_alloc`.  

```c
	dentry->d_parent = dget_dlock(parent);
	hlist_add_head(&dentry->d_sib, &parent->d_children);
```

Wait, `hlist_add_head` adds to the *head* of `parent->d_children`. So the *last* created dentry is at the head. If we create `t1` and then `t2`, `parent->d_children` *should* point to `t2`.  Therefore, `t2->d_sib.next` would point to `t1`.  That is correct.

Now, what if `dput(t2)` *doesn't* kill `t2`? If `t2` is still in use, `dput(t2)` won't kill it.  Is it? We created it with `creat` and closed it.  So its `d_lockref.count` is initially 1 (held by the directory). Then `rename("s2", "t2")` unlinks it. `shmem_unlink` calls `simple_unlink(t2)`, and that in turn calls `d_make_discardable(t2)`. `d_make_discardable` does `dentry->d_lockref.count--`, reducing it.  So count becomes 0! Hold on. `vfs_rename` *holds a reference* to `t2`!  `dget(new_dentry)` is called in `vfs_rename`!

```c
	take_dentry_name_snapshot(&old_name, old_dentry);
	dget(new_dentry);
```

Ah!  `vfs_rename` does `dget(new_dentry)`. So before `d_make_discardable`, the count is 2 (directory + `vfs_rename`).  `d_make_discardable` drops the directory's reference, making the count 1. Then `vfs_rename` completes, and `end_renaming` calls `dput(new_dentry)`. *That* drops `vfs_rename`'s reference, making the count 0! So `t2` *is* killed. That's correct.

Okay, what if `t2` is

map[ContextFile:fs/dcache.c IncludeLines:true Name:retain_dentry]

map[SourceCode: 734:	/*
 735:	 * Decide if dentry is worth retaining.  Usually this is called with dentry
 736:	 * locked; if not locked, we are more limited and might not be able to tell
 737:	 * without a lock.  False in this case means "punt to locked path and recheck".
 738:	 *
 739:	 * In case we aren't locked, these predicates are not "stable". However, it is
 740:	 * sufficient that at some point after we dropped the reference the dentry was
 741:	 * hashed and the flags had the proper value. Other dentry users may have
 742:	 * re-gotten a reference to the dentry and change that, but our work is done -
 743:	 * we can leave the dentry around with a zero refcount.
 744:	 */
 745:	static inline bool retain_dentry(struct dentry *dentry, bool locked)
 746:	{
 747:		unsigned int d_flags;
 748:	
 749:		smp_rmb();
 750:		d_flags = READ_ONCE(dentry->d_flags);
 751:	
 752:		// Unreachable? Nobody would be able to look it up, no point retaining
 753:		if (unlikely(d_unhashed(dentry)))
 754:			return false;
 755:	
 756:		// Same if it's disconnected
 757:		if (unlikely(d_flags & DCACHE_DISCONNECTED))
 758:			return false;
 759:	
 760:		// ->d_delete() might tell us not to bother, but that requires
 761:		// ->d_lock; can't decide without it
 762:		if (unlikely(d_flags & DCACHE_OP_DELETE)) {
 763:			if (!locked || dentry->d_op->d_delete(dentry))
 764:				return false;
 765:		}
 766:	
 767:		// Explicitly told not to bother
 768:		if (unlikely(d_flags & DCACHE_DONTCACHE))
 769:			return false;
 770:	
 771:		// At this point it looks like we ought to keep it.  We also might
 772:		// need to do something - put it on LRU if it wasn't there already
 773:		// and mark it referenced if it was on LRU, but not marked yet.
 774:		// Unfortunately, both actions require ->d_lock, so in lockless
 775:		// case we'd have to punt rather than doing those.
 776:		if (unlikely(!(d_flags & DCACHE_LRU_LIST))) {
 777:			if (!locked)
 778:				return false;
 779:			d_lru_add(dentry);
 780:		} else if (unlikely(!(d_flags & DCACHE_REFERENCED))) {
 781:			if (!locked)
 782:				return false;
 783:			dentry->d_flags |= DCACHE_REFERENCED;
 784:		}
 785:		return true;
 786:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 149349
							output: 38
							thoughts: 354
						

**Analyzing a File Rename in the Shared Memory File System**

Okay, here's what's running through my head as I dissect this `shmem_rename2` call. First, I remember `retain_dentry` returning `false` if the dentry is unhashed. Now, I need to figure out if `t2` (the target dentry in the rename operation) is unhashed at this point. `shmem_rename2` then calls `shmem_unlink(t2)`. That makes sense, as the target needs to be removed before it can be replaced. `shmem_unlink` then calls `simple_unlink(t2)`.

This is where it gets interesting: `simple_unlink` calls `d_make_discardable(t2)`. My immediate thought is, "does *that* unhash the dentry?" Let me quickly refresh my understanding of what `d_make_discardable` actually *does*. Ah, no, it simply drops `DCACHE_PERSISTENT` and decrements the reference count, it doesn't actually unhash anything. That's good to know.

Now, I'm second-guessing myself. Does `vfs_rename` itself unhash the target during the rename? Time to revisit the `vfs_rename` code. Let's see... okay, here's the relevant snippet:

```c
	if (!(flags & RENAME_EXCHANGE) && target) {
		if (is_dir) {
			shrink_dcache_parent(new_dentry);
			target->i_flags |= S_DEAD;
		}
		dont_mount(new_dentry);
		detach_mounts(new_dentry);
	}
	if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE)) {
		if (!(flags & RENAME_EXCHANGE))
			d_move(old_dentry, new_dentry);
		else
			d_exchange(old_dentry, new_dentry);
	}
```

Aha! It calls `d_move(old_dentry, new_dentry)`. Now the million-dollar question is what does `d_move` *do*? I should check `d_move`.

map[ContextFile:fs/dcache.c IncludeLines:true Name:d_move]

map[SourceCode:2965:	/*
2966:	 * d_move - move a dentry
2967:	 * @dentry: entry to move
2968:	 * @target: new dentry
2969:	 *
2970:	 * Update the dcache to reflect the move of a file name. Negative
2971:	 * dcache entries should not be moved in this way. See the locking
2972:	 * requirements for __d_move.
2973:	 */
2974:	void d_move(struct dentry *dentry, struct dentry *target)
2975:	{
2976:		write_seqlock(&rename_lock);
2977:		__d_move(dentry, target, false);
2978:		write_sequnlock(&rename_lock);
2979:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 150504
							output: 39
							thoughts: 10
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial Checkpoint: Internal Variable "__d_move"**

Alright, before diving too deep into this problem, I need to take a step back and examine the core components involved. My first thought is to zero in on `__d_move`. It's a key internal variable, and often these variables have significant implications for the program's overall functionality. It's likely involved in the core logic, possibly motion, or data management of a specific module. I need to be sure its value or meaning isn't causing a side effect elsewhere. Let's see what that thing is doing.

map[ContextFile:fs/dcache.c IncludeLines:true Name:__d_move]

map[SourceCode:2869:	/*
2870:	 * __d_move - move a dentry
2871:	 * @dentry: entry to move
2872:	 * @target: new dentry
2873:	 * @exchange: exchange the two dentries
2874:	 *
2875:	 * Update the dcache to reflect the move of a file name. Negative dcache
2876:	 * entries should not be moved in this way. Caller must hold rename_lock, the
2877:	 * i_rwsem of the source and target directories (exclusively), and the sb->
2878:	 * s_vfs_rename_mutex if they differ. See lock_rename().
2879:	 */
2880:	static void __d_move(struct dentry *dentry, struct dentry *target,
2881:			     bool exchange)
2882:	{
2883:		struct dentry *old_parent, *p;
2884:		wait_queue_head_t *d_wait;
2885:		struct inode *dir = NULL;
2886:		unsigned n;
2887:	
2888:		WARN_ON(!dentry->d_inode);
2889:		if (WARN_ON(dentry == target))
2890:			return;
2891:	
2892:		BUG_ON(d_ancestor(target, dentry));
2893:		old_parent = dentry->d_parent;
2894:		p = d_ancestor(old_parent, target);
2895:		if (IS_ROOT(dentry)) {
2896:			BUG_ON(p);
2897:			spin_lock(&target->d_parent->d_lock);
2898:		} else if (!p) {
2899:			/* target is not a descendent of dentry->d_parent */
2900:			spin_lock(&target->d_parent->d_lock);
2901:			spin_lock_nested(&old_parent->d_lock, DENTRY_D_LOCK_NESTED);
2902:		} else {
2903:			BUG_ON(p == dentry);
2904:			spin_lock(&old_parent->d_lock);
2905:			if (p != target)
2906:				spin_lock_nested(&target->d_parent->d_lock,
2907:						DENTRY_D_LOCK_NESTED);
2908:		}
2909:		spin_lock_nested(&dentry->d_lock, 2);
2910:		spin_lock_nested(&target->d_lock, 3);
2911:	
2912:		if (unlikely(d_in_lookup(target))) {
2913:			dir = target->d_parent->d_inode;
2914:			n = start_dir_add(dir);
2915:			d_wait = __d_lookup_unhash(target);
2916:		}
2917:	
2918:		write_seqcount_begin(&dentry->d_seq);
2919:		write_seqcount_begin_nested(&target->d_seq, DENTRY_D_LOCK_NESTED);
2920:	
2921:		/* unhash both */
2922:		if (!d_unhashed(dentry))
2923:			___d_drop(dentry);
2924:		if (!d_unhashed(target))
2925:			___d_drop(target);
2926:	
2927:		/* ... and switch them in the tree */
2928:		dentry->d_parent = target->d_parent;
2929:		if (!exchange) {
2930:			copy_name(dentry, target);
2931:			target->d_hash.pprev = NULL;
2932:			dentry->d_parent->d_lockref.count++;
2933:			if (dentry != old_parent) /* wasn't IS_ROOT */
2934:				WARN_ON(!--old_parent->d_lockref.count);
2935:		} else {
2936:			target->d_parent = old_parent;
2937:			swap_names(dentry, target);
2938:			if (!hlist_unhashed(&target->d_sib))
2939:				__hlist_del(&target->d_sib);
2940:			hlist_add_head(&target->d_sib, &target->d_parent->d_children);
2941:			__d_rehash(target);
2942:			fsnotify_update_flags(target);
2943:		}
2944:		if (!hlist_unhashed(&dentry->d_sib))
2945:			__hlist_del(&dentry->d_sib);
2946:		hlist_add_head(&dentry->d_sib, &dentry->d_parent->d_children);
2947:		__d_rehash(dentry);
2948:		fsnotify_update_flags(dentry);
2949:		fscrypt_handle_d_move(dentry);
2950:	
2951:		write_seqcount_end(&target->d_seq);
2952:		write_seqcount_end(&dentry->d_seq);
2953:	
2954:		if (dir)
2955:			end_dir_add(dir, n, d_wait);
2956:	
2957:		if (dentry->d_parent != old_parent)
2958:			spin_unlock(&dentry->d_parent->d_lock);
2959:		if (dentry != old_parent)
2960:			spin_unlock(&old_parent->d_lock);
2961:		spin_unlock(&target->d_lock);
2962:		spin_unlock(&dentry->d_lock);
2963:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 152320
							output: 39
							thoughts: 681
						

**Analyzing the `__d_move` Logic**

Okay, so I'm digging into `__d_move` and trying to understand its implications, particularly regarding dentry states. It looks like the code unhashes `target` using `d_unhashed` and `___d_drop`. Crucially, if `!exchange`, it *doesn't* rehash `target`. This means `target` ends up in an unhashed state. This detail is key.

If `target` is unhashed, then `retain_dentry(target, false)` will return `false`. That's because an unhashed dentry isn't being "retained" in the traditional sense. This, in turn, means the `fast_dput` path will return `false`, triggering a fall-back to the "locked" path.

Now, because the dentry isn't being retained and its count is zero, `fast_dput` *still* fails. So, the code then calls `dput` which calls `finish_dput(target)`. This eventually leads to `__dentry_kill(target)`. Aha! So `target` *is* effectively killed, which makes sense.

Wait, I need to backtrack slightly, something's not quite right. `__d_move` *also* manipulates `target->d_sib`! But hold on... if `!exchange`, `target->d_sib` is *not* modified! It's left exactly as it was. That means `target` remains linked in the `d_children` list of its parent directory. And its `d_sib.next` is still pointing to the same dentry as before! This seems like a valid optimization. I can see why the code structure is like this.

I should probably think about `unlink`, since it changes the parent dentry. I'll need to figure out what happens in `vfs_unlink`. I remember it calls `shmem_unlink`, which in turn, calls `simple_unlink`. Does this eventually call `d_drop`? Let's check `vfs_unlink`...

map[ContextFile:fs/namei.c IncludeLines:true Name:vfs_unlink]

map[SourceCode:5419:	/**
5420:	 * vfs_unlink - unlink a filesystem object
5421:	 * @idmap:	idmap of the mount the inode was found from
5422:	 * @dir:	parent directory
5423:	 * @dentry:	victim
5424:	 * @delegated_inode: returns victim inode, if the inode is delegated.
5425:	 *
5426:	 * The caller must hold dir->i_rwsem exclusively.
5427:	 *
5428:	 * If vfs_unlink discovers a delegation, it will return -EWOULDBLOCK and
5429:	 * return a reference to the inode in delegated_inode.  The caller
5430:	 * should then break the delegation on that inode and retry.  Because
5431:	 * breaking a delegation may take a long time, the caller should drop
5432:	 * dir->i_rwsem before doing so.
5433:	 *
5434:	 * Alternatively, a caller may pass NULL for delegated_inode.  This may
5435:	 * be appropriate for callers that expect the underlying filesystem not
5436:	 * to be NFS exported.
5437:	 *
5438:	 * If the inode has been found through an idmapped mount the idmap of
5439:	 * the vfsmount must be passed through @idmap. This function will then take
5440:	 * care to map the inode according to @idmap before checking permissions.
5441:	 * On non-idmapped mounts or if permission checking is to be performed on the
5442:	 * raw inode simply pass @nop_mnt_idmap.
5443:	 */
5444:	int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir,
5445:		       struct dentry *dentry, struct delegated_inode *delegated_inode)
5446:	{
5447:		struct inode *target = dentry->d_inode;
5448:		int error = may_delete_dentry(idmap, dir, dentry, false);
5449:	
5450:		if (error)
5451:			return error;
5452:	
5453:		if (!dir->i_op->unlink)
5454:			return -EPERM;
5455:	
5456:		inode_lock(target);
5457:		if (IS_SWAPFILE(target))
5458:			error = -EPERM;
5459:		else if (is_local_mountpoint(dentry))
5460:			error = -EBUSY;
5461:		else {
5462:			error = security_inode_unlink(dir, dentry);
5463:			if (!error) {
5464:				error = try_break_deleg(dir, delegated_inode);
5465:				if (error)
5466:					goto out;
5467:				error = try_break_deleg(target, delegated_inode);
5468:				if (error)
5469:					goto out;
5470:				error = dir->i_op->unlink(dir, dentry);
5471:				if (!error) {
5472:					dont_mount(dentry);
5473:					detach_mounts(dentry);
5474:				}
5475:			}
5476:		}
5477:	out:
5478:		inode_unlock(target);
5479:	
5480:		/* We don't d_delete() NFS sillyrenamed files--they still exist. */
5481:		if (!error && dentry->d_flags & DCACHE_NFSFS_RENAMED) {
5482:			fsnotify_unlink(dir, dentry);
5483:		} else if (!error) {
5484:			fsnotify_link_count(target);
5485:			d_delete_notify(dir, dentry);
5486:		}
5487:	
5488:		return error;
5489:	}
 SourceFile:fs/namei.c]

gemini-3-pro-preview

							input: 154616
							output: 40
							thoughts: 11
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in this field and the context is clear:

**Analyzing the `d_delete_notify` Function**

Alright, time to focus on `d_delete_notify`. This function is critical; it likely handles the cleanup or notification process related to deletions within this system. I need to quickly assess its purpose and behavior. What's the context? What exactly is being deleted? Is this data, a resource, a user account, what? And more importantly, what's *supposed* to happen after the deletion? Is it a cascade effect, a simple acknowledgement, or something more complex? I need to understand the dependencies and implications of this function call. I need to make sure this is done correctly and safely. Time to dive in and get my bearings.

map[ContextFile:fs/namei.c IncludeLines:true Name:d_delete_notify]

map[SourceCode: 363:	/**
 364:	 * d_delete_notify - delete a dentry and call fsnotify_delete()
 365:	 * @dentry: The dentry to delete
 366:	 *
 367:	 * This helper is used to guaranty that the unlinked inode cannot be found
 368:	 * by lookup of this name after fsnotify_delete() event has been delivered.
 369:	 */
 370:	static inline void d_delete_notify(struct inode *dir, struct dentry *dentry)
 371:	{
 372:		struct inode *inode = d_inode(dentry);
 373:	
 374:		ihold(inode);
 375:		d_delete(dentry);
 376:		fsnotify_delete(dir, inode, dentry);
 377:		iput(inode);
 378:	}
 SourceFile:include/linux/fsnotify.h]

gemini-3-pro-preview

							input: 155113
							output: 38
							thoughts: 9
						

Okay, here's my interpretation of that thought process, assuming I'm deep in my domain of expertise:

**Checking `d_delete`**

Alright, let's get down to brass tacks. I've got a mental checklist running, and the next item up is `d_delete`. This usually means I'm either reviewing a deletion function, variable, or data structure. The precise context is missing, so I'm already mentally running through potential scenarios. Is this related to garbage collection? A cache invalidation procedure? Perhaps a database interaction where I'm explicitly removing records? I need to quickly determine the origin and purpose of `d_delete` to ensure proper understanding. This could be crucial to identifying a memory leak, preventing data corruption, or simply ensuring the intended behavior is achieved. Let's see what's what.

map[ContextFile:fs/dcache.c IncludeLines:true Name:d_delete]

map[SourceCode:2517:	void d_delete(struct dentry * dentry)
2518:	{
2519:		struct inode *inode = dentry->d_inode;
2520:	
2521:		spin_lock(&inode->i_lock);
2522:		spin_lock(&dentry->d_lock);
2523:		/*
2524:		 * Are we the only user?
2525:		 */
2526:		if (dentry->d_lockref.count == 1) {
2527:			if (dentry_negative_policy)
2528:				__d_drop(dentry);
2529:			dentry->d_flags &= ~DCACHE_CANT_MOUNT;
2530:			dentry_unlink_inode(dentry);
2531:		} else {
2532:			__d_drop(dentry);
2533:			spin_unlock(&dentry->d_lock);
2534:			spin_unlock(&inode->i_lock);
2535:		}
2536:	}
 SourceFile:fs/dcache.c]

gemini-3-pro-preview

							input: 155656
							output: 546
							thoughts: 2194
						

**Analyzing the Dentry Lifecycle and Identifying a Race Condition**

Okay, let's break this down. My thought process here is centered around understanding the lifecycle of a dentry and how `unlink` and `rename` operations affect it. I started by tracing the call stack: `d_delete` calls `__d_drop`, which unhashes the dentry. If it's unhashed, `retain_dentry` will return false and then `fast_dput` is also false. `dput` then triggers `finish_dput`, eventually leading to `__dentry_kill`. So, `unlink` *does* kill the dentry, exactly as expected.

Then I shifted to `rename`, realizing that it doesn't use `d_delete` on the target. Instead, `vfs_rename` invokes `d_move`. `__d_move` calls `___d_drop` on the target, so the target is unhashed in this scenario as well. Thus both `unlink` and `rename` unhash the target, leading to a kill via `dput`.

But here's a crucial point: Does unhashing the target via `__d_move` also remove it from the sibling list? No, `___d_drop` only removes from the hash table; it *doesn't* touch the `d_sib` list.  Then, again, `dput` calls `__dentry_kill`, and `dentry_unlist` is invoked. `dentry_unlist` iterates through `d_sib.next`. Bingo! This is what I want.

So, the issue is that this race window has to be incredibly small, and that's why it's not triggering reliably. I decided to write a C program to try to trigger it by running `rename` in a tight loop. I thought of a multi-threaded C program like this:

```c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <pthread.h>
#include <fcntl.h>

void *worker1(void *arg) {
    while (1) {
        int fd = creat("s1", 0666); close(fd);
        fd = creat("t1", 0666); close(fd);
        rename("s1", "t1");
    }
    return NULL;
}

void *worker2(void *arg) {
    while (1) {
        int fd = creat("s2", 0666); close(fd);
        fd = creat("t2", 0666); close(fd);
        rename("s2", "t2");
    }
    return NULL;
}

int main() {
    pthread_t t1, t2;
    pthread_create(&t1, NULL, worker1, NULL);
    pthread_create(&t2, NULL, worker2, NULL);
    pthread_join(t1, NULL);
    pthread_join(t2, NULL);
    return 0;
}
```

However, I needed to ensure that the order of the files in the sibling list was favorable. Specifically, I need `t2->d_sib.next` to point to `t1` to correctly trigger the race.  I realized that creating and renaming in a loop combined with the potential for interleaving of syscalls could eventually yield the correct ordering.

But I hit a snag: `rename` *removes* the entries from the list. The `dentry_unlist` function does this and it would just recreate them.

The next step: let's try a syzkaller program, considering the fact that `syz_execute_func` is not enabled, and thus, I can't run the above C program directly in syzkaller. However, I can still leverage `ReproOpts` with `repeat: true` and `procs: 6`. I started with `unlink` but it seems that `rename` might be more promising based on the bug report's details.

Here is an example syzkaller program with `unlink` that I was considering:

```syzkaller
r0 = creat(&(0x7f0000000000)='./f0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./f1\x00', 0x1ff)
close(r1)
unlink(&(0x7f0000000000)='./f0\x0

map[ReproSyz:r0 = creat(&(0x7f0000000000)='./s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./t0\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./s1\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./t1\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./s2\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./t2\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./s3\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./t3\x00', 0x1ff)
close(r7)
rename(&(0x7f0000000000)='./s0\x00', &(0x7f0000000040)='./t0\x00')
rename(&(0x7f0000000080)='./s1\x00', &(0x7f00000000c0)='./t1\x00')
rename(&(0x7f0000000100)='./s2\x00', &(0x7f0000000140)='./t2\x00')
rename(&(0x7f0000000180)='./s3\x00', &(0x7f00000001c0)='./t3\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 159446
							output: 40
							thoughts: 80
						

Okay, here's my take on that.

**Analyzing the Persistent "No Crash" and Exploring `renameat2`**

Alright, still no crash, which is... frustrating, to say the least. Time to start digging deeper. Perhaps I should consider using `renameat2` with the `RENAME_EXCHANGE` flag? It’s often the go-to for atomic operations, and perhaps my approach isn't thread-safe enough without it. Let's see if that provides any clues.

The bug report mentions `shmem_rename2+0x18e/0x310 mm/shmem.c:4086`. That's the breadcrumb I need. Looks like the kernel's shared memory rename function, and the report specifically pinpoints a line of code. Let's get right to it - I'm going to pull up `mm/shmem.c` and check out line 4086. Hopefully, that will lead me to the root cause.

map[ContextFile:mm/shmem.c IncludeLines:true Name:shmem_rename2]

map[SourceCode:4042:	/*
4043:	 * The VFS layer already does all the dentry stuff for rename,
4044:	 * we just have to decrement the usage count for the target if
4045:	 * it exists so that the VFS layer correctly free's it when it
4046:	 * gets overwritten.
4047:	 */
4048:	static int shmem_rename2(struct mnt_idmap *idmap,
4049:				 struct inode *old_dir, struct dentry *old_dentry,
4050:				 struct inode *new_dir, struct dentry *new_dentry,
4051:				 unsigned int flags)
4052:	{
4053:		struct inode *inode = d_inode(old_dentry);
4054:		int they_are_dirs = S_ISDIR(inode->i_mode);
4055:		bool had_offset = false;
4056:		int error;
4057:	
4058:		if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
4059:			return -EINVAL;
4060:	
4061:		if (flags & RENAME_EXCHANGE)
4062:			return simple_offset_rename_exchange(old_dir, old_dentry,
4063:							     new_dir, new_dentry);
4064:	
4065:		if (!simple_empty(new_dentry))
4066:			return -ENOTEMPTY;
4067:	
4068:		error = simple_offset_add(shmem_get_offset_ctx(new_dir), new_dentry);
4069:		if (error == -EBUSY)
4070:			had_offset = true;
4071:		else if (unlikely(error))
4072:			return error;
4073:	
4074:		if (flags & RENAME_WHITEOUT) {
4075:			error = shmem_whiteout(idmap, old_dir, old_dentry);
4076:			if (error) {
4077:				if (!had_offset)
4078:					simple_offset_remove(shmem_get_offset_ctx(new_dir),
4079:							     new_dentry);
4080:				return error;
4081:			}
4082:		}
4083:	
4084:		simple_offset_rename(old_dir, old_dentry, new_dir, new_dentry);
4085:		if (d_really_is_positive(new_dentry)) {
4086:			(void) shmem_unlink(new_dir, new_dentry);
4087:			if (they_are_dirs) {
4088:				drop_nlink(d_inode(new_dentry));
4089:				drop_nlink(old_dir);
4090:			}
4091:		} else if (they_are_dirs) {
4092:			drop_nlink(old_dir);
4093:			inc_nlink(new_dir);
4094:		}
4095:	
4096:		old_dir->i_size -= BOGO_DIRENT_SIZE;
4097:		new_dir->i_size += BOGO_DIRENT_SIZE;
4098:		simple_rename_timestamp(old_dir, old_dentry, new_dir, new_dentry);
4099:		inode_inc_iversion(old_dir);
4100:		inode_inc_iversion(new_dir);
4101:		return 0;
4102:	}
 SourceFile:mm/shmem.c]

gemini-3-pro-preview

							input: 160797
							output: 1086
							thoughts: 3144
						

**Race Condition Analysis in Linux Rename Operation**

Alright, let's break this down. Line 4086 isn't a simple `shmem_unlink` as I initially thought; it's a standard rename that overwrites an existing file. The `RENAME_EXCHANGE` path is irrelevant here. The question is, why isn't the race condition triggering?

I started by checking the `d_sib` list. The code confirms that new dentries are added to the *head* of the `d_children` list. So, if we create `t1`, `t2`, and `t3`, the list order is indeed `t3 -> t2 -> t1`. Now, the order in `d_sib` won't change as the lookup is done via `lock_rename`. Therefore, the dentries remain in the dcache.

The critical bit comes with the `rename` calls. `rename("s1", "t1")` unlinks `t1`, and `rename("s2", "t2")` unlinks `t2`. Since the `d_sib.next` of `t2` is `t1`, if the `rename("s2", "t2")` is finishing, `dput(t2)` calls `__dentry_kill(t2)`, and finally `dentry_unlist(t2)`.

In the `dentry_unlist(t2)` function, the code reads `t1->d_flags` to check `DCACHE_DENTRY_CURSOR` *while* `rename("s1", "t1")` is concurrently calling `d_make_discardable(t1)`. The latter operation modifies `t1->d_flags` via an `&=` which means it's a non-atomic read-modify-write.

This is the race: a plain write to `d_flags` against a plain read. KCSAN might not catch this; perhaps it's not enabled, or the reproducer isn't hitting the bug. To increase the chances of hitting the race, I'll add more files and renames and carefully structure the file names. The Syzkaller code should expose the race now.

I realize that I need the adjacent *targets*. If the source and target files alternate, then the unlink won't trigger the flags check. Let's create `s0`, `s1`, `s2`, `s3`... then `t0`, `t1`, `t2`, `t3`... and `rename` the sources to the targets. Now, the list structure will be perfect, and the race should be reproducible with `collide: true`. This should trigger it, hopefully.

map[ReproSyz:r0 = creat(&(0x7f0000000000)='./s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000040)='./s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f0000000080)='./s2\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f00000000c0)='./s3\x00', 0x1ff)
close(r3)
r4 = creat(&(0x7f0000000100)='./s4\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f0000000140)='./s5\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000180)='./s6\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f00000001c0)='./s7\x00', 0x1ff)
close(r7)
r8 = creat(&(0x7f0000000200)='./t0\x00', 0x1ff)
close(r8)
r9 = creat(&(0x7f0000000240)='./t1\x00', 0x1ff)
close(r9)
r10 = creat(&(0x7f0000000280)='./t2\x00', 0x1ff)
close(r10)
r11 = creat(&(0x7f00000002c0)='./t3\x00', 0x1ff)
close(r11)
r12 = creat(&(0x7f0000000300)='./t4\x00', 0x1ff)
close(r12)
r13 = creat(&(0x7f0000000340)='./t5\x00', 0x1ff)
close(r13)
r14 = creat(&(0x7f0000000380)='./t6\x00', 0x1ff)
close(r14)
r15 = creat(&(0x7f00000003c0)='./t7\x00', 0x1ff)
close(r15)
rename(&(0x7f0000000000)='./s0\x00', &(0x7f0000000200)='./t0\x00')
rename(&(0x7f0000000040)='./s1\x00', &(0x7f0000000240)='./t1\x00')
rename(&(0x7f0000000080)='./s2\x00', &(0x7f0000000280)='./t2\x00')
rename(&(0x7f00000000c0)='./s3\x00', &(0x7f00000002c0)='./t3\x00')
rename(&(0x7f0000000100)='./s4\x00', &(0x7f0000000300)='./t4\x00')
rename(&(0x7f0000000140)='./s5\x00', &(0x7f0000000340)='./t5\x00')
rename(&(0x7f0000000180)='./s6\x00', &(0x7f0000000380)='./t6\x00')
rename(&(0x7f00000001c0)='./s7\x00', &(0x7f00000003c0)='./t7\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 165636
							output: 1331
							thoughts: 4689
						

**The Race in `rename` and `dentry_unlist`**

Okay, so still no crash, but I'm narrowing it down.  The bug report indicates a recent kernel, but no obvious KCSAN issue.  The trace points to `rename`, specifically the interaction with the `d_sib` list.  Initially, I was thinking siblings in the *same* directory, but then I realized the lock order ensures that's serialized.  However, what if two `rename` calls were moving files into the *same* target directory *from different* source directories?

That's when it hit me.  While the target directory's `inode_lock` would serialize operations, the race could be around the list manipulation in `dentry_unlist`.  Specifically, the sequence: thread 2 releases `inode_lock(dir2)` and calls `dput(t2)`, and thread 1 acquires it and calls `d_make_discardable(t1)`. The core problem lies in `dentry_unlist` removing the entry *before* reading the subsequent entry's flags. This tiny window is key, and it all revolves around the `d_sib` list.

The critical line is where `dentry_unlist` modifies `t2->d_sib` before reading `t1->d_flags`. My initial concern about cursor entries adding complexity turned out to be irrelevant.  The bug is in a very tight read on `t1->d_flags`. It is a very small race window. If `t1` is not a cursor, the `while` loop exits after reading exactly once.  So the race window is just this single read.

The key to triggering this is to make this read happen while `d_make_discardable` is writing to that `t1->d_flags` field.  KCSAN is sampling, so it might need a lot of attempts to catch this, making me think about how to ramp up the attempts to trigger the race.  `ReproOpts` with `repeat: true` is a first attempt but I want to make sure syzkaller is running enough times. I think using `async` with a loop is the best answer.

The plan is to leverage syzkaller's `async` feature to run many `rename` operations concurrently. I think the key is to construct the `d_sib` list carefully.  I realized a critical mistake in my earlier syzkaller program:  I was intermixing the creation of 's' and 't' files. The list order matters. It must be created with all the `s` files followed by all the `t` files to create the correct list! If created in the same directory I need to take care to create all `s` files and then all `t` files.

Creating files in separate directories is a much better approach.  Then, I can set up independent rename pairs, all moving to the same target directory.  This should give multiple pairs of `rename` operations running concurrently!
I'll create a syzkaller program with four directories, each with a pair of `rename` operations moving files to the target directory.  This gives the best chance to trigger the race, with many independent `rename` operations running in parallel. This is the way to do it.

map[ReproSyz:mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000080)='./d0/s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f00000000c0)='./d0/t0\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f0000000100)='./d0/t1\x00', 0x1ff)
close(r3)

mkdir(&(0x7f0000000140)='./d1\x00', 0x1ff)
r4 = creat(&(0x7f0000000180)='./d1/s0\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f00000001c0)='./d1/s1\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000200)='./d1/t0\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f0000000240)='./d1/t1\x00', 0x1ff)
close(r7)

mkdir(&(0x7f0000000280)='./d2\x00', 0x1ff)
r8 = creat(&(0x7f00000002c0)='./d2/s0\x00', 0x1ff)
close(r8)
r9 = creat(&(0x7f0000000300)='./d2/s1\x00', 0x1ff)
close(r9)
r10 = creat(&(0x7f0000000340)='./d2/t0\x00', 0x1ff)
close(r10)
r11 = creat(&(0x7f0000000380)='./d2/t1\x00', 0x1ff)
close(r11)

mkdir(&(0x7f00000003c0)='./d3\x00', 0x1ff)
r12 = creat(&(0x7f0000000400)='./d3/s0\x00', 0x1ff)
close(r12)
r13 = creat(&(0x7f0000000440)='./d3/s1\x00', 0x1ff)
close(r13)
r14 = creat(&(0x7f0000000480)='./d3/t0\x00', 0x1ff)
close(r14)
r15 = creat(&(0x7f00000004c0)='./d3/t1\x00', 0x1ff)
close(r15)

rename(&(0x7f0000000040)='./d0/s0\x00', &(0x7f00000000c0)='./d0/t0\x00') (async)
rename(&(0x7f0000000080)='./d0/s1\x00', &(0x7f0000000100)='./d0/t1\x00') (async)
rename(&(0x7f0000000180)='./d1/s0\x00', &(0x7f0000000200)='./d1/t0\x00') (async)
rename(&(0x7f00000001c0)='./d1/s1\x00', &(0x7f0000000240)='./d1/t1\x00') (async)
rename(&(0x7f00000002c0)='./d2/s0\x00', &(0x7f0000000340)='./d2/t0\x00') (async)
rename(&(0x7f0000000300)='./d2/s1\x00', &(0x7f0000000380)='./d2/t1\x00') (async)
rename(&(0x7f0000000400)='./d3/s0\x00', &(0x7f0000000480)='./d3/t0\x00') (async)
rename(&(0x7f0000000440)='./d3/s1\x00', &(0x7f00000004c0)='./d3/t1\x00')]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 172383
							output: 691
							thoughts: 2862
						

**Reproducing the Race in shmem_rename2**

Okay, no crash yet. Let's dig into this. The bug report points to `renameat2` with a standard `rename`. The crash originates within `shmem_unlink` on line 4086 of `mm/shmem.c`. That's only triggered when NOT using `RENAME_EXCHANGE`, which is consistent with the report's details.

The report also shows a data race, a write followed by a read to the same memory location, specifically involving `d_make_discardable`, `simple_unlink`, `shmem_unlink`, and `shmem_rename2` functions on one side and `dentry_unlist`, `__dentry_kill`, `finish_dput`, `dput`, and `filename_renameat2` on the other. This matches my initial analysis, but why isn't the reproducer hitting the race consistently?

Could KCSAN be disabled in the "reproduce-crash" environment? If that's the case, we'd never see the data race because it wouldn't be reported. However, the tool *should* use the same config, so it's probably not the problem. Maybe the tool is assuming the reproducer is correct. Assuming the reproducer is correct, let's look at the logic.

I considered `unlink`, but the report *specifically* mentions `rename`. So, let's focus on `rename`. The goal is to maximize the likelihood of the race condition. I'll construct a simplified reproducer using `syzkaller` to increase the chance of hitting the race. Here's a core idea:

```syzkaller
mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000080)='./d0/s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f00000000c0)='./d0/t0\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f0000000100)='./d0/t1\x00', 0x1ff)
close(r3)
rename(&(0x7f0000000040)='./d0/s0\x00', &(0x7f00000000c0)='./d0/t0\x00') (async)
rename(&(0x7f0000000080)='./d0/s1\x00', &(0x7f0000000100)='./d0/t1\x00') (async)
```

The plan is to use `ReproOpts` with the settings `{"threaded":true,"collide":true,"repeat":true,"procs":6}`. It allows syzkaller to run the program in multiple threads and try to collide the syscalls. While `rename` calls are already async, `collide: true` allows syzkaller to find the exact timing window to trigger the race.

The race happens because `rename("d0/s0", "d0/t0")` unlinks `t0` and calls `d_make_discardable(t0)`, and then `dput(t0)`. If `rename("d0/s1", "d0/t1")` finishes first, it calls `dput(t1)`, which calls `dentry_unlist(t1)`, which reads `t0->d_flags` *concurrently* with `d_make_discardable(t0)` modifying `t0->d_flags`. That's the race!

`renameat2` with `RENAME_EXCHANGE` isn't relevant, since it skips `shmem_unlink`. Using `unlink` is possible but less likely.

Here's the final reproducer.
```syzkaller
mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0

map[ReproOpts:{"threaded":true,"collide":true,"repeat":true,"procs":6} ReproSyz:mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000080)='./d0/s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f00000000c0)='./d0/t0\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f0000000100)='./d0/t1\x00', 0x1ff)
close(r3)
mkdir(&(0x7f0000000140)='./d1\x00', 0x1ff)
r4 = creat(&(0x7f0000000180)='./d1/s0\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f00000001c0)='./d1/s1\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000200)='./d1/t0\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f0000000240)='./d1/t1\x00', 0x1ff)
close(r7)
rename(&(0x7f0000000040)='./d0/s0\x00', &(0x7f00000000c0)='./d0/t0\x00') (async)
rename(&(0x7f0000000080)='./d0/s1\x00', &(0x7f0000000100)='./d0/t1\x00') (async)
rename(&(0x7f0000000180)='./d1/s0\x00', &(0x7f0000000200)='./d1/t0\x00') (async)
rename(&(0x7f00000001c0)='./d1/s1\x00', &(0x7f0000000240)='./d1/t1\x00')]

map[ReproOpts:{"threaded":true,"collide":true,"repeat":true,"procs":6} ReproSyz:mkdir(&(0x7f0000000000)='./d0\x00', 0x1ff)
r0 = creat(&(0x7f0000000040)='./d0/s0\x00', 0x1ff)
close(r0)
r1 = creat(&(0x7f0000000080)='./d0/s1\x00', 0x1ff)
close(r1)
r2 = creat(&(0x7f00000000c0)='./d0/t0\x00', 0x1ff)
close(r2)
r3 = creat(&(0x7f0000000100)='./d0/t1\x00', 0x1ff)
close(r3)
mkdir(&(0x7f0000000140)='./d1\x00', 0x1ff)
r4 = creat(&(0x7f0000000180)='./d1/s0\x00', 0x1ff)
close(r4)
r5 = creat(&(0x7f00000001c0)='./d1/s1\x00', 0x1ff)
close(r5)
r6 = creat(&(0x7f0000000200)='./d1/t0\x00', 0x1ff)
close(r6)
r7 = creat(&(0x7f0000000240)='./d1/t1\x00', 0x1ff)
close(r7)
rename(&(0x7f0000000040)='./d0/s0\x00', &(0x7f00000000c0)='./d0/t0\x00') (async)
rename(&(0x7f0000000080)='./d0/s1\x00', &(0x7f0000000100)='./d0/t1\x00') (async)
rename(&(0x7f0000000180)='./d1/s0\x00', &(0x7f0000000200)='./d1/t0\x00') (async)
rename(&(0x7f00000001c0)='./d1/s1\x00', &(0x7f0000000240)='./d1/t1\x00')]