| 0/0 |
2026/05/22 22:47 |
flow |
assessment-security |
36m
Results: map[DenialOfService:false Explanation:Based on the analysis of the provided KCSAN bug report and the kernel source
code, here is the assessment of the bug:
### Bug Mechanism
The report highlights a data race on the `d_flags` field of a `struct dentry`.
1. **Writer**: `d_shrink_del()` performs a read-modify-write operation
(`dentry->d_flags &= ~(DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);`) to clear the
shrink and LRU list flags. This operation is correctly protected by the child's
`dentry->d_lock`.
2. **Reader**: `d_same_name()` reads `parent->d_flags` (which points to the same
dentry object) to check if the `DCACHE_OP_COMPARE` bit is set (`parent->d_flags
& DCACHE_OP_COMPARE`). This read is performed locklessly (without holding the
parent's `d_lock`).
### Security Impact Assessment
* **Exploitable**: **No**. This is a classic benign data race. The
`DCACHE_OP_COMPARE` bit is set exactly once during the dentry's initialization
(in `d_set_d_op()`) and is never modified or cleared for the lifetime of the
dentry. Because the bit being checked by the reader is constant, the concurrent
modification of other bits (`DCACHE_SHRINK_LIST`, `DCACHE_LRU_LIST`) in the same
32-bit word will not affect the outcome of the read. The reader will always see
the correct value for `DCACHE_OP_COMPARE`. There is no memory corruption,
out-of-bounds access, or control flow hijacking possible here.
* **Denial Of Service**: **No**. In production builds, KCSAN is disabled,
meaning this benign race will silently occur without triggering any warnings,
panics, or system hangs. It does not leak resources or cause deadlocks.
* **Accessible From Unprivileged Processes**: **Yes**. The reader path is
reachable via a standard `openat()` system call, which is heavily used by
unprivileged processes. The writer path is reachable via `shrink_dentry_list()`,
which is called by the dcache shrinker during normal system memory pressure
(which any unprivileged user can induce by allocating memory) or via filesystem
unmounting.
### Conclusion
This is a benign data race inherent to the lockless path-lookup design in the
Linux VFS. It poses no security risk, cannot be exploited, and does not cause a
denial of service. Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]
|
| 1/1 |
2026/05/22 22:47 |
action |
syz-repro-to-c-repro |
0m
Results:
|
| 2/1 |
2026/05/22 22:47 |
action |
kernel-checkouter |
2m
Results: map[KernelSrc:/app/workdir/cache/src/a580385dbb8ecf5336c33a3bd089ab5ead1252dc]
|
| 3/1 |
2026/05/22 22:49 |
action |
kernel-builder |
19m
Results: map[KernelObj:/app/workdir/cache/build/fada836d39ac2253f51960c6abf24deda2d95d2b]
|
| 4/1 |
2026/05/22 23:08 |
action |
codesearch-prepare |
13m
Results: map[Index:codesearch-index]
|
| 5/1 |
2026/05/22 23:22 |
agent |
expert |
1m
Model:
Results: map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]
Instruction:
You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.
Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).
Try different strategies when analyzing the bug:
- think of ways in which the vulnerable code is unreachable
- or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.
Analysis dimensions:
* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.
Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.
* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.
* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).
* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.
* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.
* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).
* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.
* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).
* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.
* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.
Don't make assumptions about the kernel source code (it may be different from what you assume it is).
Extensively use the provided code access tools (codesearch-*, git-*, grepper, etc)
to examine the actual source code, and confirm any assumptions.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
The kernel bug report is:
==================================================================
BUG: KCSAN: data-race in __d_lookup / shrink_dentry_list
read-write to 0xffff888153c80780 of 4 bytes by task 12240 on cpu 0:
d_shrink_del fs/dcache.c:525 [inline]
shrink_dentry_list+0x22d/0x3d0 fs/dcache.c:1214
shrink_dcache_sb+0x15d/0x290 fs/dcache.c:1343
reconfigure_super+0x142/0x590 fs/super.c:1058
do_remount fs/namespace.c:3400 [inline]
path_mount+0xaf7/0xbc0 fs/namespace.c:4146
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x28c/0x2e0 fs/namespace.c:4360
__x64_sys_mount+0x67/0x80 fs/namespace.c:4360
x64_sys_call+0x2d61/0x3020 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff888153c80780 of 4 bytes by task 8596 on cpu 1:
d_same_name fs/dcache.c:2287 [inline]
__d_lookup+0x118/0x340 fs/dcache.c:2525
lookup_fast+0x5e/0x320 fs/namei.c:1873
lookup_fast_for_open fs/namei.c:4548 [inline]
open_last_lookups fs/namei.c:4582 [inline]
path_openat+0x436/0x2050 fs/namei.c:4855
do_file_open+0x16c/0x290 fs/namei.c:4887
do_sys_openat2+0x94/0x130 fs/open.c:1364
do_sys_open fs/open.c:1370 [inline]
__do_sys_openat fs/open.c:1386 [inline]
__se_sys_openat fs/open.c:1381 [inline]
__x64_sys_openat+0xf2/0x120 fs/open.c:1381
x64_sys_call+0x1e39/0x3020 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00140444 -> 0x00100044
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8596 Comm: syz-executor Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
==================================================================
Reply: Based on the analysis of the provided KCSAN bug report and the kernel source code, here is the assessment of the bug:
### Bug Mechanism
The report highlights a data race on the `d_flags` field of a `struct dentry`.
1. **Writer**: `d_shrink_del()` performs a read-modify-write operation (`dentry->d_flags &= ~(DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);`) to clear the shrink and LRU list flags. This operation is correctly protected by the child's `dentry->d_lock`.
2. **Reader**: `d_same_name()` reads `parent->d_flags` (which points to the same dentry object) to check if the `DCACHE_OP_COMPARE` bit is set (`parent->d_flags & DCACHE_OP_COMPARE`). This read is performed locklessly (without holding the parent's `d_lock`).
### Security Impact Assessment
* **Exploitable**: **No**. This is a classic benign data race. The `DCACHE_OP_COMPARE` bit is set exactly once during the dentry's initialization (in `d_set_d_op()`) and is never modified or cleared for the lifetime of the dentry. Because the bit being checked by the reader is constant, the concurrent modification of other bits (`DCACHE_SHRINK_LIST`, `DCACHE_LRU_LIST`) in the same 32-bit word will not affect the outcome of the read. The reader will always see the correct value for `DCACHE_OP_COMPARE`. There is no memory corruption, out-of-bounds access, or control flow hijacking possible here.
* **Denial Of Service**: **No**. In production builds, KCSAN is disabled, meaning this benign race will silently occur without triggering any warnings, panics, or system hangs. It does not leak resources or cause deadlocks.
* **Accessible From Unprivileged Processes**: **Yes**. The reader path is reachable via a standard `openat()` system call, which is heavily used by unprivileged processes. The writer path is reachable via `shrink_dentry_list()`, which is called by the dcache shrinker during normal system memory pressure (which any unprivileged user can induce by allocating memory) or via filesystem unmounting.
### Conclusion
This is a benign data race inherent to the lockless path-lookup design in the Linux VFS. It poses no security risk, cannot be exploited, and does not cause a denial of service.
|
| 6/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 6407
output: 160
thoughts: 115
Thoughts: **Analyzing a KCSAN Data-Race Report in the Dentry Cache**
Okay, so I've got a KCSAN data-race report that's popped up, and it's flagged issues within `__d_lookup` and `shrink_dentry_list`. My initial instinct is to dig in and understand the interaction here. The report points to a read-write race condition specifically, with the write occurring in `d_shrink_del` at `fs/dcache.c:525`, which is, of course, called by `shrink_dentry_list`. The read is happening in `d_same_name` at `fs/dcache.c:2287`, which is called within `__d_lookup`.
Clearly, this requires a deep dive into the dentry cache implementation. My immediate next step is to examine the source code of `fs/dcache.c`. I need to understand the logic flow of both `shrink_dentry_list` and `__d_lookup`, specifically how they interact with the dentry struct and how they are touching the same memory location, at the same time. I'll need to pay close attention to the lock usage within these functions. Iβm especially interested in the synchronization primitives employed β are they using proper locks? If so, what is the ordering and interaction between these locks? Are there any potential ABA problems at play? I'll probably start by looking at the data structures involved, specifically the `dentry` and its associated fields. I need to figure out what data is being read and written and under what conditions. Letβs get to the code.
|
| 7/2 |
2026/05/22 23:22 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/dcache.c IncludeLines:true Name:d_shrink_del]
Results: map[SourceCode: 521: static void d_shrink_del(struct dentry *dentry)
522: {
523: D_FLAG_VERIFY(dentry, DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);
524: list_del_init(&dentry->d_lru);
525: dentry->d_flags &= ~(DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);
526: this_cpu_dec(nr_dentry_unused);
527: }
SourceFile:fs/dcache.c]
|
| 8/2 |
2026/05/22 23:22 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/dcache.c IncludeLines:true Name:d_same_name]
Results: map[SourceCode:2276: /**
2277: * d_same_name - compare dentry name with case-exact name
2278: * @dentry: the negative dentry that was passed to the parent's lookup func
2279: * @parent: parent dentry
2280: * @name: the case-exact name to be associated with the returned dentry
2281: *
2282: * Return: true if names are same, or false
2283: */
2284: bool d_same_name(const struct dentry *dentry, const struct dentry *parent,
2285: const struct qstr *name)
2286: {
2287: if (likely(!(parent->d_flags & DCACHE_OP_COMPARE))) {
2288: if (dentry->d_name.len != name->len)
2289: return false;
2290: return dentry_cmp(dentry, name->name, name->len) == 0;
2291: }
2292: return parent->d_op->d_compare(dentry,
2293: dentry->d_name.len, dentry->d_name.name,
2294: name) == 0;
2295: }
SourceFile:fs/dcache.c]
|
| 9/2 |
2026/05/22 23:22 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/dcache.c IncludeLines:true Name:__d_lookup]
Results: map[SourceCode:2469: /**
2470: * __d_lookup - search for a dentry (racy)
2471: * @parent: parent dentry
2472: * @name: qstr of name we wish to find
2473: * Returns: dentry, or NULL
2474: *
2475: * __d_lookup is like d_lookup, however it may (rarely) return a
2476: * false-negative result due to unrelated rename activity.
2477: *
2478: * __d_lookup is slightly faster by avoiding rename_lock read seqlock,
2479: * however it must be used carefully, eg. with a following d_lookup in
2480: * the case of failure.
2481: *
2482: * __d_lookup callers must be commented.
2483: */
2484: struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
2485: {
2486: unsigned int hash = name->hash;
2487: struct hlist_bl_head *b = d_hash(hash);
2488: struct hlist_bl_node *node;
2489: struct dentry *found = NULL;
2490: struct dentry *dentry;
2491:
2492: /*
2493: * Note: There is significant duplication with __d_lookup_rcu which is
2494: * required to prevent single threaded performance regressions
2495: * especially on architectures where smp_rmb (in seqcounts) are costly.
2496: * Keep the two functions in sync.
2497: */
2498:
2499: /*
2500: * The hash list is protected using RCU.
2501: *
2502: * Take d_lock when comparing a candidate dentry, to avoid races
2503: * with d_move().
2504: *
2505: * It is possible that concurrent renames can mess up our list
2506: * walk here and result in missing our dentry, resulting in the
2507: * false-negative result. d_lookup() protects against concurrent
2508: * renames using rename_lock seqlock.
2509: *
2510: * See Documentation/filesystems/path-lookup.txt for more details.
2511: */
2512: rcu_read_lock();
2513:
2514: hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
2515:
2516: if (dentry->d_name.hash != hash)
2517: continue;
2518:
2519: spin_lock(&dentry->d_lock);
2520: if (dentry->d_parent != parent)
2521: goto next;
2522: if (d_unhashed(dentry))
2523: goto next;
2524:
2525: if (!d_same_name(dentry, parent, name))
2526: goto next;
2527:
2528: dentry->d_lockref.count++;
2529: found = dentry;
2530: spin_unlock(&dentry->d_lock);
2531: break;
2532: next:
2533: spin_unlock(&dentry->d_lock);
2534: }
2535: rcu_read_unlock();
2536:
2537: return found;
2538: }
SourceFile:fs/dcache.c]
|
| 10/2 |
2026/05/22 23:22 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/dcache.c IncludeLines:true Name:shrink_dentry_list]
Results: map[SourceCode:1203: void shrink_dentry_list(struct list_head *list)
1204: {
1205: while (!list_empty(list)) {
1206: struct dentry *dentry;
1207:
1208: dentry = list_entry(list->prev, struct dentry, d_lru);
1209: spin_lock(&dentry->d_lock);
1210: rcu_read_lock();
1211: if (!lock_for_kill(dentry)) {
1212: bool can_free;
1213: rcu_read_unlock();
1214: d_shrink_del(dentry);
1215: can_free = dentry->d_flags & DCACHE_DENTRY_KILLED;
1216: spin_unlock(&dentry->d_lock);
1217: if (can_free)
1218: dentry_free(dentry);
1219: continue;
1220: }
1221: d_shrink_del(dentry);
1222: shrink_kill(dentry);
1223: }
1224: }
SourceFile:fs/dcache.c]
|
| 11/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 8965
output: 25
thoughts: 1302
Thoughts: **Benign Data Race in VFS: Analyzing a Dentry Flag Access**
Okay, let's break this down. The report flags a potential data race involving `parent->d_flags` (or effectively `dentry->d_flags`). The core issue seems to stem from a conflict between `d_shrink_del` and `d_same_name`.
`d_shrink_del` modifies `dentry->d_flags` by clearing certain bits: `DCACHE_SHRINK_LIST` and `DCACHE_LRU_LIST`. Crucially, it does so with a read-modify-write operation (`&= ~(...)`). On the other hand, `d_same_name` reads `parent->d_flags`, specifically checking if `DCACHE_OP_COMPARE` is set.
The critical insight here, gleaned from the call stack, is that `parent` in `d_same_name` *is* the same `dentry` that's passed to `d_shrink_del`. We can see it in `__d_lookup`. The report explicitly confirms this link: the addresses match.
`d_shrink_del` is called *with* `dentry->d_lock` held, which is good. But the real kicker is that `__d_lookup` does *not* hold `parent->d_lock` when it calls `d_same_name`. It holds the *child's* lock (`dentry->d_lock`). So, there's a potential race: `d_shrink_del` modifies `d_flags` *under a lock*, and `d_same_name` reads it *without* a lock, or any RCU protection, only the child's dentry spinlock.
This pattern is a classic VFS scenario. The question is, does this matter? While the read-modify-write in `d_shrink_del` *could* be problematic if done without atomics, or locking which covers the readers, a quick review of the code reveals that `d_flags` is an `unsigned int` so the atomic nature of the operation is not guaranteed.
However, the key is `DCACHE_OP_COMPARE`. This bit, I'm pretty sure, is set *during dentry allocation* if the filesystem has a `d_compare` operation, and it's never cleared or modified later. So, once set, it's *constant*. Thus, the value of `DCACHE_OP_COMPARE` is constant for the lifetime of the dentry. The read in `d_same_name` should always see the correct value of this *one specific bit*. The compiler shouldn't do anything crazy like load/store tearing which is impossible for an aligned 32-bit integer on x86.
Furthermore, `d_shrink_del` is *only* modifying `d_flags` under `dentry->d_lock`. This means no concurrent writers exist to this data.
Therefore, we have a benign data race. The reader in `d_same_name` is checking a constant bit. It won't lead to incorrect results.
I need to confirm the constant nature of `DCACHE_OP_COMPARE` to be absolutely sure.
|
| 12/2 |
2026/05/22 23:22 |
tool |
codesearch-find-references |
0m
Error:
Args: map[Name:DCACHE_OP_COMPARE]
Results: map[References:<nil> TruncatedOutput:false]
|
| 13/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 11015
output: 21
thoughts: 22
Thoughts: Here's my take on those thoughts, tailored for an expert audience:
**Investigating a `DCACHE_OP_COMPARE` Macro**
Right, so `DCACHE_OP_COMPARE`... that's a macro, isn't it? Okay, I'll need to see its definition to understand what's going on. Let's fire up `grep` and find its usage, see where it's expanded and what it's doing under the hood. Time to trace this thing down. Gotta get into the weeds of the macro expansion.
|
| 14/2 |
2026/05/22 23:22 |
tool |
grepper |
0m
Args: map[Expression:DCACHE_OP_COMPARE]
Results: map[Output:fs/dcache.c=1956=EXPORT_SYMBOL(d_alloc_name);
--
fs/dcache.c-1958-#define DCACHE_OP_FLAGS \
fs/dcache.c:1959: (DCACHE_OP_HASH | DCACHE_OP_COMPARE | DCACHE_OP_REVALIDATE | \
fs/dcache.c-1960- DCACHE_OP_WEAK_REVALIDATE | DCACHE_OP_DELETE | DCACHE_OP_PRUNE | \
--
fs/dcache.c=1963=static unsigned int d_op_flags(const struct dentry_operations *op)
--
fs/dcache.c-1969- if (op->d_compare)
fs/dcache.c:1970: flags |= DCACHE_OP_COMPARE;
fs/dcache.c-1971- if (op->d_revalidate)
--
fs/dcache.c=2284=bool d_same_name(const struct dentry *dentry, const struct dentry *parent,
--
fs/dcache.c-2286-{
fs/dcache.c:2287: if (likely(!(parent->d_flags & DCACHE_OP_COMPARE))) {
fs/dcache.c-2288- if (dentry->d_name.len != name->len)
--
fs/dcache.c=2296=EXPORT_SYMBOL_GPL(d_same_name);
--
fs/dcache.c-2299- * This is __d_lookup_rcu() when the parent dentry has
fs/dcache.c:2300: * DCACHE_OP_COMPARE, which makes things much nastier.
fs/dcache.c-2301- */
--
fs/dcache.c=2366=struct dentry *__d_lookup_rcu(const struct dentry *parent,
--
fs/dcache.c-2382-
fs/dcache.c:2383: if (unlikely(parent->d_flags & DCACHE_OP_COMPARE))
fs/dcache.c-2384- return __d_lookup_rcu_op_compare(parent, name, seqp);
--
fs/overlayfs/util.c=202=bool ovl_dentry_weird(struct dentry *dentry)
--
fs/overlayfs/util.c-216-
fs/overlayfs/util.c:217: return dentry->d_flags & (DCACHE_OP_HASH | DCACHE_OP_COMPARE);
fs/overlayfs/util.c-218-}
--
include/linux/dcache.h=192=enum dentry_flags {
include/linux/dcache.h-193- DCACHE_OP_HASH = BIT(0),
include/linux/dcache.h:194: DCACHE_OP_COMPARE = BIT(1),
include/linux/dcache.h-195- DCACHE_OP_REVALIDATE = BIT(2),
]
|
| 15/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 11963
output: 21
thoughts: 67
Thoughts: Okay, let's see, I'm tracking down this `DCACHE_OP_COMPARE` flag. I know it's set in `d_op_flags()`, which is called when the dentry operations are defined. So that means it's probably happening either at the time a dentry is allocated or when `d_set_d_op()` is explicitly called. Hmm, interesting... let me now dig into where `d_set_d_op()` itself is actually *called* within the codebase. That should give me a good handle on where this flag is being initialized and why.
|
| 16/2 |
2026/05/22 23:22 |
tool |
grepper |
0m
Args: map[Expression:d_set_d_op]
Results: map[Output:Documentation/filesystems/porting.rst=1261=rather than manually setting sb->s_d_op.
--
Documentation/filesystems/porting.rst-1266-
Documentation/filesystems/porting.rst:1267:d_set_d_op() is no longer exported (or public, for that matter); _if_
Documentation/filesystems/porting.rst-1268-your filesystem really needed that, make use of d_splice_alias_ops()
--
fs/dcache.c=1963=static unsigned int d_op_flags(const struct dentry_operations *op)
--
fs/dcache.c-1984-
fs/dcache.c:1985:static void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
fs/dcache.c-1986-{
--
fs/dcache.c=2814=static inline void __d_add(struct dentry *dentry, struct inode *inode,
--
fs/dcache.c-2826- if (unlikely(ops))
fs/dcache.c:2827: d_set_d_op(dentry, ops);
fs/dcache.c-2828- if (inode) {
]
|
| 17/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 12514
output: 24
thoughts: 938
Thoughts: **Analyzing a Benign Data Race in the Dentry Cache**
Okay, so I'm looking at this data race reported by KCSAN involving `d_set_d_op` and `d_flags` in the dentry cache. It seems the `DCACHE_OP_COMPARE` flag within `d_flags` is the key. `d_set_d_op` is set during dentry addition or allocation, and crucially, once set, it *never* changes. That's good.
The issue is that there's a potential race where a reader is looking at `d_flags` while a writer is modifying *other* bits β specifically those related to the shrink lists (`DCACHE_SHRINK_LIST`, `DCACHE_LRU_LIST`). Since `d_flags` is an `unsigned int`, and assuming a standard 32-bit architecture, both read and write are operating on the same 4-byte word. This screams "benign data race." The reader, in this case, doesn't care about the bits the writer is changing. The `DCACHE_OP_COMPARE` bit is constant for the reader.
The writer uses `&= ~` which is a read-modify-write. However, the writer holds the `dentry->d_lock`, meaning there cannot be concurrent writers, which further reinforces that this is a benign data race. Even if a compiler were to be *extremely* unusual and break an `unsigned int` into byte-level reads, this is fine because of atomicity. On x86, a 32-bit read and write are atomic, so the reader will see either the old or the new value of the entire `d_flags`, both of which have the `DCACHE_OP_COMPARE` bit in the same state.
I'm double-checking, just to be sure, that there's no way this could lead to a bug. Could there be an issue if `parent->d_flags` is read, and the compiler decides to read it byte-by-byte? No, compilers *don't* behave that way for `unsigned int` bitwise operations. KCSAN flags this as a race, but that's its job; it reports all potential races, even harmless ones. Standard practice in the kernel would be to use `READ_ONCE()` and `WRITE_ONCE()` to be explicit, but it's often ignored if the race is known to be harmless.
Okay, let me think this through. Is `d_shrink_del` somehow modifying `d_flags` in a way that the `d_same_name` reader could see a corrupted value? Nope. The write is `dentry->d_flags &= ~(DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);` This is either an atomic `and` instruction, or a load, `and`, store. Either way, the `DCACHE_OP_COMPARE` bit is untouched. So the value of `DCACHE_OP_COMPARE` will *always* be correct for `d_same_name`.
Alright, what are the *other* implications? Denial of Service? No, KCSAN is a debugging tool. It's not enabled in production, so there's no crash or performance issue. Exploitable? No, benign data race.
Can *unprivileged* users trigger this? Yes. Any user can trigger dentry lookups and, more importantly, memory pressure. Memory pressure can lead to `shrink_dentry_list` being called.
Let's summarize:
- Exploitable: False
- DenialOfService: False
- Unprivileged: True (it's reachable, but it's not a bug).
Hang on⦠the prompt asks about reachability from a *typical* non-root process. The writer is triggered by `mount` -> `do_remount` -> `reconfigure_super` -> `shrink_dcache_sb`. But `shrink_dcache_sb` can be triggered by memory pressure, or `umount`, as well. Can an unprivileged user trigger `do_remount`? Yes! In a user namespace, an unprivileged user *can* create a mount namespace and remount a filesystem (like a tmpfs) they've mounted. Also, `shrink_dentry_list` is called from `prune_dcache_sb`, which is called by the shrinker (memory pressure). Memory pressure can *always* be triggered by unprivileged users. The reader is triggered by `openat`, which is definitely accessible.
Okay, I need to verify that `shrink_dentry_list` can be triggered by memory pressure. But all evidence points to that
|
| 18/2 |
2026/05/22 23:22 |
tool |
codesearch-find-references |
0m
Args: map[Name:shrink_dentry_list]
Results: map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:d_prune_aliases SourceFile:fs/dcache.c SourceLine:1187] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mntput_no_expire_slowpath SourceFile:fs/namespace.c SourceLine:1373] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:namespace_unlock SourceFile:fs/namespace.c SourceLine:1714] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:prune_dcache_sb SourceFile:fs/dcache.c SourceLine:1304] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:shrink_dcache_sb SourceFile:fs/dcache.c SourceLine:1343] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:shrink_dcache_tree SourceFile:fs/dcache.c SourceLine:1653] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:shrink_dcache_tree SourceFile:fs/dcache.c SourceLine:1675] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:shrink_dcache_tree SourceFile:fs/dcache.c SourceLine:1687]] TruncatedOutput:false]
|
| 19/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 14920
output: 19
thoughts: 359
Thoughts: **Analyzing the Accessibility and Potential Exploitation of a Data Race**
Okay, so `prune_dcache_sb` calls `shrink_dentry_list`, and `prune_dcache_sb` itself is triggered by `super_cache_scan`, the superblock shrinker. This means an unprivileged user can induce memory pressure which in turn kicks off the shrinker and eventually calls `shrink_dentry_list`. The function `openat` is also an unprivileged reader. This means this race condition is definitely accessible from any user-space process without any elevated privileges.
The race is confirmed. It's a benign data race, and not a denial of service. The race isn't exploitable.
Now, let's see if we've missed something. Could `dentry->d_flags` be manipulated in a way that we could temporarily clear or set `DCACHE_OP_COMPARE`? No, that's not possible, we know that `DCACHE_OP_COMPARE` is only ever set in `d_set_d_op` and never cleared.
Wait a minute, `d_shrink_del` does something interesting: `dentry->d_flags &= ~(DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);`. It *only* clears `DCACHE_SHRINK_LIST` and `DCACHE_LRU_LIST`. It's possible that the compiler implements the `&= ~` operator as a read-modify-write operation. If another CPU were to modify `d_flags` concurrently, that update could be lost. But, `d_shrink_del` is supposed to be holding `dentry->d_lock`, so it should be safe.
I'd better double check though. Are there any modifications to `d_flags` that don't hold the lock? I need to go through the code again.
|
| 20/2 |
2026/05/22 23:22 |
tool |
grepper |
0m
Args: map[Expression:d_flags.*=]
Results: map[Output:
Full output is too long, showing 500 out of 6927 lines.
Use more precise expression if possible.
[Documentation/scheduler/sched-deadline.rst=808=Appendix B. Minimal main()
--
Documentation/scheduler/sched-deadline.rst-891- attr.size = sizeof(attr);
Documentation/scheduler/sched-deadline.rst:892: attr.sched_flags = 0;
Documentation/scheduler/sched-deadline.rst-893- attr.sched_nice = 0;
--
arch/alpha/kernel/signal.c=523=do_work_pending(struct pt_regs *regs, unsigned long thread_flags,
--
arch/alpha/kernel/signal.c-541- local_irq_disable();
arch/alpha/kernel/signal.c:542: thread_flags = read_thread_flags();
arch/alpha/kernel/signal.c-543- } while (thread_flags & _TIF_WORK_MASK);
--
arch/arm/kernel/signal.c=603=do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
--
arch/arm/kernel/signal.c-635- local_irq_disable();
arch/arm/kernel/signal.c:636: thread_flags = read_thread_flags();
arch/arm/kernel/signal.c-637- } while (thread_flags & _TIF_WORK_MASK);
--
arch/arm64/kernel/stacktrace.c=459=static bool dump_backtrace_entry(const struct kunwind_state *state, void *arg)
--
arch/arm64/kernel/stacktrace.c-461- const char *source = state_source_string(state);
arch/arm64/kernel/stacktrace.c:462: union unwind_flags flags = state->flags;
arch/arm64/kernel/stacktrace.c-463- bool has_info = source || flags.all;
--
arch/loongarch/kvm/mmu.c=442=void kvm_arch_commit_memory_region(struct kvm *kvm,
--
arch/loongarch/kvm/mmu.c-447- int needs_flush;
arch/loongarch/kvm/mmu.c:448: u32 old_flags = old ? old->flags : 0;
arch/loongarch/kvm/mmu.c-449- u32 new_flags = new ? new->flags : 0;
--
arch/openrisc/kernel/signal.c=332=do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
--
arch/openrisc/kernel/signal.c-356- local_irq_disable();
arch/openrisc/kernel/signal.c:357: thread_flags = read_thread_flags();
arch/openrisc/kernel/signal.c-358- } while (thread_flags & _TIF_WORK_MASK);
--
arch/powerpc/platforms/powermac/feature.c=299=static long ohare_sleep_state(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-302-
arch/powerpc/platforms/powermac/feature.c:303: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-304- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=582=static long heathrow_sleep_state(struct device_node *node, long param,
--
arch/powerpc/platforms/powermac/feature.c-584-{
arch/powerpc/platforms/powermac/feature.c:585: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-586- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=1263=core99_firewire_cable_power(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1268- /* Trick: we allow NULL node */
arch/powerpc/platforms/powermac/feature.c:1269: if ((pmac_mb.board_flags & PMAC_MB_HAS_FW_POWER) == 0)
arch/powerpc/platforms/powermac/feature.c-1270- return -ENODEV;
--
arch/powerpc/platforms/powermac/feature.c=1823=core99_sleep_state(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1839- }
arch/powerpc/platforms/powermac/feature.c:1840: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-1841- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=1856=generic_dev_can_wake(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1862- if (pmac_mb.board_flags & PMAC_MB_MAY_SLEEP)
arch/powerpc/platforms/powermac/feature.c:1863: pmac_mb.board_flags |= PMAC_MB_CAN_SLEEP;
arch/powerpc/platforms/powermac/feature.c-1864- return 0;
--
arch/powerpc/platforms/powermac/feature.c=2398=static int __init probe_motherboard(void)
--
arch/powerpc/platforms/powermac/feature.c-2534- || strncmp(model, "iBook", 5) == 0))
arch/powerpc/platforms/powermac/feature.c:2535: pmac_mb.board_flags |= PMAC_MB_MOBILE;
arch/powerpc/platforms/powermac/feature.c-2536-
--
arch/powerpc/platforms/powernv/pci-ioda.c=1725=static const struct msi_parent_ops pnv_msi_parent_ops = {
arch/powerpc/platforms/powernv/pci-ioda.c:1726: .required_flags = PNV_PCI_MSI_FLAGS_REQUIRED,
arch/powerpc/platforms/powernv/pci-ioda.c:1727: .supported_flags = PNV_PCI_MSI_FLAGS_SUPPORTED,
arch/powerpc/platforms/powernv/pci-ioda.c-1728- .chip_flags = MSI_CHIP_FLAG_SET_EOI,
--
arch/powerpc/platforms/pseries/msi.c=526=static const struct msi_parent_ops pseries_msi_parent_ops = {
arch/powerpc/platforms/pseries/msi.c:527: .required_flags = PSERIES_PCI_MSI_FLAGS_REQUIRED,
arch/powerpc/platforms/pseries/msi.c:528: .supported_flags = PSERIES_PCI_MSI_FLAGS_SUPPORTED,
arch/powerpc/platforms/pseries/msi.c-529- .chip_flags = MSI_CHIP_FLAG_SET_EOI,
--
arch/powerpc/platforms/pseries/papr_scm.c=834=static int papr_pdsm_smart_inject(struct papr_scm_priv *p,
--
arch/powerpc/platforms/pseries/papr_scm.c-837- int rc;
arch/powerpc/platforms/pseries/papr_scm.c:838: u32 supported_flags = 0;
arch/powerpc/platforms/pseries/papr_scm.c-839- u64 inject_mask = 0, clear_mask = 0;
--
arch/powerpc/platforms/pseries/papr_scm.c-843- if (payload->smart_inject.flags & PDSM_SMART_INJECT_HEALTH_FATAL) {
arch/powerpc/platforms/pseries/papr_scm.c:844: supported_flags |= PDSM_SMART_INJECT_HEALTH_FATAL;
arch/powerpc/platforms/pseries/papr_scm.c-845- if (payload->smart_inject.fatal_enable)
--
arch/powerpc/platforms/pseries/papr_scm.c-851- if (payload->smart_inject.flags & PDSM_SMART_INJECT_BAD_SHUTDOWN) {
arch/powerpc/platforms/pseries/papr_scm.c:852: supported_flags |= PDSM_SMART_INJECT_BAD_SHUTDOWN;
arch/powerpc/platforms/pseries/papr_scm.c-853- if (payload->smart_inject.unsafe_shutdown_enable)
--
arch/s390/kvm/vsie.c=315=static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
--
arch/s390/kvm/vsie.c-357- (ECB3_AES | ECB3_DEA);
arch/s390/kvm/vsie.c:358: ecd_flags = scb_o->ecd & vcpu->arch.sie_block->ecd &
arch/s390/kvm/vsie.c-359- (ECD_ECC | ECD_HMAC);
--
arch/s390/pci/pci_irq.c=495=static struct msi_parent_ops zpci_msi_parent_ops = {
arch/s390/pci/pci_irq.c:496: .supported_flags = MSI_GENERIC_FLAGS_MASK |
arch/s390/pci/pci_irq.c-497- MSI_FLAG_PCI_MSIX |
arch/s390/pci/pci_irq.c-498- MSI_FLAG_MULTI_PCI_MSI,
arch/s390/pci/pci_irq.c:499: .required_flags = MSI_FLAG_USE_DEF_DOM_OPS |
arch/s390/pci/pci_irq.c-500- MSI_FLAG_USE_DEF_CHIP_OPS,
--
arch/s390/pci/pci_irq.c=504=int zpci_create_parent_msi_domain(struct zpci_bus *zbus)
--
arch/s390/pci/pci_irq.c-519- if (irq_delivery == FLOATING)
arch/s390/pci/pci_irq.c:520: zpci_msi_parent_ops.required_flags |= MSI_FLAG_NO_AFFINITY;
arch/s390/pci/pci_irq.c-521-
--
arch/um/drivers/virt-pci.c=414=static const struct msi_parent_ops um_pci_msi_parent_ops = {
arch/um/drivers/virt-pci.c:415: .required_flags = UM_PCI_MSI_FLAGS_REQUIRED,
arch/um/drivers/virt-pci.c:416: .supported_flags = UM_PCI_MSI_FLAGS_SUPPORTED,
arch/um/drivers/virt-pci.c-417- .bus_select_token = DOMAIN_BUS_NEXUS,
--
arch/um/kernel/process.c=84=void interrupt_end(void)
--
arch/um/kernel/process.c-88-
arch/um/kernel/process.c:89: thread_flags = read_thread_flags();
arch/um/kernel/process.c-90- while (thread_flags & _TIF_WORK_MASK) {
--
arch/um/kernel/process.c-96- resume_user_mode_work(regs);
arch/um/kernel/process.c:97: thread_flags = read_thread_flags();
arch/um/kernel/process.c-98- }
--
arch/x86/boot/cpuflags.c=68=void get_cpuflags(void)
--
arch/x86/boot/cpuflags.c-75- return;
arch/x86/boot/cpuflags.c:76: loaded_flags = true;
arch/x86/boot/cpuflags.c-77-
--
arch/x86/boot/startup/sme.c=209=static void __init __sme_map_range(struct sme_populate_pgd_data *ppd,
--
arch/x86/boot/startup/sme.c-213-
arch/x86/boot/startup/sme.c:214: ppd->pmd_flags = pmd_flags;
arch/x86/boot/startup/sme.c-215- ppd->pte_flags = pte_flags;
--
arch/x86/hyperv/irqdomain.c=322=static struct msi_parent_ops hv_msi_parent_ops = {
arch/x86/hyperv/irqdomain.c:323: .supported_flags = HV_MSI_FLAGS_SUPPORTED,
arch/x86/hyperv/irqdomain.c:324: .required_flags = HV_MSI_FLAGS_REQUIRED,
arch/x86/hyperv/irqdomain.c-325- .bus_select_token = DOMAIN_BUS_NEXUS,
--
arch/x86/include/asm/pgtable.h=175=static inline bool pmd_shstk(pmd_t pmd)
--
arch/x86/include/asm/pgtable.h-177- return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
arch/x86/include/asm/pgtable.h:178: (pmd_flags(pmd) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
arch/x86/include/asm/pgtable.h-179- (_PAGE_DIRTY | _PAGE_PSE);
--
arch/x86/include/asm/pgtable.h=198=static inline bool pud_shstk(pud_t pud)
--
arch/x86/include/asm/pgtable.h-200- return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
arch/x86/include/asm/pgtable.h:201: (pud_flags(pud) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
arch/x86/include/asm/pgtable.h-202- (_PAGE_DIRTY | _PAGE_PSE);
--
arch/x86/include/asm/pgtable.h=1025=static inline int pmd_bad(pmd_t pmd)
arch/x86/include/asm/pgtable.h-1026-{
arch/x86/include/asm/pgtable.h:1027: return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
arch/x86/include/asm/pgtable.h-1028- (_KERNPG_TABLE & ~_PAGE_ACCESSED);
--
arch/x86/include/asm/pgtable.h=1064=static inline int pud_bad(pud_t pud)
arch/x86/include/asm/pgtable.h-1065-{
arch/x86/include/asm/pgtable.h:1066: return (pud_flags(pud) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
arch/x86/include/asm/pgtable.h-1067-}
--
arch/x86/include/asm/pgtable.h=1092=static inline int p4d_bad(p4d_t p4d)
--
arch/x86/include/asm/pgtable.h-1098-
arch/x86/include/asm/pgtable.h:1099: return (p4d_flags(p4d) & ~ignore_flags) != 0;
arch/x86/include/asm/pgtable.h-1100-}
--
arch/x86/include/asm/pgtable.h=1135=static inline int pgd_bad(pgd_t pgd)
--
arch/x86/include/asm/pgtable.h-1144-
arch/x86/include/asm/pgtable.h:1145: return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
arch/x86/include/asm/pgtable.h-1146-}
--
arch/x86/kernel/apic/msi.c=259=static const struct msi_parent_ops x86_vector_msi_parent_ops = {
arch/x86/kernel/apic/msi.c:260: .supported_flags = X86_VECTOR_MSI_FLAGS_SUPPORTED,
arch/x86/kernel/apic/msi.c-261- .init_dev_msi_info = x86_init_dev_msi_info,
--
arch/x86/kernel/head64.c=51=SYM_PIC_ALIAS(next_early_pgt);
arch/x86/kernel/head64.c:52:pmdval_t early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
arch/x86/kernel/head64.c-53-
--
arch/x86/kernel/kprobes/core.c=817=save_previous_kprobe(struct kprobe_ctlblk *kcb)
--
arch/x86/kernel/kprobes/core.c-820- kcb->prev_kprobe.status = kcb->kprobe_status;
arch/x86/kernel/kprobes/core.c:821: kcb->prev_kprobe.old_flags = kcb->kprobe_old_flags;
arch/x86/kernel/kprobes/core.c:822: kcb->prev_kprobe.saved_flags = kcb->kprobe_saved_flags;
arch/x86/kernel/kprobes/core.c-823-}
--
arch/x86/kernel/kprobes/core.c=826=restore_previous_kprobe(struct kprobe_ctlblk *kcb)
--
arch/x86/kernel/kprobes/core.c-829- kcb->kprobe_status = kcb->prev_kprobe.status;
arch/x86/kernel/kprobes/core.c:830: kcb->kprobe_old_flags = kcb->prev_kprobe.old_flags;
arch/x86/kernel/kprobes/core.c:831: kcb->kprobe_saved_flags = kcb->prev_kprobe.saved_flags;
arch/x86/kernel/kprobes/core.c-832-}
--
arch/x86/kernel/kprobes/core.c=835=set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
--
arch/x86/kernel/kprobes/core.c-838- __this_cpu_write(current_kprobe, p);
arch/x86/kernel/kprobes/core.c:839: kcb->kprobe_saved_flags = kcb->kprobe_old_flags
arch/x86/kernel/kprobes/core.c-840- = (regs->flags & X86_EFLAGS_IF);
--
arch/x86/kernel/pvclock.c-18-
arch/x86/kernel/pvclock.c:19:static u8 valid_flags __read_mostly = 0;
arch/x86/kernel/pvclock.c-20-static struct pvclock_vsyscall_time_info *pvti_cpu0_va __read_mostly;
--
arch/x86/kernel/pvclock.c=22=void pvclock_set_flags(u8 flags)
arch/x86/kernel/pvclock.c-23-{
arch/x86/kernel/pvclock.c:24: valid_flags = flags;
arch/x86/kernel/pvclock.c-25-}
--
arch/x86/kvm/x86.c=13706=static void kvm_mmu_slot_apply_flags(struct kvm *kvm,
--
arch/x86/kvm/x86.c-13710-{
arch/x86/kvm/x86.c:13711: u32 old_flags = old ? old->flags : 0;
arch/x86/kvm/x86.c-13712- u32 new_flags = new ? new->flags : 0;
--
arch/x86/kvm/xen.c=1362=int kvm_xen_hvm_config(struct kvm *kvm, struct kvm_xen_hvm_config *xhc)
--
arch/x86/kvm/xen.c-1364- /* Only some feature flags need to be *enabled* by userspace */
arch/x86/kvm/xen.c:1365: u32 permitted_flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL |
arch/x86/kvm/xen.c-1366- KVM_XEN_HVM_CONFIG_EVTCHN_SEND |
--
arch/x86/kvm/xen.c-1397-
arch/x86/kvm/xen.c:1398: old_flags = kvm->arch.xen.hvm_config.flags;
arch/x86/kvm/xen.c-1399- memcpy(&kvm->arch.xen.hvm_config, xhc, sizeof(*xhc));
--
arch/x86/mm/kmmio.c=236=int kmmio_handler(struct pt_regs *regs, unsigned long addr)
--
arch/x86/mm/kmmio.c-298- ctx->probe = get_kmmio_probe(page_base);
arch/x86/mm/kmmio.c:299: ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
arch/x86/mm/kmmio.c-300- ctx->addr = page_base;
--
arch/x86/mm/mem_encrypt_amd.c=156=static void __init __sme_early_map_unmap_mem(void *vaddr, unsigned long size,
--
arch/x86/mm/mem_encrypt_amd.c-162- /* Use early_pmd_flags but remove the encryption mask */
arch/x86/mm/mem_encrypt_amd.c:163: pmd_flags = __sme_clr(early_pmd_flags);
arch/x86/mm/mem_encrypt_amd.c-164-
--
arch/x86/mm/mem_encrypt_amd.c=477=void __init sme_early_init(void)
--
arch/x86/mm/mem_encrypt_amd.c-481-
arch/x86/mm/mem_encrypt_amd.c:482: early_pmd_flags = __sme_set(early_pmd_flags);
arch/x86/mm/mem_encrypt_amd.c-483-
--
arch/x86/mm/pat/memtype.c=142=static inline void set_page_memtype(struct page *pg,
--
arch/x86/mm/pat/memtype.c-164-
arch/x86/mm/pat/memtype.c:165: old_flags = READ_ONCE(pg->flags.f);
arch/x86/mm/pat/memtype.c-166- do {
--
arch/x86/mm/pat/set_memory.c=1322=static int collapse_pud_page(pud_t *pud, unsigned long addr,
--
arch/x86/mm/pat/set_memory.c-1352- return 0;
arch/x86/mm/pat/set_memory.c:1353: if (pmd_flags(entry) != pmd_flags(first))
arch/x86/mm/pat/set_memory.c-1354- return 0;
--
block/bfq-iosched.c=6236=static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
--
block/bfq-iosched.c-6284- */
block/bfq-iosched.c:6285: cmd_flags = rq->cmd_flags;
block/bfq-iosched.c-6286- spin_unlock_irq(&bfqd->lock);
--
block/blk-flush.c=148=static void blk_flush_complete_seq(struct request *rq,
--
block/blk-flush.c-157- rq->flush.seq |= seq;
block/blk-flush.c:158: cmd_flags = rq->cmd_flags;
block/blk-flush.c-159-
--
block/blk-flush.c=276=static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq,
--
block/blk-flush.c-317-
block/blk-flush.c:318: flush_rq->cmd_flags = REQ_OP_FLUSH | REQ_PREFLUSH;
block/blk-flush.c:319: flush_rq->cmd_flags |= (flags & REQ_DRV) | (flags & REQ_FAILFAST_MASK);
block/blk-flush.c-320- flush_rq->rq_flags |= RQF_FLUSH_SEQ;
--
block/blk-flush.c=384=bool blk_insert_flush(struct request *rq)
--
block/blk-flush.c-410- */
block/blk-flush.c:411: rq->cmd_flags &= ~REQ_PREFLUSH;
block/blk-flush.c-412- if (!supports_fua)
block/blk-flush.c:413: rq->cmd_flags &= ~REQ_FUA;
block/blk-flush.c-414-
--
block/blk-flush.c-419- */
block/blk-flush.c:420: rq->cmd_flags |= REQ_SYNC;
block/blk-flush.c-421-
--
block/blk-integrity.c=58=int blk_get_meta_cap(struct block_device *bdev, unsigned int cmd,
--
block/blk-integrity.c-72- if (bi->flags & BLK_INTEGRITY_DEVICE_CAPABLE)
block/blk-integrity.c:73: meta_cap.lbmd_flags |= LBMD_PI_CAP_INTEGRITY;
block/blk-integrity.c-74- if (bi->flags & BLK_INTEGRITY_REF_TAG)
block/blk-integrity.c:75: meta_cap.lbmd_flags |= LBMD_PI_CAP_REFTAG;
block/blk-integrity.c-76- meta_cap.lbmd_interval = 1 << bi->interval_exp;
--
block/blk-integrity.c=123=int blk_rq_integrity_map_user(struct request *rq, void __user *ubuf,
--
block/blk-integrity.c-134- rq->nr_integrity_segments = blk_rq_count_integrity_sg(rq->q, rq->bio);
block/blk-integrity.c:135: rq->cmd_flags |= REQ_INTEGRITY;
block/blk-integrity.c-136- return 0;
--
block/blk-merge.c=707=static inline void blk_update_mixed_merge(struct request *req,
--
block/blk-merge.c-714- if (front_merge) {
block/blk-merge.c:715: req->cmd_flags &= ~REQ_FAILFAST_MASK;
block/blk-merge.c:716: req->cmd_flags |= bio->bi_opf & REQ_FAILFAST_MASK;
block/blk-merge.c-717- }
--
block/blk-merge.c=743=static bool blk_atomic_write_mergeable_rq_bio(struct request *rq,
--
block/blk-merge.c-745-{
block/blk-merge.c:746: return (rq->cmd_flags & REQ_ATOMIC) == (bio->bi_opf & REQ_ATOMIC);
block/blk-merge.c-747-}
--
block/blk-merge.c=749=static bool blk_atomic_write_mergeable_rqs(struct request *rq,
--
block/blk-merge.c-751-{
block/blk-merge.c:752: return (rq->cmd_flags & REQ_ATOMIC) == (next->cmd_flags & REQ_ATOMIC);
block/blk-merge.c-753-}
--
block/blk-merge.c=777=static struct request *attempt_merge(struct request_queue *q,
--
block/blk-merge.c-822- if (((req->rq_flags | next->rq_flags) & RQF_MIXED_MERGE) ||
block/blk-merge.c:823: (req->cmd_flags & REQ_FAILFAST_MASK) !=
block/blk-merge.c-824- (next->cmd_flags & REQ_FAILFAST_MASK)) {
--
block/blk-merge.c=944=enum bio_merge_status bio_attempt_back_merge(struct request *req,
--
block/blk-merge.c-954-
block/blk-merge.c:955: if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
block/blk-merge.c-956- blk_rq_set_mixed_merge(req);
--
block/blk-merge.c=975=static enum bio_merge_status bio_attempt_front_merge(struct request *req,
--
block/blk-merge.c-993-
block/blk-merge.c:994: if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
block/blk-merge.c-995- blk_rq_set_mixed_merge(req);
--
block/blk-mq-debugfs.c=264=int __blk_mq_debugfs_rq_show(struct seq_file *m, struct request *rq)
--
block/blk-mq-debugfs.c-277- seq_printf(m, "%s", op_str);
block/blk-mq-debugfs.c:278: seq_puts(m, ", .cmd_flags=");
block/blk-mq-debugfs.c-279- blk_flags_show(m, (__force unsigned int)(rq->cmd_flags & ~REQ_OP_MASK),
--
block/blk-mq.c=410=static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
--
block/blk-mq.c-420- rq->mq_hctx = hctx;
block/blk-mq.c:421: rq->cmd_flags = data->cmd_flags;
block/blk-mq.c-422-
--
block/blk-mq.c=501=static void blk_mq_limit_depth(struct blk_mq_alloc_data *data)
--
block/blk-mq.c-520- */
block/blk-mq.c:521: if ((data->cmd_flags & REQ_OP_MASK) == REQ_OP_FLUSH ||
block/blk-mq.c-522- blk_op_is_passthrough(data->cmd_flags))
--
block/blk-mq.c=597=static struct request *blk_mq_rq_cache_fill(struct request_queue *q,
--
block/blk-mq.c-605- .shallow_depth = 0,
block/blk-mq.c:606: .cmd_flags = opf,
block/blk-mq.c-607- .rq_flags = 0,
--
block/blk-mq.c=626=static struct request *blk_mq_alloc_cached_request(struct request_queue *q,
--
block/blk-mq.c-648- return NULL;
block/blk-mq.c:649: if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
block/blk-mq.c-650- return NULL;
--
block/blk-mq.c-655-
block/blk-mq.c:656: rq->cmd_flags = opf;
block/blk-mq.c-657- INIT_LIST_HEAD(&rq->queuelist);
--
block/blk-mq.c=661=struct request *blk_mq_alloc_request(struct request_queue *q, blk_opf_t opf,
--
block/blk-mq.c-671- .shallow_depth = 0,
block/blk-mq.c:672: .cmd_flags = opf,
block/blk-mq.c-673- .rq_flags = 0,
--
block/blk-mq.c=700=struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
--
block/blk-mq.c-706- .shallow_depth = 0,
block/blk-mq.c:707: .cmd_flags = opf,
block/blk-mq.c-708- .rq_flags = 0,
--
block/blk-mq.c=954=bool blk_update_request(struct request *req, blk_status_t error,
--
block/blk-mq.c-1046- if (req->rq_flags & RQF_MIXED_MERGE) {
block/blk-mq.c:1047: req->cmd_flags &= ~REQ_FAILFAST_MASK;
block/blk-mq.c:1048: req->cmd_flags |= req->bio->bi_opf & REQ_FAILFAST_MASK;
block/blk-mq.c-1049- }
--
block/blk-mq.c=2685=static void blk_mq_bio_to_request(struct request *rq, struct bio *bio,
--
block/blk-mq.c-2690- if (bio->bi_opf & REQ_RAHEAD)
block/blk-mq.c:2691: rq->cmd_flags |= REQ_FAILFAST_MASK;
block/blk-mq.c-2692-
--
block/blk-mq.c=3046=static struct request *blk_mq_get_new_requests(struct request_queue *q,
--
block/blk-mq.c-3053- .shallow_depth = 0,
block/blk-mq.c:3054: .cmd_flags = bio->bi_opf,
block/blk-mq.c-3055- .rq_flags = 0,
--
block/blk-mq.c=3080=static struct request *blk_mq_peek_cached_request(struct blk_plug *plug,
--
block/blk-mq.c-3093- return NULL;
block/blk-mq.c:3094: if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
block/blk-mq.c-3095- return NULL;
--
block/blk-mq.c=3099=static void blk_mq_use_cached_rq(struct request *rq, struct blk_plug *plug,
--
block/blk-mq.c-3112- blk_mq_rq_time_init(rq, blk_time_get_ns());
block/blk-mq.c:3113: rq->cmd_flags = bio->bi_opf;
block/blk-mq.c-3114- INIT_LIST_HEAD(&rq->queuelist);
--
block/blk.h=481=static inline void req_set_nomerge(struct request_queue *q, struct request *req)
block/blk.h-482-{
block/blk.h:483: req->cmd_flags |= REQ_NOMERGE;
block/blk.h-484- if (req == q->last_merge)
--
drivers/acpi/acpica/dsfield.c=260=acpi_ds_get_field_names(struct acpi_create_field_info *info,
--
drivers/acpi/acpica/dsfield.c-319-
drivers/acpi/acpica/dsfield.c:320: info->field_flags = (u8)
drivers/acpi/acpica/dsfield.c-321- ((info->
--
drivers/acpi/acpica/dsfield.c=473=acpi_ds_create_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-510- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:511: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-512- info.attribute = 0;
--
drivers/acpi/acpica/dsfield.c=673=acpi_ds_create_bank_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-728- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:729: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-730-
--
drivers/acpi/acpica/dsfield.c=766=acpi_ds_create_index_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-806- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:807: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-808-
--
drivers/acpi/acpica/dsopcode.c=75=acpi_ds_init_buffer_field(u16 aml_opcode,
--
drivers/acpi/acpica/dsopcode.c-125-
drivers/acpi/acpica/dsopcode.c:126: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-127- bit_offset = offset;
--
drivers/acpi/acpica/dsopcode.c-145- bit_count = 1;
drivers/acpi/acpica/dsopcode.c:146: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-147- break;
--
drivers/acpi/acpica/dsopcode.c-154- bit_count = 8;
drivers/acpi/acpica/dsopcode.c:155: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-156- break;
--
drivers/acpi/acpica/dsopcode.c-163- bit_count = 16;
drivers/acpi/acpica/dsopcode.c:164: field_flags = AML_FIELD_ACCESS_WORD;
drivers/acpi/acpica/dsopcode.c-165- break;
--
drivers/acpi/acpica/dsopcode.c-172- bit_count = 32;
drivers/acpi/acpica/dsopcode.c:173: field_flags = AML_FIELD_ACCESS_DWORD;
drivers/acpi/acpica/dsopcode.c-174- break;
--
drivers/acpi/acpica/dsopcode.c-181- bit_count = 64;
drivers/acpi/acpica/dsopcode.c:182: field_flags = AML_FIELD_ACCESS_QWORD;
drivers/acpi/acpica/dsopcode.c-183- break;
--
drivers/acpi/acpica/dsopcode.c-208- * Initialize areas of the field object that are common to all fields
drivers/acpi/acpica/dsopcode.c:209: * For field_flags, use LOCK_RULE = 0 (NO_LOCK),
drivers/acpi/acpica/dsopcode.c-210- * UPDATE_RULE = 0 (UPDATE_PRESERVE)
--
drivers/acpi/acpica/excreate.c=409=acpi_ex_create_method(u8 * aml_start,
--
drivers/acpi/acpica/excreate.c-436- */
drivers/acpi/acpica/excreate.c:437: method_flags = (u8)operand[1]->integer.value;
drivers/acpi/acpica/excreate.c-438- obj_desc->method.param_count = (u8)
--
drivers/acpi/acpica/exprep.c=293=acpi_ex_prep_common_field_object(union acpi_operand_object *obj_desc,
--
drivers/acpi/acpica/exprep.c-308- */
drivers/acpi/acpica/exprep.c:309: obj_desc->common_field.field_flags = field_flags;
drivers/acpi/acpica/exprep.c-310- obj_desc->common_field.attribute = field_attribute;
--
drivers/acpi/acpica/nsxfname.c=475=acpi_status acpi_install_method(u8 *buffer)
--
drivers/acpi/acpica/nsxfname.c-516-
drivers/acpi/acpica/nsxfname.c:517: method_flags = *parser_state.aml++;
drivers/acpi/acpica/nsxfname.c-518- aml_start = parser_state.aml;
--
]
]
|
| 21/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 26957
output: 19
thoughts: 46
Thoughts: Okay, let's see what we've got.
**Examining dentry->d_flags Modifications**
Right, the output is truncated, but the important thing I'm picking up on is that `dentry->d_flags` is being modified in several locations. This immediately flags my attention. Time to zoom in and pinpoint those modifications. Given the nature of dcache operations, `fs/dcache.c` is the obvious place to start digging. That's where I would expect to find the core logic affecting the dentry flags. Let's see what modifications are taking place within that file to understand the context and intent. I'm looking for where these flags are being set, cleared, or checked.
|
| 22/2 |
2026/05/22 23:22 |
tool |
grepper |
0m
Args: map[Expression:d_flags.*=]
Results: map[Output:
Full output is too long, showing 500 out of 6927 lines.
Use more precise expression if possible.
[Documentation/scheduler/sched-deadline.rst=808=Appendix B. Minimal main()
--
Documentation/scheduler/sched-deadline.rst-891- attr.size = sizeof(attr);
Documentation/scheduler/sched-deadline.rst:892: attr.sched_flags = 0;
Documentation/scheduler/sched-deadline.rst-893- attr.sched_nice = 0;
--
arch/alpha/kernel/signal.c=523=do_work_pending(struct pt_regs *regs, unsigned long thread_flags,
--
arch/alpha/kernel/signal.c-541- local_irq_disable();
arch/alpha/kernel/signal.c:542: thread_flags = read_thread_flags();
arch/alpha/kernel/signal.c-543- } while (thread_flags & _TIF_WORK_MASK);
--
arch/arm/kernel/signal.c=603=do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
--
arch/arm/kernel/signal.c-635- local_irq_disable();
arch/arm/kernel/signal.c:636: thread_flags = read_thread_flags();
arch/arm/kernel/signal.c-637- } while (thread_flags & _TIF_WORK_MASK);
--
arch/arm64/kernel/stacktrace.c=459=static bool dump_backtrace_entry(const struct kunwind_state *state, void *arg)
--
arch/arm64/kernel/stacktrace.c-461- const char *source = state_source_string(state);
arch/arm64/kernel/stacktrace.c:462: union unwind_flags flags = state->flags;
arch/arm64/kernel/stacktrace.c-463- bool has_info = source || flags.all;
--
arch/loongarch/kvm/mmu.c=442=void kvm_arch_commit_memory_region(struct kvm *kvm,
--
arch/loongarch/kvm/mmu.c-447- int needs_flush;
arch/loongarch/kvm/mmu.c:448: u32 old_flags = old ? old->flags : 0;
arch/loongarch/kvm/mmu.c-449- u32 new_flags = new ? new->flags : 0;
--
arch/openrisc/kernel/signal.c=332=do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
--
arch/openrisc/kernel/signal.c-356- local_irq_disable();
arch/openrisc/kernel/signal.c:357: thread_flags = read_thread_flags();
arch/openrisc/kernel/signal.c-358- } while (thread_flags & _TIF_WORK_MASK);
--
arch/powerpc/platforms/powermac/feature.c=299=static long ohare_sleep_state(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-302-
arch/powerpc/platforms/powermac/feature.c:303: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-304- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=582=static long heathrow_sleep_state(struct device_node *node, long param,
--
arch/powerpc/platforms/powermac/feature.c-584-{
arch/powerpc/platforms/powermac/feature.c:585: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-586- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=1263=core99_firewire_cable_power(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1268- /* Trick: we allow NULL node */
arch/powerpc/platforms/powermac/feature.c:1269: if ((pmac_mb.board_flags & PMAC_MB_HAS_FW_POWER) == 0)
arch/powerpc/platforms/powermac/feature.c-1270- return -ENODEV;
--
arch/powerpc/platforms/powermac/feature.c=1823=core99_sleep_state(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1839- }
arch/powerpc/platforms/powermac/feature.c:1840: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-1841- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=1856=generic_dev_can_wake(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1862- if (pmac_mb.board_flags & PMAC_MB_MAY_SLEEP)
arch/powerpc/platforms/powermac/feature.c:1863: pmac_mb.board_flags |= PMAC_MB_CAN_SLEEP;
arch/powerpc/platforms/powermac/feature.c-1864- return 0;
--
arch/powerpc/platforms/powermac/feature.c=2398=static int __init probe_motherboard(void)
--
arch/powerpc/platforms/powermac/feature.c-2534- || strncmp(model, "iBook", 5) == 0))
arch/powerpc/platforms/powermac/feature.c:2535: pmac_mb.board_flags |= PMAC_MB_MOBILE;
arch/powerpc/platforms/powermac/feature.c-2536-
--
arch/powerpc/platforms/powernv/pci-ioda.c=1725=static const struct msi_parent_ops pnv_msi_parent_ops = {
arch/powerpc/platforms/powernv/pci-ioda.c:1726: .required_flags = PNV_PCI_MSI_FLAGS_REQUIRED,
arch/powerpc/platforms/powernv/pci-ioda.c:1727: .supported_flags = PNV_PCI_MSI_FLAGS_SUPPORTED,
arch/powerpc/platforms/powernv/pci-ioda.c-1728- .chip_flags = MSI_CHIP_FLAG_SET_EOI,
--
arch/powerpc/platforms/pseries/msi.c=526=static const struct msi_parent_ops pseries_msi_parent_ops = {
arch/powerpc/platforms/pseries/msi.c:527: .required_flags = PSERIES_PCI_MSI_FLAGS_REQUIRED,
arch/powerpc/platforms/pseries/msi.c:528: .supported_flags = PSERIES_PCI_MSI_FLAGS_SUPPORTED,
arch/powerpc/platforms/pseries/msi.c-529- .chip_flags = MSI_CHIP_FLAG_SET_EOI,
--
arch/powerpc/platforms/pseries/papr_scm.c=834=static int papr_pdsm_smart_inject(struct papr_scm_priv *p,
--
arch/powerpc/platforms/pseries/papr_scm.c-837- int rc;
arch/powerpc/platforms/pseries/papr_scm.c:838: u32 supported_flags = 0;
arch/powerpc/platforms/pseries/papr_scm.c-839- u64 inject_mask = 0, clear_mask = 0;
--
arch/powerpc/platforms/pseries/papr_scm.c-843- if (payload->smart_inject.flags & PDSM_SMART_INJECT_HEALTH_FATAL) {
arch/powerpc/platforms/pseries/papr_scm.c:844: supported_flags |= PDSM_SMART_INJECT_HEALTH_FATAL;
arch/powerpc/platforms/pseries/papr_scm.c-845- if (payload->smart_inject.fatal_enable)
--
arch/powerpc/platforms/pseries/papr_scm.c-851- if (payload->smart_inject.flags & PDSM_SMART_INJECT_BAD_SHUTDOWN) {
arch/powerpc/platforms/pseries/papr_scm.c:852: supported_flags |= PDSM_SMART_INJECT_BAD_SHUTDOWN;
arch/powerpc/platforms/pseries/papr_scm.c-853- if (payload->smart_inject.unsafe_shutdown_enable)
--
arch/s390/kvm/vsie.c=315=static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
--
arch/s390/kvm/vsie.c-357- (ECB3_AES | ECB3_DEA);
arch/s390/kvm/vsie.c:358: ecd_flags = scb_o->ecd & vcpu->arch.sie_block->ecd &
arch/s390/kvm/vsie.c-359- (ECD_ECC | ECD_HMAC);
--
arch/s390/pci/pci_irq.c=495=static struct msi_parent_ops zpci_msi_parent_ops = {
arch/s390/pci/pci_irq.c:496: .supported_flags = MSI_GENERIC_FLAGS_MASK |
arch/s390/pci/pci_irq.c-497- MSI_FLAG_PCI_MSIX |
arch/s390/pci/pci_irq.c-498- MSI_FLAG_MULTI_PCI_MSI,
arch/s390/pci/pci_irq.c:499: .required_flags = MSI_FLAG_USE_DEF_DOM_OPS |
arch/s390/pci/pci_irq.c-500- MSI_FLAG_USE_DEF_CHIP_OPS,
--
arch/s390/pci/pci_irq.c=504=int zpci_create_parent_msi_domain(struct zpci_bus *zbus)
--
arch/s390/pci/pci_irq.c-519- if (irq_delivery == FLOATING)
arch/s390/pci/pci_irq.c:520: zpci_msi_parent_ops.required_flags |= MSI_FLAG_NO_AFFINITY;
arch/s390/pci/pci_irq.c-521-
--
arch/um/drivers/virt-pci.c=414=static const struct msi_parent_ops um_pci_msi_parent_ops = {
arch/um/drivers/virt-pci.c:415: .required_flags = UM_PCI_MSI_FLAGS_REQUIRED,
arch/um/drivers/virt-pci.c:416: .supported_flags = UM_PCI_MSI_FLAGS_SUPPORTED,
arch/um/drivers/virt-pci.c-417- .bus_select_token = DOMAIN_BUS_NEXUS,
--
arch/um/kernel/process.c=84=void interrupt_end(void)
--
arch/um/kernel/process.c-88-
arch/um/kernel/process.c:89: thread_flags = read_thread_flags();
arch/um/kernel/process.c-90- while (thread_flags & _TIF_WORK_MASK) {
--
arch/um/kernel/process.c-96- resume_user_mode_work(regs);
arch/um/kernel/process.c:97: thread_flags = read_thread_flags();
arch/um/kernel/process.c-98- }
--
arch/x86/boot/cpuflags.c=68=void get_cpuflags(void)
--
arch/x86/boot/cpuflags.c-75- return;
arch/x86/boot/cpuflags.c:76: loaded_flags = true;
arch/x86/boot/cpuflags.c-77-
--
arch/x86/boot/startup/sme.c=209=static void __init __sme_map_range(struct sme_populate_pgd_data *ppd,
--
arch/x86/boot/startup/sme.c-213-
arch/x86/boot/startup/sme.c:214: ppd->pmd_flags = pmd_flags;
arch/x86/boot/startup/sme.c-215- ppd->pte_flags = pte_flags;
--
arch/x86/hyperv/irqdomain.c=322=static struct msi_parent_ops hv_msi_parent_ops = {
arch/x86/hyperv/irqdomain.c:323: .supported_flags = HV_MSI_FLAGS_SUPPORTED,
arch/x86/hyperv/irqdomain.c:324: .required_flags = HV_MSI_FLAGS_REQUIRED,
arch/x86/hyperv/irqdomain.c-325- .bus_select_token = DOMAIN_BUS_NEXUS,
--
arch/x86/include/asm/pgtable.h=175=static inline bool pmd_shstk(pmd_t pmd)
--
arch/x86/include/asm/pgtable.h-177- return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
arch/x86/include/asm/pgtable.h:178: (pmd_flags(pmd) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
arch/x86/include/asm/pgtable.h-179- (_PAGE_DIRTY | _PAGE_PSE);
--
arch/x86/include/asm/pgtable.h=198=static inline bool pud_shstk(pud_t pud)
--
arch/x86/include/asm/pgtable.h-200- return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
arch/x86/include/asm/pgtable.h:201: (pud_flags(pud) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
arch/x86/include/asm/pgtable.h-202- (_PAGE_DIRTY | _PAGE_PSE);
--
arch/x86/include/asm/pgtable.h=1025=static inline int pmd_bad(pmd_t pmd)
arch/x86/include/asm/pgtable.h-1026-{
arch/x86/include/asm/pgtable.h:1027: return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
arch/x86/include/asm/pgtable.h-1028- (_KERNPG_TABLE & ~_PAGE_ACCESSED);
--
arch/x86/include/asm/pgtable.h=1064=static inline int pud_bad(pud_t pud)
arch/x86/include/asm/pgtable.h-1065-{
arch/x86/include/asm/pgtable.h:1066: return (pud_flags(pud) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
arch/x86/include/asm/pgtable.h-1067-}
--
arch/x86/include/asm/pgtable.h=1092=static inline int p4d_bad(p4d_t p4d)
--
arch/x86/include/asm/pgtable.h-1098-
arch/x86/include/asm/pgtable.h:1099: return (p4d_flags(p4d) & ~ignore_flags) != 0;
arch/x86/include/asm/pgtable.h-1100-}
--
arch/x86/include/asm/pgtable.h=1135=static inline int pgd_bad(pgd_t pgd)
--
arch/x86/include/asm/pgtable.h-1144-
arch/x86/include/asm/pgtable.h:1145: return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
arch/x86/include/asm/pgtable.h-1146-}
--
arch/x86/kernel/apic/msi.c=259=static const struct msi_parent_ops x86_vector_msi_parent_ops = {
arch/x86/kernel/apic/msi.c:260: .supported_flags = X86_VECTOR_MSI_FLAGS_SUPPORTED,
arch/x86/kernel/apic/msi.c-261- .init_dev_msi_info = x86_init_dev_msi_info,
--
arch/x86/kernel/head64.c=51=SYM_PIC_ALIAS(next_early_pgt);
arch/x86/kernel/head64.c:52:pmdval_t early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
arch/x86/kernel/head64.c-53-
--
arch/x86/kernel/kprobes/core.c=817=save_previous_kprobe(struct kprobe_ctlblk *kcb)
--
arch/x86/kernel/kprobes/core.c-820- kcb->prev_kprobe.status = kcb->kprobe_status;
arch/x86/kernel/kprobes/core.c:821: kcb->prev_kprobe.old_flags = kcb->kprobe_old_flags;
arch/x86/kernel/kprobes/core.c:822: kcb->prev_kprobe.saved_flags = kcb->kprobe_saved_flags;
arch/x86/kernel/kprobes/core.c-823-}
--
arch/x86/kernel/kprobes/core.c=826=restore_previous_kprobe(struct kprobe_ctlblk *kcb)
--
arch/x86/kernel/kprobes/core.c-829- kcb->kprobe_status = kcb->prev_kprobe.status;
arch/x86/kernel/kprobes/core.c:830: kcb->kprobe_old_flags = kcb->prev_kprobe.old_flags;
arch/x86/kernel/kprobes/core.c:831: kcb->kprobe_saved_flags = kcb->prev_kprobe.saved_flags;
arch/x86/kernel/kprobes/core.c-832-}
--
arch/x86/kernel/kprobes/core.c=835=set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
--
arch/x86/kernel/kprobes/core.c-838- __this_cpu_write(current_kprobe, p);
arch/x86/kernel/kprobes/core.c:839: kcb->kprobe_saved_flags = kcb->kprobe_old_flags
arch/x86/kernel/kprobes/core.c-840- = (regs->flags & X86_EFLAGS_IF);
--
arch/x86/kernel/pvclock.c-18-
arch/x86/kernel/pvclock.c:19:static u8 valid_flags __read_mostly = 0;
arch/x86/kernel/pvclock.c-20-static struct pvclock_vsyscall_time_info *pvti_cpu0_va __read_mostly;
--
arch/x86/kernel/pvclock.c=22=void pvclock_set_flags(u8 flags)
arch/x86/kernel/pvclock.c-23-{
arch/x86/kernel/pvclock.c:24: valid_flags = flags;
arch/x86/kernel/pvclock.c-25-}
--
arch/x86/kvm/x86.c=13706=static void kvm_mmu_slot_apply_flags(struct kvm *kvm,
--
arch/x86/kvm/x86.c-13710-{
arch/x86/kvm/x86.c:13711: u32 old_flags = old ? old->flags : 0;
arch/x86/kvm/x86.c-13712- u32 new_flags = new ? new->flags : 0;
--
arch/x86/kvm/xen.c=1362=int kvm_xen_hvm_config(struct kvm *kvm, struct kvm_xen_hvm_config *xhc)
--
arch/x86/kvm/xen.c-1364- /* Only some feature flags need to be *enabled* by userspace */
arch/x86/kvm/xen.c:1365: u32 permitted_flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL |
arch/x86/kvm/xen.c-1366- KVM_XEN_HVM_CONFIG_EVTCHN_SEND |
--
arch/x86/kvm/xen.c-1397-
arch/x86/kvm/xen.c:1398: old_flags = kvm->arch.xen.hvm_config.flags;
arch/x86/kvm/xen.c-1399- memcpy(&kvm->arch.xen.hvm_config, xhc, sizeof(*xhc));
--
arch/x86/mm/kmmio.c=236=int kmmio_handler(struct pt_regs *regs, unsigned long addr)
--
arch/x86/mm/kmmio.c-298- ctx->probe = get_kmmio_probe(page_base);
arch/x86/mm/kmmio.c:299: ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
arch/x86/mm/kmmio.c-300- ctx->addr = page_base;
--
arch/x86/mm/mem_encrypt_amd.c=156=static void __init __sme_early_map_unmap_mem(void *vaddr, unsigned long size,
--
arch/x86/mm/mem_encrypt_amd.c-162- /* Use early_pmd_flags but remove the encryption mask */
arch/x86/mm/mem_encrypt_amd.c:163: pmd_flags = __sme_clr(early_pmd_flags);
arch/x86/mm/mem_encrypt_amd.c-164-
--
arch/x86/mm/mem_encrypt_amd.c=477=void __init sme_early_init(void)
--
arch/x86/mm/mem_encrypt_amd.c-481-
arch/x86/mm/mem_encrypt_amd.c:482: early_pmd_flags = __sme_set(early_pmd_flags);
arch/x86/mm/mem_encrypt_amd.c-483-
--
arch/x86/mm/pat/memtype.c=142=static inline void set_page_memtype(struct page *pg,
--
arch/x86/mm/pat/memtype.c-164-
arch/x86/mm/pat/memtype.c:165: old_flags = READ_ONCE(pg->flags.f);
arch/x86/mm/pat/memtype.c-166- do {
--
arch/x86/mm/pat/set_memory.c=1322=static int collapse_pud_page(pud_t *pud, unsigned long addr,
--
arch/x86/mm/pat/set_memory.c-1352- return 0;
arch/x86/mm/pat/set_memory.c:1353: if (pmd_flags(entry) != pmd_flags(first))
arch/x86/mm/pat/set_memory.c-1354- return 0;
--
block/bfq-iosched.c=6236=static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
--
block/bfq-iosched.c-6284- */
block/bfq-iosched.c:6285: cmd_flags = rq->cmd_flags;
block/bfq-iosched.c-6286- spin_unlock_irq(&bfqd->lock);
--
block/blk-flush.c=148=static void blk_flush_complete_seq(struct request *rq,
--
block/blk-flush.c-157- rq->flush.seq |= seq;
block/blk-flush.c:158: cmd_flags = rq->cmd_flags;
block/blk-flush.c-159-
--
block/blk-flush.c=276=static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq,
--
block/blk-flush.c-317-
block/blk-flush.c:318: flush_rq->cmd_flags = REQ_OP_FLUSH | REQ_PREFLUSH;
block/blk-flush.c:319: flush_rq->cmd_flags |= (flags & REQ_DRV) | (flags & REQ_FAILFAST_MASK);
block/blk-flush.c-320- flush_rq->rq_flags |= RQF_FLUSH_SEQ;
--
block/blk-flush.c=384=bool blk_insert_flush(struct request *rq)
--
block/blk-flush.c-410- */
block/blk-flush.c:411: rq->cmd_flags &= ~REQ_PREFLUSH;
block/blk-flush.c-412- if (!supports_fua)
block/blk-flush.c:413: rq->cmd_flags &= ~REQ_FUA;
block/blk-flush.c-414-
--
block/blk-flush.c-419- */
block/blk-flush.c:420: rq->cmd_flags |= REQ_SYNC;
block/blk-flush.c-421-
--
block/blk-integrity.c=58=int blk_get_meta_cap(struct block_device *bdev, unsigned int cmd,
--
block/blk-integrity.c-72- if (bi->flags & BLK_INTEGRITY_DEVICE_CAPABLE)
block/blk-integrity.c:73: meta_cap.lbmd_flags |= LBMD_PI_CAP_INTEGRITY;
block/blk-integrity.c-74- if (bi->flags & BLK_INTEGRITY_REF_TAG)
block/blk-integrity.c:75: meta_cap.lbmd_flags |= LBMD_PI_CAP_REFTAG;
block/blk-integrity.c-76- meta_cap.lbmd_interval = 1 << bi->interval_exp;
--
block/blk-integrity.c=123=int blk_rq_integrity_map_user(struct request *rq, void __user *ubuf,
--
block/blk-integrity.c-134- rq->nr_integrity_segments = blk_rq_count_integrity_sg(rq->q, rq->bio);
block/blk-integrity.c:135: rq->cmd_flags |= REQ_INTEGRITY;
block/blk-integrity.c-136- return 0;
--
block/blk-merge.c=707=static inline void blk_update_mixed_merge(struct request *req,
--
block/blk-merge.c-714- if (front_merge) {
block/blk-merge.c:715: req->cmd_flags &= ~REQ_FAILFAST_MASK;
block/blk-merge.c:716: req->cmd_flags |= bio->bi_opf & REQ_FAILFAST_MASK;
block/blk-merge.c-717- }
--
block/blk-merge.c=743=static bool blk_atomic_write_mergeable_rq_bio(struct request *rq,
--
block/blk-merge.c-745-{
block/blk-merge.c:746: return (rq->cmd_flags & REQ_ATOMIC) == (bio->bi_opf & REQ_ATOMIC);
block/blk-merge.c-747-}
--
block/blk-merge.c=749=static bool blk_atomic_write_mergeable_rqs(struct request *rq,
--
block/blk-merge.c-751-{
block/blk-merge.c:752: return (rq->cmd_flags & REQ_ATOMIC) == (next->cmd_flags & REQ_ATOMIC);
block/blk-merge.c-753-}
--
block/blk-merge.c=777=static struct request *attempt_merge(struct request_queue *q,
--
block/blk-merge.c-822- if (((req->rq_flags | next->rq_flags) & RQF_MIXED_MERGE) ||
block/blk-merge.c:823: (req->cmd_flags & REQ_FAILFAST_MASK) !=
block/blk-merge.c-824- (next->cmd_flags & REQ_FAILFAST_MASK)) {
--
block/blk-merge.c=944=enum bio_merge_status bio_attempt_back_merge(struct request *req,
--
block/blk-merge.c-954-
block/blk-merge.c:955: if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
block/blk-merge.c-956- blk_rq_set_mixed_merge(req);
--
block/blk-merge.c=975=static enum bio_merge_status bio_attempt_front_merge(struct request *req,
--
block/blk-merge.c-993-
block/blk-merge.c:994: if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
block/blk-merge.c-995- blk_rq_set_mixed_merge(req);
--
block/blk-mq-debugfs.c=264=int __blk_mq_debugfs_rq_show(struct seq_file *m, struct request *rq)
--
block/blk-mq-debugfs.c-277- seq_printf(m, "%s", op_str);
block/blk-mq-debugfs.c:278: seq_puts(m, ", .cmd_flags=");
block/blk-mq-debugfs.c-279- blk_flags_show(m, (__force unsigned int)(rq->cmd_flags & ~REQ_OP_MASK),
--
block/blk-mq.c=410=static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
--
block/blk-mq.c-420- rq->mq_hctx = hctx;
block/blk-mq.c:421: rq->cmd_flags = data->cmd_flags;
block/blk-mq.c-422-
--
block/blk-mq.c=501=static void blk_mq_limit_depth(struct blk_mq_alloc_data *data)
--
block/blk-mq.c-520- */
block/blk-mq.c:521: if ((data->cmd_flags & REQ_OP_MASK) == REQ_OP_FLUSH ||
block/blk-mq.c-522- blk_op_is_passthrough(data->cmd_flags))
--
block/blk-mq.c=597=static struct request *blk_mq_rq_cache_fill(struct request_queue *q,
--
block/blk-mq.c-605- .shallow_depth = 0,
block/blk-mq.c:606: .cmd_flags = opf,
block/blk-mq.c-607- .rq_flags = 0,
--
block/blk-mq.c=626=static struct request *blk_mq_alloc_cached_request(struct request_queue *q,
--
block/blk-mq.c-648- return NULL;
block/blk-mq.c:649: if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
block/blk-mq.c-650- return NULL;
--
block/blk-mq.c-655-
block/blk-mq.c:656: rq->cmd_flags = opf;
block/blk-mq.c-657- INIT_LIST_HEAD(&rq->queuelist);
--
block/blk-mq.c=661=struct request *blk_mq_alloc_request(struct request_queue *q, blk_opf_t opf,
--
block/blk-mq.c-671- .shallow_depth = 0,
block/blk-mq.c:672: .cmd_flags = opf,
block/blk-mq.c-673- .rq_flags = 0,
--
block/blk-mq.c=700=struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
--
block/blk-mq.c-706- .shallow_depth = 0,
block/blk-mq.c:707: .cmd_flags = opf,
block/blk-mq.c-708- .rq_flags = 0,
--
block/blk-mq.c=954=bool blk_update_request(struct request *req, blk_status_t error,
--
block/blk-mq.c-1046- if (req->rq_flags & RQF_MIXED_MERGE) {
block/blk-mq.c:1047: req->cmd_flags &= ~REQ_FAILFAST_MASK;
block/blk-mq.c:1048: req->cmd_flags |= req->bio->bi_opf & REQ_FAILFAST_MASK;
block/blk-mq.c-1049- }
--
block/blk-mq.c=2685=static void blk_mq_bio_to_request(struct request *rq, struct bio *bio,
--
block/blk-mq.c-2690- if (bio->bi_opf & REQ_RAHEAD)
block/blk-mq.c:2691: rq->cmd_flags |= REQ_FAILFAST_MASK;
block/blk-mq.c-2692-
--
block/blk-mq.c=3046=static struct request *blk_mq_get_new_requests(struct request_queue *q,
--
block/blk-mq.c-3053- .shallow_depth = 0,
block/blk-mq.c:3054: .cmd_flags = bio->bi_opf,
block/blk-mq.c-3055- .rq_flags = 0,
--
block/blk-mq.c=3080=static struct request *blk_mq_peek_cached_request(struct blk_plug *plug,
--
block/blk-mq.c-3093- return NULL;
block/blk-mq.c:3094: if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
block/blk-mq.c-3095- return NULL;
--
block/blk-mq.c=3099=static void blk_mq_use_cached_rq(struct request *rq, struct blk_plug *plug,
--
block/blk-mq.c-3112- blk_mq_rq_time_init(rq, blk_time_get_ns());
block/blk-mq.c:3113: rq->cmd_flags = bio->bi_opf;
block/blk-mq.c-3114- INIT_LIST_HEAD(&rq->queuelist);
--
block/blk.h=481=static inline void req_set_nomerge(struct request_queue *q, struct request *req)
block/blk.h-482-{
block/blk.h:483: req->cmd_flags |= REQ_NOMERGE;
block/blk.h-484- if (req == q->last_merge)
--
drivers/acpi/acpica/dsfield.c=260=acpi_ds_get_field_names(struct acpi_create_field_info *info,
--
drivers/acpi/acpica/dsfield.c-319-
drivers/acpi/acpica/dsfield.c:320: info->field_flags = (u8)
drivers/acpi/acpica/dsfield.c-321- ((info->
--
drivers/acpi/acpica/dsfield.c=473=acpi_ds_create_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-510- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:511: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-512- info.attribute = 0;
--
drivers/acpi/acpica/dsfield.c=673=acpi_ds_create_bank_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-728- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:729: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-730-
--
drivers/acpi/acpica/dsfield.c=766=acpi_ds_create_index_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-806- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:807: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-808-
--
drivers/acpi/acpica/dsopcode.c=75=acpi_ds_init_buffer_field(u16 aml_opcode,
--
drivers/acpi/acpica/dsopcode.c-125-
drivers/acpi/acpica/dsopcode.c:126: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-127- bit_offset = offset;
--
drivers/acpi/acpica/dsopcode.c-145- bit_count = 1;
drivers/acpi/acpica/dsopcode.c:146: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-147- break;
--
drivers/acpi/acpica/dsopcode.c-154- bit_count = 8;
drivers/acpi/acpica/dsopcode.c:155: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-156- break;
--
drivers/acpi/acpica/dsopcode.c-163- bit_count = 16;
drivers/acpi/acpica/dsopcode.c:164: field_flags = AML_FIELD_ACCESS_WORD;
drivers/acpi/acpica/dsopcode.c-165- break;
--
drivers/acpi/acpica/dsopcode.c-172- bit_count = 32;
drivers/acpi/acpica/dsopcode.c:173: field_flags = AML_FIELD_ACCESS_DWORD;
drivers/acpi/acpica/dsopcode.c-174- break;
--
drivers/acpi/acpica/dsopcode.c-181- bit_count = 64;
drivers/acpi/acpica/dsopcode.c:182: field_flags = AML_FIELD_ACCESS_QWORD;
drivers/acpi/acpica/dsopcode.c-183- break;
--
drivers/acpi/acpica/dsopcode.c-208- * Initialize areas of the field object that are common to all fields
drivers/acpi/acpica/dsopcode.c:209: * For field_flags, use LOCK_RULE = 0 (NO_LOCK),
drivers/acpi/acpica/dsopcode.c-210- * UPDATE_RULE = 0 (UPDATE_PRESERVE)
--
drivers/acpi/acpica/excreate.c=409=acpi_ex_create_method(u8 * aml_start,
--
drivers/acpi/acpica/excreate.c-436- */
drivers/acpi/acpica/excreate.c:437: method_flags = (u8)operand[1]->integer.value;
drivers/acpi/acpica/excreate.c-438- obj_desc->method.param_count = (u8)
--
drivers/acpi/acpica/exprep.c=293=acpi_ex_prep_common_field_object(union acpi_operand_object *obj_desc,
--
drivers/acpi/acpica/exprep.c-308- */
drivers/acpi/acpica/exprep.c:309: obj_desc->common_field.field_flags = field_flags;
drivers/acpi/acpica/exprep.c-310- obj_desc->common_field.attribute = field_attribute;
--
drivers/acpi/acpica/nsxfname.c=475=acpi_status acpi_install_method(u8 *buffer)
--
drivers/acpi/acpica/nsxfname.c-516-
drivers/acpi/acpica/nsxfname.c:517: method_flags = *parser_state.aml++;
drivers/acpi/acpica/nsxfname.c-518- aml_start = parser_state.aml;
--
]
]
|
| 23/2 |
2026/05/22 23:22 |
llm |
expert |
0m
Model:
Tokens:
input: 38425
output: 19
thoughts: 19
Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience:
**Diving into the dcache.c Deep End**
Right, so I'm thinking, let's cut through the noise and get straight to the point. No need for elaborate debugging tools or verbose print statements just yet. The goal here is efficient exploration. The `d_flags` field is a key piece of the dentry puzzle, so my instinct is to immediately zero in on where it's *used*. My thoughts immediately steer me towards `fs/dcache.c`. I have a feeling that diving directly into that file and just using `grep d_flags` will be the quickest, most direct way to get a handle on all the contexts where the system interacts with that field. I'm hoping to quickly identify the key functions, conditional logic, and any potential areas of concern or interest surrounding how these flags are set, read, and manipulated. It's a fundamental move β quick, dirty and effective.
|
| 24/2 |
2026/05/22 23:23 |
tool |
grepper |
0m
Args: map[Expression:d_flags.*=]
Results: map[Output:
Full output is too long, showing 500 out of 6927 lines.
Use more precise expression if possible.
[Documentation/scheduler/sched-deadline.rst=808=Appendix B. Minimal main()
--
Documentation/scheduler/sched-deadline.rst-891- attr.size = sizeof(attr);
Documentation/scheduler/sched-deadline.rst:892: attr.sched_flags = 0;
Documentation/scheduler/sched-deadline.rst-893- attr.sched_nice = 0;
--
arch/alpha/kernel/signal.c=523=do_work_pending(struct pt_regs *regs, unsigned long thread_flags,
--
arch/alpha/kernel/signal.c-541- local_irq_disable();
arch/alpha/kernel/signal.c:542: thread_flags = read_thread_flags();
arch/alpha/kernel/signal.c-543- } while (thread_flags & _TIF_WORK_MASK);
--
arch/arm/kernel/signal.c=603=do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
--
arch/arm/kernel/signal.c-635- local_irq_disable();
arch/arm/kernel/signal.c:636: thread_flags = read_thread_flags();
arch/arm/kernel/signal.c-637- } while (thread_flags & _TIF_WORK_MASK);
--
arch/arm64/kernel/stacktrace.c=459=static bool dump_backtrace_entry(const struct kunwind_state *state, void *arg)
--
arch/arm64/kernel/stacktrace.c-461- const char *source = state_source_string(state);
arch/arm64/kernel/stacktrace.c:462: union unwind_flags flags = state->flags;
arch/arm64/kernel/stacktrace.c-463- bool has_info = source || flags.all;
--
arch/loongarch/kvm/mmu.c=442=void kvm_arch_commit_memory_region(struct kvm *kvm,
--
arch/loongarch/kvm/mmu.c-447- int needs_flush;
arch/loongarch/kvm/mmu.c:448: u32 old_flags = old ? old->flags : 0;
arch/loongarch/kvm/mmu.c-449- u32 new_flags = new ? new->flags : 0;
--
arch/openrisc/kernel/signal.c=332=do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
--
arch/openrisc/kernel/signal.c-356- local_irq_disable();
arch/openrisc/kernel/signal.c:357: thread_flags = read_thread_flags();
arch/openrisc/kernel/signal.c-358- } while (thread_flags & _TIF_WORK_MASK);
--
arch/powerpc/platforms/powermac/feature.c=299=static long ohare_sleep_state(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-302-
arch/powerpc/platforms/powermac/feature.c:303: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-304- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=582=static long heathrow_sleep_state(struct device_node *node, long param,
--
arch/powerpc/platforms/powermac/feature.c-584-{
arch/powerpc/platforms/powermac/feature.c:585: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-586- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=1263=core99_firewire_cable_power(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1268- /* Trick: we allow NULL node */
arch/powerpc/platforms/powermac/feature.c:1269: if ((pmac_mb.board_flags & PMAC_MB_HAS_FW_POWER) == 0)
arch/powerpc/platforms/powermac/feature.c-1270- return -ENODEV;
--
arch/powerpc/platforms/powermac/feature.c=1823=core99_sleep_state(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1839- }
arch/powerpc/platforms/powermac/feature.c:1840: if ((pmac_mb.board_flags & PMAC_MB_CAN_SLEEP) == 0)
arch/powerpc/platforms/powermac/feature.c-1841- return -EPERM;
--
arch/powerpc/platforms/powermac/feature.c=1856=generic_dev_can_wake(struct device_node *node, long param, long value)
--
arch/powerpc/platforms/powermac/feature.c-1862- if (pmac_mb.board_flags & PMAC_MB_MAY_SLEEP)
arch/powerpc/platforms/powermac/feature.c:1863: pmac_mb.board_flags |= PMAC_MB_CAN_SLEEP;
arch/powerpc/platforms/powermac/feature.c-1864- return 0;
--
arch/powerpc/platforms/powermac/feature.c=2398=static int __init probe_motherboard(void)
--
arch/powerpc/platforms/powermac/feature.c-2534- || strncmp(model, "iBook", 5) == 0))
arch/powerpc/platforms/powermac/feature.c:2535: pmac_mb.board_flags |= PMAC_MB_MOBILE;
arch/powerpc/platforms/powermac/feature.c-2536-
--
arch/powerpc/platforms/powernv/pci-ioda.c=1725=static const struct msi_parent_ops pnv_msi_parent_ops = {
arch/powerpc/platforms/powernv/pci-ioda.c:1726: .required_flags = PNV_PCI_MSI_FLAGS_REQUIRED,
arch/powerpc/platforms/powernv/pci-ioda.c:1727: .supported_flags = PNV_PCI_MSI_FLAGS_SUPPORTED,
arch/powerpc/platforms/powernv/pci-ioda.c-1728- .chip_flags = MSI_CHIP_FLAG_SET_EOI,
--
arch/powerpc/platforms/pseries/msi.c=526=static const struct msi_parent_ops pseries_msi_parent_ops = {
arch/powerpc/platforms/pseries/msi.c:527: .required_flags = PSERIES_PCI_MSI_FLAGS_REQUIRED,
arch/powerpc/platforms/pseries/msi.c:528: .supported_flags = PSERIES_PCI_MSI_FLAGS_SUPPORTED,
arch/powerpc/platforms/pseries/msi.c-529- .chip_flags = MSI_CHIP_FLAG_SET_EOI,
--
arch/powerpc/platforms/pseries/papr_scm.c=834=static int papr_pdsm_smart_inject(struct papr_scm_priv *p,
--
arch/powerpc/platforms/pseries/papr_scm.c-837- int rc;
arch/powerpc/platforms/pseries/papr_scm.c:838: u32 supported_flags = 0;
arch/powerpc/platforms/pseries/papr_scm.c-839- u64 inject_mask = 0, clear_mask = 0;
--
arch/powerpc/platforms/pseries/papr_scm.c-843- if (payload->smart_inject.flags & PDSM_SMART_INJECT_HEALTH_FATAL) {
arch/powerpc/platforms/pseries/papr_scm.c:844: supported_flags |= PDSM_SMART_INJECT_HEALTH_FATAL;
arch/powerpc/platforms/pseries/papr_scm.c-845- if (payload->smart_inject.fatal_enable)
--
arch/powerpc/platforms/pseries/papr_scm.c-851- if (payload->smart_inject.flags & PDSM_SMART_INJECT_BAD_SHUTDOWN) {
arch/powerpc/platforms/pseries/papr_scm.c:852: supported_flags |= PDSM_SMART_INJECT_BAD_SHUTDOWN;
arch/powerpc/platforms/pseries/papr_scm.c-853- if (payload->smart_inject.unsafe_shutdown_enable)
--
arch/s390/kvm/vsie.c=315=static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
--
arch/s390/kvm/vsie.c-357- (ECB3_AES | ECB3_DEA);
arch/s390/kvm/vsie.c:358: ecd_flags = scb_o->ecd & vcpu->arch.sie_block->ecd &
arch/s390/kvm/vsie.c-359- (ECD_ECC | ECD_HMAC);
--
arch/s390/pci/pci_irq.c=495=static struct msi_parent_ops zpci_msi_parent_ops = {
arch/s390/pci/pci_irq.c:496: .supported_flags = MSI_GENERIC_FLAGS_MASK |
arch/s390/pci/pci_irq.c-497- MSI_FLAG_PCI_MSIX |
arch/s390/pci/pci_irq.c-498- MSI_FLAG_MULTI_PCI_MSI,
arch/s390/pci/pci_irq.c:499: .required_flags = MSI_FLAG_USE_DEF_DOM_OPS |
arch/s390/pci/pci_irq.c-500- MSI_FLAG_USE_DEF_CHIP_OPS,
--
arch/s390/pci/pci_irq.c=504=int zpci_create_parent_msi_domain(struct zpci_bus *zbus)
--
arch/s390/pci/pci_irq.c-519- if (irq_delivery == FLOATING)
arch/s390/pci/pci_irq.c:520: zpci_msi_parent_ops.required_flags |= MSI_FLAG_NO_AFFINITY;
arch/s390/pci/pci_irq.c-521-
--
arch/um/drivers/virt-pci.c=414=static const struct msi_parent_ops um_pci_msi_parent_ops = {
arch/um/drivers/virt-pci.c:415: .required_flags = UM_PCI_MSI_FLAGS_REQUIRED,
arch/um/drivers/virt-pci.c:416: .supported_flags = UM_PCI_MSI_FLAGS_SUPPORTED,
arch/um/drivers/virt-pci.c-417- .bus_select_token = DOMAIN_BUS_NEXUS,
--
arch/um/kernel/process.c=84=void interrupt_end(void)
--
arch/um/kernel/process.c-88-
arch/um/kernel/process.c:89: thread_flags = read_thread_flags();
arch/um/kernel/process.c-90- while (thread_flags & _TIF_WORK_MASK) {
--
arch/um/kernel/process.c-96- resume_user_mode_work(regs);
arch/um/kernel/process.c:97: thread_flags = read_thread_flags();
arch/um/kernel/process.c-98- }
--
arch/x86/boot/cpuflags.c=68=void get_cpuflags(void)
--
arch/x86/boot/cpuflags.c-75- return;
arch/x86/boot/cpuflags.c:76: loaded_flags = true;
arch/x86/boot/cpuflags.c-77-
--
arch/x86/boot/startup/sme.c=209=static void __init __sme_map_range(struct sme_populate_pgd_data *ppd,
--
arch/x86/boot/startup/sme.c-213-
arch/x86/boot/startup/sme.c:214: ppd->pmd_flags = pmd_flags;
arch/x86/boot/startup/sme.c-215- ppd->pte_flags = pte_flags;
--
arch/x86/hyperv/irqdomain.c=322=static struct msi_parent_ops hv_msi_parent_ops = {
arch/x86/hyperv/irqdomain.c:323: .supported_flags = HV_MSI_FLAGS_SUPPORTED,
arch/x86/hyperv/irqdomain.c:324: .required_flags = HV_MSI_FLAGS_REQUIRED,
arch/x86/hyperv/irqdomain.c-325- .bus_select_token = DOMAIN_BUS_NEXUS,
--
arch/x86/include/asm/pgtable.h=175=static inline bool pmd_shstk(pmd_t pmd)
--
arch/x86/include/asm/pgtable.h-177- return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
arch/x86/include/asm/pgtable.h:178: (pmd_flags(pmd) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
arch/x86/include/asm/pgtable.h-179- (_PAGE_DIRTY | _PAGE_PSE);
--
arch/x86/include/asm/pgtable.h=198=static inline bool pud_shstk(pud_t pud)
--
arch/x86/include/asm/pgtable.h-200- return cpu_feature_enabled(X86_FEATURE_SHSTK) &&
arch/x86/include/asm/pgtable.h:201: (pud_flags(pud) & (_PAGE_RW | _PAGE_DIRTY | _PAGE_PSE)) ==
arch/x86/include/asm/pgtable.h-202- (_PAGE_DIRTY | _PAGE_PSE);
--
arch/x86/include/asm/pgtable.h=1025=static inline int pmd_bad(pmd_t pmd)
arch/x86/include/asm/pgtable.h-1026-{
arch/x86/include/asm/pgtable.h:1027: return (pmd_flags(pmd) & ~(_PAGE_USER | _PAGE_ACCESSED)) !=
arch/x86/include/asm/pgtable.h-1028- (_KERNPG_TABLE & ~_PAGE_ACCESSED);
--
arch/x86/include/asm/pgtable.h=1064=static inline int pud_bad(pud_t pud)
arch/x86/include/asm/pgtable.h-1065-{
arch/x86/include/asm/pgtable.h:1066: return (pud_flags(pud) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
arch/x86/include/asm/pgtable.h-1067-}
--
arch/x86/include/asm/pgtable.h=1092=static inline int p4d_bad(p4d_t p4d)
--
arch/x86/include/asm/pgtable.h-1098-
arch/x86/include/asm/pgtable.h:1099: return (p4d_flags(p4d) & ~ignore_flags) != 0;
arch/x86/include/asm/pgtable.h-1100-}
--
arch/x86/include/asm/pgtable.h=1135=static inline int pgd_bad(pgd_t pgd)
--
arch/x86/include/asm/pgtable.h-1144-
arch/x86/include/asm/pgtable.h:1145: return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
arch/x86/include/asm/pgtable.h-1146-}
--
arch/x86/kernel/apic/msi.c=259=static const struct msi_parent_ops x86_vector_msi_parent_ops = {
arch/x86/kernel/apic/msi.c:260: .supported_flags = X86_VECTOR_MSI_FLAGS_SUPPORTED,
arch/x86/kernel/apic/msi.c-261- .init_dev_msi_info = x86_init_dev_msi_info,
--
arch/x86/kernel/head64.c=51=SYM_PIC_ALIAS(next_early_pgt);
arch/x86/kernel/head64.c:52:pmdval_t early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
arch/x86/kernel/head64.c-53-
--
arch/x86/kernel/kprobes/core.c=817=save_previous_kprobe(struct kprobe_ctlblk *kcb)
--
arch/x86/kernel/kprobes/core.c-820- kcb->prev_kprobe.status = kcb->kprobe_status;
arch/x86/kernel/kprobes/core.c:821: kcb->prev_kprobe.old_flags = kcb->kprobe_old_flags;
arch/x86/kernel/kprobes/core.c:822: kcb->prev_kprobe.saved_flags = kcb->kprobe_saved_flags;
arch/x86/kernel/kprobes/core.c-823-}
--
arch/x86/kernel/kprobes/core.c=826=restore_previous_kprobe(struct kprobe_ctlblk *kcb)
--
arch/x86/kernel/kprobes/core.c-829- kcb->kprobe_status = kcb->prev_kprobe.status;
arch/x86/kernel/kprobes/core.c:830: kcb->kprobe_old_flags = kcb->prev_kprobe.old_flags;
arch/x86/kernel/kprobes/core.c:831: kcb->kprobe_saved_flags = kcb->prev_kprobe.saved_flags;
arch/x86/kernel/kprobes/core.c-832-}
--
arch/x86/kernel/kprobes/core.c=835=set_current_kprobe(struct kprobe *p, struct pt_regs *regs,
--
arch/x86/kernel/kprobes/core.c-838- __this_cpu_write(current_kprobe, p);
arch/x86/kernel/kprobes/core.c:839: kcb->kprobe_saved_flags = kcb->kprobe_old_flags
arch/x86/kernel/kprobes/core.c-840- = (regs->flags & X86_EFLAGS_IF);
--
arch/x86/kernel/pvclock.c-18-
arch/x86/kernel/pvclock.c:19:static u8 valid_flags __read_mostly = 0;
arch/x86/kernel/pvclock.c-20-static struct pvclock_vsyscall_time_info *pvti_cpu0_va __read_mostly;
--
arch/x86/kernel/pvclock.c=22=void pvclock_set_flags(u8 flags)
arch/x86/kernel/pvclock.c-23-{
arch/x86/kernel/pvclock.c:24: valid_flags = flags;
arch/x86/kernel/pvclock.c-25-}
--
arch/x86/kvm/x86.c=13706=static void kvm_mmu_slot_apply_flags(struct kvm *kvm,
--
arch/x86/kvm/x86.c-13710-{
arch/x86/kvm/x86.c:13711: u32 old_flags = old ? old->flags : 0;
arch/x86/kvm/x86.c-13712- u32 new_flags = new ? new->flags : 0;
--
arch/x86/kvm/xen.c=1362=int kvm_xen_hvm_config(struct kvm *kvm, struct kvm_xen_hvm_config *xhc)
--
arch/x86/kvm/xen.c-1364- /* Only some feature flags need to be *enabled* by userspace */
arch/x86/kvm/xen.c:1365: u32 permitted_flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL |
arch/x86/kvm/xen.c-1366- KVM_XEN_HVM_CONFIG_EVTCHN_SEND |
--
arch/x86/kvm/xen.c-1397-
arch/x86/kvm/xen.c:1398: old_flags = kvm->arch.xen.hvm_config.flags;
arch/x86/kvm/xen.c-1399- memcpy(&kvm->arch.xen.hvm_config, xhc, sizeof(*xhc));
--
arch/x86/mm/kmmio.c=236=int kmmio_handler(struct pt_regs *regs, unsigned long addr)
--
arch/x86/mm/kmmio.c-298- ctx->probe = get_kmmio_probe(page_base);
arch/x86/mm/kmmio.c:299: ctx->saved_flags = (regs->flags & (X86_EFLAGS_TF | X86_EFLAGS_IF));
arch/x86/mm/kmmio.c-300- ctx->addr = page_base;
--
arch/x86/mm/mem_encrypt_amd.c=156=static void __init __sme_early_map_unmap_mem(void *vaddr, unsigned long size,
--
arch/x86/mm/mem_encrypt_amd.c-162- /* Use early_pmd_flags but remove the encryption mask */
arch/x86/mm/mem_encrypt_amd.c:163: pmd_flags = __sme_clr(early_pmd_flags);
arch/x86/mm/mem_encrypt_amd.c-164-
--
arch/x86/mm/mem_encrypt_amd.c=477=void __init sme_early_init(void)
--
arch/x86/mm/mem_encrypt_amd.c-481-
arch/x86/mm/mem_encrypt_amd.c:482: early_pmd_flags = __sme_set(early_pmd_flags);
arch/x86/mm/mem_encrypt_amd.c-483-
--
arch/x86/mm/pat/memtype.c=142=static inline void set_page_memtype(struct page *pg,
--
arch/x86/mm/pat/memtype.c-164-
arch/x86/mm/pat/memtype.c:165: old_flags = READ_ONCE(pg->flags.f);
arch/x86/mm/pat/memtype.c-166- do {
--
arch/x86/mm/pat/set_memory.c=1322=static int collapse_pud_page(pud_t *pud, unsigned long addr,
--
arch/x86/mm/pat/set_memory.c-1352- return 0;
arch/x86/mm/pat/set_memory.c:1353: if (pmd_flags(entry) != pmd_flags(first))
arch/x86/mm/pat/set_memory.c-1354- return 0;
--
block/bfq-iosched.c=6236=static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
--
block/bfq-iosched.c-6284- */
block/bfq-iosched.c:6285: cmd_flags = rq->cmd_flags;
block/bfq-iosched.c-6286- spin_unlock_irq(&bfqd->lock);
--
block/blk-flush.c=148=static void blk_flush_complete_seq(struct request *rq,
--
block/blk-flush.c-157- rq->flush.seq |= seq;
block/blk-flush.c:158: cmd_flags = rq->cmd_flags;
block/blk-flush.c-159-
--
block/blk-flush.c=276=static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq,
--
block/blk-flush.c-317-
block/blk-flush.c:318: flush_rq->cmd_flags = REQ_OP_FLUSH | REQ_PREFLUSH;
block/blk-flush.c:319: flush_rq->cmd_flags |= (flags & REQ_DRV) | (flags & REQ_FAILFAST_MASK);
block/blk-flush.c-320- flush_rq->rq_flags |= RQF_FLUSH_SEQ;
--
block/blk-flush.c=384=bool blk_insert_flush(struct request *rq)
--
block/blk-flush.c-410- */
block/blk-flush.c:411: rq->cmd_flags &= ~REQ_PREFLUSH;
block/blk-flush.c-412- if (!supports_fua)
block/blk-flush.c:413: rq->cmd_flags &= ~REQ_FUA;
block/blk-flush.c-414-
--
block/blk-flush.c-419- */
block/blk-flush.c:420: rq->cmd_flags |= REQ_SYNC;
block/blk-flush.c-421-
--
block/blk-integrity.c=58=int blk_get_meta_cap(struct block_device *bdev, unsigned int cmd,
--
block/blk-integrity.c-72- if (bi->flags & BLK_INTEGRITY_DEVICE_CAPABLE)
block/blk-integrity.c:73: meta_cap.lbmd_flags |= LBMD_PI_CAP_INTEGRITY;
block/blk-integrity.c-74- if (bi->flags & BLK_INTEGRITY_REF_TAG)
block/blk-integrity.c:75: meta_cap.lbmd_flags |= LBMD_PI_CAP_REFTAG;
block/blk-integrity.c-76- meta_cap.lbmd_interval = 1 << bi->interval_exp;
--
block/blk-integrity.c=123=int blk_rq_integrity_map_user(struct request *rq, void __user *ubuf,
--
block/blk-integrity.c-134- rq->nr_integrity_segments = blk_rq_count_integrity_sg(rq->q, rq->bio);
block/blk-integrity.c:135: rq->cmd_flags |= REQ_INTEGRITY;
block/blk-integrity.c-136- return 0;
--
block/blk-merge.c=707=static inline void blk_update_mixed_merge(struct request *req,
--
block/blk-merge.c-714- if (front_merge) {
block/blk-merge.c:715: req->cmd_flags &= ~REQ_FAILFAST_MASK;
block/blk-merge.c:716: req->cmd_flags |= bio->bi_opf & REQ_FAILFAST_MASK;
block/blk-merge.c-717- }
--
block/blk-merge.c=743=static bool blk_atomic_write_mergeable_rq_bio(struct request *rq,
--
block/blk-merge.c-745-{
block/blk-merge.c:746: return (rq->cmd_flags & REQ_ATOMIC) == (bio->bi_opf & REQ_ATOMIC);
block/blk-merge.c-747-}
--
block/blk-merge.c=749=static bool blk_atomic_write_mergeable_rqs(struct request *rq,
--
block/blk-merge.c-751-{
block/blk-merge.c:752: return (rq->cmd_flags & REQ_ATOMIC) == (next->cmd_flags & REQ_ATOMIC);
block/blk-merge.c-753-}
--
block/blk-merge.c=777=static struct request *attempt_merge(struct request_queue *q,
--
block/blk-merge.c-822- if (((req->rq_flags | next->rq_flags) & RQF_MIXED_MERGE) ||
block/blk-merge.c:823: (req->cmd_flags & REQ_FAILFAST_MASK) !=
block/blk-merge.c-824- (next->cmd_flags & REQ_FAILFAST_MASK)) {
--
block/blk-merge.c=944=enum bio_merge_status bio_attempt_back_merge(struct request *req,
--
block/blk-merge.c-954-
block/blk-merge.c:955: if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
block/blk-merge.c-956- blk_rq_set_mixed_merge(req);
--
block/blk-merge.c=975=static enum bio_merge_status bio_attempt_front_merge(struct request *req,
--
block/blk-merge.c-993-
block/blk-merge.c:994: if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff)
block/blk-merge.c-995- blk_rq_set_mixed_merge(req);
--
block/blk-mq-debugfs.c=264=int __blk_mq_debugfs_rq_show(struct seq_file *m, struct request *rq)
--
block/blk-mq-debugfs.c-277- seq_printf(m, "%s", op_str);
block/blk-mq-debugfs.c:278: seq_puts(m, ", .cmd_flags=");
block/blk-mq-debugfs.c-279- blk_flags_show(m, (__force unsigned int)(rq->cmd_flags & ~REQ_OP_MASK),
--
block/blk-mq.c=410=static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
--
block/blk-mq.c-420- rq->mq_hctx = hctx;
block/blk-mq.c:421: rq->cmd_flags = data->cmd_flags;
block/blk-mq.c-422-
--
block/blk-mq.c=501=static void blk_mq_limit_depth(struct blk_mq_alloc_data *data)
--
block/blk-mq.c-520- */
block/blk-mq.c:521: if ((data->cmd_flags & REQ_OP_MASK) == REQ_OP_FLUSH ||
block/blk-mq.c-522- blk_op_is_passthrough(data->cmd_flags))
--
block/blk-mq.c=597=static struct request *blk_mq_rq_cache_fill(struct request_queue *q,
--
block/blk-mq.c-605- .shallow_depth = 0,
block/blk-mq.c:606: .cmd_flags = opf,
block/blk-mq.c-607- .rq_flags = 0,
--
block/blk-mq.c=626=static struct request *blk_mq_alloc_cached_request(struct request_queue *q,
--
block/blk-mq.c-648- return NULL;
block/blk-mq.c:649: if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
block/blk-mq.c-650- return NULL;
--
block/blk-mq.c-655-
block/blk-mq.c:656: rq->cmd_flags = opf;
block/blk-mq.c-657- INIT_LIST_HEAD(&rq->queuelist);
--
block/blk-mq.c=661=struct request *blk_mq_alloc_request(struct request_queue *q, blk_opf_t opf,
--
block/blk-mq.c-671- .shallow_depth = 0,
block/blk-mq.c:672: .cmd_flags = opf,
block/blk-mq.c-673- .rq_flags = 0,
--
block/blk-mq.c=700=struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
--
block/blk-mq.c-706- .shallow_depth = 0,
block/blk-mq.c:707: .cmd_flags = opf,
block/blk-mq.c-708- .rq_flags = 0,
--
block/blk-mq.c=954=bool blk_update_request(struct request *req, blk_status_t error,
--
block/blk-mq.c-1046- if (req->rq_flags & RQF_MIXED_MERGE) {
block/blk-mq.c:1047: req->cmd_flags &= ~REQ_FAILFAST_MASK;
block/blk-mq.c:1048: req->cmd_flags |= req->bio->bi_opf & REQ_FAILFAST_MASK;
block/blk-mq.c-1049- }
--
block/blk-mq.c=2685=static void blk_mq_bio_to_request(struct request *rq, struct bio *bio,
--
block/blk-mq.c-2690- if (bio->bi_opf & REQ_RAHEAD)
block/blk-mq.c:2691: rq->cmd_flags |= REQ_FAILFAST_MASK;
block/blk-mq.c-2692-
--
block/blk-mq.c=3046=static struct request *blk_mq_get_new_requests(struct request_queue *q,
--
block/blk-mq.c-3053- .shallow_depth = 0,
block/blk-mq.c:3054: .cmd_flags = bio->bi_opf,
block/blk-mq.c-3055- .rq_flags = 0,
--
block/blk-mq.c=3080=static struct request *blk_mq_peek_cached_request(struct blk_plug *plug,
--
block/blk-mq.c-3093- return NULL;
block/blk-mq.c:3094: if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
block/blk-mq.c-3095- return NULL;
--
block/blk-mq.c=3099=static void blk_mq_use_cached_rq(struct request *rq, struct blk_plug *plug,
--
block/blk-mq.c-3112- blk_mq_rq_time_init(rq, blk_time_get_ns());
block/blk-mq.c:3113: rq->cmd_flags = bio->bi_opf;
block/blk-mq.c-3114- INIT_LIST_HEAD(&rq->queuelist);
--
block/blk.h=481=static inline void req_set_nomerge(struct request_queue *q, struct request *req)
block/blk.h-482-{
block/blk.h:483: req->cmd_flags |= REQ_NOMERGE;
block/blk.h-484- if (req == q->last_merge)
--
drivers/acpi/acpica/dsfield.c=260=acpi_ds_get_field_names(struct acpi_create_field_info *info,
--
drivers/acpi/acpica/dsfield.c-319-
drivers/acpi/acpica/dsfield.c:320: info->field_flags = (u8)
drivers/acpi/acpica/dsfield.c-321- ((info->
--
drivers/acpi/acpica/dsfield.c=473=acpi_ds_create_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-510- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:511: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-512- info.attribute = 0;
--
drivers/acpi/acpica/dsfield.c=673=acpi_ds_create_bank_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-728- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:729: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-730-
--
drivers/acpi/acpica/dsfield.c=766=acpi_ds_create_index_field(union acpi_parse_object *op,
--
drivers/acpi/acpica/dsfield.c-806- arg = arg->common.next;
drivers/acpi/acpica/dsfield.c:807: info.field_flags = (u8) arg->common.value.integer;
drivers/acpi/acpica/dsfield.c-808-
--
drivers/acpi/acpica/dsopcode.c=75=acpi_ds_init_buffer_field(u16 aml_opcode,
--
drivers/acpi/acpica/dsopcode.c-125-
drivers/acpi/acpica/dsopcode.c:126: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-127- bit_offset = offset;
--
drivers/acpi/acpica/dsopcode.c-145- bit_count = 1;
drivers/acpi/acpica/dsopcode.c:146: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-147- break;
--
drivers/acpi/acpica/dsopcode.c-154- bit_count = 8;
drivers/acpi/acpica/dsopcode.c:155: field_flags = AML_FIELD_ACCESS_BYTE;
drivers/acpi/acpica/dsopcode.c-156- break;
--
drivers/acpi/acpica/dsopcode.c-163- bit_count = 16;
drivers/acpi/acpica/dsopcode.c:164: field_flags = AML_FIELD_ACCESS_WORD;
drivers/acpi/acpica/dsopcode.c-165- break;
--
drivers/acpi/acpica/dsopcode.c-172- bit_count = 32;
drivers/acpi/acpica/dsopcode.c:173: field_flags = AML_FIELD_ACCESS_DWORD;
drivers/acpi/acpica/dsopcode.c-174- break;
--
drivers/acpi/acpica/dsopcode.c-181- bit_count = 64;
drivers/acpi/acpica/dsopcode.c:182: field_flags = AML_FIELD_ACCESS_QWORD;
drivers/acpi/acpica/dsopcode.c-183- break;
--
drivers/acpi/acpica/dsopcode.c-208- * Initialize areas of the field object that are common to all fields
drivers/acpi/acpica/dsopcode.c:209: * For field_flags, use LOCK_RULE = 0 (NO_LOCK),
drivers/acpi/acpica/dsopcode.c-210- * UPDATE_RULE = 0 (UPDATE_PRESERVE)
--
drivers/acpi/acpica/excreate.c=409=acpi_ex_create_method(u8 * aml_start,
--
drivers/acpi/acpica/excreate.c-436- */
drivers/acpi/acpica/excreate.c:437: method_flags = (u8)operand[1]->integer.value;
drivers/acpi/acpica/excreate.c-438- obj_desc->method.param_count = (u8)
--
drivers/acpi/acpica/exprep.c=293=acpi_ex_prep_common_field_object(union acpi_operand_object *obj_desc,
--
drivers/acpi/acpica/exprep.c-308- */
drivers/acpi/acpica/exprep.c:309: obj_desc->common_field.field_flags = field_flags;
drivers/acpi/acpica/exprep.c-310- obj_desc->common_field.attribute = field_attribute;
--
drivers/acpi/acpica/nsxfname.c=475=acpi_status acpi_install_method(u8 *buffer)
--
drivers/acpi/acpica/nsxfname.c-516-
drivers/acpi/acpica/nsxfname.c:517: method_flags = *parser_state.aml++;
drivers/acpi/acpica/nsxfname.c-518- aml_start = parser_state.aml;
--
]
]
|
| 25/2 |
2026/05/22 23:23 |
llm |
expert |
0m
Model:
Tokens:
input: 49924
output: 19
thoughts: 15
Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience:
**Refining the Grep Strategy**
Right, so I'm thinking, instead of just running a generic `git grep`, which can be a bit broad and generate a lot of noise, let's get surgically precise. It's time to craft a more targeted regular expression for `git grep`. This will allow us to filter down our results more efficiently, rather than manually sifting through a mountain of unrelated matches. We've got the tools; let's use them intelligently. This isn't about brute force; it's about intelligent application of the right search parameters to quickly find what we need. Let's make this grep count.
|
| 26/2 |
2026/05/22 23:23 |
tool |
grepper |
0m
Error:
Args: map[Expression:d_flags.*=]
|
| 27/2 |
2026/05/22 23:23 |
llm |
expert |
0m
Model:
Tokens:
input: 50149
output: 42
thoughts: 84
Thoughts: **D-Cache Optimization Thoughts**
Okay, so I'm thinking about how to manage these dentry flags, specifically within the `fs/dcache.c` context. My initial instinct was to go for direct manipulation using `dentry->d_flags.*=` or just `d_flags.*=`, but I stopped myself. I recall that `DCACHE_OP_COMPARE` is *only* set within `d_set_d_op`. I need to be absolutely sure, though. It's time to quickly double-check that `d_set_d_op` function to solidify this. This should simplify my code logic.
|
| 28/2 |
2026/05/22 23:23 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/dcache.c IncludeLines:true Name:d_set_d_op]
Results: map[SourceCode:1985: static void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
1986: {
1987: unsigned int flags = d_op_flags(op);
1988: WARN_ON_ONCE(dentry->d_op);
1989: WARN_ON_ONCE(dentry->d_flags & DCACHE_OP_FLAGS);
1990: dentry->d_op = op;
1991: if (flags)
1992: dentry->d_flags |= flags;
1993: }
SourceFile:fs/dcache.c]
|
| 29/2 |
2026/05/22 23:23 |
llm |
expert |
0m
Model:
Tokens:
input: 50602
output: 66
thoughts: 494
Thoughts: **Benign Data Race in Dentry Flags**
Okay, so I've looked at this KCSAN data race report, and I think I've got a handle on it. It's a race condition alright, between a read of `parent->d_flags` in `d_same_name` and a read-modify-write of the same `dentry->d_flags` in `d_shrink_del`. Specifically, `d_shrink_del` is messing with `DCACHE_SHRINK_LIST` and `DCACHE_LRU_LIST` bits. Meanwhile, `d_same_name` is reading the `DCACHE_OP_COMPARE` bit.
The crucial bit, and this is where it gets interesting, is that `d_set_d_op` sets `DCACHE_OP_COMPARE` during dentry initialization, and *it never changes after that*. So, the `d_same_name` read is completely safe. It's a "set it and forget it" situation with `DCACHE_OP_COMPARE`. We're only setting `DCACHE_OP_COMPARE` once, when `d_op` is set. Also, we're careful in only ever setting it once, which the code warns about.
Therefore, the read in `d_same_name` will always see the correct value of `DCACHE_OP_COMPARE`, regardless of concurrent modifications to other bits in `d_flags`. Itβs benign. There's no risk of memory corruption, logic errors, or even a denial of service. The worst-case scenario is a slightly out-of-sync read, which is harmless here.
It looks like the race *can* be triggered by unprivileged users, since `openat` (which calls `d_same_name`) and memory pressure/the shrinker (which calls `d_shrink_del`) are accessible to them. But it's not exploitable. It isn't a denial of service, either. Just a data race that doesn't have any real consequences.
So, let's get the results filled in. Exploitable? False. Denial of Service? False. Unprivileged? True. UserNamespace? True. None of the trigger types are relevant here: no VMGuest, VMHost, Network, Remote, Peripheral, or Filesystem trigger. It can be triggered on any filesystem, so it's not a filesystem specific problem. Case closed!
|
| 30/2 |
2026/05/22 23:23 |
tool |
set-results |
0m
Args: map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]
Results: map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]
|
| 31/2 |
2026/05/22 23:23 |
llm |
expert |
0m
Model:
Tokens:
input: 51757
output: 549
thoughts: 378
Thoughts: **My Analysis of the KCSAN Report**
Okay, I've got a clear picture now. The KCSAN report flagged a data race on `dentry->d_flags` within the VFS, specifically between `d_shrink_del()` and `d_same_name()`. Let me break it down: `d_shrink_del()` is doing a read-modify-write operation under `dentry->d_lock`, clearing `DCACHE_SHRINK_LIST` and `DCACHE_LRU_LIST` bits. Meanwhile, `d_same_name()` is reading `parent->d_flags` β and remember `parent` is the same `dentry` β to check the `DCACHE_OP_COMPARE` bit, and *this* happens without holding the lock.
Crucially, the KCSAN report is correct that `DCACHE_OP_COMPARE` is set once during initialization via `d_set_d_op()` and never modified again. That's the key. Although other bits within the same 32-bit word are being modified concurrently by `d_shrink_del()`, the constant value of `DCACHE_OP_COMPARE` guarantees that the read in `d_same_name()` will *always* see the correct state of this bit. This means it doesn't matter that the other bits are getting munged.
This is a well-known benign race condition. It isn't going to result in any memory corruption, logical errors, or system crashes, which is good. In a production environment, where KCSAN isn't enabled, this is a non-issue. The race is essentially undetectable in production. There's no possible attack surface or vector for denial-of-service here.
Furthermore, this race can be triggered by unprivileged users, because the reader path (via `openat`) is a standard unprivileged system call, and the writer path (`shrink_dentry_list`) can be triggered by memory pressure or by unmounting a filesystem, but still remains innocuous.
With this understanding, I can now formulate a precise and accurate response.
|
| 32/1 |
2026/05/22 23:23 |
action |
format-explanation |
0m
Results: map[Explanation:Based on the analysis of the provided KCSAN bug report and the kernel source
code, here is the assessment of the bug:
### Bug Mechanism
The report highlights a data race on the `d_flags` field of a `struct dentry`.
1. **Writer**: `d_shrink_del()` performs a read-modify-write operation
(`dentry->d_flags &= ~(DCACHE_SHRINK_LIST | DCACHE_LRU_LIST);`) to clear the
shrink and LRU list flags. This operation is correctly protected by the child's
`dentry->d_lock`.
2. **Reader**: `d_same_name()` reads `parent->d_flags` (which points to the same
dentry object) to check if the `DCACHE_OP_COMPARE` bit is set (`parent->d_flags
& DCACHE_OP_COMPARE`). This read is performed locklessly (without holding the
parent's `d_lock`).
### Security Impact Assessment
* **Exploitable**: **No**. This is a classic benign data race. The
`DCACHE_OP_COMPARE` bit is set exactly once during the dentry's initialization
(in `d_set_d_op()`) and is never modified or cleared for the lifetime of the
dentry. Because the bit being checked by the reader is constant, the concurrent
modification of other bits (`DCACHE_SHRINK_LIST`, `DCACHE_LRU_LIST`) in the same
32-bit word will not affect the outcome of the read. The reader will always see
the correct value for `DCACHE_OP_COMPARE`. There is no memory corruption,
out-of-bounds access, or control flow hijacking possible here.
* **Denial Of Service**: **No**. In production builds, KCSAN is disabled,
meaning this benign race will silently occur without triggering any warnings,
panics, or system hangs. It does not leak resources or cause deadlocks.
* **Accessible From Unprivileged Processes**: **Yes**. The reader path is
reachable via a standard `openat()` system call, which is heavily used by
unprivileged processes. The writer path is reachable via `shrink_dentry_list()`,
which is called by the dcache shrinker during normal system memory pressure
(which any unprivileged user can induce by allocating memory) or via filesystem
unmounting.
### Conclusion
This is a benign data race inherent to the lockless path-lookup design in the
Linux VFS. It poses no security risk, cannot be exploited, and does not cause a
denial of service.]
|